hxxps://slidechef[.]net/templates/free-interactive-family-feud-game-template/

Analysis

user interaction
yes
max time kernel
292s
max time network
294s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/09/2026, 16:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://slidechef.net/templates/free-interactive-family-feud-game-template/
Sample260905-txrydsvyex

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
501	3392	msedge.exe

Executes dropped EXE 1 IoCs

pid	Process
4704	Setup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3392	msedge.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	POWERPNT.EXE

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	POWERPNT.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134330992116583969"	msedge.exe

Modifies registry class 56 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	Setup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	Setup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Setup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg	Setup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Setup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 0100000000000000ffffffff	Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell	Setup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\NodeSlot = "5"	Setup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	Setup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Setup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	Setup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	Setup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	Setup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\NodeSlot = "4"	Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings	Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4	Setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Setup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell	Setup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	Setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{D33BE30B-9D77-42AE-8CF9-E42B204AA5F2}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	Setup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1 = 14002e80922b16d365937a46956b92703aca08af0000	Setup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	Setup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	Setup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0 = 6400310000000000ad5cb0aa10004f55544c4f4f7e3100004c0009000400efbead5cb0aaad5cb0aa2e000000dde601000000030000000000000000000000000000009c8ac6004f00750074006c006f006f006b002000460069006c0065007300000018000000	Setup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202	Setup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Setup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1	Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Setup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\MRUListEx = 00000000ffffffff	Setup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\MRUListEx = ffffffff	Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5	Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg	Setup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	Setup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\SniffedFolderType = "Documents"	Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	Setup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	Setup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	Setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\SniffedFolderType = "Documents"	Setup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0	Setup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	Setup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	Setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Setup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\MRUListEx = ffffffff	Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Setup.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2388	POWERPNT.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2388	msedge.exe
2388	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2388	POWERPNT.EXE
4704	Setup.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 21 IoCs

pid	Process
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe

Suspicious use of FindShellTrayWindow 55 IoCs

pid	Process
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
4704	Setup.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2388	POWERPNT.EXE
2388	POWERPNT.EXE
2388	POWERPNT.EXE
2388	POWERPNT.EXE
4704	Setup.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1072 wrote to memory of 3792	1072	msedge.exe	86
PID 1072 wrote to memory of 3392	1072	msedge.exe	87
PID 1072 wrote to memory of 5996	1072	msedge.exe	88
PID 1072 wrote to memory of 5996	1072	msedge.exe	88
PID 1072 wrote to memory of 5996	1072	msedge.exe	88
PID 1072 wrote to memory of 2816	1072	msedge.exe	89
PID 1072 wrote to memory of 2816	1072	msedge.exe	89
PID 1072 wrote to memory of 5240	1072	msedge.exe	90
PID 1072 wrote to memory of 5240	1072	msedge.exe	90
PID 1072 wrote to memory of 5240	1072	msedge.exe	90
PID 1072 wrote to memory of 6044	1072	msedge.exe	91
PID 1072 wrote to memory of 6044	1072	msedge.exe	91
PID 1072 wrote to memory of 6044	1072	msedge.exe	91
PID 1072 wrote to memory of 208	1072	msedge.exe	96
PID 1072 wrote to memory of 208	1072	msedge.exe	96
PID 1072 wrote to memory of 208	1072	msedge.exe	96
PID 1072 wrote to memory of 216	1072	msedge.exe	97
PID 1072 wrote to memory of 216	1072	msedge.exe	97
PID 1072 wrote to memory of 216	1072	msedge.exe	97
PID 1072 wrote to memory of 4760	1072	msedge.exe	98
PID 1072 wrote to memory of 4760	1072	msedge.exe	98
PID 1072 wrote to memory of 4760	1072	msedge.exe	98
PID 1072 wrote to memory of 1968	1072	msedge.exe	99
PID 1072 wrote to memory of 1968	1072	msedge.exe	99
PID 1072 wrote to memory of 1968	1072	msedge.exe	99
PID 1072 wrote to memory of 3660	1072	msedge.exe	100
PID 1072 wrote to memory of 3660	1072	msedge.exe	100
PID 1072 wrote to memory of 3660	1072	msedge.exe	100
PID 1072 wrote to memory of 3724	1072	msedge.exe	101
PID 1072 wrote to memory of 3724	1072	msedge.exe	101
PID 1072 wrote to memory of 3724	1072	msedge.exe	101
PID 1072 wrote to memory of 3248	1072	msedge.exe	102
PID 1072 wrote to memory of 3248	1072	msedge.exe	102
PID 1072 wrote to memory of 3248	1072	msedge.exe	102
PID 1072 wrote to memory of 5184	1072	msedge.exe	103
PID 1072 wrote to memory of 5184	1072	msedge.exe	103
PID 1072 wrote to memory of 5184	1072	msedge.exe	103
PID 1072 wrote to memory of 4384	1072	msedge.exe	104
PID 1072 wrote to memory of 4384	1072	msedge.exe	104
PID 1072 wrote to memory of 4368	1072	msedge.exe	105
PID 1072 wrote to memory of 4368	1072	msedge.exe	105
PID 1072 wrote to memory of 4368	1072	msedge.exe	105
PID 1072 wrote to memory of 64	1072	msedge.exe	106
PID 1072 wrote to memory of 6004	1072	msedge.exe	107
PID 1072 wrote to memory of 6004	1072	msedge.exe	107
PID 1072 wrote to memory of 1744	1072	msedge.exe	108
PID 1072 wrote to memory of 1744	1072	msedge.exe	108
PID 1072 wrote to memory of 5632	1072	msedge.exe	110
PID 1072 wrote to memory of 8	1072	msedge.exe	121
PID 1072 wrote to memory of 3340	1072	msedge.exe	122
PID 1072 wrote to memory of 5176	1072	msedge.exe	123
PID 1072 wrote to memory of 3316	1072	msedge.exe	132
PID 1072 wrote to memory of 3316	1072	msedge.exe	132
PID 1072 wrote to memory of 3316	1072	msedge.exe	132
PID 1072 wrote to memory of 1856	1072	msedge.exe	133
PID 1072 wrote to memory of 1856	1072	msedge.exe	133
PID 1072 wrote to memory of 1856	1072	msedge.exe	133
PID 1072 wrote to memory of 3020	1072	msedge.exe	134
PID 1072 wrote to memory of 3020	1072	msedge.exe	134
PID 1072 wrote to memory of 3020	1072	msedge.exe	134
PID 1072 wrote to memory of 3340	1072	msedge.exe	136
PID 1072 wrote to memory of 3340	1072	msedge.exe	136
PID 1072 wrote to memory of 2812	1072	msedge.exe	137
PID 1072 wrote to memory of 2812	1072	msedge.exe	137

