0d578e52499ad93b51aa198f860f76a0f5f966a6348201198accbeb344fa218f

Analysis

geolocation tags

asiadelhiinindia
user interaction
yes
max time kernel
1799s
max time network
1803s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/09/2026, 17:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sample.html
Size 52KB
Sample260903-vm2khssape
SHA256 0d578e52499ad93b51aa198f860f76a0f5f966a6348201198accbeb344fa218f
MD5 db0e97d632f549ca89918ca9ccea37f1
SHA1 a9f03bf306d23466ed849c9dfcd09afc9b7f640a
SHA512 6c71d33d269e32642638222310a02ea86ddd97753f13ff2cdc53e5b1237a8d652982493ca77a561b6639a03dca1966cc7145b45b0202e5661b3afecd941bdfb1
SSDEEP 384:uqqrlkc1RcWWeFlkc1RcWaMoZrS8WdqS62joILklkc1RcWYFiQVmJkV8KUECpjZf:uqkkwIePkwcZZrzCd8IQkwGFTqFp
TLSH
T1B833B415A29020264837A3EAAFB3475DFB959017E74A47E83AEE53560FF2920C553FCC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence ransomware

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
288	2864	msedge.exe

Executes dropped EXE 6 IoCs

pid	Process
1776	SuperInstaller.exe
1992	SuperInstaller.exe
4312	NVDisplay.Container.exe
1124	NVDisplay.Container.exe
4872	NVDisplay.Container.exe
4360	NVDisplay.Container.exe

Loads dropped DLL 64 IoCs

pid	Process
1992	SuperInstaller.exe
1992	SuperInstaller.exe
1992	SuperInstaller.exe
1992	SuperInstaller.exe
1992	SuperInstaller.exe
1992	SuperInstaller.exe
1992	SuperInstaller.exe
1992	SuperInstaller.exe
1992	SuperInstaller.exe
1992	SuperInstaller.exe
1992	SuperInstaller.exe
1992	SuperInstaller.exe
1992	SuperInstaller.exe
1992	SuperInstaller.exe
1992	SuperInstaller.exe
1992	SuperInstaller.exe
1992	SuperInstaller.exe
1992	SuperInstaller.exe
1992	SuperInstaller.exe
1992	SuperInstaller.exe
1992	SuperInstaller.exe
1992	SuperInstaller.exe
1992	SuperInstaller.exe
1992	SuperInstaller.exe
1992	SuperInstaller.exe
1992	SuperInstaller.exe
1992	SuperInstaller.exe
1992	SuperInstaller.exe
1992	SuperInstaller.exe
1992	SuperInstaller.exe
1992	SuperInstaller.exe
1992	SuperInstaller.exe
1992	SuperInstaller.exe
1992	SuperInstaller.exe
1992	SuperInstaller.exe
1992	SuperInstaller.exe
1992	SuperInstaller.exe
1992	SuperInstaller.exe
1992	SuperInstaller.exe
1992	SuperInstaller.exe
1992	SuperInstaller.exe
1124	NVDisplay.Container.exe
1124	NVDisplay.Container.exe
1124	NVDisplay.Container.exe
1124	NVDisplay.Container.exe
1124	NVDisplay.Container.exe
1124	NVDisplay.Container.exe
1124	NVDisplay.Container.exe
1124	NVDisplay.Container.exe
1124	NVDisplay.Container.exe
1124	NVDisplay.Container.exe
1124	NVDisplay.Container.exe
1124	NVDisplay.Container.exe
1124	NVDisplay.Container.exe
1124	NVDisplay.Container.exe
1124	NVDisplay.Container.exe
1124	NVDisplay.Container.exe
1124	NVDisplay.Container.exe
1124	NVDisplay.Container.exe
1124	NVDisplay.Container.exe
1124	NVDisplay.Container.exe
1124	NVDisplay.Container.exe
1124	NVDisplay.Container.exe
1124	NVDisplay.Container.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Windows\CurrentVersion\Run\NVDisplayContainer = "wscript.exe //B //Nologo \"C:\\Users\\Admin\\AppData\\Local\\NVDisplayContainer\\.sys\\svc_helper.vbs\""	SuperInstaller.exe

Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
310	api.gofile.io
331	api.gofile.io
235	api.gofile.io
236	api.gofile.io
238	api.gofile.io

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
82	ip-api.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4152	cmd.exe
5500	cmd.exe
1224	cmd.exe
4168	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2864	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
2200	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134329288655572171"	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3611646547-550105268-947503007-1000\{69944162-EBD7-4D45-B12C-1EFDA9FE0C23}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\LogicalViewMode = "3"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f0005398e082303024b98265d99428e115f0000	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 020000000100000000000000ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\IconSize = "48"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2 = 3a001f49471a0359723fa74489c55595fe6b30ee260001002600efbe10000000edd3c2a8ad0fdd016e3f8153b50fdd016532f49cc73bdd0114000000	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupView = "0"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:PID = "0"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\NotificationData	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\NodeSlot = "3"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}\Instance\	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Downloads"	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "2"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1092616193"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\MRUListEx = ffffffff	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4056	schtasks.exe
3892	schtasks.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
2424	msedge.exe
2424	msedge.exe
1992	SuperInstaller.exe
1992	SuperInstaller.exe
1992	SuperInstaller.exe
1992	SuperInstaller.exe
1992	SuperInstaller.exe
1992	SuperInstaller.exe
1124	NVDisplay.Container.exe
1124	NVDisplay.Container.exe
1124	NVDisplay.Container.exe
1124	NVDisplay.Container.exe
4360	NVDisplay.Container.exe
4360	NVDisplay.Container.exe
4360	NVDisplay.Container.exe
4360	NVDisplay.Container.exe
4360	NVDisplay.Container.exe
4360	NVDisplay.Container.exe
1124	NVDisplay.Container.exe
1124	NVDisplay.Container.exe
1124	NVDisplay.Container.exe
1124	NVDisplay.Container.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1992	SuperInstaller.exe
Token: SeDebugPrivilege	2200	taskkill.exe
Token: SeDebugPrivilege	1124	NVDisplay.Container.exe
Token: SeDebugPrivilege	4360	NVDisplay.Container.exe
Token: SeBackupPrivilege	4360	NVDisplay.Container.exe
Token: SeBackupPrivilege	4360	NVDisplay.Container.exe
Token: SeBackupPrivilege	4360	NVDisplay.Container.exe
Token: SeBackupPrivilege	4360	NVDisplay.Container.exe
Token: SeBackupPrivilege	4360	NVDisplay.Container.exe
Token: SeBackupPrivilege	4360	NVDisplay.Container.exe
Token: SeBackupPrivilege	4360	NVDisplay.Container.exe
Token: SeBackupPrivilege	4360	NVDisplay.Container.exe
Token: SeBackupPrivilege	4360	NVDisplay.Container.exe
Token: SeBackupPrivilege	4360	NVDisplay.Container.exe
Token: SeBackupPrivilege	4360	NVDisplay.Container.exe
Token: SeBackupPrivilege	4360	NVDisplay.Container.exe
Token: SeBackupPrivilege	4360	NVDisplay.Container.exe
Token: SeBackupPrivilege	4360	NVDisplay.Container.exe
Token: SeBackupPrivilege	4360	NVDisplay.Container.exe
Token: SeBackupPrivilege	4360	NVDisplay.Container.exe
Token: SeBackupPrivilege	4360	NVDisplay.Container.exe
Token: SeBackupPrivilege	4360	NVDisplay.Container.exe
Token: SeBackupPrivilege	4360	NVDisplay.Container.exe
Token: SeBackupPrivilege	4360	NVDisplay.Container.exe
Token: SeBackupPrivilege	4360	NVDisplay.Container.exe
Token: SeBackupPrivilege	4360	NVDisplay.Container.exe
Token: SeBackupPrivilege	4360	NVDisplay.Container.exe
Token: SeBackupPrivilege	4360	NVDisplay.Container.exe
Token: SeBackupPrivilege	4360	NVDisplay.Container.exe
Token: SeBackupPrivilege	4360	NVDisplay.Container.exe
Token: SeBackupPrivilege	4360	NVDisplay.Container.exe
Token: SeBackupPrivilege	4360	NVDisplay.Container.exe
Token: SeBackupPrivilege	4360	NVDisplay.Container.exe
Token: SeBackupPrivilege	4360	NVDisplay.Container.exe
Token: SeBackupPrivilege	4360	NVDisplay.Container.exe
Token: SeBackupPrivilege	4360	NVDisplay.Container.exe
Token: SeBackupPrivilege	4360	NVDisplay.Container.exe
Token: SeBackupPrivilege	4360	NVDisplay.Container.exe
Token: SeBackupPrivilege	4360	NVDisplay.Container.exe
Token: SeBackupPrivilege	4360	NVDisplay.Container.exe
Token: SeBackupPrivilege	4360	NVDisplay.Container.exe
Token: SeBackupPrivilege	4360	NVDisplay.Container.exe
Token: SeBackupPrivilege	4360	NVDisplay.Container.exe
Token: SeBackupPrivilege	4360	NVDisplay.Container.exe
Token: SeBackupPrivilege	4360	NVDisplay.Container.exe
Token: SeBackupPrivilege	4360	NVDisplay.Container.exe
Token: SeBackupPrivilege	4360	NVDisplay.Container.exe
Token: SeBackupPrivilege	4360	NVDisplay.Container.exe
Token: SeBackupPrivilege	4360	NVDisplay.Container.exe
Token: SeBackupPrivilege	4360	NVDisplay.Container.exe
Token: SeBackupPrivilege	4360	NVDisplay.Container.exe
Token: SeBackupPrivilege	4360	NVDisplay.Container.exe
Token: SeBackupPrivilege	1124	NVDisplay.Container.exe
Token: SeBackupPrivilege	1124	NVDisplay.Container.exe
Token: SeBackupPrivilege	1124	NVDisplay.Container.exe
Token: SeBackupPrivilege	1124	NVDisplay.Container.exe
Token: SeBackupPrivilege	1124	NVDisplay.Container.exe
Token: SeBackupPrivilege	1124	NVDisplay.Container.exe
Token: SeBackupPrivilege	1124	NVDisplay.Container.exe
Token: SeBackupPrivilege	1124	NVDisplay.Container.exe
Token: SeBackupPrivilege	1124	NVDisplay.Container.exe
Token: SeBackupPrivilege	1124	NVDisplay.Container.exe
Token: SeBackupPrivilege	1124	NVDisplay.Container.exe
Token: SeBackupPrivilege	1124	NVDisplay.Container.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4568	msedge.exe
1124	NVDisplay.Container.exe
4360	NVDisplay.Container.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1316 wrote to memory of 4276	1316	msedge.exe	89
PID 1316 wrote to memory of 4584	1316	msedge.exe	90
PID 1316 wrote to memory of 2864	1316	msedge.exe	91
PID 1316 wrote to memory of 4584	1316	msedge.exe	90
PID 1316 wrote to memory of 4584	1316	msedge.exe	90
PID 1316 wrote to memory of 4896	1316	msedge.exe	92
PID 1316 wrote to memory of 4896	1316	msedge.exe	92
PID 1316 wrote to memory of 6020	1316	msedge.exe	94
PID 1316 wrote to memory of 6020	1316	msedge.exe	94
PID 1316 wrote to memory of 6020	1316	msedge.exe	94
PID 1316 wrote to memory of 1336	1316	msedge.exe	95
PID 1316 wrote to memory of 1336	1316	msedge.exe	95
PID 1316 wrote to memory of 1336	1316	msedge.exe	95
PID 1316 wrote to memory of 4916	1316	msedge.exe	96
PID 1316 wrote to memory of 2840	1316	msedge.exe	97
PID 1316 wrote to memory of 4916	1316	msedge.exe	96
PID 1316 wrote to memory of 4916	1316	msedge.exe	96
PID 1316 wrote to memory of 2840	1316	msedge.exe	97
PID 1316 wrote to memory of 2840	1316	msedge.exe	97
PID 1316 wrote to memory of 2464	1316	msedge.exe	98
PID 1316 wrote to memory of 2464	1316	msedge.exe	98
PID 1316 wrote to memory of 2464	1316	msedge.exe	98
PID 1316 wrote to memory of 2888	1316	msedge.exe	100
PID 1316 wrote to memory of 2312	1316	msedge.exe	101
PID 1316 wrote to memory of 2888	1316	msedge.exe	100
PID 1316 wrote to memory of 2312	1316	msedge.exe	101
PID 1316 wrote to memory of 1708	1316	msedge.exe	102
PID 1316 wrote to memory of 1708	1316	msedge.exe	102
PID 1316 wrote to memory of 1708	1316	msedge.exe	102
PID 1316 wrote to memory of 2420	1316	msedge.exe	104
PID 1316 wrote to memory of 4308	1316	msedge.exe	107
PID 1316 wrote to memory of 4308	1316	msedge.exe	107
PID 1316 wrote to memory of 3332	1316	msedge.exe	108
PID 1316 wrote to memory of 3332	1316	msedge.exe	108
PID 1316 wrote to memory of 3332	1316	msedge.exe	108
PID 1316 wrote to memory of 1612	1316	msedge.exe	109
PID 1316 wrote to memory of 1612	1316	msedge.exe	109
PID 1316 wrote to memory of 1612	1316	msedge.exe	109
PID 1316 wrote to memory of 5656	1316	msedge.exe	110
PID 1316 wrote to memory of 5656	1316	msedge.exe	110
PID 1316 wrote to memory of 5656	1316	msedge.exe	110
PID 1316 wrote to memory of 5180	1316	msedge.exe	112
PID 1316 wrote to memory of 5728	1316	msedge.exe	113
PID 1316 wrote to memory of 4292	1316	msedge.exe	114
PID 1316 wrote to memory of 1740	1316	msedge.exe	115
PID 1316 wrote to memory of 1740	1316	msedge.exe	115
PID 1316 wrote to memory of 2424	1316	msedge.exe	117
PID 1316 wrote to memory of 2512	1316	msedge.exe	118
PID 1316 wrote to memory of 2512	1316	msedge.exe	118
PID 1316 wrote to memory of 2512	1316	msedge.exe	118
PID 1316 wrote to memory of 1148	1316	msedge.exe	119
PID 1316 wrote to memory of 1148	1316	msedge.exe	119
PID 1316 wrote to memory of 1148	1316	msedge.exe	119
PID 1316 wrote to memory of 6036	1316	msedge.exe	120
PID 1316 wrote to memory of 6036	1316	msedge.exe	120
PID 1316 wrote to memory of 6036	1316	msedge.exe	120
PID 1316 wrote to memory of 1340	1316	msedge.exe	121
PID 1316 wrote to memory of 1340	1316	msedge.exe	121
PID 1316 wrote to memory of 1340	1316	msedge.exe	121
PID 1316 wrote to memory of 568	1316	msedge.exe	122
PID 1316 wrote to memory of 568	1316	msedge.exe	122
PID 1316 wrote to memory of 1660	1316	msedge.exe	123
PID 1316 wrote to memory of 1660	1316	msedge.exe	123
PID 1316 wrote to memory of 5552	1316	msedge.exe	124

