hxxps://unlock[.]rubiproject[.]com/

Analysis

user interaction
yes
max time kernel
234s
max time network
238s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/09/2026, 17:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://unlock.rubiproject.com/
Sample260903-vth2raaf46

Score

8^/10

discovery persistence privilege_escalation ransomware

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
218	6000	msedge.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 4 IoCs

pid	Process
4508	7z2602-x64.exe
6764	7z2602-x64.exe
1852	7zG.exe
1404	7z.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	OpenWith.exe
File opened for modification	C:\Users\Public\desktop.ini	OpenWith.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	OpenWith.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Lang\va.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ast.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ja.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tr.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ps.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\descript.ion	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sl.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tg.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\7zCon.sfx	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cs.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lt.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng2.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cy.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hi.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng2.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mr.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\af.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\el.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hr.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kab.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sw.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\an.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fy.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nb.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\co.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\he.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nn.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ar.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ga.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kab.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mk.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ne.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.chm	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hi.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt-br.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fur.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nl.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nn.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spl.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tt.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\et.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\de.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\id.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\License.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz-cyrl.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\yo.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-cn.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cy.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\de.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gl.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tk.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\co.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\et.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fa.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hu.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kk.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt.txt	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sq.txt	7z2602-x64.exe
File created	C:\Program Files\7-Zip\7-zip.dll.tmp2	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\7z.dll	7z2602-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\es.txt	7z2602-x64.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7068_1210030846\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7068_770578071\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7068_770578071\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7068_1530251496\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7068_1530251496\nav_config.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6000	msedge.exe
3392	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134329294263080677"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2602-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip	7z2602-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2602-x64.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{43FED747-B357-468E-AE70-EE0CB0F46508}\FFlags = "1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{5FA96407-7E77-483C-AC93-691D05850DE8}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\FFlags = "1092616257"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202020202020202	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip	7z2602-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\8\MRUListEx = ffffffff	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Applications\7zG.exe\shell	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\13\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Applications\7z.exe\shell	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Applications\7z.exe\shell\open\command\ = "\"C:\\Program Files\\7-Zip\\7z.exe\" \"%1\""	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3\NodeSlot = "6"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0700000006000000050000000100000004000000030000000200000000000000ffffffff	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 030000000200000008000000070000000600000005000000010000000400000000000000ffffffff	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	OpenWith.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2602-x64.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}\Instance\	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\13\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\SniffedFolderType = "Generic"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\13\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 010000000300000002000000080000000700000006000000050000000400000000000000ffffffff	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\Shell\SniffedFolderType = "Pictures"	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2602-x64.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\4\MRUListEx = ffffffff	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\6\MRUListEx = ffffffff	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2602-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip.dll"	7z2602-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2602-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\GroupByDirection = "1"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{94D6DDCC-4A68-4175-A374-BD584A510B78}\Mode = "4"	OpenWith.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	7z2602-x64.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\8\NodeSlot = "12"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\13\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	OpenWith.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	7z2602-x64.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
7068	msedge.exe
7068	msedge.exe
4668	msedge.exe
4668	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1716	OpenWith.exe
6032	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	1852	7zG.exe
Token: 35	1852	7zG.exe
Token: SeRestorePrivilege	1404	7z.exe
Token: 35	1404	7z.exe

Suspicious use of FindShellTrayWindow 60 IoCs

pid	Process
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe

Suspicious use of SendNotifyMessage 20 IoCs

pid	Process
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
1716	OpenWith.exe
1716	OpenWith.exe
1716	OpenWith.exe
1716	OpenWith.exe
1716	OpenWith.exe
6032	OpenWith.exe
6032	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1372 wrote to memory of 4120	1372	msedge.exe	89
PID 1372 wrote to memory of 892	1372	msedge.exe	90
PID 1372 wrote to memory of 6000	1372	msedge.exe	92
PID 1372 wrote to memory of 892	1372	msedge.exe	90
PID 1372 wrote to memory of 892	1372	msedge.exe	90
PID 1372 wrote to memory of 5004	1372	msedge.exe	93
PID 1372 wrote to memory of 2816	1372	msedge.exe	94
PID 1372 wrote to memory of 5004	1372	msedge.exe	93
PID 1372 wrote to memory of 240	1372	msedge.exe	95
PID 1372 wrote to memory of 2816	1372	msedge.exe	94
PID 1372 wrote to memory of 2816	1372	msedge.exe	94
PID 1372 wrote to memory of 240	1372	msedge.exe	95
PID 1372 wrote to memory of 240	1372	msedge.exe	95
PID 1372 wrote to memory of 3836	1372	msedge.exe	96
PID 1372 wrote to memory of 2648	1372	msedge.exe	97
PID 1372 wrote to memory of 3836	1372	msedge.exe	96
PID 1372 wrote to memory of 3836	1372	msedge.exe	96
PID 1372 wrote to memory of 2648	1372	msedge.exe	97
PID 1372 wrote to memory of 2648	1372	msedge.exe	97
PID 1372 wrote to memory of 6048	1372	msedge.exe	100
PID 1372 wrote to memory of 3804	1372	msedge.exe	99
PID 1372 wrote to memory of 6048	1372	msedge.exe	100
PID 1372 wrote to memory of 3804	1372	msedge.exe	99
PID 1372 wrote to memory of 2744	1372	msedge.exe	101
PID 1372 wrote to memory of 2744	1372	msedge.exe	101
PID 1372 wrote to memory of 2744	1372	msedge.exe	101
PID 1372 wrote to memory of 5820	1372	msedge.exe	103
PID 1372 wrote to memory of 2124	1372	msedge.exe	106
PID 1372 wrote to memory of 2348	1372	msedge.exe	107
PID 1372 wrote to memory of 2124	1372	msedge.exe	106
PID 1372 wrote to memory of 2348	1372	msedge.exe	107
PID 1372 wrote to memory of 2348	1372	msedge.exe	107
PID 1372 wrote to memory of 1428	1372	msedge.exe	108
PID 1372 wrote to memory of 2420	1372	msedge.exe	111
PID 1372 wrote to memory of 4264	1372	msedge.exe	112
PID 1372 wrote to memory of 2816	1372	msedge.exe	113
PID 1372 wrote to memory of 5264	1372	msedge.exe	115
PID 1372 wrote to memory of 5264	1372	msedge.exe	115
PID 1372 wrote to memory of 5072	1372	msedge.exe	116
PID 1372 wrote to memory of 5072	1372	msedge.exe	116
PID 1372 wrote to memory of 5072	1372	msedge.exe	116
PID 1372 wrote to memory of 2988	1372	msedge.exe	117
PID 1372 wrote to memory of 2988	1372	msedge.exe	117
PID 1372 wrote to memory of 2988	1372	msedge.exe	117
PID 1372 wrote to memory of 4248	1372	msedge.exe	118
PID 1372 wrote to memory of 4248	1372	msedge.exe	118
PID 1372 wrote to memory of 5212	1372	msedge.exe	120
PID 1372 wrote to memory of 5212	1372	msedge.exe	120
PID 1372 wrote to memory of 5212	1372	msedge.exe	120
PID 1372 wrote to memory of 3080	1372	msedge.exe	121
PID 1372 wrote to memory of 3080	1372	msedge.exe	121
PID 1372 wrote to memory of 3080	1372	msedge.exe	121
PID 1372 wrote to memory of 1540	1372	msedge.exe	122
PID 1372 wrote to memory of 1540	1372	msedge.exe	122
PID 1372 wrote to memory of 1540	1372	msedge.exe	122
PID 1372 wrote to memory of 3592	1372	msedge.exe	123
PID 1372 wrote to memory of 3592	1372	msedge.exe	123
PID 1372 wrote to memory of 3592	1372	msedge.exe	123
PID 1372 wrote to memory of 2760	1372	msedge.exe	124
PID 1372 wrote to memory of 2412	1372	msedge.exe	125
PID 1372 wrote to memory of 2760	1372	msedge.exe	124
PID 1372 wrote to memory of 2760	1372	msedge.exe	124
PID 1372 wrote to memory of 2496	1372	msedge.exe	126
PID 1372 wrote to memory of 2496	1372	msedge.exe	126