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://slidechef.net/templates/free-interactive-family-feud-game-template/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x294,0x7ffc25c3c188,0x7ffc25c3c194,0x7ffc25c3c1a0
  2⤵
  PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1812,i,11391403905322219746,15539662885352809121,524288 --field-trial-handle=2232,i,971290056774696272,547551072839286848,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1684,i,14286444467508407674,9732959020267289352,262144 --field-trial-handle=2232,i,971290056774696272,547551072839286848,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:2
  2⤵
  PID:5996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2524,i,1123088051449517451,3924703828480243481,524288 --field-trial-handle=2232,i,971290056774696272,547551072839286848,262144 --variations-seed-version --mojo-platform-channel-handle=2496 /prefetch:8
  2⤵
  PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3476,i,2178190370948075647,2585760371930370370,2097152 --field-trial-handle=2232,i,971290056774696272,547551072839286848,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:5240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3484,i,14944162259072863354,10396858613070924389,2097152 --field-trial-handle=2232,i,971290056774696272,547551072839286848,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:6044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5200,i,5513524977375533282,14960179662567625896,2097152 --field-trial-handle=2232,i,971290056774696272,547551072839286848,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:1
  2⤵
  PID:208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4936,i,17684021299988849266,3218960062291927620,2097152 --field-trial-handle=2232,i,971290056774696272,547551072839286848,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:1
  2⤵
  PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4924,i,7009718751166013022,451864366471997984,2097152 --field-trial-handle=2232,i,971290056774696272,547551072839286848,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:1
  2⤵
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5332,i,18181620874951732539,9538819647481441476,2097152 --field-trial-handle=2232,i,971290056774696272,547551072839286848,262144 --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:1
  2⤵
  PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5512,i,12462628005758254419,13536515070632727053,2097152 --field-trial-handle=2232,i,971290056774696272,547551072839286848,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:1
  2⤵
  PID:3660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5560,i,14546158256040753326,16326432479951542104,2097152 --field-trial-handle=2232,i,971290056774696272,547551072839286848,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:3724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5720,i,843980593394725388,9868306541076421627,2097152 --field-trial-handle=2232,i,971290056774696272,547551072839286848,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:1
  2⤵
  PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6000,i,17131354400178353490,12669906614339692598,2097152 --field-trial-handle=2232,i,971290056774696272,547551072839286848,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:1
  2⤵
  PID:5184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6292,i,511882777510371543,4121920909108602545,524288 --field-trial-handle=2232,i,971290056774696272,547551072839286848,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:8
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6332,i,13809155951946293289,11767621773542479119,2097152 --field-trial-handle=2232,i,971290056774696272,547551072839286848,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:1
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6192,i,18186393278363188075,13029110123130592104,524288 --field-trial-handle=2232,i,971290056774696272,547551072839286848,262144 --variations-seed-version --mojo-platform-channel-handle=6776 /prefetch:8
  2⤵
  PID:64
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6728,i,8013868896561946435,10884227776083031539,524288 --field-trial-handle=2232,i,971290056774696272,547551072839286848,262144 --variations-seed-version --mojo-platform-channel-handle=6940 /prefetch:8
  2⤵
  PID:6004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6916,i,16280920938291002280,9636057950582270092,524288 --field-trial-handle=2232,i,971290056774696272,547551072839286848,262144 --variations-seed-version --mojo-platform-channel-handle=6944 /prefetch:8
  2⤵
  PID:1744
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7600,i,10248208715159202978,14409433813443559959,524288 --field-trial-handle=2232,i,971290056774696272,547551072839286848,262144 --variations-seed-version --mojo-platform-channel-handle=7616 /prefetch:8
  2⤵
  PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7600,i,10248208715159202978,14409433813443559959,524288 --field-trial-handle=2232,i,971290056774696272,547551072839286848,262144 --variations-seed-version --mojo-platform-channel-handle=7616 /prefetch:8
  2⤵
  PID:5632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7616,i,16319067780816134681,8162681396976836793,524288 --field-trial-handle=2232,i,971290056774696272,547551072839286848,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7612,i,15022537125650389115,10697295772163750767,524288 --field-trial-handle=2232,i,971290056774696272,547551072839286848,262144 --variations-seed-version --mojo-platform-channel-handle=7600 /prefetch:8
  2⤵
  PID:3340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,13185208992617501239,571817751149177502,524288 --field-trial-handle=2232,i,971290056774696272,547551072839286848,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:8
  2⤵
  PID:5176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6196,i,8548307007695113426,6095955190903221456,2097152 --field-trial-handle=2232,i,971290056774696272,547551072839286848,262144 --variations-seed-version --mojo-platform-channel-handle=2176 /prefetch:1
  2⤵
  PID:3316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6372,i,6984086113811807537,15022768876325483576,2097152 --field-trial-handle=2232,i,971290056774696272,547551072839286848,262144 --variations-seed-version --mojo-platform-channel-handle=7584 /prefetch:1
  2⤵
  PID:1856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6568,i,17223068009375637796,14093071690728507808,2097152 --field-trial-handle=2232,i,971290056774696272,547551072839286848,262144 --variations-seed-version --mojo-platform-channel-handle=6600 /prefetch:1
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5296,i,14510588749156842577,8383671413518652162,524288 --field-trial-handle=2232,i,971290056774696272,547551072839286848,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:8
  2⤵
  PID:3340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,2954489447834742180,14231142575824458565,524288 --field-trial-handle=2232,i,971290056774696272,547551072839286848,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:2812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=5956,i,263252790625997182,8971460905863860438,2097152 --field-trial-handle=2232,i,971290056774696272,547551072839286848,262144 --variations-seed-version --mojo-platform-channel-handle=7728 /prefetch:1
  2⤵
  PID:3760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=8104,i,8304063191297059432,5394305535509393961,2097152 --field-trial-handle=2232,i,971290056774696272,547551072839286848,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:1
  2⤵
  PID:2592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6624,i,18252093876279969834,15144851219444660313,524288 --field-trial-handle=2232,i,971290056774696272,547551072839286848,262144 --variations-seed-version --mojo-platform-channel-handle=6548 /prefetch:8
  2⤵
  PID:5812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7000,i,5099352540316622094,9026203543153177608,262144 --field-trial-handle=2232,i,971290056774696272,547551072839286848,262144 --variations-seed-version --mojo-platform-channel-handle=6668 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=6668,i,1071905039706336134,4690207845047590410,2097152 --field-trial-handle=2232,i,971290056774696272,547551072839286848,262144 --variations-seed-version --mojo-platform-channel-handle=7016 /prefetch:1
  2⤵
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=6464,i,4958384234964281917,7395234577330344469,2097152 --field-trial-handle=2232,i,971290056774696272,547551072839286848,262144 --variations-seed-version --mojo-platform-channel-handle=7224 /prefetch:1
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=6904,i,2060274169591125198,3802461544626293239,2097152 --field-trial-handle=2232,i,971290056774696272,547551072839286848,262144 --variations-seed-version --mojo-platform-channel-handle=8140 /prefetch:1
  2⤵
  PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=7772,i,11851392170846306426,11902617895012244119,2097152 --field-trial-handle=2232,i,971290056774696272,547551072839286848,262144 --variations-seed-version --mojo-platform-channel-handle=7056 /prefetch:1
  2⤵
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6464,i,13004902166536731636,14796797095141608761,524288 --field-trial-handle=2232,i,971290056774696272,547551072839286848,262144 --variations-seed-version --mojo-platform-channel-handle=760 /prefetch:8
  2⤵
  PID:1480
- C:\Users\Admin\Downloads\Setup.exe
  "C:\Users\Admin\Downloads\Setup.exe"
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6484,i,14888195967449985294,13763263209633462372,524288 --field-trial-handle=2232,i,971290056774696272,547551072839286848,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:8
  2⤵
  PID:1596