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2d0,0x7fffdde7c188,0x7fffdde7c194,0x7fffdde7c1a0
  2⤵
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1520,i,8156683240121718046,2024747302979134863,262144 --field-trial-handle=2264,i,2252284657603177108,5522111600200981849,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:2
  2⤵
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1696,i,14599379246009046918,13880197699263365831,524288 --field-trial-handle=2264,i,2252284657603177108,5522111600200981849,262144 --variations-seed-version --mojo-platform-channel-handle=2864 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2400,i,515243325672633925,16425031754364130219,524288 --field-trial-handle=2264,i,2252284657603177108,5522111600200981849,262144 --variations-seed-version --mojo-platform-channel-handle=3112 /prefetch:13
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3628,i,5857527758367982694,3321999348541028863,2097152 --field-trial-handle=2264,i,2252284657603177108,5522111600200981849,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:1
  2⤵
  PID:6020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3640,i,1830991796274840499,16921833674947726137,2097152 --field-trial-handle=2264,i,2252284657603177108,5522111600200981849,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:1
  2⤵
  PID:1336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4336,i,14997467541981597632,13709845346778439581,2097152 --field-trial-handle=2264,i,2252284657603177108,5522111600200981849,262144 --variations-seed-version --mojo-platform-channel-handle=4532 /prefetch:9
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4356,i,18010577237358393862,11798768278533502988,2097152 --field-trial-handle=2264,i,2252284657603177108,5522111600200981849,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:1
  2⤵
  PID:2840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5296,i,16229195791669530077,13892726452118697951,2097152 --field-trial-handle=2264,i,2252284657603177108,5522111600200981849,262144 --variations-seed-version --mojo-platform-channel-handle=1948 /prefetch:1
  2⤵
  PID:2464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5540,i,4352361802237028554,1992152246283123179,524288 --field-trial-handle=2264,i,2252284657603177108,5522111600200981849,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:14
  2⤵
  PID:2888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5212,i,5379281103859443576,14876152341626465458,524288 --field-trial-handle=2264,i,2252284657603177108,5522111600200981849,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:14
  2⤵
  PID:2312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5968,i,4050886863199462432,12403191116925886185,2097152 --field-trial-handle=2264,i,2252284657603177108,5522111600200981849,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:1
  2⤵
  PID:1708
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5232,i,120162166623094471,10058121879877311555,524288 --field-trial-handle=2264,i,2252284657603177108,5522111600200981849,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:14
  2⤵
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5232,i,120162166623094471,10058121879877311555,524288 --field-trial-handle=2264,i,2252284657603177108,5522111600200981849,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:14
  2⤵
  PID:2420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4688,i,13756400997631844774,4090103568275358141,524288 --field-trial-handle=2264,i,2252284657603177108,5522111600200981849,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:14
  2⤵
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3908,i,5880089103124721799,6842027299911208162,2097152 --field-trial-handle=2264,i,2252284657603177108,5522111600200981849,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:1
  2⤵
  PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6864,i,242946027733084388,15227071213008840734,2097152 --field-trial-handle=2264,i,2252284657603177108,5522111600200981849,262144 --variations-seed-version --mojo-platform-channel-handle=4544 /prefetch:1
  2⤵
  PID:1612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=3708,i,14746743327411238795,12323963414910603074,2097152 --field-trial-handle=2264,i,2252284657603177108,5522111600200981849,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:1
  2⤵
  PID:5656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1512,i,5121254213907074654,15007035186120039282,524288 --field-trial-handle=2264,i,2252284657603177108,5522111600200981849,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:14
  2⤵
  PID:5180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2460,i,26871197409273288,17068181061145244615,524288 --field-trial-handle=2264,i,2252284657603177108,5522111600200981849,262144 --variations-seed-version --mojo-platform-channel-handle=3896 /prefetch:14
  2⤵
  PID:5728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4996,i,11370936073478394952,7653395940245495904,524288 --field-trial-handle=2264,i,2252284657603177108,5522111600200981849,262144 --variations-seed-version --mojo-platform-channel-handle=6472 /prefetch:14
  2⤵
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6436,i,13777524454171123565,7488175939675483929,524288 --field-trial-handle=2264,i,2252284657603177108,5522111600200981849,262144 --variations-seed-version --mojo-platform-channel-handle=2460 /prefetch:14
  2⤵
  PID:1740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3352,i,12504232114258430577,16793082719643541954,262144 --field-trial-handle=2264,i,2252284657603177108,5522111600200981849,262144 --variations-seed-version --mojo-platform-channel-handle=4968 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6408,i,8749935470341106577,5969353458722438013,2097152 --field-trial-handle=2264,i,2252284657603177108,5522111600200981849,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:1
  2⤵
  PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=5300,i,5589203413454065914,5232109608203919943,2097152 --field-trial-handle=2264,i,2252284657603177108,5522111600200981849,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:1
  2⤵
  PID:1148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=4900,i,2421101061257738084,15129280679628352824,2097152 --field-trial-handle=2264,i,2252284657603177108,5522111600200981849,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:6036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=5988,i,2100532732915221406,1146674776016189612,2097152 --field-trial-handle=2264,i,2252284657603177108,5522111600200981849,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:1
  2⤵
  PID:1340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6476,i,14932710397600449727,16749117128006314911,524288 --field-trial-handle=2264,i,2252284657603177108,5522111600200981849,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:14
  2⤵
  PID:568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6400,i,3754676425106058645,6463897513711409755,524288 --field-trial-handle=2264,i,2252284657603177108,5522111600200981849,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:14
  2⤵
  PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7096,i,15298491269766677838,771787117228674616,524288 --field-trial-handle=2264,i,2252284657603177108,5522111600200981849,262144 --variations-seed-version --mojo-platform-channel-handle=7068 /prefetch:14
  2⤵
  PID:5552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3348,i,18307477484965954593,15548429178673201290,524288 --field-trial-handle=2264,i,2252284657603177108,5522111600200981849,262144 --variations-seed-version --mojo-platform-channel-handle=4672 /prefetch:14
  2⤵
  PID:1824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6308,i,4773247298843100613,1715096526324399548,524288 --field-trial-handle=2264,i,2252284657603177108,5522111600200981849,262144 --variations-seed-version --mojo-platform-channel-handle=6980 /prefetch:14
  2⤵
  PID:3356
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6992,i,8675834482333460434,7796337248460126233,524288 --field-trial-handle=2264,i,2252284657603177108,5522111600200981849,262144 --variations-seed-version --mojo-platform-channel-handle=6956 /prefetch:14
  2⤵
  PID:6092
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6992,i,8675834482333460434,7796337248460126233,524288 --field-trial-handle=2264,i,2252284657603177108,5522111600200981849,262144 --variations-seed-version --mojo-platform-channel-handle=6956 /prefetch:14
  2⤵
  PID:3380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6408,i,121767089367123589,7813952471059055978,524288 --field-trial-handle=2264,i,2252284657603177108,5522111600200981849,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:14
  2⤵
  PID:1236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=6328,i,8591219838081887204,13547989795210661295,2097152 --field-trial-handle=2264,i,2252284657603177108,5522111600200981849,262144 --variations-seed-version --mojo-platform-channel-handle=7308 /prefetch:1
  2⤵
  PID:5764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=3488,i,1270873066454768871,13791185364240668022,2097152 --field-trial-handle=2264,i,2252284657603177108,5522111600200981849,262144 --variations-seed-version --mojo-platform-channel-handle=7652 /prefetch:1
  2⤵
  PID:2488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6428,i,10187871015339854296,567965441791151670,524288 --field-trial-handle=2264,i,2252284657603177108,5522111600200981849,262144 --variations-seed-version --mojo-platform-channel-handle=3368 /prefetch:14
  2⤵
  PID:2924
- C:\Users\Admin\Downloads\SuperInstaller.exe
  "C:\Users\Admin\Downloads\SuperInstaller.exe"
  2⤵
  - Executes dropped EXE
  PID:1776
- - C:\Users\Admin\Downloads\SuperInstaller.exe
    "C:\Users\Admin\Downloads\SuperInstaller.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1992
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "ver"
      4⤵
      Executes a command shell one-liner
      PID:4152
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /Delete /TN CrowControlAgent /F
      4⤵
      PID:4872
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /Delete /TN RealtekAudioWatchdog /F
      4⤵
      PID:4788
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /Delete /TN RealtekAudioService /F
      4⤵
      PID:1828
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /Delete /TN SteamClientServiceWatchdog /F
      4⤵
      PID:1036
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /Delete /TN MicrosoftEdgeUpdateWatchdog /F
      4⤵
      PID:1068
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /Delete /TN GoogleCrashReporterWatchdog /F
      4⤵
      PID:2596
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /Delete /TN RealtekHDAudioServiceWatchdog /F
      4⤵
      PID:5512
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /Delete /TN IntelRapidStorageTechWatchdog /F
      4⤵
      PID:2388
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /Delete /TN NVDisplayContainerWatchdog /F
      4⤵
      PID:4840
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /Delete /TN OneDriveServiceWatchdog /F
      4⤵
      PID:5744
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /Delete /TN WindowsDefenderSvcWatchdog /F
      4⤵
      PID:6080
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /Delete /TN DiscordServiceWatchdog /F
      4⤵
      PID:6124
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /Delete /TN AdobeUpdateManagerWatchdog /F
      4⤵
      PID:3488
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /Delete /TN GoogleCrashReporterWatchdog /F
      4⤵
      PID:2692
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM wscript.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2200
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /Create /TN NVDisplayContainerWatchdog /XML C:\Users\Admin\AppData\Local\Temp\_svchlp.xml /F
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4056
  - - C:\Users\Admin\AppData\Local\NVDisplayContainer\NVDisplay.Container.exe
      C:\Users\Admin\AppData\Local\NVDisplayContainer\NVDisplay.Container.exe --no-admin-check --skip-preset
      4⤵
      Executes dropped EXE
      PID:4312
    - - C:\Users\Admin\AppData\Local\NVDisplayContainer\NVDisplay.Container.exe
        