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://unlock.rubiproject.com/
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x284,0x7ffd17b7c188,0x7ffd17b7c194,0x7ffd17b7c1a0
  2⤵
  PID:4120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1552,i,5489553584548518761,2757914727913895634,262144 --field-trial-handle=1944,i,6399347247040063197,500391617130423093,262144 --variations-seed-version --mojo-platform-channel-handle=1988 /prefetch:2
  2⤵
  PID:892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1796,i,10547650506478292335,8284393284073464553,524288 --field-trial-handle=1944,i,6399347247040063197,500391617130423093,262144 --variations-seed-version --mojo-platform-channel-handle=3204 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:6000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2228,i,10777420338871735061,8132879264725122122,524288 --field-trial-handle=1944,i,6399347247040063197,500391617130423093,262144 --variations-seed-version --mojo-platform-channel-handle=3416 /prefetch:13
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3340,i,902104310729223178,12427561100870741841,2097152 --field-trial-handle=1944,i,6399347247040063197,500391617130423093,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3344,i,5119856595890847267,5206685658528449576,2097152 --field-trial-handle=1944,i,6399347247040063197,500391617130423093,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4272,i,8352879182608600158,2504220233233195310,2097152 --field-trial-handle=1944,i,6399347247040063197,500391617130423093,262144 --variations-seed-version --mojo-platform-channel-handle=4524 /prefetch:1
  2⤵
  PID:3836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4280,i,12380550661691205919,2077210327682345849,2097152 --field-trial-handle=1944,i,6399347247040063197,500391617130423093,262144 --variations-seed-version --mojo-platform-channel-handle=4528 /prefetch:9
  2⤵
  PID:2648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5372,i,98256197056816128,11535384901293762500,524288 --field-trial-handle=1944,i,6399347247040063197,500391617130423093,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:14
  2⤵
  PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5368,i,14946294186761278040,1107415354409507644,524288 --field-trial-handle=1944,i,6399347247040063197,500391617130423093,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:14
  2⤵
  PID:6048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=6068,i,9876304844550590128,15716751378812178551,2097152 --field-trial-handle=1944,i,6399347247040063197,500391617130423093,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:1
  2⤵
  PID:2744
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6284,i,14250401790698786479,15891338942988856248,524288 --field-trial-handle=1944,i,6399347247040063197,500391617130423093,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:14
  2⤵
  PID:6008
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6284,i,14250401790698786479,15891338942988856248,524288 --field-trial-handle=1944,i,6399347247040063197,500391617130423093,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:14
  2⤵
  PID:5820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6944,i,12104850950343082807,17710151793032342635,524288 --field-trial-handle=1944,i,6399347247040063197,500391617130423093,262144 --variations-seed-version --mojo-platform-channel-handle=6864 /prefetch:14
  2⤵
  PID:2124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6932,i,7347470009154156752,5683418412580782080,2097152 --field-trial-handle=1944,i,6399347247040063197,500391617130423093,262144 --variations-seed-version --mojo-platform-channel-handle=6952 /prefetch:1
  2⤵
  PID:2348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7468,i,16858989572331717723,2908954161582724154,524288 --field-trial-handle=1944,i,6399347247040063197,500391617130423093,262144 --variations-seed-version --mojo-platform-channel-handle=6792 /prefetch:14
  2⤵
  PID:1428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7016,i,1147798248892054603,11424103362367966101,524288 --field-trial-handle=1944,i,6399347247040063197,500391617130423093,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:14
  2⤵
  PID:2420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6336,i,17648126481755988320,12514579483037032844,524288 --field-trial-handle=1944,i,6399347247040063197,500391617130423093,262144 --variations-seed-version --mojo-platform-channel-handle=6880 /prefetch:14
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6380,i,14588173867360246253,2566935318105068562,524288 --field-trial-handle=1944,i,6399347247040063197,500391617130423093,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:14
  2⤵
  PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5284,i,1033288988948964695,1706120685487116301,524288 --field-trial-handle=1944,i,6399347247040063197,500391617130423093,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:14
  2⤵
  PID:5264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5508,i,2497198291806094432,12797316694794397403,2097152 --field-trial-handle=1944,i,6399347247040063197,500391617130423093,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:1
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=7072,i,12175079638856967300,9753068678873674078,2097152 --field-trial-handle=1944,i,6399347247040063197,500391617130423093,262144 --variations-seed-version --mojo-platform-channel-handle=7376 /prefetch:1
  2⤵
  PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6124,i,10924227056995014208,2329569628706075733,524288 --field-trial-handle=1944,i,6399347247040063197,500391617130423093,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:14
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=4948,i,6229711690217815730,7347625878936285734,2097152 --field-trial-handle=1944,i,6399347247040063197,500391617130423093,262144 --variations-seed-version --mojo-platform-channel-handle=4820 /prefetch:1
  2⤵
  PID:5212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7660,i,10784779049235385849,11058334827604294180,2097152 --field-trial-handle=1944,i,6399347247040063197,500391617130423093,262144 --variations-seed-version --mojo-platform-channel-handle=7656 /prefetch:1
  2⤵
  PID:3080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7588,i,12056363694464551056,11827664141781069567,2097152 --field-trial-handle=1944,i,6399347247040063197,500391617130423093,262144 --variations-seed-version --mojo-platform-channel-handle=7788 /prefetch:1
  2⤵
  PID:1540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7980,i,15269165924024790592,9574839408857852275,2097152 --field-trial-handle=1944,i,6399347247040063197,500391617130423093,262144 --variations-seed-version --mojo-platform-channel-handle=7984 /prefetch:1
  2⤵
  PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=8028,i,10347157139135459728,13895923951196066506,2097152 --field-trial-handle=1944,i,6399347247040063197,500391617130423093,262144 --variations-seed-version --mojo-platform-channel-handle=8092 /prefetch:1
  2⤵
  PID:2760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8144,i,16854665403152533130,6411475988505108762,524288 --field-trial-handle=1944,i,6399347247040063197,500391617130423093,262144 --variations-seed-version --mojo-platform-channel-handle=8032 /prefetch:14
  2⤵
  PID:2412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8064,i,3891332161822411021,2877779122550017242,524288 --field-trial-handle=1944,i,6399347247040063197,500391617130423093,262144 --variations-seed-version --mojo-platform-channel-handle=6956 /prefetch:14
  2⤵
  PID:2496
- C:\Users\Admin\Downloads\7z2602-x64.exe
  "C:\Users\Admin\Downloads\7z2602-x64.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Modifies registry class
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:7068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x238,0x284,0x7ffd17b7c188,0x7ffd17b7c194,0x7ffd17b7c1a0
    3⤵
    PID:7108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2008,i,12102451280209127586,366828316285316568,524288 --field-trial-handle=2584,i,14322273606044297086,7534522822026739316,262144 --variations-seed-version --mojo-platform-channel-handle=2624 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2400,i,3777861567977176662,12508979092249171745,524288 --field-trial-handle=2584,i,14322273606044297086,7534522822026739316,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:13
    3⤵
    PID:6156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1852,i,711776984505246423,5028379754689192128,262144 --field-trial-handle=2584,i,14322273606044297086,7534522822026739316,262144 --variations-seed-version --mojo-platform-channel-handle=2580 /prefetch:2
    3⤵
    PID:5804
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4368,i,8213729234060237823,11989874911782614274,524288 --field-trial-handle=2584,i,14322273606044297086,7534522822026739316,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:14
    3⤵
    PID:6636
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4368,i,8213729234060237823,11989874911782614274,524288 --field-trial-handle=2584,i,14322273606044297086,7534522822026739316,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:14
    3⤵
    PID:6640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4772,i,8720070731400600480,6650163728473097888,524288 --field-trial-handle=2584,i,14322273606044297086,7534522822026739316,262144 --variations-seed-version --mojo-platform-channel-handle=4720 /prefetch:14
    3⤵
    PID:6732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4936,i,521797466579871730,9445181109840623512,524288 --field-trial-handle=2584,i,14322273606044297086,7534522822026739316,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:14
    3⤵
    PID:6844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4772,i,8452130488567218542,2454244496008832940,524288 --field-trial-handle=2584,i,14322273606044297086,7534522822026739316,262144 --variations-seed-version --mojo-platform-channel-handle=4948 /prefetch:14
    3⤵
    PID:6916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4924,i,8162848925644587547,3323713642092749620,524288 --field-trial-handle=2584,i,14322273606044297086,7534522822026739316,262144 --variations-seed-version --mojo-platform-channel-handle=5016 /prefetch:14
    3⤵
    PID:6940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5156,i,12821528799604186700,4495689452354701639,524288 --field-trial-handle=2584,i,14322273606044297086,7534522822026739316,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:14
    3⤵
    PID:1496
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5304,i,11402576960184500234,1208660471383986435,524288 --field-trial-handle=2584,i,14322273606044297086,7534522822026739316,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:14
    3⤵
    PID:2020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5456,i,11608825218258709417,15645006498962770904,524288 --field-trial-handle=2584,i,14322273606044297086,7534522822026739316,262144 --variations-seed-version --mojo-platform-channel-handle=4904 /prefetch:14
    3⤵
    PID:4852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5572,i,8932743334041577645,5466177889205822672,524288 --field-trial-handle=2584,i,14322273606044297086,7534522822026739316,262144 --variations-seed-version --mojo-platform-channel-handle=5088 /prefetch:14
    3⤵
    PID:1172
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5576,i,12632366840418501389,6274300872241429886,524288 --field-trial-handle=2584,i,14322273606044297086,7534522822026739316,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:14
    3⤵
    PID:2416
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5560,i,15686946798936983680,2661243254595820287,524288 --field-trial-handle=2584,i,14322273606044297086,7534522822026739316,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:14
    3⤵
    PID:2928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5524,i,6205652159543799603,15265016214975066654,524288 --field-trial-handle=2584,i,14322273606044297086,7534522822026739316,262144 --variations-seed-version --mojo-platform-channel-handle=4724 /prefetch:14
    3⤵
    PID:4320
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5076,i,12939851864733042075,6690052002892927872,524288 --field-trial-handle=2584,i,14322273606044297086,7534522822026739316,262144 --variations-seed-version --mojo-platform-channel-handle=836 /prefetch:14
    3⤵
    PID:4508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4420,i,4669007183940091372,2307577548217592092,262144 --field-trial-handle=2584,i,14322273606044297086,7534522822026739316,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5512,i,11440233561357622181,4511173493359244600,524288 --field-trial-handle=2584,i,14322273606044297086,7534522822026739316,262144 --variations-seed-version --mojo-platform-channel-handle=4740 /prefetch:14
    3⤵
    PID:4180