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5780

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5892

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3252

C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE
"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" "C:\Users\Admin\Downloads\SCF00340-Family-Feud-Template\Interactive Family Feud 1.pptx" /ou ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2388

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 7KB
SHA256 e65e8b81368fbde397f10db2ff1ed908513b631c6ba04c19b83ecd20f789b44d
MD5 5e3562a4c8d15db221de663ad0937f54
SHA1 8b05883d68f812d7fcd5cf12494e46d7b3812dae
SHA512 d702e3482906fddb6bd501e45bce7ac61264ad28df9288474ac39e20ace4d698b61c2310d70d5a3fc31f888cc30246e3e2af9d0c46924648201413c3e41cbd09
SSDEEP 192:jj9Tul49ss1OOfgBpeWnneeeCCCTTT444ZZZOAFh:jj9Tul49ss1OOfgBpeWnneeeCCCTTT43
TLSH
T1C4F16D4286D5CB9A8B0910FB4DA0675C41B83B0BEBDCD648138FDDDD704E4ABF4A5BA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 151B
SHA256 638fc7e45a745683ad16c83c4be835e65031503a39b5c456ce140c71d890910e
MD5 00a76bdd21b71faf50b8ecdd6027696f
SHA1 1e4e7650207c1941c05d1eda32fed3a6de831ad4
SHA512 263500319a5bd0ee03b7aa67af740ba8dfc0c9724a4ccff796526f04be4f699eccb58c2cd738fe74cb967c8096a9d5e6ac7d4ebc11dc1c72a2e721a58da4a4f2
TLSH
T1E3C08C7938DD681AEAA8287AA34AA0040FB042052022FC2642B8EE847A815A40A5A124
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 e618397791443791e42f457265acdf8e0eb2a9d653eb5cdb3746a39326ba98fd
MD5 8ba87c9bd78343a2d1dfe1b91a1a6bb5
SHA1 113466aeebab9164948b068c59b72558cb740dc7
SHA512 b7c2b5b1f320074df5f3f7f3105291589957fe58d5b3c4a82ac15b3d5c5cfe4cb25732f3628d9c663dc7cdcf15f6c286c9337e979d712c71bce6eca3b898c34f
TLSH
T177E022B6C822EC2708FD0769A0098B4AE70413172A508D5F3A3C820A8FB062A4AD5C5C
MD5 SHA1 SHA512 TLSH

Submit Download

f_0000b1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b1
Size 1.2MB
SHA256 16a17dfb49521ce03e61f93dd3624d8b5779975b17ba511fbc7da231d0f2112c
MD5 4468e57d8cd2a0028f416ec45c3b8994
SHA1 f77bc8317492e926aa22a370fdedf7de35b476fe
SHA512 bef87648158eade8fda5314237f1affc4c42f2a3f79bf1cbf1fdada3fe5204be47f4e0c65d1cc2544cca52d8f8db06fd27c1f62651b03a8e29ffd5c7388f96b3
SSDEEP 24576:FSLpJSClDm6D1byTxXZIIrSuQH0XAa0qM+iOeXSpxtkrGwuXVQSRSgUzu:wphlD11I04NQHIwqMFIxtkguYKu
TLSH
T13E45339BF50521BCC3E221C886A3B558F59BD7B044CE2269BEFF58640926E1F49CDE43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000f0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000f0
Size 256KB
SHA256 f3fdb11faee00508cfab853c284debb72a6054ce7a437005f271fdaa419c8c9a
MD5 be569398e0e595dd2f72e1bc4cb2e4c7
SHA1 a7a59eddb0ea2dacb98ff03113480327c1805c9c
SHA512 475d255ae27e373971a32efb3c28faaa9aba5e3b6790329c211e038d1258f84b826b88aed8c7451749a608dad9aa433b9454520314c20339fe6527872bb15f61
SSDEEP 6144:oxQsrSL1TgnPaBehiQ0tlOw49YjoCrT3:eQESLNMaBeGyS7
TLSH
T14644BDB4FBC3D782CB132BBDA43D3D374BA852C561D05A0744639D26A598B26E30727E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000f8

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000f8
Size 512KB
SHA256 9a55f5b4da42f0b12e14cf3b4959f2bf8c41b356577211d90f2df96e51d083c1
MD5 fe53ea7bc9881cd79475121c91c84dce
SHA1 e467d2c0195dc4c5252b9068db63dd4879dcfbf2
SHA512 1dd6b7c55c1702df3f10f88a4987a0a5618c2e3530062c0b201a7013f5481ab6950bc87b6ffdecab0e0d772042b904f7876aac5d3ef7ac6170adf5969da60031
SSDEEP 6144:yvzOResswwSQmWRPhkcIJd222iXCdBpKklPoxLyz2DIPjpAmZp2wkhAM:y7ORessbNRpudjcg/Ly68dfp2ww
TLSH
T172B412718BF0B7C5C9269972B2DE38CE5D2A1A2C5B0CDC1BF2618D25FCB954EE6406D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000f9

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000f9
Size 256KB
SHA256 ef389287b32b215ab2e1831b8baed478f94246cafb0528c444a34008bd45096d
MD5 538ab0e37d112423be3332008685b7d6
SHA1 77cc839d2d7aa136436cfc3fbc90da2cb8a76525
SHA512 ea4b975c6f315cd2a17ab34b10bc8cae93d3cd3a104302f5b9ccc3f6ebf4a900559487ba58bbd5f54d4ce87889aa99bedaf3986d3938a00838f80164273c7f01
SSDEEP 3072:MrD9ZU2i9owsDU/LCOmkbqQi8eEvf5VjmIFhdJV/vZN+mAQQEp4FTUqbWHfJx8an:MnsobbYxvfHjJFxVLx3tiTlbSfTUNG
TLSH
T1114402A9D6638341CF03BAB9B46E3C73CB700ACE76C0199686065D11BC617A5D32F92F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000fd