        C:\Users\Admin\AppData\Local\NVDisplayContainer\NVDisplay.Container.exe --no-admin-check --skip-preset
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:1124
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        6⤵
        Executes a command shell one-liner
        
        PID:5500
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /Delete /TN NVDisplayContainerWatchdog /F
        6⤵
        
        PID:5940
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /Query /TN CrowControlAgent
        6⤵
        
        PID:3564
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /Query /TN CrowControlAgent
        6⤵
        
        PID:1152
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /Create /TN CrowControlAgent /XML C:\Users\Admin\AppData\Local\Temp\CrowControl_task.xml /F
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3892
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /Query /TN CrowControlAgent
        6⤵
        
        PID:3436
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /Query /TN CrowControlAgent
        6⤵
        
        PID:6140
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /Query /TN CrowControlAgent
        6⤵
        
        PID:3996
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /Query /TN CrowControlAgent
        6⤵
        
        PID:4628
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /Query /TN CrowControlAgent
        6⤵
        
        PID:4456
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /Query /TN CrowControlAgent
        6⤵
        
        PID:4044
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:2140
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /Query /TN CrowControlAgent
        6⤵
        
        PID:1760
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /Query /TN CrowControlAgent
        6⤵
        
        PID:3036
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /Query /TN CrowControlAgent
        6⤵
        
        PID:124
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /Query /TN CrowControlAgent
        6⤵
        
        PID:4568
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:4628
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /Query /TN CrowControlAgent
        6⤵
        
        PID:4044
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /Query /TN CrowControlAgent
        6⤵
        
        PID:1304
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /Query /TN CrowControlAgent
        6⤵
        
        PID:2680
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /Query /TN CrowControlAgent
        6⤵
        
        PID:5016
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /Query /TN CrowControlAgent
        6⤵
        
        PID:4332
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /Query /TN CrowControlAgent
        6⤵
        
        PID:3000
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /Query /TN CrowControlAgent
        6⤵
        
        PID:928
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /Query /TN CrowControlAgent
        6⤵
        
        PID:3376
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /Query /TN CrowControlAgent
        6⤵
        
        PID:2636
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /Query /TN CrowControlAgent
        6⤵
        
        PID:4992
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /Query /TN CrowControlAgent
        6⤵
        
        PID:5176
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /Query /TN CrowControlAgent
        6⤵
        
        PID:1184
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /Query /TN CrowControlAgent
        6⤵
        
        PID:2844
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /Query /TN CrowControlAgent
        6⤵
        
        PID:4516
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /Query /TN CrowControlAgent
        6⤵
        
        PID:2680
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /Query /TN CrowControlAgent
        6⤵
        
        PID:3380
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /Query /TN CrowControlAgent
        6⤵
        
        PID:5928
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /Query /TN CrowControlAgent
        6⤵
        
        PID:2400
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /Query /TN CrowControlAgent
        6⤵
        
        PID:2532
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /Query /TN CrowControlAgent
        6⤵
        
        PID:1824
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /Query /TN CrowControlAgent
        6⤵
        
        PID:3700
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /Query /TN CrowControlAgent
        6⤵
        
        PID:4332
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /Query /TN CrowControlAgent
        6⤵
        
        PID:3428
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /Query /TN CrowControlAgent
        6⤵
        
        PID:4368
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /Query /TN CrowControlAgent
        6⤵
        
        PID:2248
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /Query /TN CrowControlAgent
        6⤵
        
        PID:2280
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /Query /TN CrowControlAgent
        6⤵
        
        PID:4064
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /Query /TN CrowControlAgent
        6⤵
        
        PID:5780
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /Query /TN CrowControlAgent
        6⤵
        
        PID:1196
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /Query /TN CrowControlAgent
        6⤵
        
        PID:5132
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /Query /TN CrowControlAgent
        6⤵
        
        PID:956
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /Query /TN CrowControlAgent
        6⤵
        
        PID:1232
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /Query /TN CrowControlAgent
        6⤵
        
        PID:2148
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /Query /TN CrowControlAgent
        6⤵
        
        PID:6100
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /Query /TN CrowControlAgent
        6⤵
        
        PID:2032
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /Query /TN CrowControlAgent
        6⤵
        
        PID:5500
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /Query /TN CrowControlAgent
        6⤵
        
        PID:5148
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /Query /TN CrowControlAgent
        6⤵
        
        PID:4516
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /Query /TN CrowControlAgent
        6⤵
        
        PID:1484
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /Query /TN CrowControlAgent
        6⤵
        
        PID:2624
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /Query /TN CrowControlAgent
        6⤵
        
        PID:3380
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /Query /TN CrowControlAgent
        6⤵
        
        PID:2312
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /Query /TN CrowControlAgent
        6⤵
        
        PID:2200
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /Query /TN CrowControlAgent
        6⤵
        
        PID:992
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /Query /TN CrowControlAgent
        6⤵
        
        PID:4480
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /Query /TN CrowControlAgent
        6⤵
        
        PID:3320
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /Query /TN CrowControlAgent
        6⤵
        
        PID:4592
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /Query /TN CrowControlAgent
        6⤵
        
        PID:4688
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /Query /TN CrowControlAgent
        6⤵
        
        PID:1192
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /Query /TN CrowControlAgent
        6⤵
        
        PID:628
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /Query /TN CrowControlAgent
        6⤵
        
        PID:240
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /Query /TN CrowControlAgent
        6⤵
        
        PID:5880
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /Query /TN CrowControlAgent
        6⤵
        
        PID:5368
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /Query /TN CrowControlAgent
        6⤵
        
        PID:5340
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /Query /TN CrowControlAgent
        6⤵
        
        PID:2424
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /Query /TN CrowControlAgent
        6⤵
        
        PID:3536
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /Query /TN CrowControlAgent
        6⤵
        
        PID:4772
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /Query /TN CrowControlAgent
        6⤵
        
        PID:5984
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /Query /TN CrowControlAgent
        6⤵
        
        PID:1084
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /Query /TN CrowControlAgent
        6⤵
        
        PID:4616
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /Query /TN CrowControlAgent
        6⤵
        
        PID:3168
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /Query /TN CrowControlAgent
        6⤵
        
        PID:1452
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /Query /TN CrowControlAgent
        6⤵
        
        PID:6080
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /Query /TN CrowControlAgent
        6⤵
        
        PID:560
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /Query /TN CrowControlAgent
        6⤵
        
        PID:4516
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /Query /TN CrowControlAgent
        6⤵
        
        PID:2312
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /Query /TN CrowControlAgent
        6⤵
        
        PID:2680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7548,i,15397060546062555541,3219112759328287424,524288 --field-trial-handle=2264,i,2252284657603177108,5522111600200981849,262144 --variations-seed-version --mojo-platform-channel-handle=7536 /prefetch:14
  2⤵
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7356,i,6068297386591900553,7643466164805209780,524288 --field-trial-handle=2264,i,2252284657603177108,5522111600200981849,262144 --variations-seed-version --mojo-platform-channel-handle=3340 /prefetch:14
  2⤵
  PID:4992