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1428

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5324

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3048

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5504

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1192

C:\Users\Admin\Downloads\7z2602-x64.exe
"C:\Users\Admin\Downloads\7z2602-x64.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies registry class
PID:6764

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Drops desktop.ini file(s)
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1716
- C:\Program Files\7-Zip\7zG.exe
  "C:\Program Files\7-Zip\7zG.exe" "C:\Users\Admin\Downloads\UnlockALL_Password_123.rar"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1852

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:6032
- C:\Program Files\7-Zip\7z.exe
  "C:\Program Files\7-Zip\7z.exe" "C:\Users\Admin\Downloads\UnlockALL_Password_123.rar"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1404

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7-zip.chm

Path C:\Program Files\7-Zip\7-zip.chm
Size 124KB
SHA256 96dd966cef6d32126b5d1540dc0a9fa9868bb4342251acaea12710d20ac247d9
MD5 09541b240eeb3f5362d306eacc7e6ef9
SHA1 38031798a95a9d72b952c29546366a911b63b16e
SHA512 3105a74e1a81a7219d94bc2c2f8de6a863e3ea5ad959b22a5ed87a08bbb8910a42af8b9d9ca5700dc9c9a1b56fd0659d6e7f526eefa9744dcbcb5206e88f6931
SSDEEP 3072:cgsIbmKWelCXLFetn5dmKcrRUVQ3AoVaEl2X:ZaVewXLU3WUV67Ji
TLSH
T1CCC302B11B9E2893CEF5D778892F92813128572254D84DA8B62E15AE9FF0F6E14803D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7-zip.dll.tmp2

Path C:\Program Files\7-Zip\7-zip.dll.tmp2
Size 99KB
SHA256 fc46083ab31a20bacc8135766c063b6cc72e16abbed0294f4d9c630b05e8b8f5
MD5 2e11356db5a1e6c52f685ea90007024a
SHA1 7630f3236068201be55c00ba92e34d9a241e080c
SHA512 d826c15458ad1da562618ec6d38682e0e176e4e11e88ba0c4e574b60de24b2187d8436d4e8d30e9eb9d197d170009ea79d50e172c82aaf220b0cef13ecfdd30b
SSDEEP 1536:dG2eoxbHFxG0ms0/WvbuKedUiQgKnlK/rjJX3dss8Vg4vQ8JAUI3C7+:kOxBx4N/IvnlK/rjhNeg1UI3C+
TLSH
T13FA3D825B2A48331D073D0B9C9D2AA99EA7278419F3047CF2246A75D1E37BDACD35732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 974KB
SHA256 ebc4f14a05deb7443a2ca3c8c379b6ae1b0f1a3fe193e00f51e10da6bb3adf3a
MD5 c2b436843c1a230e866e4625111d747e
SHA1 a76fc5441a4e8a2c62b19baf24cddc24ca554522
SHA512 940f92601ef3a8b013c108eee658f41efcc0b0b130875fcb7891e62c7fc8a2da3002299820de668959b3898145d2149f90ebc711a43039274acb6056d32e3d83
SSDEEP 12288:9SOBshTF0cvCQH514bzx078h+NQXWPcLWw1c3rQbq1yy+cpiAbh1gEeIpeE/:JsJXH56bzx078h+am0WwabVicpDPobE
TLSH
T14325D825F5788333D0B2D0BAC5D6BA9AFE7230465B3089CB0246976C3E276D6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7a89804fbf3296628b391ed16af0667c7828db5920b0a1a6dd73967e24c6b877
MD5 ce7eb70d406f74c89f330da83ac00dc0
SHA1 d99e2cbcc8c92fd14708641e59856a0b5105802a
SHA512 aa31ce80910e053401660a79aec4b92e1846e9b996f883cbe71064c963f21ae408d49d840356824f120a1ccd5f1f1b52359012be24405f5ff417bba4d414b9fc
TLSH
T1E0D0A7347EDCB5E2E135157D4231460175AD9692BA87A10BE850091D8C7468362D5DE7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 326712a9dfbdb42ca858325e4f55d828416265d9bba7533ff5f61755a5909883
MD5 0a5034a075c85a9f550527bcc59d1934
SHA1 92c3bbf22df4d363d30bfb65be7a528d1a95d68e
SHA512 7a49aaf88fba98ca4ea9bf8dbf39a356e3c425511416419826b1fb4b22f34d915d7ea8b941c2c9a1b862d934a16a6b3159ce9ffd5af43e51df77d34fa3f7d84e
TLSH
T17FD02374BBCCF151F11244B852314B1A75BEC740BD4BE00AFC51114C0C00A4313CC4D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c80f71026fa07cc9b3e69c8779d4b4b40710cf7bc2893b740943db0d0f79591a
MD5 590eca05f11ec72644a09f205b548fbc
SHA1 c6521700bee3b500259ee3a70292b90201f20597
SHA512 fddd457c35c61ceb727f99bd39f55314cdeb7d062798c573a377675121f972ed95109fec329f911c502139a1794b70e5a98a57dd3b21b5a70e6518890a361f66
TLSH
T1E7D02B7A37C40404C0D0747221F24602D530C520AC4C81088801702CCC207C3010B8EF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ee00825bbd5a4f21308ad2e10e5a9d3c4512f07fbd288ec8ac76788de6019e25
MD5 c3584e6bc22b3ad2f168ede48d20a993
SHA1 ffb4ecef8f65638ca17e16a32806195193977c7e
SHA512 5fd777359305e67e9f30fc404af9013a876846b1d6db271fa73dfcf2ee22fb25a8e26d4d0c970cc3a8219df11038dc6b4c2c411db652593bda1c3d7643753c0b
TLSH
T18AD02B7637C40404C0D0747621F34602D530C520584C81088801B03CCC207C3010A8DB
MD5 SHA1 SHA512 TLSH