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000fd
Size 54KB
SHA256 84d81ea99a1d2cf747922bfebce840bfbb31fd5524eda8f52ea4afe5431cb316
MD5 8ccc6b59b69f167c85afc623606c414f
SHA1 1f2937ca52f906ec3b4e239bc0b74af7a60b1e80
SHA512 4bc5ea1260794a3374158e06fbfbfa3cbf51116432609b64dc2da52ba7164028933dff5985b9ebe753f6de98dbd37e2122d77ef450600b60201217d099bd0a53
SSDEEP 1536:cVRDef3FTysslo0izICNU3yoWCPtc8y25UaP:cVcf5Zs2ZCP68y25UaP
TLSH
T18D4302C526E857E85E2F14FD41D823123CE9039B57E60250C6C61CBCE7BE9A752F49A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000106

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000106
Size 205KB
SHA256 70b1ed0da2bca5145ca2a6c4bd60cecf692731345bbc7807fa6234251ea3dd2b
MD5 5eaa40b176611c9238277982e24d97b1
SHA1 c0fbd941d034a597a281d439a8f4d0ba0226307f
SHA512 32442d2fdb79835d59c45fb638298f84d5dbbda68ecb4cb8e522250901b8841924cc7c4082f1aaa0f8d4ddbfdc98f3f35cf2f6fab6a38c56dff091f18ba4373a
SSDEEP 6144:ZDTkNxJYNpNvQW42lWwaVe27uoyr7r37xS:dTixGHtt42l7acldnk
TLSH
T10324233100BA4A386F3C328E3521A952E09E1B3FD9952DF9B7694FD14EB972345F4E90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000108

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000108
Size 22KB
SHA256 b9543822bc4cbfaa078229a03407eefdb9ee7d867dec02737d33e8f34850f2a8
MD5 d52291ce78533eaefe8891ec582bd5b4
SHA1 fdaf566d46bade0bf299f9af529ef2cab1c3bc50
SHA512 3c281268d99f1c8adca5363a961b84adf1318f5108d0ae8ad2f863d86edeba0b1e3f5430fdb24cde590606250e295395d89c2b678dd83d88d56163274a2df934
SSDEEP 384:fbt6Nze5bKqadHsZbZxW99UMDGXkkj5KY5S8pQQtk4AXVME22GMU6ZAj:fbt6NzUbKqQ+1XkSG8pNtz2B22Zaj
TLSH
T1EAA2E1838342ABE1F99BFDFC85A5BF646BE956FFC21BC46AA1C49D8830401452BC0DC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00010a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00010a
Size 27KB
SHA256 5bfedb726ac94fe026358876df6628a93214d1772d07b63d3699395d5dc4fb73
MD5 0b2861673a244b6e29964334f90fe48f
SHA1 18dd6a00833f35266857592489cba968dcc6aeed
SHA512 b141df448ccce7456c7ae15fd3ab917d07b17d5e387bc1a08cd801fc73c6a116c52812c30c505cef0511f976b6a5efe21f7f0ff146766e0154c2576386481bfb
SSDEEP 768:1TIFAuAqzULW6dc7zzLLixoDVi2YmeADWZwM5TZ:1QApNsLt/EADpMdZ
TLSH
T107C2E195EECF8726352B6C2A231CD0547FBCFE61270F414B4B287C4422DC576B9B86A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00010b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00010b
Size 32KB
SHA256 1f55d2c7515414a94b3f4076fec8932e1e6a91d30231981c713c7edeb0495b3e
MD5 00aa3737f9c5617dfbdf8b2d48eb46c5
SHA1 85d5c8f29396ba5f81e098d8e93a2720d246033e
SHA512 5393672da5e231715cdfda318a2750b383cb9b3b56b693c8a63fc7a3f6eca6517cad15894d57e0f85dffebbdc27b00d7cc0074c8bd92431cb7b9879dc6eedca0
SSDEEP 768:E+MfZYZc3csz9Ia4n7G24AEo0A8MU4dXysTThetWp9l98/GCcp0CvnCxFQLI1VhY:E+MhYZc3nX47GKEotU4diXWp98tcumCu
TLSH
T133E2E1325BFC43D381E11F5D0CD689AA52515B74838CDAEB6A6E39C8730A64D720DF16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000110

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000110
Size 28KB
SHA256 26bb716ccd5d30bbe22abe4b85b56c88c75359277e2e89bca1b4e1e2940d6538
MD5 cb5b84c16726214835131fdd2e452083
SHA1 bfc4484e140884106223c9cc24b9b883ac399a68
SHA512 8ddd8acc782f3eddcd127d2c4ac9a50a49865c70e40ed7b869ab68607f96d58afb43453f056b859bb013c0d22a988f26664e996f68353a71dbcfbf5cc621e098
SSDEEP 768:Z/P/Rou0Aa9Jnif5M1iRTvdbAyRVSoftxkmB2Xs0Yu:ZWu0Aa9JnifCITvdJRYoftxkmB2cNu
TLSH
T164D2E14E033CF14DAA90627281D66ABF516BD3446392C35746CA11CFEC739359FAE2A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000123