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3392

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3004

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4928

C:\Windows\system32\wscript.exe
wscript.exe
1⤵
PID:2772

C:\Users\Admin\AppData\Local\NVDisplayContainer\NVDisplay.Container.exe
"C:\Users\Admin\AppData\Local\NVDisplayContainer\NVDisplay.Container.exe"
1⤵
- Executes dropped EXE
PID:4872
- C:\Users\Admin\AppData\Local\NVDisplayContainer\NVDisplay.Container.exe
  "C:\Users\Admin\AppData\Local\NVDisplayContainer\NVDisplay.Container.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:4360
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    - Executes a command shell one-liner
    PID:1224
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Delete /TN NVDisplayContainerWatchdog /F
    3⤵
    PID:3140
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Query /TN CrowControlAgent
    3⤵
    PID:1152
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3892
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Query /TN CrowControlAgent
    3⤵
    PID:3396
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4840
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Query /TN CrowControlAgent
    3⤵
    PID:2140
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Query /TN CrowControlAgent
    3⤵
    PID:472
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Query /TN CrowControlAgent
    3⤵
    PID:4540
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Query /TN CrowControlAgent
    3⤵
    PID:2336
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Query /TN CrowControlAgent
    3⤵
    PID:2640
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Query /TN CrowControlAgent
    3⤵
    PID:5228
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Query /TN CrowControlAgent
    3⤵
    PID:5972
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Query /TN CrowControlAgent
    3⤵
    PID:3992
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Query /TN CrowControlAgent
    3⤵
    PID:696
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "pimmel gng"
    3⤵
    - Executes a command shell one-liner
    PID:4168
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Query /TN CrowControlAgent
    3⤵
    PID:5576
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Query /TN CrowControlAgent
    3⤵
    PID:5744
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Query /TN CrowControlAgent
    3⤵
    PID:756
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Query /TN CrowControlAgent
    3⤵
    PID:4564
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Query /TN CrowControlAgent
    3⤵
    PID:8
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Query /TN CrowControlAgent
    3⤵
    PID:4756
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Query /TN CrowControlAgent
    3⤵
    PID:4656
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Query /TN CrowControlAgent
    3⤵
    PID:4500
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Query /TN CrowControlAgent
    3⤵
    PID:4564
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Query /TN CrowControlAgent
    3⤵
    PID:5268
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Query /TN CrowControlAgent
    3⤵
    PID:2060
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Query /TN CrowControlAgent
    3⤵
    PID:5620
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Query /TN CrowControlAgent
    3⤵
    PID:2004
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Query /TN CrowControlAgent
    3⤵
    PID:5704
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Query /TN CrowControlAgent
    3⤵
    PID:4108
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Query /TN CrowControlAgent
    3⤵
    PID:4260
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Query /TN CrowControlAgent
    3⤵
    PID:4680
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Query /TN CrowControlAgent
    3⤵
    PID:3476
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Query /TN CrowControlAgent
    3⤵
    PID:1180
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Query /TN CrowControlAgent
    3⤵
    PID:1760
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Query /TN CrowControlAgent
    3⤵
    PID:3952
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Query /TN CrowControlAgent
    3⤵
    PID:1532
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Query /TN CrowControlAgent
    3⤵
    PID:5104
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Query /TN CrowControlAgent
    3⤵
    PID:3508
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Query /TN CrowControlAgent
    3⤵
    PID:2732
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Query /TN CrowControlAgent
    3⤵
    PID:5176
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Query /TN CrowControlAgent
    3⤵
    PID:3396
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Query /TN CrowControlAgent
    3⤵
    PID:2312
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Query /TN CrowControlAgent
    3⤵
    PID:5728
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Query /TN CrowControlAgent
    3⤵
    PID:4628
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Query /TN CrowControlAgent
    3⤵
    PID:916
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Query /TN CrowControlAgent
    3⤵
    PID:5960
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Query /TN CrowControlAgent
    3⤵
    PID:4488
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Query /TN CrowControlAgent
    3⤵
    PID:5516
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Query /TN CrowControlAgent
    3⤵
    PID:1632
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Query /TN CrowControlAgent
    3⤵
    PID:4024
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Query /TN CrowControlAgent
    3⤵
    PID:4484
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Query /TN CrowControlAgent
    3⤵
    PID:5076
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Query /TN CrowControlAgent
    3⤵
    PID:3020
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Query /TN CrowControlAgent
    3⤵
    PID:2968
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Query /TN CrowControlAgent
    3⤵
    PID:4036
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Query /TN CrowControlAgent
    3⤵
    PID:3044
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Query /TN CrowControlAgent
    3⤵
    PID:2256
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Query /TN CrowControlAgent
    3⤵
    PID:3448
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Query /TN CrowControlAgent
    3⤵
    PID:4596
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Query /TN CrowControlAgent
    3⤵
    PID:1232
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Query /TN CrowControlAgent
    3⤵
    PID:1020
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Query /TN CrowControlAgent
    3⤵
    PID:2420
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Query /TN CrowControlAgent
    3⤵
    PID:5960
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Query /TN CrowControlAgent
    3⤵
    PID:5008
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Query /TN CrowControlAgent
    3⤵
    PID:956
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Query /TN CrowControlAgent
    3⤵
    PID:4376
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Query /TN CrowControlAgent
    3⤵
    PID:1080
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Query /TN CrowControlAgent
    3⤵
    PID:2032
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Query /TN CrowControlAgent
    3⤵
    PID:560
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Query /TN CrowControlAgent
    3⤵
    PID:4496
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Query /TN CrowControlAgent
    3⤵
    PID:1824
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Query /TN CrowControlAgent
    3⤵
    PID:2964
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Query /TN CrowControlAgent
    3⤵
    PID:4076
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Query /TN CrowControlAgent
    3⤵
    PID:956
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Query /TN CrowControlAgent
    3⤵
    PID:4016
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Query /TN CrowControlAgent
    3⤵
    PID:4592
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Query /TN CrowControlAgent
    3⤵
    PID:3536
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Query /TN CrowControlAgent
    3⤵
    PID:6036
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Query /TN CrowControlAgent
    3⤵
    PID:2108
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Query /TN CrowControlAgent
    3⤵
    PID:1884

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:4712

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ee3af991fa1719733ca1e3ac746d5b605f4205e269bf244bd9ae780ceadb9bd8
MD5 a044f6413820c4c3fbd300ee9b379ebc
SHA1 94fc91536a25274f06d3a6e89322dec7fde7912e
SHA512 ced4374c54d7b4ea2b76afe4ca5d8841dfb55d8cb5db96de4ed49e64bd3850a817db5301787c268756641c94c0bf85eb4ee188f04fc891fa2e45ad48284985a5
TLSH
T13AD02BA433044D0CCE40203215B8A210720484209C49031A8D41B01C8C6FD4387171FB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 22c1d58ffa7df77a7e0440ce3b2c474b1e03f30b60355bbf5dd6392fefb641fd
MD5 b9f45a900b1f64efbf90731f41c6ad44
SHA1 0c28e85e464e328fbbc07373b05113d39f83bdcc
SHA512 132313545c55ea809da0e811d6d5d324ecf5b6cfaefadb3fa4a29df5e6266dfeca7cffa4daf21754b4b37771504d3692189b5660a468784b5eaf80bf92f59ae0
TLSH
T11ED02BA033044C0CCE40203215B9A210720484204849031A8E41F02C8C6FD4387161F7
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 8a4ff03e3e85ae5df57b21ea175ee7e4237af09be0b9666db5b62bad8fc80c29
MD5 3191180e3a393a8d59c5f01f38c41e99
SHA1 b84aa854612af7b4d044f6a12ad4b37c691249cb
SHA512 46ec5039b27c639067015200a82dd5bf657724cbac8cb34297ad954c4e9d34d552a7d6c091c100f1c05c67a70c4fc24da6e5dc11ced5be6e3ded60b23023f8a5
TLSH
T1DCE020D824C4C35DF1B0648785744B0C95D13F4E9ACCAF4517048454714954467D2B70
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 f1ed517e63c632d0946c76516578c46de9886427d7596497dc3719042bef8e10
MD5 2a5f73db525820bbe8ee6babc75170ec
SHA1 6c945d48f35ccdd769f7e02f4b3110b5c70d1463
SHA512 f462cccc078de703cf3835867781c91421d015f827aa7d416a504e50bf7eb27e46a7dacdd7bb6fd979c2263c7998ec8495b281f67c03aaaed98678f5afff3e5f
TLSH
T15AE020C814D5C35D5294649752BC470C85C23F0B97CC6FD51704C44CB04254873C5771
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 e7a441859bebd0cae5f04612823dcc45d15cf66915f3b6ee37b401d5156b799d
MD5 fe5daae8fa1dd3546e5a56f6350746fe
SHA1 f698c7dbeffae7f2d0497849b365364926721781
SHA512 56fb5919c4cb12c0763d003326e4a05f89077099caf6e211e68ca330c9d1b69bab08e72f32438ac091457d296ca375f315448373edf1d9825a619cec82c87534
TLSH
T1BAE0208425C8D36D9691744741584B4C85C13B0B96CC7FCA1704884A701344466F6778
MD5 SHA1 SHA512 TLSH

Submit Download

f_000070

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000070
Size 900KB
SHA256 e9ced447cc181746fb4cfd592d213f7db9d5840c648b1048d28872c6a714d4ed
MD5 17dac04e28f058bcb6d7ae05322e3be7
SHA1 ceac8ca105360cd8e4f01cd459dc12a2861d5c55
SHA512 e5578cc0bcbc60ee062f72d573ddaf4d3d1bbe4f49b0cc27bfcfce9e0d66210d2ffdff896132767f6ac4e1e6eeaf1d5501b1cf180d2776105bef839003b6f8a9
SSDEEP 24576:BgF2P79RUSuC7g8FXEVN3MmZofTTbVM2BhUpd1qr:+Mz/5sbN3MkiT5M2zUFqr
TLSH
T154153343E1A5FDC1886374824B672BA8A5D114B521446638EFD3CEDD87DDBA8CE1EC0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000077

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000077
Size 33KB
SHA256 539628bdc4f3b107aeb78713c741ab9b5f4737532233506d8f1b1fdc4c81040c
MD5 a06c8f49a760752dc8b3ee4f217bf4fe
SHA1 2c159af5b7341c03cbce67afffafbbae2cbb7787
SHA512 af3b5c625bf4c83616c3ae1e2380df3bd35119998ca75cb96cd590c18b9227d18a03a50cf22880ddf41edd99ac7b8b9918c93a7be90d4dd3a8e6602c8e2b519c
SSDEEP 768:f+QHjwElyDV21n98SlMi1MEOV1IyItHdLqO:GOwKyD01n9RlfyTVJYRqO
TLSH
T1F7E2F15B2127014BED8CA143576EFB4FA9E374AC5609A24F547BE0AA7B8938754BD0C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000078

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000078
Size 68KB
SHA256 dc46c0f370af3317b75ef17688014c4122145f2170df7354e1a0fdb57d655346
MD5 d2be8f1695c20c5f513faad1325dd7e4
SHA1 6d195467ec15e021dd4d67e28efb33a4529f6676
SHA512 443fc19f6d303192683867e7717b2c79728d1f77a02f511edf5949f486ac77025bbe02a706688bbc5816df0f0ab86fa6fb8a90d313279bc6d6f23b257bb44468
SSDEEP 1536:T7WvJqBvzi/JWqGSyJXSKkCCF3gpYTdS+kRszVjjL50p:PW02sLkC43gerjjL6p
TLSH
T13E63028BB7FDEC40DBA0EF107519947389391214CBAB7EADE253B68DF7D88274162061
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000079

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000079
Size 96KB
SHA256 00b42308115826481315f6a815745f8d445a89d855fa587f627b7b4388810023
MD5 89341da90f4120b2461a9bafeef01775
SHA1 90e281f4ff94fc0eaee2e876234884e16f69894d
SHA512 bb3e8fd234ec764c6450622ff2d5f2e6e777cac6006fa23b9c3e986d79b89911b9a57ebca3bb3f3e15b8437d0b305634eea968e7d8808188efca4840bf4d5112
SSDEEP 3072:OFM4gnEp7667akyq8ez5pqVo0cvK4Dhq/8fQVT:8cIwdq87ouczQR
TLSH
T1F8A312DE415A5AD9711B87D540A18F2E140288FDAE3AC206E3C7493E1D7E1BED2392DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007a
Size 47KB
SHA256 3100e775e8616cd2611beecfa23a4263d7037586789b43f035236a2e6fbd4c62
MD5 260c81a4759baf163c025001c4f27872
SHA1 f11d729bb0a4d8350d2ea3d0fc062cf6ef2d5298
SHA512 9acec3e7a411a1eb6d072c3773bb14e5aa74d85d334674ec0fb018b7937174d5b612b756b2ce7aa3993d31dfe172516e7aaec79c7dd209eac5fd15d9aea077e9
SSDEEP 768:Gp4Wb3wv+eCLRZRtq9uGHpHveBOX5qw/14X+5edVWK4afHSTle4MRhVUNMT/TQDt:Gp483wdmXRtqhJPeByj/f4WK4mHIj8xw
TLSH
T1BE2302DF9E4D72D29271267045338383798E2D8A50AAE7A1061C0FE6DE05B69D31FB9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 6f1704573686e0f0cd32b66b9240396db8e9fcecd06752beae20983c4f91b5a8
MD5 9306dbcb05e1d931659a01908882bbaf
SHA1 c59c5ece62c05e74caea72f5850cf2f54896bc5c
SHA512 747c8e1a5c88a3e66815669a09813e5721d1e359f54cf32a6755a7036dd98308ac774bbc18dbd86614bec6d062a3a78173e80c22dc3117bf1f001ba331d88425
TLSH
T12E613DA363329BC1D76388B663E19C593AF4C72549039B56885CAF309B07F1C04D973B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 43d25db9d74a21746cc63a4db03cb5ae6321197cbbb27856e0bfe3eaedde2188
MD5 24fd2ea42603403a44d2fdf65cb5f3ee
SHA1 5da731cceda13016667e679bf218b56592ab6668
SHA512 113bf31b2052567b343b9678940f3fbb54e1e5971f9f037e66c1edf8369117910750bae7cc1b8b06d6b44b74c4e28ce5187aad8e803f1dd1fac770ea11a883e7
SSDEEP 96:JxgtpgV/3pcPaiReYkixezWUnmfyd7UmbvmfG57NYeK1XPOLiBP:rgDY/OPaahki/gmqd7UEvL5YeKpPOGBP
TLSH
T135D16FE35BB16690EB9349BE63D05C2676F08A2888435F568D5CDF38AB83F9C44D4327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5a17ee.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a17ee.TMP
Size 2KB
SHA256 ffc500c02160b29d0aaf78ef09b2bdd67ce1f4dcfa986617a130d64b08c7b239
MD5 e151925fa30c0cbeed2602c3f79e71af
SHA1 2c4332a4b89c5b0c26ff29bcb629e67f8048ec29
SHA512 30bfda590777226bda2f52ced5090254b0e6b551332ec58f61c7b62719e40d36aefa13c193cf99348e67eaa74e05783aa8185e78ec396d31c4355602875bd929
TLSH
T19C511AA75732ABD1D76388B263E19C5836F4CB6589039F55804CAF348B46F1C50D573B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