Submit Download

1830faf4-3828-440d-9a2c-e23c385ab961.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1830faf4-3828-440d-9a2c-e23c385ab961.tmp
Size 414B
SHA256 61039ae3d8c3624812f9a454a13b0b7dc1ed21b02e279c2311adaa182773b772
MD5 f710c6fa61f17fe9f89aa7dc15f64f2d
SHA1 88698761cd9b01337107a53d65d69b4c15e5076f
SHA512 e3e61c8be53eac1bab26dc89d4bfacd29814579c3b23d77e22c26ae748d1edb57b66c9e7eca7d365d01248a9c54d7323eb6ec32a6337b40773cd76e82c9c72dc
TLSH
T103E022ADCA32FC3719FD1B196065478BE75103A72680491B3F3C810A8FB473A4A8AC6C
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 eb092828a7dfacfee2bcbaa7858027f130ea9926c52bf25eb8fa13919ad85197
MD5 9a934852a64072ed08415e27e32d055f
SHA1 092567a97048cf6ec76b400dbcea28794cc9d900
SHA512 f4e31d8ca79fd86bdb17ce90ea444fb524e814c7b46dc38a876aa248211105ea919ffcf3c2ea79fb52972694917d4dc5411c9cb9653105b3469b6a007c3995d6
SSDEEP 768:faz9lYHxjQebm/4skSAm0dJ2yQlWI6+c6JzOR:fUlYu9cZfn2yQIInc6I
TLSH
T12813F67FB65D4C5EDAD7203D791B1A73A321E8B8C6E8211B066FF1224666F5E08CE407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 520KB
SHA256 fe908d0029a31aaef10ca25075dc5ab7a94047a033125252070e2dcfe8e7ba03
MD5 e6113bd87b2981f84795d18fbf402c0d
SHA1 c47b502482191601af77a8d27f231ec5bc4cc4bd
SHA512 757ba9939fc46055ed6c135e29cef7eec3febb7dd6f770e5b557985a58f9588762186c3216f5322ab22474caf79fff9406f662d80fa9498e450c57db856328be
SSDEEP 6144:7YL/ML/Wk6pL/PL/EjXg36T2VTWPYL/vL/iL/bT5:cL/ML/qL/PL/ErgvWAL/vL/iL/bT
TLSH
T168B4B5F71912A00ACFA802F6A2063E3DD177411D3CD1F9EAD57C5C952929F32A2FDA85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 619f9e7ba329f4dca06c2a704e85ed6e57bf82081706315f883134216ff98be2
MD5 7126415c27d6ec55a71170c7eab4b4c6
SHA1 5fd8a9baf315e9855777769fd42f22d5d4bacb13
SHA512 12594cd935ce51b61028c6669c5aaab69cc6a850aef7db49b0198a11ffed2c081f2466574eae3b2053fc707b40be7953560316fa3febcad6d31a0314ec165def
SSDEEP 6144:JQ8Uyv1cLNkadNFBOTnLaeGBqqfoCFd0yUHyplMnHW+guZ:JQ1uaNkyFBMEfB30HypCnHUuZ
TLSH
T157256CEEC7282C82CF6B8770B0E0D9077E712182B699D0D39945C5D897D6B8176EC2BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 c4d70a84ce1a405e79a1cbcb6d3c8be982f2e91f42a9dedf20a684802792d0c5
MD5 b6688313f4607204bc6ecba246c7868d
SHA1 e738897e721c78e08c8f883b68e2d111a3a75ce9
SHA512 190121d4667c64845c54c914d68ae50ac10e1cae869ce06bd591e028c02151943c7bdc4cbe0da827602f0391fcd4f1db32e59994f787b04f0a7bed0517915d38
TLSH
T18E61940B93559EDFDF66E47352D1A45436F7B47289472E0054FBAE78C802F80A2D152F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 2f70defbd9e80a0adcfc7841a1f4d17b5affd27f0823e488c148dd86f2e3ec98
MD5 5408582b1f0081523cd667f3649bde96
SHA1 321c680916d7b634656e42afdf643b5c9ca24f3c
SHA512 61e1dc8e288e995335e9570816f387577f333b9b8cc154c7c8bc0da00122548facbd58eea9be804e96e88452939d53579304c96cd0b1d092116eb7f3e914b5fc
SSDEEP 96:WpR4KsFuYZhmZxjuAKctOSK1TC/Ok30xLUlECMjMIonxHIYVhUmm3M/wT1Azw5FG:WIFuYCLfFK1XZ9CMjfKUvM/wwRVv
TLSH
T1C2F1A59792AD8A9EFF25A43232C4594634F620B344436E035CEEDD38950BF9891DC25F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe59962b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59962b.TMP
Size 3KB
SHA256 977a373118f599c7bdafc0376a355f03e9a7e5e97a2992ecba3d56ba5ad99999
MD5 6f6c2cb4125d7c4a4f43eee9599b5792
SHA1 875bbddbbc3e64f8672b213462f46bc9473039a7
SHA512 4bd313729506a989b03f577ea04f7ce815e64ab5a83d363430ea3c004862692be6fe0d2a0458ff87cada17020e08991afb4955e6978cef18a63f5f6685787ae4
TLSH
T17D51830B93568EDFCB26C87352E1A45836F7B07189032E0065FB6E78C902F8462D152F
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 342B
SHA256 39dfdec86949f152a1471442545245ac5f3372b56428a6f61dffac0a3ec159e7
MD5 829a3c6987490c82e6ba954662c1d61b
SHA1 3799630075c4e24b21e810bb5896dd5ecb96c9b5
SHA512 0fe38650c2f79854b11bb4f6564fa45639e74cf8e644f7913c55cc92ee0ebe58c20307360aa83432e6521c046c39ccf2d2e1098695cae563817d0f4af593e30a
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 322B
SHA256 9a1d6cd775ad584c31f1b1b40e7e58723696edf88945b796066b68054c4ed559
MD5 9c63bb1bd53db262d61300bcc298a795
SHA1 cae04b516cf87900c0c122b10ffa3304321c644e
SHA512 e1abba1551a95ab386eb7d94fb92f150f9bdd67a3e750958c3e49d88f001bc375fce5e4787d0993a648646995863502ae03b1031f922f7a005c0b01a0cc26a9d
TLSH
T13FE0C85419CDC67B5C5D6CA347647748C3D13946F78D3E013F698C4C7511785B3D5560
MD5 SHA1 SHA512 TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 24KB
SHA256 d215adc21ac7c6cc7f8472440c82212b3e098a3305120d3060b4c55b2a8a5435
MD5 f9f8b135e28ee24a083ad583bab38e35
SHA1 61cb5ece02f699ef1d045f88eee4c46f89607efe
SHA512 4cab7a0ad73e1065f7220eb89562e3e3fd234ab18cb483023b9854d6b5aa61dbc22f981418ea180d4350f0447b6c481b6bf04bff310f79fab6ed0bdeb0984a62
SSDEEP 96:UBC3/tPbYG6/0bY7mkwtHE7EIIc+lea/ik8vwiZD:G2/6G6/X7mptVlhlea/yZD
TLSH
T140B2F863AE767C02C70149BA18661836DE33D1598FEBAD88393410B148BC07665398FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 224KB
SHA256 9d6381cefc08b00151bf64c00713c3f30818e93771f7caad3b195cc6235b0a18
MD5 c63f85f2c3e8fa236b2253929f7dbedf
SHA1 b4d072ecb389fe0aa651e9f4c452e43e80bda1cc
SHA512 b5f039ff9d50444c6e94feecf6c6201fc97f800dcc52224531573d426423686f1d1ae14a4906d1afe52578628a516cfd4135b42dbd053230a502215ddf2323df
SSDEEP 384:L/O/4/zxfRgOIkUI3ijVoWN3qL/Z/m/K/P/a/XA:jESzjgf4i93qDV8AHwX
TLSH
T1B324A75FAF223602CD7D507168E759D6AC2DF07F8B5365CA68B010B0CEE2616911D8FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 49KB
SHA256 0b7a21db9403ec9b6350ef36271dfcf2936b0a1445c8428e52eebb2dcda19a29
MD5 731030f4003b0dcf5c7d501068b2d8c7
SHA1 982d9fea76ec144cbda5e297e847bd4c0172d5ac
SHA512 506aa73b5e415e0e3565f28f14c4682a5aea27141ac72c6dacda90b1b1baed1d36a1743c42ca4b964560fcce2abaf70c22a7bfda16eacf7f37d70e8e4aa9d61e
SSDEEP 768:C1mnwI9OZ6o0LANCtkbFNGL2Ev5tsCV8mmEK5RfcihVyPF03oq:VLAC6X2lD3bgVyPF03t
TLSH
T1DC33B667340CE617CBAAFD8F67BAFF3CC25A443BA589FE55C0A04988E5890776739440
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 c5a121cafb709ae014139b479a6b69876e7df1d9e459a3a96f03fc1a80344995
MD5 050e7283af8dcedb1ee26f7579259eb9
SHA1 3c4aea5c1b13f7ae4b9fc2a392741f275fe28b22
SHA512 c5781563e3717f0a04349cf2b73c1657324d0180ace15c5f9dd21461187cf94d64e5611cda2500b742584931e84f3e51040f5b375111cf88283207a8eb380933
TLSH
T11CE020A079DDC55D5B443C8782297B0CC3F1398BD78C7F415F199C45BC41108B3811D1
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 40KB
SHA256 90a4a216b84367b9d4c6c732bc1229fc1480c372bde1de26738de9d9d4e7d1fe
MD5 4b08997ba85ca38a034e4d0164ee653c
SHA1 7d5050cb64be321fe680df789c6e56ea7bf34b1a
SHA512 31f95af26a7536c5788563675ec8385a4b0e730e34a9b589d820434b7a1fe09d0561bddbdfbe2af0da274708cb43caddcd9f644029ab3a4b3251590f5c283fb8
SSDEEP 192:qDLaTaZkkkDE6BkMeZIbH5L8t+CKkMss5Q+1vQCWdKZG:IiAkkrokMkk8t+zkMss5ydK
TLSH
T110035CEF080B7841CAEBA932D46D9C276975808A1A43EAFB557990A21D347C37D3707B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 69feba339089e2eeb815cc50d990ff807e8f5a31fa3fdb8ad43040d131e68ab6
MD5 4ba236ddabf203ace11812dbef2a1ee7
SHA1 2a127c30264dfd0ceb34e5d49799c0a03dfacf2c
SHA512 ed549938a9644a451853264e3554145bb4c86990c1f18187bde5685c18e442988fbb10bb10926acc03cf955c8b27c504cc0c04158b1848dadb5bba755dc66e6e
SSDEEP 192:D3baaAeUo+C/ZgVaaijhnW1YFSrxXSSX4vaTVYzgAtBvTHyGmt8/yox:D3baaAeUo+C/ZgVaai5W1YFSrxXSSX4V
TLSH
T14102BDF3C3F8856DD91196F0AA187E1BCE2D0515536C3C5A85E8AF4B93F2472D142E8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 39fd431b379b7c8b974ad71ba26b73cae69c2eec7e87bf19d33961b1d571f257
MD5 855c211220e64d9d2c4c0c34bc4b986f
SHA1 28f0f31499a6ab17e64dfe3b1e10492302dd0039