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000123
Size 16KB
SHA256 c3654bcd538e93d7a79342ca840691a4d52df91ba3e12a83ada091f8008320e6
MD5 59351526d695908257ad76a511c4035e
SHA1 c8e04fc0b7ca5869f66d955c8e4946bd638ed2f3
SHA512 7a60399fb0eeb427e969e9bdf2755cf6562938f023c73daa3e501c6949d8c24144ef53b9b7d7a5855d4955a5b2df7187815e7c7f9c6c27e8e756b36497bdc56e
SSDEEP 384:DoFPPg5BDSDyD28+am1LDvNihgh40ugJW1+lOPLn+l8xa02gt:DoFKSDy6/fNVru4WkCLEga0x
TLSH
T14572D13DF605263CB852C9F9570743DD25A092200473B40CD96FBE8CEA417AB70BCA6C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 f0ae47124c92d01331b1e49ae3dab63efcd0d18942ee23262bb754d0046d16d5
MD5 62f69253de579d93ee8890f5ce97764e
SHA1 39a16d959f4c1101a6714e67ea6ec7a671d1f521
SHA512 2534fc3dba32daac4981108103b3f9de29b5f833529910a0705899d7ff415acd98366a5c4789389aa7a7554b038ad469bc122dc6b8f4d09cb3dd15d757a4870b
SSDEEP 48:Y68tSHZ/t11tljOqjCd8yrWblbBWVcCKFWENvXeEjsgM7Mptm2uXVoNBT9wzf9zx:YXwxOqjarWbacCRkgym2uXOL9wzWEH
TLSH
T127A14FBE06861D60EB157CF078DB3936B57EDAD4F65ADE42C089F53A5D1B38B0328144
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 69b2ff8d6fb60762ae90f696faf6d6ef5598db32fedfe69a8f73311255133225
MD5 79e6c41e24d29b6705177426b9a9e064
SHA1 12c47edc85f5b326690fe05b1ec4714703ce24db
SHA512 da16d2e516a1894a3e7c42ba93047e122c1af26fd67596f3e4ac88e32f2a36afef090395748633e549a027e30a50653b484c8baa28d8e01f65d1cf74d88a474e
SSDEEP 96:e1K0sOq3UNSUeLGwX11CBfPdWbzPC8J6+zrJ/mwM4wCa4im:e1K0/qkNsX0szq8jO+
TLSH
T1F4E1E7BE05D55A65EB15BCF1B8CA2A22317DCAD0F64ACF82C7C8F47A5D0B7878724204
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5903a0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5903a0.TMP
Size 3KB
SHA256 5415ee5f708c1c6e2f28d1644d31c61c1fa783cc42fdaff5acde5964d1a33c0d
MD5 6827aa8bc0547882c8aa036c863b1957
SHA1 71f9f707a16094b034e9d477df2620d673a158ab
SHA512 97a8edd88f04ba7b591e0e9cad975b155686273d773028ec20cca9507f7ba3b4ec19ee5c7bed2109886fad96319c3eca7154b352b2453d12b33e81dc03c893f1
TLSH
T1D7712A3E05016C60E7257CF5A8E37639B8BEC5C9FA1BDE54C50435375E1B35B4329288
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\000003.log
Size 32KB
SHA256 7f3789f87943fbf834ba6095868fc22060c6d5442529c49fc8c5f93a5f3c6b99
MD5 a009224622789d41e26455862c1d0595
SHA1 0df51468d80e6849a61244ac85158a501c558746
SHA512 5c4b0edcd652008fd20442b2f0682a7d6bfd5e1a3ba13d9c2e14883b10995458f1b64e39290f533abffc19371dc7e3106e395ad7e58a15847e2f1fe4b43654fc
SSDEEP 768:JuCRwFoV+yeyyJvvXdyamJpVpgibVcJ5+01877f7kMRBuIxz:6FLVydcr+QpIxz
TLSH
T1A1E27766B5F8120AF27B9EBBA8B617954C7ABE462D04CC5D5860610E4C71F80CD73F3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\LOG
Size 345B
SHA256 a22d17796ca85d4f98f6b257e601cf3059c935739a6d468025d97a6db94a63a8
MD5 4ea29996fdcf3a7b2a84faab70739ec5
SHA1 c2a8c0768669a552e1de10219c6acd775e865214
SHA512 0505522ead4bccafbab1b4a6ec832a8fc5b265b03beedd7fec5e7460d0476860c57ca54b376197a9b2bbcbcbbd7d2df87fd209f18db4eb099b9cd9e9bfdd86bb
TLSH
T121E0D8B888CAC56F611450D70535BF0D96E7770A978C7E864F5ED844B443044B86E6A1
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 18KB
SHA256 5dd4b01dc9f0c6b1dbc94a2c1873144fe035b6f95ef9beb9d53fa509dc2f6d67