228ef02a-88a6-4ca7-9abc-bd834e6c9260.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\228ef02a-88a6-4ca7-9abc-bd834e6c9260.tmp
Size 1KB
SHA256 097f3296614097776f704dc0d0c25f79988709990ac807243efc07366f0873c5
MD5 7849e17b6a19a3a55caf9eb74705171f
SHA1 8838d74a6393286fddcb1f626bd4a93c58b140e9
SHA512 046521f0c383c95d0d71d57a182dbfbd6530e9d0db6ee54879e8a33dd5b322f3c9d2de7f97d4e414faeafe25aa372e91522d4ae1bf4a136a7bba39718d428ce0
TLSH
T187219DF3C2E8567D8D5542F467243F1BCE2D0C54431C3D5AC9D4AB5B93E5471E28095E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 fbd28dacab13351d2d671d5d2485c11e1eb4fbbfb3439b48669f6def4b1e30e2
MD5 cf02213126ec847ebb1b2d4828fb092f
SHA1 496b55175dcf9cf3222b4c9e457a84f234580e59
SHA512 a3bc2eea08babde070e6bf1db3f0b2fb26f70e23f2848d36e53958446531437a6822c5bde67353d0c80f880ef0ef4fcf15084944c688f9ab6df99a4348888541
SSDEEP 192:DOW6ZOveA6sc5e/JYUMgpoaVaiju1uwwrRN0RTAxrGfnwHRqkjFOPxctG/tKj44F:DOW6ZOveA6sc5e/JYUMgpoaVaiju1uwy
TLSH
T182029FF783B5826DDA2191F09A14AF2FCE581016432C7D7989E4AE47E3F2472E14279F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 29d188910db63f5bb47454947d549620546406a8aff1595ab12ae8ba72a77d36
MD5 fd840b593f48659d0af5dc4526343acc
SHA1 b06dcfc86cec42cc2ca76d8898ea9d08224158b8
SHA512 6bf1bf7af3c08fc4fced2150bc5dd539d688fd0421626e3ba9080174f3831ac6e3ca4a3479d198d2663401253226f4fd403b73303e20c6276ca1c23e5a66d05e
SSDEEP 192:DdGK4fRej0V95t6eC/aVaijtkCfwwrwQ07d2YAxrGfhcHKIqkeVo+UBS:DdGK4fRej0V95t6eC/aVaijtkCfwwrw1
TLSH
T1F902AFF7C3E8866D8A2255F09A247E2BCD1D155583283D2AC9E9AF4BE7F1031D20179F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 92120681059b70549b344e2c5ce825d6aa6b02b697ed4f6bffd281353f535f92
MD5 2dd02a5ac661fcf8c497c71bc193e206
SHA1 b1188eb0a99b0b7488437a6847dccd56efcf04dd
SHA512 0ae527943cccd69419ef8cbf32aba76a3670a08e6014ba00b2d570e0a63951b9c6b307ee978f2d6cbfb1e316f8d9b2f00c86fb7655afac4fe09e5b491665829e
SSDEEP 192:DOW6ZOve6sc5e/JYUMgps8aVaiju1uwwrRN0RTAxrGfnwHRqjFOPxctG/tKj44U3:DOW6ZOve6sc5e/JYUMgps8aVaiju1uww
TLSH
T1B70290F783B5826DDA2191F09A14AF2BCE581016432C7D7989E4AF47E3F2471E24279F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 d70f75222ff713b9befc4e16d1b91bd509b5eb7fd18282dac3eb6cd2aebfa4bd
MD5 d14f1debc9af1153dab8ebb59b775bcd
SHA1 62e62865e95c9bcfd9783a5bdc2feb02da4d5f17
SHA512 a6cf6a8ef42c724a65875cb9e5d8a8c994e0e2d0a3aebc05b91ae691716610d6d594f66c2ba0a742e845b6753ede1d29dc5719550fa9b307b0cc379f76caa32b
SSDEEP 192:DdGK4fRej0V95t6eCbAaVaijtkCfwwrwQ07dCAxrGfhcHKIqeV5qWWKFES:DdGK4fRej0V95t6eCbAaVaijtkCfwwrg
TLSH
T16302B0F7C3E8866DCA2255F09A246E2BCD1D151583283D2AC9E5EF4BE7F2031D20179E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 e76dcc0f9254d50962a0226280c7fca219798cad202f6cc7423de1d0c1c0c9a3
MD5 8bf7a5e64af87ad6d1f32d520a178a2d
SHA1 fffab3f05fb5d976ad0b025d2dfff4ea9e370571
SHA512 2d167404f87bbe4144847deeecd2a4a83d5abb5f30454ae21c348275c26a7cbe6511ff2578dfc680a433300b474ecbae566aa7f81410513eddfddabb2c47043a
SSDEEP 192:DOW6ZOveA6sc5e/JVeIgpoaVaiju1uwwrRN0RTAxrGfnwHRqqkjS7nOPxUQo/tK1:DOW6ZOveA6sc5e/JVeIgpoaVaiju1uwb
TLSH
T11712A2F783B5826DDA2191F09A14AF2BCE581416432C3D7989E4AF47E3F2471D14279F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 92c12d2e420c54b153ae984b3ded7319e6966068e45dcaefa22ae45f65c93479
MD5 021bbf87d27ba5766fb21fc300725af0
SHA1 2d48d90a429a4155e98df5468828875e60d8e7c5
SHA512 5e6205d6178d3f031e66ac64241ffacb151f71aabcba99e860d8db5aca9fd83c87fe8660ff2806828e34f0478b4f837ee7e9489f5657eba0db4bc13eae346c4b
TLSH
T13D219DF3C3E8567D8D5542F466243F1BCE2D0C54431C3D5AC9D4AB5B93E5471E28095E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 11KB
SHA256 f07f6cfbe766fac9764aa4bef01286f90e416acc0c0619044070339cfbb02775
MD5 b27ebbc52075bc9179fcfbd63abbf999
SHA1 3dcdc418635b21c7c16632ac1de4bdd205180df1
SHA512 b52974e8338824279276b231180670ec1c0187c9d9431a4f02163cefac90707a7a0fa6e02ae9d76f2b25a042cec2066585676e1ffc02b2293fac500554deee45
SSDEEP 192:DdGK4fRej0V95t6eCbUVeUaVaijtkCfwwrwQ07dCAxrGfhcHKIqeV5qWWKjS7nw/:DdGK4fRej0V95t6eCbUVeUaVaijtkCfG
TLSH
T11832CEF7C3E8866DCA2251F09A147F2BCE18145583283D2AC9E4AF4BA7F2471D20178F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 acfad380e68120c5f5e3c28c61e217a3b63ed9d1d5e71b00890124317594864d
MD5 6bcfd18ddf44f8980c736c05ea5bbc5e
SHA1 4c4c02e6244b909eb72c3dc8e86b2e446bb1fd7b
SHA512 9546b592803282b28a2f2d6badb84684f20c0f8e2062f913a1c54e05e11984c1b76f971112c8c696c56b7619b2380e6ff11ba96ae959a025715d09020e979163
SSDEEP 192:sxRdR1bk/fXsAv6pq1zFkzoD8p46gls/g6+WNTXb4/YGs6kLGzIgDROJ:sxRdnk/fXsAv64pMR/5n4/MIo
TLSH
T12E42C9156968AD3B9CC7D20DFA55BF53D2FA5032A1912F58A7FC8A0C04EB7DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 28KB
SHA256 417efe1567a4cc5470dfb1f69ee4afee7ca53c2c754a58f28e97c7091d18e106
MD5 77a8bd8e5228ca3786a9b386f2bcca33
SHA1 8a89777046da64fab8388f417bb786cc509029df
SHA512 b5cc07239734c6b475144b7ad1cd813a75a429fe8395865fbd1d5159823edb905bfef143835d52e64e35afde03fb2df5850dfda656614783d899b6752f9fdd53
SSDEEP 384:sxRh/k/fXsAvW66s8qMpRiYnazAW8pZS15posJWeT+ud47yI/53pj/5Io:st/k/ftW4Mnc7WeT+uds/5V5L
TLSH
T1B4D20805A824D83B9AC39D1CA93D7E33E6EC506262C5DEDE56ECCA1C019D1FDAB07853
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 433bdb8025aa116b5497b550b8e56dd3bcbff385b7046609655fca6b8c7e415c
MD5 ddcc4d2684384913660a3511aa4439c9
SHA1 06ee31d9cf5120751c3216ae1f3298aa8d7d5706
SHA512 fd16eefcbb2e00d7fca2e733b1e3415a2b51ae0f437daf6a03f6819abec9bd1b05e446ef8e4628e8b5011494e32cce8f305cc67bf65ef665b4c4d74067403c03
SSDEEP 192:sxRKR1bk/fXsGvPpq1zokzoD8p4Y/g6+WNIYGlbCkLGzIgIJ:sxRKnk/fXsGvP4EMp/5IXIs
TLSH
T1FD32B8156928A93B9CCBD20DFB557F53D2FE5032A1D56E58A7FC860C04EB6DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 eda8f3ab52cfd0f4d151934b45abbacb582020fa905d509ef89b280f5383841a
MD5 9a772f0eca7ccf1568e381b57472a5ec
SHA1 9792cdb63e879ff9196426626c7ae121a3ddc65a
SHA512 dea49c88ee652a7465616cd3d2b92a37b746e2712dddd7f56306b7b9995baf838f7bf87cdc9b8df21f2aded689855cd06e180861b78ef16e44da95ad30ef5cce
SSDEEP 192:sxRlR1bk/fXsAv6pq1zIkzoD8p46glgA/g6+WNTgpeZYGh6kLGzIgDROJ:sxRlnk/fXsAv640MY/5bZDIo
TLSH
T1A542C9556968AD3B9CCBD21DFA55BF53D2FA5032A1912F48A7FC8A0C04E77DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 50e816f01177b2246cca354465a3498f950821cfb921a82ba3e5db8866e4689e
MD5 3e3c46e3da597a7dd4f4b94bbe25febe
SHA1 2471f1476f77de8cc5478490edd20718b2dff82d
SHA512 d39346ab0613c6039b6ef571d70167017e8af1a9d13885c0750fa5460638cf2973ae2dda13267ef006674405960673193d6853682b9cf5628aa26ac842745507
SSDEEP 192:sxRlRqbk/fXsAv6pq1zIkzoD8pe6glgA/g6+WNT7YxYGY6kLGzIgDROJ:sxRlek/fXsAv640Mq/5AxAIo
TLSH
T11042D916A968AD7B9CC7D20DFA55BF53D2FA503261912E58B7FC8A0C04E77DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 59b492bfe41188bc28a6f9a7b3915b4ea9e6d978b8a97af775ca0987d7b32efa
MD5 a6405b4943815106f90fb5718d86576a
SHA1 646edc59cf191e31547beed0029c0bbf5b78f499
SHA512 25e36c495ffaa608a36c655c25aa92321664e77de5d40ea452606de6196a29e7bc3f51ab7efa71022c2a40a6b6ada940f7d8de2d21e2860bb8cf56b11ef9c508
SSDEEP 192:sxRdR1bk/fXsAvPpq1zokzoD8p46glp/g6+WNTXb4/YG4bCkLGzIgDRsJ:sxRdnk/fXsAvP4EMM/5n4/sIq
TLSH
T12342C9156968AD3B8CC7D21DFA557F53D2FE5032A1D16E58A7FC8A0C04EB6DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 28KB
SHA256 a4723fe07451e07f9d5bb88d058129ad1143a9cab3ad52c7b37b928499e07879
MD5 4746dd55c672d338ece7c5c09e9bccf4
SHA1 a0f9608b65d78172b7a0a9e315486300b5b3bb36
SHA512 522880da81054c6d73080da2c87bc747964701e98f4e2cd1c5d609b950dc1a4ce7dedd1e0d557823580d32cdcb1e893b4b6e50b85b2283338a81c818b25ffdc5
SSDEEP 384:sxRl/k/fXsAvW66s8qMpRiYnazAW8pZS15posJWeT+ud47yI/53W9/hIo:sJ/k/ftW4Mnc7WeT+uds/5QhL
TLSH
T199D2F905A824D87B9AC39D18B93D7E33E6EC506262C5DEDE56ECCA0C019D1FDAB07853
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 28KB
SHA256 2a93e93294d453fae5ec643d6d8d580fbf2b2ff2b2f0f4eed5e89a0c9ea23438
MD5 2c0c51583a1c903b4c9a58cbfc11249d
SHA1 6fb318a0bb8824b92d4e46927f699e0e84521268
SHA512 c9235eb0defc9abc252e83309a4e96d3560f5aef6ed8761df160dcb84dc384be4ffdcd6a73563fbae7a503b9a33387800f3c46ee885c90b3f62209ebb8d32078
SSDEEP 384:sxRlek/fXsAvW66s8qMpRiYnazAW8pZS15posJWeT+ud47yI/5Wi9/oIo:sJek/ftW4Mnc7WeT+uds/5PoL
TLSH
T16AD2F805A824C8779AC39D18B93D7E33EAEC50626285DEDE56ECCA1C019D1FDAB07853
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 52d9be7f93cf1a1b6e6ffde24b8309850052ecabc6cc749a585354285e027972
MD5 c669730d9b167741f724ce05fde40913
SHA1 86903c5c0e4614c395888e0b8ac67fae97481079
SHA512 e7fc029ade383faf7fab8d1e44f770b907152c639a6c99ee1fe644b8d137ce0ea6f159de1df9e0a6743f0fe2f7e65fe2a1e1d87b6d1d8b4b002b5304b62b46ef
SSDEEP 384:US5Yi0hfCtgvZFfxJKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVDT9NHRIIrowB:UQYi0NWgv7fxJ8F1+UoAYDCx9Tuqh0Vm
TLSH
T194B2FB3B604DCB7E9F800AAD9C197FDB6D9802C796589D8047FE990C02C77FA911A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ab87a795-00f1-4d09-a86a-9e44a6e0a674\index-dir\the-real-index
Size 216B
SHA256 a5bf4ae805569838d839bf8d1e4ef855cba51c1ccb5d1fd0ed29d352aa653559
MD5 c851e704657f5085f0ff741d0fa20d61
SHA1 4074c4486cc6342b149c9d5fc61b31a502703ff2
SHA512 1a89a17329ebcb72093b06ffd9d007a0c040950def4247656dced5be075a110d32a808fd011386ca98dfa10bed49d424ee55b6ee4cf582df0f31269b5fc82722
TLSH