SHA512 40412216072bb462a6bf5c616c8b726d8ae1073eeda9acb304826f8772dfcc5ad02705e3f5cfde972c3d788d935539113d7ef38e0beab2765863320ce26d9b0f
SSDEEP 192:DQ1EPCe/NnX0C9VjhnW1YFSrxXSSX4vaTVYzgAwvTHyGmt8/yg0GMcl:DQ1EPCe/NnX0C9V5W1YFSrxXSSX4vaTL
TLSH
T1CE12BDF3C3E8866DC91156F0AA187E2BCE2D0515536C3C5A85E8AF4B93F2472D152ECE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 cbca53003b535dd6d7c1ca9c8d7781c79af75c03372c57776251b624ff86038b
MD5 a6a78addd7bcf707a122e57f7be670c5
SHA1 f3fc7e72d0173ecf78ba9053abd6f7f27642b84b
SHA512 b0a6c79fbab77b54b8b4983c8cc4e51d2f702c911e2fa34b8e24307d7de51ac4b6001d8721f837fd121e2786d06f7b2d16f6585e76dd2d15c1f433c6add10112
SSDEEP 192:D3baaAeU0VaaijhnW1YFSrxXSSX4vRATkUjGcTxt1fP7i:D3baaAeU0Vaai5W1YFSrxXSSX4vRATkx
TLSH
T1CEE19AF3C3F8C56EC91196F0AA186E2BCE290515536C3C5A85D8AE4B93F2462D142ECF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 78a0df1b1a0e8bdeb3bd7f8bc42ab862a54bfa686e0092dcda3b52d0dfe0d8ef
MD5 ff1cf2c7a84c396b0a39145abb5a19b9
SHA1 bb6beb004bdd712cfc6d21fde61410a66ea52f78
SHA512 32603980f6280f16924dca56bf8839b831b91874b526be53818f5d6c96e6945768aafe4ed966ff4a2ab78dbe582f54ec83d4aa7e7cfc499912c236a45774d229
TLSH
T15CD02313150570B5667C3FD54155ADCFC32710500842EDF950D0DC5C053585E0607245
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 c42f736eeb6c648a732fb798895615fdd01e5e2a213253d6b1f5de0e41d24167
MD5 6a17cf30cf4e0cafbd06f59d2ffd93c2
SHA1 a525f2868cc6ffb39d72f12e856932be11f26ed9
SHA512 ed46da37c66b3f5161c43fd8a1dc633dfc9b5239045e82fcf639fc357fcfe0865277cbda98f7e008f6dae513851c34e47b372509654f7324146f0935caf927f1
SSDEEP 192:sxRzReOOZf/fbsq5B3AtFUzoA8pkp/g6+WNmEN/YZFLG5xGTdIgmaRJ:sxRzSZf/fbsq5BG14/5//SvBmab
TLSH
T16942B8167928AD3B5CC7D21DFA55BF53E3F95032A1E12E48AAFC861C04E76DD120790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 e986b106625a32b245610309ee6269587b0932d4751f1bfb40fd57b563863b94
MD5 7023132319585cbc23fc44bfb761697f
SHA1 d26c515de17247c0011305974532db8ae1e7e370
SHA512 08dba9ba79507ecef624ecaeb3dc4287681e244ca463451cf4f2ad4cd4da4197930af4af2d18ba92e86b0f184f036f132bfac659c510758a92582bfd14890401
SSDEEP 192:sxRYReOBZf/fbsC5x3AtFUzoA8pkp/g6+WNmEN/YZFLA/xGTdIgD0aRJ:sxRYtZf/fbsC5xG14/5//SdBIab
TLSH
T14742B716B928AD3B5CCBD21DFA55BF53E3F95032A1A12E48A6FCC61C14E76DD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 74935cd165982c55b923002264ecaa46def188f14deecdf28da09e56f7654fa8
MD5 602a9386bc026e772c71c3e1279f49f9
SHA1 dfa3fa663e474a28b8a407acafb34e06654c6b6f
SHA512 0cf510a41ac2e066f2336d84c39544a8e32353119324fc88c34d9aeb28afbd54fc089705facca5410400dcd0d3362a4bd1013bfc1a3e00744a4d92bae4591f56
SSDEEP 192:sxRYReOOZf/fbsC5B3AtFUzoA8pkp/g6+WNmEN/YZFLG5xGTdIgDaaRJ:sxRYSZf/fbsC5BG14/5//SvBOab
TLSH
T16942B716B928AD3B5CCBD21DFA55BF53E3F95032A1E12E48A6FC861C04E76DD120790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 260e037ca06fa48a4c99e314f67caf35071cebf8b8771406f84365395c09f8eb
MD5 85046604fe21a12fb6d0424c17726031
SHA1 0f53a3e111dbd00350710ac62c0a83b10e8b1012
SHA512 40c92e474e055da9d8b04b04be4a6c735329346c219f8b130e7458c05f30c68c57304db89733e155d7d20e596154c8c2eeb7246548850cdea5b673a0cb451e28
SSDEEP 384:sxRYKmWZf/fbsdWvt5xzSB65vS/58ZKytW/2HABIa//7WaF9:scKmWZ/fsYt5xGB6Q/552geaX759
TLSH
T10992E61265249C7B9DC7D519FE31BF63E2F950228CA16E5CAAFCC91C04EB6ED120784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 45a54d9457b47abf6d262cc4716a7c51fcb7dd9ce36800fa639dc6952d35f284
MD5 dff3d76186c5e07283922a393fc40e67
SHA1 6e34379588b0109bfbb0813b17602afe282d5c2e
SHA512 c5c31d84c4b2e210b7fe21c2dd8e20882559be03ce4e64676553ba17ec4b2f146b9dc7aa025ea4cd8666c8df5e3284128cb5d62605ed42fd53de1798832e6805
SSDEEP 384:sxRYzmWZf/fbsC5xuKe9S/5rZMytW/ShrBIa8/7WaF9:sczmWZ/fn5xu4/50S9eaG759
TLSH
T10382D51269249D779CC7D619BE31BF53E7F9502298A11E4CABFCCA1C04EB6ED120781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 4982339b2ff767adf3140ff20b66e1a7e4986f98db908f86e4795673f7143fa5
MD5 ab8448075f753e020bdae62d4766e059
SHA1 222654a5d31edd361264a51afff5e503a137e0a8
SHA512 2c0b65d6d2f70be0a4f360a21792a42ca98dcd399edaec0b9e38edfd88c7266b5e0b178a338da852d4c42d6fee78674cc2a626ab71517d7abd271ae808f1ae38
SSDEEP 384:sxRYKmWZf/fbsrWvf5xzB65vS/58ZKytW/2HwBIa8/7WaF9:scKmWZ/fiYf5xzB6Q/552QeaG759
TLSH
T11292E61265249C779DC7D619FE31BF63E3F8502298A16E5CAAFCC91C04EB6ED120784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 d9c8d5e0e2601b64303159729e859b3f41230d1410b16000ce0bd0a934e3416f
MD5 a737c9216cce951733949a8d91e8068d
SHA1 c344e04663989efc0cbdba1f8fed3cb1bf3de2a3
SHA512 d8bba472e2874319233c0b570fe1440eb867cbbdae610998cb851a7ee0ffb9381ee7e7cd26c0107a00f94bdb5a2502215352219f3a5868885728036c89a85f36
SSDEEP 384:KAX0EdqfCtgNbFfVNKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVui9LZRGmrocmU:K80EdwWgNhfVN8F1+UoAYDCx9Tuqh0VE
TLSH
T192B2CA3B640DCB7E5F800A9DAC196FD77D9802C7A6988D4047FE994C02C77EA911A4DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4966fcd2-6d49-4646-b81a-5e2b948dfe71\index-dir\the-real-index
Size 192B
SHA256 f5ee095f86a12d14906a7e29d3397be786cd61d3020d06834d224b90037788e4
MD5 239b5f47ba8fd1a055af0b4d2be53523
SHA1 dacf3337ecbeb247dea0d6af13059b14475ee1a4
SHA512 0fe6748b350252467486e7e24928480248c459655179a9176e579e04eeac33209bb9937ad94079501a75a233ab494addf1bb79e8f43494a211a7449fe96c08dd
TLSH
T178C08C018C7699AAEA3B5A34097F3129372605ED18162A23008CA85AA9A219CD04A806
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4966fcd2-6d49-4646-b81a-5e2b948dfe71\index-dir\the-real-index
Size 3KB
SHA256 abeb724d5f3b6a4bc1e1a4c12bd5bfb6a7b9dabdee6652165dd75c508d20f6b3
MD5 47288a78de4d7a157f86a9b9066a9691
SHA1 ffc72758f9c3aae8e08a069b0224b9e8b14d8abb
SHA512 6067a2294167144205cbd31e7f4c56db7619e989a233de82cedd33b9ac44d1d55c32de9d86115965083c5f056b4e25cfe5d669d9140195cd3908af513414c2d4
TLSH
T1B251D84F0D0B1FA9DDEC21B208BA0C93333938ED17482D0B51EDA231B8D3724AC1E599
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a0f92.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4966fcd2-6d49-4646-b81a-5e2b948dfe71\index-dir\the-real-index~RFe5a0f92.TMP
Size 216B
SHA256 0200f0af5e4db5287af04d59650dc504621b06c7e2eee8745bdf152cb0ed479d
MD5 169e08b65350da9a6f6fbd54bf290c1b
SHA1 10d85a980bd69946bf02ff1eec0546b5b56e15a4
SHA512 e0d81670d301584097ce5992debbbbf0e3b9f6e8ba45521fafe7a66d4fec131531bc373cda2822abe949263d6f125d7075cae16d8349953d0e57f1b1497d2f8a
TLSH
T14FD0809744D155B9D91719303047551D337B083118215A265087141E94715EC4446506
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\71e4915d-effd-4597-a97f-59c57e108800\index-dir\the-real-index
Size 72B
SHA256 39fcb80497912614b0330dfbaf5960bc70a8e09dc9ea783d09a07425df2a54e6
MD5 35c312d8f56d9682567b9b67d637aae7
SHA1 e7da265b540d46c184f6fe49ccc2f7418646c143
SHA512 87bc4f3793897f5d381f8b14f870c8edb08c994be6ef0891cb12f003a7909bbc10b5bbaf75e27d9a85a446b21bb0448192bc5664a4a4d2e5f48b9d84e526de37
TLSH
T14EA0022767880019C0929AB139A705E22312FA12024123075A948248CD525458FE604D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a6ad1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\71e4915d-effd-4597-a97f-59c57e108800\index-dir\the-real-index~RFe5a6ad1.TMP
Size 72B
SHA256 3c7b0c76d8ce0b63bd402bd3813792c775f601ed3640569cb02591c4d2542f03
MD5 2367174256819541cec81d54d133498b
SHA1 e389ffe44ddbf11c502bf15c4dab326b97c0895d
SHA512 8630ecbaee4e2810e124dc54e22a1bc49eddfa195c6fb5d3e972f5ecd219046d060a9b44dd5304b0416884a1f24f4abb261460593832b535da030312d46ee6a7
TLSH