MD5 eccc7c9c42bbac22310a61f6810e1512
SHA1 5f9d33877bfa9465f5de91a500875ff00287d445
SHA512 3510e2fb97529187d31f5cc89889960fc7278b8a551eac5346dd13a33fdd33a8c7afbbb3a9d5554edcf953ecdb16573cbca0e42e155685e2ba9e93741d8930e8
SSDEEP 384:D1gFukLWS0woD2e6IsJDeGJ/IGJpeFexRercaaiG/GVqd0XeN9MmNvBQazNVSrtw:MvkqBHPeKNjQs
TLSH
T1B882ADF2D3F4D66D8A1155F46A587E2BCE6D181602287C6ECCE4EE47B3E2472E10264F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 21KB
SHA256 20311f743d109a77472a8b5c32e856b2066127aa5bafd593cef26dc91aad950a
MD5 f8bb4d79810a6e388feead1ea5ec4596
SHA1 01f924ab42eebc873a6d9d28cc546f83ef9d194e
SHA512 48ba2f2509e0a98af59122ef300c10c7fbcfd30cd74f326047f538230d2b47e88120be4046ce7eab20580b52fc5682b49f0516d0aca2a0adc2f86e520842a435
SSDEEP 384:sxZynoIuPG/f4syeUzDq844QHbM5QzXEx5DXwO1:sUovG/feeUzDKHbMGELXx1
TLSH
T197A2E80665248977CDE7D619F925BF62E7F90023DD914E8CA6FCC91C04EA7FD221282B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 72b3dfe8e26873e2d56885c6588a67fcdee4e5971cf936168c803b854e80de41
MD5 fcae151f5575bf32071c513c25bfdf49
SHA1 a0fc2d20c1f5c8967b345040533caf656a9889b3
SHA512 47646ec473ccc52cc4f6a339df2789346e6f53f059644df196ecc7a1ff788ff27181512ebfd48fce2b2b3105e8412b47a4e6ec4e9a8401a9fa3043eb25e0cbca
SSDEEP 192:sxZlRzyMqZjK1Ml8MkG/f4ss0e3aZdaodpZrHW6+WN0yQ/YvOC+tPIgjnJ:sxZlIMG/f4ss0e3azb9Hb+/jxjJ
TLSH
T1F262D9166A3899778CDBD219F645BF53D7F91163A2904E44AAFC8A0C04E77EC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 1609a06c6eeddeb2260929998055a7a07ab3575690b7ad82394e2773c3ab92a0
MD5 2a24e6b067cb22d6406784eca74228bc
SHA1 3b2521b6bd80158095d65b448ca7a3d1914bd81c
SHA512 507066ddb358d2b1888fbcfc15a67789a49f9524dc5d8a750d7d83e8024d8bbe76aa78aa87002b7893c138d6155861c07dee1538beb944f88ac991cb3ae3c930
SSDEEP 384:sxZynLI1G/f4syeUzF1c4UQHbM5QzXEx5J:sULoG/feeUzFZHbMGER
TLSH
T1A592F8067534593B8DE7D219F905BB63E7F81163D9904E88A6FC8A1C18E7BED2203C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 fd2c6be08b45455a2bac26523e38b42c37ad88787495063747741dc5f011a753
MD5 5864c830e32889f7d982701ababc9afc
SHA1 1a40962d2d45deda4faa0ac1302f6939e083ea57
SHA512 633844632b5145de24cb4472730c3ce5c75eab6d55419b2c2f2b1e419e1e006b748ee64be2363aba611989362ad4ec442f9ef51cc6170fd40b7cc1ff5b55af78
SSDEEP 192:sxZ1RzyMqZjK1Ml8MWPG/f4syeUZdnhbR+kodp4IYgs3LHW6+WNYPtMtopHvbXYz:sxZ1IuPG/f4syeUznrs4HHbM5zXmx5J
TLSH
T16E82E8066934597B8DE7D219F945BF63E3F9106396904E48A6FCCA0C18E7BED2203C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 21KB
SHA256 7974a1edd0eb56d9d87309d0dbc9eab4a2ca881f5fc0dcf628b1252a5e24dc40
MD5 14064aad55f1565121cf7faebd31d777
SHA1 c2009b78d87af20fad1ba2b68227898c548e4ffb
SHA512 5fe424435709b6f5c5d2979435730b0b8a3f5fa493141f5013867371c49284b64abfc1ef4f63e0ec853dbc7417c6920c1df6d34c560162bc6d31760216c4e58d
SSDEEP 384:sxZyn9IqVG/f4syeUzTq844cHbM5Qz+/Yx5DXwO1:sU9PVG/feeUzTmHbMvYLXx1
TLSH
T145A2E70265208977CDE7D619F925BF62E7F91063DD914E8CA6FCC91C04EA7FD221282B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 ce3b8b1cbaca0dec2a1dec1503ef1d8fef87b364a7398d15fbf1d1f867e6aeb9
MD5 806c6a03fe3253f36aacda74ec97e01f
SHA1 a281259b4c29b81cc971c0da53174def311bef1c