T1BBD0804DCC574695DA13143504773629133615FD15027F1650BD1419A55166C5447505
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ab87a795-00f1-4d09-a86a-9e44a6e0a674\index-dir\the-real-index
Size 3KB
SHA256 93cbb68b4e1566f351071b3c97d2a2b034191001adf81000dd704842ccd43f27
MD5 937291f65755a4fdede81386d1294812
SHA1 6c7c3539216eddb0bca327d157c02cac4df3bda0
SHA512 410b7547cb47d7f9b470a21459bb17da5f576f5b8ce43278291245bdb26d262a10743965cd4891f9bce3958ad8c9a184d3df1a143f667a5aa358ae65ea7f2fd4
TLSH
T1B951A74F4D031FAAEDAC617104F508953735B9CC27886D2BB5FC8231BDC372868997A8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5bbef7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ab87a795-00f1-4d09-a86a-9e44a6e0a674\index-dir\the-real-index~RFe5bbef7.TMP
Size 216B
SHA256 2084aeb324366c95bfd3e9acda16b1469e6f99d492483bf6d2ce1361258c431f
MD5 10f5877fcc27fe6c6589296f04e3c949
SHA1 7b4c3afec41b47b4ded5632a79341e0b1e6ba1dc
SHA512 f70192406b8872e7de2bd4114eb6fb91a857a5c495105fc47995b8b34f831fc16bf695ac9dcc768f3792045430e65164c8abe925993290c02bb8297195ac1c54
TLSH
T17BD02BCB9892AFB1DD072AB02457671E237B0C302921AE32E0CA5C1F5C71ADC848F50F
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 6af82597463b25909cdb4a5e3353aaf5a5a963bc60edccaf10c299f182d75f04
MD5 17720763c5a03b951bf458be96188fb3
SHA1 93913970bf0fee46804c9e785c4ae656fbc483a6
SHA512 c2b0124f486448286113e2ebb2d0858ea6b66d851213581744f781d5121c88af3729276c0c33998aeaad3ae758ab1b5bd743c93994ecf715952dfa884cb841fe
TLSH
T156E026B62DFB1C24FCAF93E31871489903897AACD50EFC4F455A968731B2315345EDA2
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 901a91872de718073828ff79639ddefc288a021899c1678823706f05f483ec44
MD5 94ec6a7c4a5e814884dcd83fe6bc03c4
SHA1 53d20935b9464c09a068f27b811a4794d699c08c
SHA512 b19047001933bf27eebe95ddbdf51232a8594a9b335288b389c797685e651b52640cff8bb0a8eabe1694f9aff74a3e7c87ef664d549e203fe54f662108ff3873
TLSH
T1F8A002248E4E9411D4221EF571F5628033A08CEE1505236BA5DDE0988C9158451C5B41
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5c333d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5c333d.TMP
Size 48B
SHA256 b35d4da2217235a7fd93510ff0fc53e97fecc4316936831bc6f9110b5a12f3d9
MD5 5c367ad29197fc69497acf277ad9558a
SHA1 215f4f1ad4e17e33c47d58c2236de41de7377aaf
SHA512 3af79fc45df538aaabbf19d28662277512304f368cc538812755ff699b54e91ad187d0ee669770ca2c24f5dc9f697292719d3c029bc3fe45cf79b7bdabe1f0a5
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 2391dc2d6a4cd379facd4411f8136292e43420e65a73458b1a1b249b445e46f7
MD5 213c61cd93274f2501757eba279c53de
SHA1 6aec8ff8e5b1d93ebd0a25ecbe6705a838d8d972
SHA512 aef072ce1fc2aad2142e23dde69da84c780f5846c42e33792d6f453fcb234d70772bcb5181099e808dfafbfce5fd98334e2b7e5940a0e1dd01f6cc7032b6cd9f
SSDEEP 96:KRm7KmgIIOW4tVgGOK47g0OcOGlktaTHd3LfWTI2gPfK4OXv6KgMuKm8Kbl:Cm7KmgIIJ4tWGm7g09OGlktaTHd3LeT6
TLSH
T1EE911515333A02903C7D791A90E6851F528279933418EA3F7FA952A60F67E034FFD8D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\index.txt
Size 149B
SHA256 df446161f1dad781d5f106afbfc2a182570cb2d629db867ae8c08a6098232015
MD5 50d8e7b3adff6cd43ce57a913a0826da
SHA1 5d9365be75ad203ffed059bfe7a2003e23ca1635
SHA512 be5fa562878bd05d5c829c216f1abc58e43dbd913fb752003ac75a2276e72db6a0bc2bf62f5c72c5027657761ad555c0c8d3607ab6dee2b22fd93cf5aebfffd7
TLSH
T184C08CE765308CA61730BAD83810730CE20F846C89C4CCE8A008208220398230806A24
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe59aa40.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\index.txt~RFe59aa40.TMP
Size 156B
SHA256 18b04369117a1b912f1266ff93e2c32f5c6a9106bf72d591e8d208da4ef766b3
MD5 83fae1da5fd2ade23e086790f6d19ab2
SHA1 b099901e574087d34d004ee18fdd51936507293a
SHA512 cf33cd09d48126f9f54233a6498270cf4b4ed73fa4de5bce429d4739e002f491910de57d51ae185e5bc9fce2bcceb31c3f829152abd40c977121da88d5b8e6fc
TLSH
T1C5C08CE7253048A21730B5D42820730CE21F8CBC8DC9CCE8A008308220388234409928
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\IndexedDB\indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59f63d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59f63d.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 ac8eccc831f5b82c2b67831c15ce8852b9bdda9fbe82c5ed48f36add5ec6892b
MD5 df48b1110c855a229f348eed3465c046
SHA1 0961ab91661e594c95112ca7e6cc942e98e7a599
SHA512 7df947b1c0f9ee6e2bd2cd6dd56dfe8e827ba4bd4f112f7466ad5481bcba82353985f29d42a1cb7efc30a596363f5df0d9b6c922bcefc80602ebc7213c87d724
SSDEEP 768:7h3RggBalYyhQ7Hucys6BRvi82oP4/z6himo6717VaaZ74HF:7h3Rgx3imOz6Imoo17VaaZ7IF
TLSH
T14EF2AE71A8518D77DCE7C2C4B4467B576EE0522386CC6994D9EEAF0E05C7A6D031BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 11da423c14d0e5a5a8fbc551f010eb08cfcf2b9b070db816e8684f90851231d3
MD5 583e08440bb00019acff1bc5be2e7303
SHA1 3bfee3d0f38e66fbc1fdea179d60ca857cd6d5d7
SHA512 b87ee02dec89d3b652d80a5e8f65ab7eee9012698a4db71a4f3d904d35798ecd218bb0757346c2dc7b7c8285b0b5fd5d76c54fd4e6d82884b4f385eaca561e79
SSDEEP 768:vrv+4UNbdS3N8lYyhh7Hucys6BRvi82oP4/z6himof72bwn+h:vbsbw3H3imOz6Imoz0w+
TLSH
T11603BF31E4148D33EDE7C184B446BA577FF4922385C91AC0E6DA6F4E028BA9E131BC63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 ec911de2dc428553ac2fd9bda9be1ccca9f5fcd7e1d3d17013a49915525a7dd5
MD5 ce360c388a8a9ac1e6b98b73a00faca8
SHA1 4f7be49c98d88089334cbe0917bf42674ccc46d8
SHA512 2cb12d1804a2a071b49cc0dead441841c7deeb3d1ed383a80e3e8b0a48e7d2fcd87084cb1d37d172dff60374bcc7a1cf652b2c1c7fa63317b7c38b72ddba88f0
SSDEEP 768:dFQo3Vwg7gglalYyhj7Hucys6BRvi82oP4/z6himo6717VaaZ74HF:so3Xg23imOz6Imoo17VaaZ7IF
TLSH
T1FC136CF298C38936DCAE8787A73D2E025EBCD123B5886554B7D95A0DCD8757FC30A821
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 33e78c985920d5fb3629e24268463288c477c2a9f263c61acde8e9308e215b1e
MD5 c2032fb04eb0345fbab9c63f891c02a2
SHA1 390cce1fcfd9c5075b3dd6cbddd6d625d19923b4
SHA512 b7240d7b170142263bc396c9427934209eff86af3792757d6bece30aae69b6c901a28fb6a779bdca97ecd85c1036e0cc76105a00d74888c46c4a7d84c873d1be
SSDEEP 768:Sh3Agg+alYyhQ7Hucys6BRvi82oP4/z6himo6717VaaZ74HF:Sh3AgU3imOz6Imoo17VaaZ7IF
TLSH
T1E9F2AE71A8518D77DCE7C2C4B4467B576EF0622386CC6994D9EEAF0E05C7A6E031BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 8118bc1dae82f843b4e4339b04b9b22f271e9432227aa51ec658a5fcd020534d
MD5 84b5ab866c02b0c3d41e2be0b5fb5f82
SHA1 2d19edbd44fb7a55a17a2353ddf01f9c03823fdc
SHA512 face70a4f47475c86d71c502271737f2df610a54b39508b894b88896fd6923eade176918d267db5e148bbce152767f27b2ead5c65dd1e65d51a1de4616ea4702
SSDEEP 768:dFHE3HwgkggooNlYyhJ7Hucys6BRvi82oP4/z6himo6717VaaZ74HF:LE3mgr3imOz6Imoo17VaaZ7IF
TLSH
T185135BF198C38936DCAE8787A77D2E025EBCD123B5886950B7D95A0DCD8757FC30A821
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 86d34f1b14aea1c1c1d6f5efecc331fdffe34acf9b0ed02f76157a34fffa6ac6
MD5 35bf568fde24a6b57b5d5ce08ba7b37e
SHA1 94432bdceef675d79fac481b1a5f619ff2b51ed1
SHA512 d6692eabc4875a62e3a108a6eafe5856e1ffdea6305828c6aa691a8784f1bead68ec2a4bde9daadd0d46f52f66113cf493c5e27dbcf862359662da56d7af49c1
SSDEEP 768:xGrv+4UNbdS3+ahlYyhk7Hucys6BRvi82oP4/z6himo+y2bwn+h:xGbsbw3+c3imOz6ImoR0w+
TLSH
T17303B036E4148D73DDE7C288B046BA937FF4522385C91AD0E6DE5B0D029BA5E130BC63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 ff5f443a3af664daea725fad529ce0503e5d0465809fda0a8b1be673182157f7
MD5 6027b2570dda39bd3a4ec86b2b5dfaba
SHA1 a800f1b2d97322f9518da5cbaf69d3fdcb433919
SHA512 b5c6d136408f445423ce7422a7fa7a26e25556f874e43ee2ddcf309e67e470e488eda25dcb59804aa682d1beb68ac1bdd82ce5afbc577e50457ab27f12613d5c
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 7de23611b2231a4c744429254f0c4b997467b88030d98c02d16884e3a7a327d6
MD5 0fd4779239170d16279d88ced7e68e55
SHA1 cb31c2b49ac5b719631ddd269cc0a3aba76b4b54
SHA512 acf821bedc540b16b82df68285af7f24792b57e16aaaf899cb8477c930b18aff2f734d3413a47c4d35dad52a30dab2e86970f06bc3ae459c645e70101ed6b5d5
TLSH
T1A2E00112A36800F6C11D0334014B1F102FD2D06402F203565B32056D0C333003E30F50
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 bdb8a8586d09daa627e4d561c4cf2b1f64238fe58b3c08fa2b9e0ace72beffd1
MD5 e346aef30bd33b0622ffecdcf4f68607
SHA1 c60487449bfb843321592699a6ca97eb2cc97436
SHA512 79ec1f1c746c938f18cf9ca053fda5629a7414c746894790fb32bf93f1cd134583749cbf2ab19cd6625cadb3046ed0fb763f064ad6ac6e77833d67603a1d8c73
TLSH
T147E00912E66810BEC12D0334018B1B212FE6947502F202569A32096D2D337003F30F90
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 73c6e8ccc9e8385b94c91b3d79b6cb021fed91dccddc21d08e8450e1ce934907
MD5 e8865988f700f3c4de65a7fa9d7bb51d
SHA1 1d1a7ae31ff00bed806bf464b32051859078ad3d
SHA512 c76ea1f4f59ae2ccecc401809657c0d78380077e12caaaf3b4ee14a6cb4519aff23592950e37ac9c1ad56da7105851099cf856bd909aec2215862cac83170a41
TLSH
T1DDE00912A36800BAC12D0334018B1B212EE6906402F202565A32096D1D333003E30F90
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe59b83a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe59b83a.TMP
Size 392B
SHA256 0ca197281dc3ed6df37e22e863a07856b5a3d766d1486deed38cc288186ed94d
MD5 b6e2964a980e1136f23acb60961a839c
SHA1 88e87fd3b4848b2b06a9220f4fb2b603a7cc3691
SHA512 07d3861fe3e59d66099bfd20e62372b192ed54af936c855fc79630f5e83779c1f0311e0f8e94c7f217138090776ae9d86637cd66b6c287300790c80cc30e74be
MD5 SHA1 SHA512