T19BA002130390440DD03222B5555642415213CC2C1212225640929044DC50DC44DA141E
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 f2ef54f0a1db75d2f5d765def7853bad2b83c5c9facff799ea0f0953240c36af
MD5 14e4d4a50d0c8257fdd656a0fbb08b23
SHA1 746b0fc120f03dfb927f735cab2364d7f29f127b
SHA512 f7da9e3ca4c01578acf0ef84a1b512b6c184dc23a6a97a4f58dc4f35f7e105b8fd000c84d87bc046e2ad23e2be4dddc666853f46655732c535ba884e9b1d4c6e
TLSH
T11DE0D8F76DF71414AC9B83D51471D0E94505B8948844BD8E6157A18B60A37517816C66
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log
Size 4KB
SHA256 7a6d08bf4c3e82ba93f03b9dafc5c7a857b588b91b7acdc25159022806c1e91d
MD5 2dd7401fad845188f03575958430fe52
SHA1 fff6ab515f95bfb4f3d1e3249d8689fb50421fd4
SHA512 89131f1d344ae1d9e9c53a03948ac71ceb4d4b1ffd711b6a6fb19722bb9be89714153de866deee7f8fcfadb68d2958c063fe98b95c2712c1e29b95407b7ce4dc
SSDEEP 48:F2em5HdYlI6TQjXf5ZONTQCTQjS5ZOZTQV5ZOV:F1m5HZ6TQjXETQCTQjBTQU
TLSH
T15C91CBE3CB055053C9C8A6FB2039F6D8541DCA066BFF87A614BD8F6E52402C23328B4C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 338B
SHA256 4e357d9df6f4a2ca80468a57b2fb2fe60c9f4e253c8a75034daa108f6525ef40
MD5 b6b6009216065c994e69c07aea504461
SHA1 6de0ae742d2221fccaaeedeca1a5e2075cfb7783
SHA512 b379a79160b4b0e743e97c1cbcb34b5c8b0bff79c6465ff1475fcc69d4826ccd79567488b1aaec9ab0af1369d1f8ff8ce37aca24d5af1b116e904bf7c7447bf5
TLSH
T107E0262019CCC17E6855244302249789C3E9B947D3CE3E022F21CC887943508B2A61A0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 6e73e39c47265988e8808cd4418d1e096fb6a421e77d5e1893c5296f1e83a9b6
MD5 0d7b97c754721a1cfde7e7c1bfff97e6
SHA1 83ce4b9fcf42dcb29b412c9c28d3dc89ee1922b4
SHA512 8f2a51edae84c1dd24ede78aa4a3f880de1dccc93c4bf2adf975a5d8328a1305184aa29eb3fe7fed4482c5bf36a9089421b41e28513550e6067534944bb74b3b
TLSH
T1AFA002218B4EA405C40746F020F5524073504CAE01055359ACACE4EA8CF55915DC9305
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a6a15.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5a6a15.TMP
Size 48B
SHA256 ddf44fb11980587dac293ef88fa99cef8834dbf924cd197fed2e2beb2e7d0e38
MD5 b9cb74766e830caf1d0488d6b879914a
SHA1 971cb6be31807d7ebc95268bbf2fad6e9b648fca
SHA512 5af8f12793bb30e60a6d20b973d73e392935b48669d51d881b0ae8bfa907a4df8dfbd7e95aede87137bf074a223860382f643e8385cd8347faf2252685258d8a
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 328B
SHA256 e57112fef94e3d3a3ee26a135fe2ebcbefca86014a6cc6e813802e98adee7270
MD5 41388992e32327f5591707aed67b1e1a
SHA1 262a97482e3a95630440670f8d06b34b82894589
SHA512 3c20032ad8a9935a995e4229cc88e44c99d2ede94e4828acad1a27dfec3d36db8496b3ee5bf2c82a60e050c8b3f0cb82a060ec3b9d6c09aa36d0cbaa960c117d
TLSH
T140E02BF877302BC5EC8F793A32284B60A753D4020540475BC91CAA431B5F4B41E4E5E0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 eb82226d2de596be810f19d1b05a33c89697955b6c77cd9869f2cf7b6fe6dff9
MD5 029aec5fb506dd536ffbe3ce3ac16269
SHA1 e13b7f7728a37067f37e70571cb910d9bc63938b
SHA512 8e022e694115fbfddecfe20c4188a82843f1287d7d2eeeeccf5cb7d1ae91bf1b93f509e79231304686d46371f5ce474d8c9fadff069e7deba6d99951bbc77b0d
TLSH
T11CE0D8702ACDC63B658524874214E74CC2F3B942D7CE2A112F19DC8876061447397160
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 01ab94ae536cd8eb293c46d2b85ba6cbb1a19eeb61c7fe26ab803168d2eaa752
MD5 04ed3025f8aba6b9ba7f23d4433a4bd2
SHA1 1faccbb1b591ac09b5bab9412448b5284efa6090
SHA512 d4254f57bc0a633e5eaefcd50acd548bd9b93cc7343a5f4dcf2070d45d0d30326596f73441fddbe448a2cbfb092bc455f0628439e503abdcdf2813f7ef687a8a
TLSH
T153E0267059C8C63A6844A4C78374AF5C82F1FD4AD3CC3B02AF289CC8AD01500B3EE191
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 967d979464d370119be867429d866eb3cea6d67284636abd2f2b8a277b741a6d
MD5 6c604409b807e8fe578fbc47ced630f0
SHA1 b016c79806bd0250b13c41e7d4d3f36f2091ee3b
SHA512 8bc3970c77e85e26172932775c8831f473a50e8b0e7f989fef5f03e6205e228ab05ed7c81f5c881a2c83f781cdb97f2f16a22303576f16b3541164a9f88b2063
SSDEEP 96:KkDg/T9xFMtBqXHrMKPZHFMjjTqtDR6YpeiISWXtunOH6XKP2HcXjA4veSX+KEMW:aT1rNvj
TLSH
T195B1C614383602803C7E292B9166956F524139E33118FF3B77A941E71E27E0A5FFE8D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 0a97ea0b85390eac0d9d82f725926411b28f696fc115ff3472045e7698abce52
MD5 9af4ed9b125d34ec328d11a9d082ef7b
SHA1 0abfe9de2a8871fcba3f3b2d09dbd596ffd1b66c
SHA512 e406a277ca3ed713cedd70d5c3472540bc59eb5e7aa369a6bb56eeb3ff3da49a5d1ee9a666dfcb5459e2e3fbaac4d0908edbdfb82cc53058f4fbb5aafc89a27b
SSDEEP 384:DNrRZyCSDnxTIC6pMEhIKyll7svbFKfk7:xFZJSDniYyI1l7svbF9
TLSH
T15244840A7B747001EDE6D9721CB080771E3CB16DCF22A6916DA254694DB3853A63D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\dc6c7458-494a-4993-83bd-1dd1531e1094\index-dir\the-real-index
Size 72B
SHA256 d02746ca551137a5cc53574a0a5dc801db9c5426ea071c96c6e0f8715a6528d0
MD5 764d40efe6356ce24ec666e8e7589ad3
SHA1 f9e9fc66a5efac886227a97aa29f57fbfb65ef89
SHA512 9906ae64a6c4105dc919a047be5bc70dd7f24a10e4ea401428b2e467fecdea9fe5989befeaef4b2cc00c615a97d19607c7c2c2273353f93110bb367ec6ddb4cc
TLSH
T172A0026853520301C4101271286B12613335AA15E955421681F671DACC951A5414313D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5997f1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\dc6c7458-494a-4993-83bd-1dd1531e1094\index-dir\the-real-index~RFe5997f1.TMP
Size 48B
SHA256 f553c74754a8b70816fad7f5a65829f06cdbe5e40ddc5689b797f1abe56d7f9a
MD5 90f09de88c5c5ecb593c3458f6256b93
SHA1 1824282241f6a92359aa83aab9f2813e160aef00
SHA512 e29e9bf638b52be13f3989665bf9a827ca797edcf7704d3eb786b0d807a6ebf5ed10f75491082fb3e3e669168641e8692e7116db843e0bf0c2fee8a85c700e3f
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 81B
SHA256 817181571cfccbaaee2d6baddfe28ecf20dac42a3e2d07f22def5fdd588646db
MD5 4a49cab969f0ce326a29281f065c6957
SHA1 84373d6c279c803414d521bdd5998458586193bf
SHA512 cb0b84c583dda07dfa0fbd016ed4f3b776227dabd2e93e48c2b06e2870ed01ead78bdcd08725e04260c7c35325b1731f5ff96f0998c916c3e9cd68ed699f9db3
TLSH
T1E5A001B74801849A9FB0A9E96025B61DF04B819C8CC0EDF18408C0422128AB310068A6
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 162B
SHA256 8bf423e96d33882ab1979d1d9b65fe9f4d2ca032686e3b206ac429eabd779ac6
MD5 8a27cbbdb5609a870f556eadb3e954c4
SHA1 9a0a3fec87ec596a0183cbac81ba19d94b9a0058
SHA512 b1a12a03efa3912fab23848f7149cb1a9bf4388356fc5a99d2a8bddb4b205c4cc39e99ab3bc1747a53eb5ddee9970d7f43df1dc4b24c4a7dd570870245326469
TLSH
T1BDC08CA3052188568BB09AEAA124370DE45B5D988CC0CCF1C009B0013038AA34000D76
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 156B
SHA256 6dd4284c1ce10fe206c370d1c59a70973ebd6147601cde8655153ebc380fe844
MD5 1497b5b0b8b2d29636950d41a8aa50ec
SHA1 ba2c320605a58ca2dda51b1f468fb6e9e111b5d7
SHA512 3057fde44d98aa8a973947d704c2c510d0071f8621d0d8e71d682980e2ebcad5917cbd86bfee2da2384d691475d4b61b815e021aedafbb1244d1dc10bed090be
TLSH
T186C08CA34421986A8EB0DAEA6124371EE40F96888CC0CCF1810880012078AA30401E76
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe59455c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt~RFe59455c.TMP
Size 165B
SHA256 a85e2002da3f9e1f459a3c7c3b3372a5e3c8be08cee629f491a8551d9aff2b17
MD5 ea85afff18dcf78b9404f97dc8eef26d
SHA1 be8560a5c1da537f2413a75fe01662618db5152a
SHA512 50781a563ef0e67af578d58d34e1e671960e0482efb81c10d192ab0635672074210f0fbeba9f310d7318213a14d761c8d4c54364666a7a64bd4eeb3051244d3a
TLSH
T1B4C08CB74532892E6BB1A8F56031350CF08B8C8CCCC0EDF58441F1C130B8AA2810AC26
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\IndexedDB\indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

default_cloud_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
Size 13KB
SHA256 f9e4da319fe1f5a7d497c452421f4648a24ec7588f309ebea0f0cd61a6251eef
MD5 256c40bace492c4e28451ce149d2f9ac
SHA1 b48b0eaf986b9efc91d5c8dd394dccb6d82e2adc
SHA512 33b38d1ced015798722180fc8c8ce6daedb18cd5d0e4b3db27d6176c13cf3ccb1bd79f2e68ca390d6eb43ac508c29067e8f1a3ee9f0167cabe37ebbddf6b0ec0
SSDEEP 384:l7BJeojewj9mg1IZyvASoIL5QJwTcoEnE0YU/VwTcoEnE0GU58:l7BJeojewjcg1IZyvASos5FEnE0YREnA
TLSH
T12452007AD2211C7719B8636858BC4692F524137F8281C81F78BC656C8F7FA79A089FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a201c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a201c.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 957de9d18deac53e492f62920f01f34248af553b70401b7ced9cd58247657cf4
MD5 c3e1bd54fc0fc0cfa6747daf6054ac21
SHA1 2ec1faca876ea004a5557fe70cfb101317e39c02
SHA512 03ba83521646eecc3dfbab29bd6a7625b301ab10507ac59ddc6e26d3ad85a5ff6ba9b391d8e9abc55de757e830f736a8cb551ed954882201e3135ad3f229385b
SSDEEP 3:MsEllllkEthXllkl2zEolKqlll:/M/xT02zDP/
TLSH
T1594404157FC50C47CD401031C435C3704770D4540F1157433C5574135CD554D0C40004
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 c8de15e84f23f23b8dfa06cf7f893f4a0ca423c4e6d6d2d328f5fe5c9953681a
MD5 ad8089b7847f3c0f7af18b08a6550dce
SHA1 78763ab11f76a5bf8bf2b65866346d62033b2362
SHA512 2f18e580bdb1fd9cb8dc1b155575a77727f193c3a5681cb7f73cefc228998bdcb6c874fcb47af60a8db38b05249caf0806c5ed5f6dac48a2d11222248c259e84
SSDEEP 768:Y23Sg2+LeSFOUxG/X4fouOToPvB2thtA9VAg6D184p/2F:Y23ysnnwthttbW+2F
TLSH
T1B8F2B0B1B8A99D63DCE9D384720AB3839EF0C12395D85F845EDDAB1D054779A070FC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 75ba7bc056ccc57e40a45f79d99c22d3723de1d8dc3f5015af5f1759dcdacda1
MD5 8ae98f06c2fe9010bb28f17057c1abbf
SHA1 40c5ed8b969189e0bd0d3e5dfb3012972b0f938d
SHA512 b44e3c5c2f8ae6576d319046e6ed3b6eaabc112a7832e6f28490f551fcff1b02f7d853d244fc0288d31d3e85d038e92c613f6b71c4b080078d9e39bc7080563c
SSDEEP 768:3rv+4UNbdH3Tk+LeSFOUxG2X4fouOToPvB2thtA9VAB6eVH1SlX:3bsbh3HsnnwthttMEH1Y
TLSH
T1E503CF72A4A88933DDE2D398710BB2536FF4811396D40FD49ADD1B4D068B99E430FD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 8913ffce70e94cd7712c92f910677b18aa98282260d61983f6dc475a978be548
MD5 dda65f0f466e083d9fbc69dfccf96dc2
SHA1 f3b57c6d0f9998e9fc22ad9e06c35363f7eadf4b
SHA512 8fe7b48c0220a1ef3064ee1db6e8a80e8156510dbb6494221cbf2f2886566bf224734ca80626f23f890761b3578c6f7481b2be067a785dac22e385d5fd72d586
SSDEEP 768:8rv+4UNbdl3SW2+LeSFOUxGyX4fouOToPvB2thtA9VAg6D184p/8:8bsbP33snnwthttbW+8
TLSH
T1EF03CF72B46CAD73DDEAD288B10BB2936FF4806345D40F949EDD6B5C058B5AA070FC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 f0cd57639827015f6c0ea41cd1b70dbc91ceb203c3005eac66853dd99ed4c4dc
MD5 630de040d71cad2a0e8cc8c08bca6b5b
SHA1 32b480a705b221a52ea86bceab66bfa21124b9ee
SHA512 e7573afbc258c99171ddc7e6d06dd64fb583f04d926a7b20b40b82834c228664b3b39dae728fbeb956ddc5e78314b3839f34bacb35dceb200e27376bbcdbbc52
SSDEEP 768:rN3mc2+LeSFOUxG/X4fouOToPvB2thtA9VAg6D184p/2F:rN3msnnwthttbW+2F
TLSH
T14AF2B0B2B8A99D63DCE9D384720AB3839EF0C02395D85F845EDDAB1D054779A070FC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 bbc78373f6da8af1ff3d62f9cfdfdcec6c08c162525bd6b4379b0c533c7a6bde
MD5 d2dda29e87719ed2ba7a48a30b19b4fa
SHA1 afea890ae7008474cc506d8e970a7989a6f43205
SHA512 6a835f6a5b671d94394f948eb0b5b19509d98327987f13322c3b1c77860e93c1399ab2792dd5cfdabe1e06491711bfb6abcfa605f4a3617c025cce9606657f6d
SSDEEP 768:QN3Xc2+LeSFOUxG/X4fouOToPvB2thtA9VAg6D184p/2F:QN3dsnnwthttbW+2F
TLSH
T169F2C0B2B8A99D63DCE9D384720AB3539EF0C02395D85F845EDDAB1D054779A070FC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 57b4e35aa5f6b1c9a3bb16b7f5125056c77409d83ca9cb47de010f5575264621
MD5 43a21d4a5bfe04da3e1217c8cffeae8d
SHA1 823637cdba3b681e355505c437d3658c958c01b0
SHA512 42f0356b52c25d9c04c4540e4c3bcae574fa540d2226d3d5ff03231f21ec591289734463a39aa39adc7b03702de2266c306bf044d093f5b76aea9b33ea2f94ab
SSDEEP 768:WFp03Mwg8w6+LeSFOUxOX4fouOToPvB2thtA9VArVG90B184p/pz:q03Bsnnwthttx1Q+pz
TLSH
T1671348F198CB993AD8ADA747633D6E125EBCC023B4A45954FBD84A0CCC126BFD30AC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 d5c3d1ffc3201ed1ce90d26a55e8f3e7d3c4589a0f24d340873b0e67733bc1b7
MD5 166ecbc781928609ef17e9ef5ef8f377
SHA1 c47a2da111e2f56ff4f70d8293b93ed7e58f7e49
SHA512 21b3d0da5e0460d30054b70a7918f46a0f47675a6ea2275981b14a5f044e464e4bcd120ea758740ee188124e9558d5b08db64063a382d172b84464b0a2e52a3a
SSDEEP 768:3F8R37wg886+LeSFOUxGAX4fouOToPvB2thtA9VAg6D184p/2F:uR3vsnnwthttbW+2F
TLSH
T1401359F258DB9877D8AD8347A33D6E429EBCC063B5945A807BD85A1CCC466BFC30AC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 9e686abe726c33e4c188df3af57ba11bdeb8e818fa023b6c7799b9aea3f3cca0
MD5 cd6411be82bae0142275691272c83c94
SHA1 d6d4a3af5453e605531e7c54167c470fc04b1439
SHA512 5fb1bbb8adf30af73cbfa424c1df3cf94c779f65a9b8084efb83c3142bea303f7a3140760d149b86d196cb1c454cb178259b5cb9e2b3fca7afead278e3d619e2
SSDEEP 768:grv+4UNbdH3LM+LeSFOUxmX4fouOToPvB2thtA9VAwmAeVH1SlX:gbsbh3gsnnwthtt1AEH1Y
TLSH
T1C603BF32A8A88933DDE6D398720B72533FF4916396D00FC499DD1B4D069B9DE470BD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 9a390c3a99cabd2fcf2d3ba0a0d92afac09513f36c6094898e7c91fcfdbd8989
MD5 599f14ca596da489b9b37391c1ffc405
SHA1 78e2dca06b1f161bacbf4517834f000bed7d413f
SHA512 12d3cfd5f24af0c340e76f20125e9795f21dca95ea63bc551fef526b4458c8dd6ed6c53496164114487c3bca14a936e73bb80c8558072adea00a200c23446111
SSDEEP 768:3FHI3Ewg81fe+LeSFOUxG/X4fouOToPvB2thtA9VAg6D184p/2F:ZI3IsnnwthttbW+2F
TLSH
T127F2AF72A899DD77ECAAD384B20A73539EF0806385D4AB90ABDD9F1C014769E030FC19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 46KB
SHA256 f8f5f9f7a555ae7c71be13e6ba451d4412ad1502cb2792d307837d58d378ddcc
MD5 dea8382a9efc3e932c2dfd467c1ebd7b
SHA1 7bc8c94536705bbeaefc0697936bb31d339ec63c
SHA512 66a67271d3a3560bf324c8e328370bc8d546c00da6335fedce61a226089c430c2d4d134f931347880569e566dbd0f3045336f12a113b9d569f967103d95048b9
SSDEEP 768:3Fp037wg8H6+LeSFOUxGVX4fouOToPvB2thtA9VAgHdKK7xjh+D184p/2F:r039snnwthttgwK7xN+W+2F
TLSH
T18223C1E95CD7883AD8AEA307633D6E6299BCC173F4A45A54F7854B0CCC2257FE70A805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 d7debaac806c4ea6be0b0caa72178097e04cc526eff39e30c4fb6380b7661203
MD5 6a106c912471d7b6519d229a6802ce18
SHA1 0079048c5673aba611b3465553b75bd8b5060a00
SHA512 60a73291d4510b2906902349599f4a5e9711bf95f69dd7971f762aa56d0437600d91ad87635eb19fb48f2f20bc4084aed716b20b88326c2369f6723156408e16
SSDEEP 768:DFp03Mwg8w6+LeSFOUxGVX4fouOToPvB2thtA9VAr2D184p/pz:/037snnwthttCW+pz
TLSH
T118135AF158DB9973D8ADD347A33D6E529EBCC063B4945A40BBD98A1CCC026BFC70A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