Submit Download

4985f628-105b-45df-95d4-95ab8fd6dc9f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\4985f628-105b-45df-95d4-95ab8fd6dc9f.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000006f02\VCRUNTIME140.dll
Size 116KB
SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
MD5 be8dbe2dc77ebe7f88f910c61aec691a
SHA1 a19f08bb2b1c1de5bb61daf9f2304531321e0e40
SHA512 0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655
SSDEEP 1536:+qvQ1Dj2DkX7OcujarvmdlYNABCmgrP4ddbkZIecbWcFML/UXzlghzdMFw84hzk:+qvQ1D2CreiABCmgYecbWVLUD6h+b4ho
TLSH
T1C4C37C4673A402B7D52EC274C1E25A06EB71B5448770ABCF03B589AA0F53BE1AF3D359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000006f02\_bz2.pyd
Size 82KB
SHA256 00b8ca9a338d2b47285c9e56d6d893db2a999b47216756f18439997fb80a56e3
MD5 aa1083bde6d21cabfc630a18f51b1926
SHA1 e40e61dba19301817a48fd66ceeaade79a934389
SHA512 2df0d07065170fee50e0cd6208b0cc7baa3a295813f4ad02bec5315aa2a14b7345da4cdf7cac893da2c7fc21b201062271f655a85ceb51940f0acb99bb6a1d4c
SSDEEP 1536:CX8z7RFgpNVu5eYu00NI5OhgYNxx8bhm+uVIYCVH7Symxs:CszlF+uyIkNxebhEVIYCVHL
TLSH
T190839E93E3605AF5E45B92B9A6A04357E331BE49035093EFF75883162F13F813D6836A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000006f02\_ctypes.pyd
Size 121KB
SHA256 c148292328f0aab7863af82f54f613961e7cb95b7215f7a81cafaf45bd4c42b7
MD5 565d011ce1cee4d48e722c7421300090
SHA1 9dc300e04e5e0075de4c0205be2e8aae2064ae19
SHA512 5af370884b5f82903fd93b566791a22e5b0cded7f743e6524880ea0c41ee73037b71df0be9f07d3224c733b076bec3be756e7e77f9e7ed5c2dd9505f35b0e4f5
SSDEEP 3072:QjyeQXVhflFZtc/uTfLImTi6pX5DJIYLP0i:QGeI+/uTfLIm+cXxp
TLSH
T113C36B0B23581099EAA7807CC5B35F17C7B1B859171087CF02A4CAAD2F637A36E7E716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000006f02\_lzma.pyd
Size 155KB
SHA256 f5e01b516c2c23035f7703e23569dec26c5616c05a929b2580ae474a5c6722c5
MD5 b86b9f292af12006187ebe6c606a377d
SHA1 604224e12514c21ab6db4c285365b0996c7f2139
SHA512 d4e97f554d57048b488bf6515c35fddadeb9d101133ee27a449381ebe75ac3556930b05e218473eba5254f3c441436e12f3d0166fb1b1e3cd7b0946d5efab312
SSDEEP 3072:esdh8kZbsOb0Mt4zorT81qjznf09mNoqCPAaQVIYZ1Ncf:esdhBZbsm0hi78YOqtX6
TLSH
T122F33A92A394F4D5F7628C78D6624F17DBF678090310929A02CCC36D2B1FB759A2E727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-console-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000006f02\api-ms-win-core-console-l1-1-0.dll
Size 21KB
SHA256 88ace577a9c51061cb7d1a36babbbefa48212fadc838ffde98fdfff60de18386
MD5 9f746f4f7d845f063fea3c37dcebc27c
SHA1 24d00523770127a5705fcc2a165731723df36312
SHA512 306952418b095e5cf139372a7e684062d05b2209e41d74798a20d7819efeb41d9a53dc864cb62cc927a98df45f7365f32b72ec9b17ba1aee63e2bf4e1d61a6e4
SSDEEP 192:xt/cOTWthWfWJWadJCsVWQ4OWKNVAv+cQ0GX01k9z3A1tUXj:xpcgWthW2CsjNbZR9zOtUX
TLSH
T137A219D38EAC8546F8AB9D7046E8DA437C3E6BC71950615525F8F55C2CA33C1EB20B2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-datetime-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000006f02\api-ms-win-core-datetime-l1-1-0.dll
Size 21KB
SHA256 1bd81dfd19204b44662510d9054852fb77c9f25c1088d647881c9b976cc16818
MD5 8f8eb9cb9e78e3a611bc8acaec4399cb
SHA1 237eee6e6e0705c4be7b0ef716b6a4136bf4e8a8
SHA512 5b10404cdc29e9fc612a0111b0b22f41d78e9a694631f48f186bdde940c477c88f202377e887b05d914108b9be531e6790f8f56e6f03273ab964209d83a60596
SSDEEP 192:xVIWthWWWEXCVWQ4OWGwvNVAv+cQ0GX01k9z3A1tUG71A5q:xVIWthWJoNbZR9zOtUG7mq
TLSH
T1A4A218938AAC8143FCEA2D7012E8DE83BD3D63D71A40916616E4F4582D937C1EB20B6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-debug-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000006f02\api-ms-win-core-debug-l1-1-0.dll
Size 21KB
SHA256 591358eb4d1531e9563ee0813e4301c552ce364c912ce684d16576eabf195dc3
MD5 226a5983ae2cbbf0c1bda85d65948abc
SHA1 d0f131dcba0f0717c5dea4a9ca7f2e2ecf0ad1c3
SHA512 a1e6671091bd5b2f83bfaa8fcf47093026e354563f84559bd2b57d6e9fa1671eea27b4ed8493e9fdf4bde814074dc669de047b4272b2d14b4f928d25c4be819d
SSDEEP 192:xqWthW8WEXCVWQ4iWUAURDoSJj+iX01k9z3A0FCH1Whf:xqWthWH/DX+iR9zHFCMf
TLSH
T194A23BD68BBCC142F9DBAEB0529CDA437C3C57C71A10D16646A5F19828D33C4EF20A6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-errorhandling-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000006f02\api-ms-win-core-errorhandling-l1-1-0.dll
Size 21KB
SHA256 d56ce7b1cd76108ad6c137326ec694a14c99d48c3d7b0ace8c3ff4d9bcee3ce8
MD5 c2f8c03ecce9941492bfbe4b82f7d2d5
SHA1 909c66c6dfea5e0c74d3892d980918251bb08632
SHA512 7c6c85e390bbe903265574e0e7a074da2ce30d9376d7a91a121a3e0b1a8b0fffd5579f404d91836525d4400d2760cb74c9cb448f8c5ae9713385329612b074cf
SSDEEP 192:x3XmxD3TsWthWBWJWadJCsVWQ4iWozCCtvpGX01k9z3AtYF2LkQ9:x3X0sWthWgCsJZpGR9zMlkE
TLSH
T111A229D686BC8143F9AA6DB042D9DD433C3D6BC65E5150260AE9F1581C973C1EE24F2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-fibers-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000006f02\api-ms-win-core-fibers-l1-1-0.dll
Size 21KB
SHA256 91d249d7bc0e38ef6bcb17158b1fdc6dd8888dc086615c9b8b750b87e52a5fb3
MD5 b5e2760c5a46dbeb8ae18c75f335707e
SHA1 e71db44fc0e0c125de90a9a87ccb1461e72a9030
SHA512 c3400772d501c5356f873d96b95dc33428a34b6fcaad83234b6782b5f4bf087121e4fd84885b1abab202066da98eb424f93dd2eed19a0e2a9f6ff4a5cfd1e4f3
SSDEEP 192:xLWthW6WJWadJCsVWQ4KWeeLrp0KBQfX01k9z3A3WXa0Sr0:xLWthW3CsneRxB+R9zcWXJB
TLSH
T1B5A21A815A7C8187FDAB6D7042E9EA973C3D67C72E5090AA45D4F5582CD33C4AF20E2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-fibers-l1-1-1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000006f02\api-ms-win-core-fibers-l1-1-1.dll
Size 21KB
SHA256 fc9d86cec621383eab636ebc87ddd3f5c19a3cb2a33d97be112c051d0b275429
MD5 050a30a687e7a2fa6f086a0db89aa131
SHA1 1484322caaf0d71cbb873a2b87bdd8d456da1a3b