campaign_history

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history
Size 20KB
SHA256 e01b1f8cbdfd815bb31e08ae19224f2dd7e9ea73f9588058ae0f71f43e188f1f
MD5 24ee048fa67da022bcefdc18fe46977e
SHA1 029e1e2b3b681c3152a788e03a64bb2fdf695a22
SHA512 99f810c3018cfc6503c07afca44d63872ea79548dce4de8a037796bb7b53944d815f9a1f8f18c07b2cd1c9e62f92468e4f70026913497157867dabb3f73aaf19
SSDEEP 12:TLhu/JiEZXiDiIF8izX4fhhdWeci2oesJahvGFUxOUDaa1i3isKpyqzAXrdPzbdg:TLE/j0afDdWec9sJVUOiyHXveVTGVjy
TLSH
T16592EF21B9302427E5AB1FB5F8934CA00DFC02EF8DAB755099F00D910962AC27B950FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 bc37a8c0d1f141c7faf2b583d9cc57ba47fc7db0ed52d74e4ece640f1beda393
MD5 93bc4e5c774d12dfee4eae95d2d8061a
SHA1 5dc200cc058dd4de9cfd06c1705bff9693b3359b
SHA512 99cce4a7e83ee5b9720fce9478dfab5b0b3e883f7798e5e30e48530605e5f113d3eec0d3d45fa63b89e9a48d0b9ced2381799e9b2ce62ba5d011a793bc7d9201
TLSH
T1A4E00213534005EAC0680331008B1B202AD3913886B202465E2451680E233147E74B84
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 b1cc20aa0a27c54b0105bb0caa32a2915e75868cc28ebec17b792d412ffe6291
MD5 3efb56af3899c8fe4d0a65b418f53f47
SHA1 80895f42495f8eac5185b660ac71e9783c1a9808
SHA512 eded2e714f4c02eaae397a0fcc887b4b3a5e0d2d4d0470f3c7302e03fbd6f7a582fa94066508d51b348aa4d88e5c2a3781540b710b0544a3084f3904110fd155
TLSH
T1C2E00212534005F5C02C0331004B1B1029D2512845F101445E2051580D233102930F44
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5a3068.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5a3068.TMP
Size 392B
SHA256 ad5f4821c057bd227c3c2f13ae0b43a068cf5da1ce4386de130cb5f849c5248b
MD5 683b94f94a81a641d8768000b059270d
SHA1 fa7fb5de2034f12e03ba3d2c10ab2caeee18d565
SHA512 fb1a69937e3321be0cfff4b1b229ba8286f5da995b66c623beb06c65c85b74cfa4f19b067733326bb528e0146ff27c54d8cb6a82a511ddb1058768cdd07d6eb0
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 060e24176bc23dc38529aa765d9f694d69038ce362e16a9c42d3a98e10f4dc36
MD5 0518a80171e9b3c454585fdaa8ac3046
SHA1 dcfb4b7ed5abeade13a0e930ea3f5a22fa8780cd
SHA512 f13b6e332df42d26ee3d4378781fabdc674087df5e8f39e8591600fb7c0f69790d374d9bf2595a16630dc7d2e37ec66020b1a44300b575d351ba34bf9d18cc6e
SSDEEP 3:MsEllllkEthXllkl2zE9mbul:/M/xT02zGmO
TLSH
T1314402047BC00805C9402030803283510771D4210521A743285554125DC69810C50006
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 85B
SHA256 b26da4f8c7e283aa74386da0229d66af14a37986b8ca828e054fc932f68dd557
MD5 bc6142469cd7dadf107be9ad87ea4753
SHA1 72a9aa05003fab742b0e4dc4c5d9eda6b9f7565c
SHA512 47d1a67a16f5dc6d50556c5296e65918f0a2fcad0e8cee5795b100fe8cd89eaf5e1fd67691e8a57af3677883a5d8f104723b1901d11845b286474c8ac56f6182
TLSH
T1F2A0120384738407E4144051C45C1341287C84570119C0012068931304240CB039643A
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

365f38e6-bb57-4c55-9eaf-6c29ed2b1c82.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\365f38e6-bb57-4c55-9eaf-6c29ed2b1c82.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

6012606f-b02d-44e1-8727-e0711613a476.tmp

Path C:\Users\Admin\AppData\Local\Temp\6012606f-b02d-44e1-8727-e0711613a476.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir7068_1575582313\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z2602-x64.exe.crdownload

Path C:\Users\Admin\Downloads\7z2602-x64.exe.crdownload
Size 1.6MB
SHA256 6745fa76dc2ea031596d8678f6f6b99c3c1b435b4164a63485adbbc7b8d82ef0
MD5 0617e5373e5e311fcb4bee506e046359
SHA1 b563e139acab81cc7ddf358bec6cee1e6b8b2b17
SHA512 85389eaef377aa9fef3155d2e3375c1fff77fc10e39d9312cab229f202f3aff78f6e807460cf6b04bc2a32f72f7853afbf475cf0dce6232a40c0a6f8ddcbe4da
SSDEEP 49152:L6Cx0Yr+pwKQtSzhTnSwIC4xQlMIUoks8KkE3XB1:L6ChSwbm4wIvxQlPkN76XB1
TLSH
T10D753302D1A0817DCDCBC871D6EC9E23E132B10DDB605E6BD266CCCEBA21A119EDDD59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnlockALL_Password_123.rar.crdownload

Path C:\Users\Admin\Downloads\UnlockALL_Password_123.rar.crdownload
Size 14.9MB
SHA256 fdc5dd407bdb8012a373ef146c65c2103d701036c7adfbd0e2b48301aad58398
MD5 0bf202db560ab82848974da35282e334
SHA1 2ae3a318116337a21d5dfa4f5544955944bef8f5
SHA512 cc8cd1ca71b0cd61506b5fb063fb090d9655b96aec1564b5ade351185a81590bd71aeb6306547d0e1f2f8e06e14e9ef17201a50c4de61a4cd9fc5b5c228a3436
SSDEEP 393216:n3tb5PUgdN+eaKWBjRLwfdOrwy9h3mlNho5aIx:3tb5PhhWBVLwlOrl1mC
TLSH
T15BF633807D5D25ECE346599C1F123372AD75D4FE1A56E9323F27F9BAF604038A0908BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1716-2408-0x000002C15D7D0000-0x000002C15D974000-memory.dmp

Download

memory/1716-2415-0x000002C15D7D0000-0x000002C15D974000-memory.dmp

Download

memory/1716-2416-0x000002C15D7D0000-0x000002C15D974000-memory.dmp

Download

memory/1716-2395-0x000002C15D7D0000-0x000002C15D974000-memory.dmp

Download

memory/1716-2370-0x000002C15D7D0000-0x000002C15D974000-memory.dmp

Download

memory/6032-2440-0x000001E08E100000-0x000001E08E2A4000-memory.dmp

Download

memory/6032-2442-0x000001E08E100000-0x000001E08E2A4000-memory.dmp

Download