SHA512 07a15aa3b0830f857b9b9ffeb57b6593ae40847a146c5041d38be9ce3410f58caa091a7d5671cc1bc7285b51d4547e3004cf0e634ae51fe3da0051e54d8759e1
SSDEEP 192:x8sWthWXWJWadJCsVWQ4KWqSY00pyEuX01k9z3AxzIsZ:xLWthWOCs4EpcR9zwpZ
TLSH
T130A23B829EBC4143FDABAE7043E5DA873C3D67C71D90A0A61594F59C1C973C4AB20A3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000006f02\api-ms-win-core-file-l1-1-0.dll
Size 25KB
SHA256 1ca895aba4e7435563a6b43e85eba67a0f8c74aa6a6a94d0fc48fa35535e2585
MD5 9f45a47ebfd9d0629f4935764243dd5a
SHA1 86a4a0ea205e31fb73f3bfcce24945bd6bea06c7
SHA512 8c1cdcad557bff1685a633d181fcf14ec512d322caeaeb9c937da8794c74694fe93528fc9578cb75098f50a2489ed4a5dedf8c8c2ac93eeb9c8f50e3dd690d5f
SSDEEP 192:xWwhDPvVr8rFTsvWthWoWEXCVWQ4KW7OcADB6ZX01k9z3A5tUQv/zf:x7JPvVrhWthWjncTR9z8SQv/zf
TLSH
T10EC22A93D9A4E24BFCCF9E7161A6D9836C3453C7041480CA57D8A75C3DE3386E3A8999
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l1-2-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000006f02\api-ms-win-core-file-l1-2-0.dll
Size 21KB
SHA256 4cadbc0c39da7c6722206fdcebd670abe5b8d261e7b041dd94f9397a89d1990d
MD5 cc228ff8d86b608e73026b1e9960b2f8
SHA1 cef0705aee1e8702589524879a49e859505d6fe0
SHA512 17abd9e0ec20b7eb686e3c0f41b043d0742ab7f9501a423b2d2922d44af660379792d1cc6221effbd7e856575d5babf72657ae9127c87cc5cf678bd2ceb1228f
SSDEEP 192:xPEkMRmKjoRWthW5WEXCVWQ4OWiGfmKDUX01k9z3Alh1EwsPRj:xMKRWthW2XWmpR9zqgt
TLSH
T1FAA21A928A6C8143F9EB6D7052B8EE837C3C77C7195090665AE8F5981C833C5EF24B6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI000006f02\base_library.zip
Size 1.4MB
SHA256 3f539b3510e15540ae24d908797442f9cd4977f4025ba6f36bc77b5ccf25ad5a
MD5 75c08e8ade5985cce66df615c5a55d9a
SHA1 de1f142e8c9eac3137838fd02e62feaff9b376fd
SHA512 1a562cc495024352c186babb3c831be6feb70119bb113e06b76bd8a833277bbf75ba455cb5e238ea4eb1fe1efa457d4beb551d39e2de21870fb705a746f99295
SSDEEP 24576:A/Ri3cnz/bucEvUFinTt3GafPWdmzn4QR5pUPHH2wjwh2:A/ROyQR5pU/j
TLSH
T1FF6509817982B5F7F804F3BB4026090DB328C5B4BB44C75739ABC1A69F9E6A47E518DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000006f02\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.DLL

Path C:\Users\Admin\AppData\Local\Temp\_MEI000006f02\python3.DLL
Size 65KB
SHA256 db84bc052cfb121fe4db36242ba5f1d2c031b600ef5d8d752cf25b7c02b6bac6
MD5 7e07c63636a01df77cd31cfca9a5c745
SHA1 593765bc1729fdca66dd45bbb6ea9fcd882f42a6
SHA512 8c538625be972481c495c7271398993cfe188e2f0a71d38fb51eb18b62467205fe3944def156d0ff09a145670af375d2fc974c6b18313fa275ce6b420decc729
SSDEEP 768:Iw/EsYpkVgBaz57kcDA7QKFmpz7cnzH/ks/KF61xubwmB1Cf//yhC74JFmpktJS0:v/5k8cnzeJWJIYL0D7Sy7x9
TLSH
T134636E529B58F8A6DAF665FC38D19DCE143B12CC87ED88DCA57893D30E1A310A62734D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python311.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000006f02\python311.dll
Size 5.5MB
SHA256 0817a2a657a24c0d5fbb60df56960f42fc66b3039d522ec952dab83e2d869364
MD5 387bb2c1e40bde1517f06b46313766be
SHA1 601f83ef61c7699652dec17edd5a45d6c20786c4
SHA512 521cde6eaa5d4a2e0ef6bbfdea50b00750ae022c1c7bd66b20654c035552b49c9d2fac18ef503bbd136a7a307bdeb97f759d45c25228a0bf0c37739b6e897bad
SSDEEP 49152:4kkzsT7AzjUaeLdj6UTSGKzuePQaOviRvYD4Kus0GYr3jDKPpWjrM06biCnCIS7E:wsgreBltVe1EsJ5CrSQHyMAwdp09U
TLSH
T146467C22B2609460C9BB4172DB2F865ACB71BC505F10CF0B51A4B7AA2F73B531AEF745
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000006f02\ucrtbase.dll
Size 1.3MB
SHA256 2e5fb14b7bf8540278f3614a12f0226e56a7cc9e64b81cbd976c6fcf2f71cbfb
MD5 286b308df8012a5dfc4276fb16dd9ccc
SHA1 8ae9df813b281c2bd7a81de1e4e9cef8934a9120
SHA512 24166cc1477cde129a9ab5b71075a6d935eb6eebcae9b39c0a106c5394ded31af3d93f6dea147120243f7790d0a0c625a690fd76177dddab2d2685105c3eb7b2
SSDEEP 24576:cQPuhXCFmugCw3wUAZMMNX6smpRrgTuJi+1Sats7F9qmxvSZX0ypKpIPng:cQWhXCFm7Cw3w3ZXX6DYaY9lpUg
TLSH
T1BE55AE2266AD01E9C5BFD13DC65B4906E9B2781503709ACB03E94E792E3BBF5077B321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_SHA224.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000013082\Crypto\Hash\_SHA224.pyd
Size 21KB
SHA256 773fac9a1a65b31d22f79a5e4f035ddc00301b741873d334ee9902db1d1bebfd
MD5 f18df573602776a7449e4452aec66d99
SHA1 28a957f3b1a738a4d10452faf867f484c2ac743c
SHA512 ad6cd03b1ce8a01fe87ecdb403701e44c118a799e39fd36989be9997b9b29c8a4f52765a67d1cdce3bd9eeb2147020fdd898afde52a6f5855f1037e48cfae9e8
SSDEEP 384:JKXqHGcvYHp5RYcARQOj4MSTjqgPmzIHXqBJ93c3O9zMR7kLMhgZvRv:JP/Ytswv9HXM3c3hkLMKZZv
TLSH
T137A20B19AF3884A4E40E603AB333867B7BF47600D394B7EF8A505B991C263ED563465A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

euc-cn.enc

Path C:\Users\Admin\AppData\Local\Temp\_MEI000013082\_tcl_data\encoding\euc-cn.enc
Size 84KB
SHA256 1700af47dc012a48cec89cf1dfae6d1d0d2f40ed731eff6ca55296a055a11c00
MD5 c5aa0d11439e0f7682dae39445f5dab4
SHA1 73a6d55b894e89a7d4cb1cd3ccff82665c303d5c
SHA512 eee6058bd214c59bcc11e6de7265da2721c119cc9261cfd755a98e270ff74d2d73e3e711aa01a0e3414c46d82e291ef0df2ad6c65ca477c888426d5a1d2a3bc5
SSDEEP 768:UHivP+bFFScXEBFhHeUrUFESCeYjN7GC0nYX:I7FFX2nHeUr8ESCDlX
TLSH
T1F383286043498EC0D70811DBE0EB7B923AFEBC7297C4D4A052F6CB859A3745D684F6D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

INSTALLER

Path C:\Users\Admin\AppData\Local\Temp\_MEI000013082\numpy-2.4.6.dist-info\INSTALLER
Size 4B
SHA256 ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
MD5 365c9bfeb7d89244f2ce01c1de44cb85
SHA1 d7a03141d5d6b1e88b6b59ef08b6681df212c599
SHA512 d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1
MD5 SHA1 SHA512

Submit Download

default.exc

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

memory/1124-3560-0x00007FFFD7E80000-0x00007FFFD9201000-memory.dmp

Download

memory/1992-2466-0x00007FFFD7E80000-0x00007FFFD9201000-memory.dmp

Download

memory/4360-4677-0x00007FFFB72D0000-0x00007FFFB8651000-memory.dmp

Download