SHA512 9f2a6bdea7a848820f25d4833f2bf96af8ab1631147f7404a01485c4a4d5cdcdb5c0d73b23a9f0cdb4fb7e2a4c939fa096570209834dcc51ff56a2668443ce0c
SSDEEP 192:sxZlRzyMqZjK1Ml8M9G/f4sye3aZdaodpZrHW6+WN0yQ/YvOuJJtPIg5DnJ:sxZlI1G/f4sye3azb9Hb+/0x5J
TLSH
T10162D9166A34997B8CDBD209F6457F53D7F91133A6905E44AAFC8A0C04E7BEC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 06e0d2164929472fc1e62336b3f29902d650c5d794414591de16ae6ad02ab1ce
MD5 0f1809baa631e615b119a0724f62ef37
SHA1 c88678ade7d7b0c8aa413b74c529ae290f28461a
SHA512 4623d8d468a634a0057c6d4d8f74a218ea7c83e125079584ced1d5178a0d61c260d3eac391d76aeabf9e1fc2eebb9f7e735dffd1dec9e73dfb02d1abb7cc1a03
SSDEEP 384:sxZyngIuPG/f4syeUzScs4HHbM5zXzx5J:sUgvG/feeUzS+HbMBzR
TLSH
T1F782F806A934593BDDE7D219F905BB63E7F8106399944E48A6FC8A0C04E7BED2203C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 21KB
SHA256 64392e5d46e2a2699274c4680cf7309d289d17e4a0e9e2cd0b0dd1a229578899
MD5 5a772f90f7e9c6ff484eb9d75287024f
SHA1 2caac6f94e8c21c726ba505a80998e088201be0d
SHA512 0b35c2385dd3527dd2c5c6a9b4049b4f8c1b0fac59c59e425f28d2294d145b7505b9a20b9e03ce6cbc4b852a06bb2f64faa0d0d27a0e5f19cb7b61d2acda11ee
SSDEEP 384:sxZynBIqVG/f4syeUzTq844cHbM5/b+/Mx5DXwO1:sUBPVG/feeUzTmHbMmMLXx1
TLSH
T1EAA2E70265208977CDE7D519F925BF62E7F91063DD904E4CAAFCC91C04EA7FD221282B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 d3ed28410c95bcdd49b775e999633ec95a9fd79e43121075d441a0e078c22041
MD5 f69e750b13c549c16996bde771106f07
SHA1 f3ce7bce220e59cf4ead817ef6423038f0d78324
SHA512 f942c9f08562a4828ba0e5eddd4688fc3995511e90fac2e939ef5f22ba5105f580b294d4c4e56e3adef92b0304627a7501a96a18e13b795a929ffee8b420600b
SSDEEP 768:ZYsv8Od/hWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVA0LlEe9NsQroIRLO:eY8Od/hWvFvmXu1ja10Lm2NuIq
TLSH
T19BD20B3B680CCB7E4F840D9DEC2A6F966DD801CB66984D5447FA884C03C77EB521B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\7b239a7a-a80e-48df-b2e1-c794eccfbe90\index-dir\the-real-index
Size 72B
SHA256 2627d266def596f0e375e5095f8f50f15958da24d4ba048f974485ec2e09ef31
MD5 b08b49172e07c1a8b6a1ec3a60ca6830
SHA1 d143dbe0d7d00be4ba8ff6b122af03dec5f50cf3
SHA512 49afe7bec639be469c5a0a33daf4ac2e681d6e901201797a0e13681c661c474f1f999af1d0cb3e5ff6f2451920ed2979afc5fac38103f24507c96259fea496b5
TLSH
T152A002E11280155AD8605A7113CD43B32BAD4D6751A1222EA2F061AB9899140D32A260
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a5d54.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\7b239a7a-a80e-48df-b2e1-c794eccfbe90\index-dir\the-real-index~RFe5a5d54.TMP
Size 48B
SHA256 7f77ccb3f2b9593cb481bdfdbce70374dc439f05ddfd4df56c27bc517ecac03a
MD5 62169e0ca5a2947472168c52a6d8e69c
SHA1 9957fdbd89f4cf518fd29bc0ea2a7b8e4e9f2fe6
SHA512 a71697e554d77b88d987362e4a46110416272f0a4c23e1da19ef22f6e5024eb75c46aea641025f3897828a0b157e94edcdb56acc4f6c821973d55d7c89576f4d
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\bc34455a-c0c0-4ad5-9d7c-df0e9e63825f\index-dir\the-real-index
Size 72B
SHA256 def3687e953ae402ca922d84e7bc59bc5ad912bed0d7a9038b24da57e21b1cb7
MD5 ee07fa475418f13c8ebce78e513600d9
SHA1 31284b94b4c62924283c695c0bf5d9eaf8374e84
SHA512 e36cf43a1daf8bae0a5cbdd59823f03b91de373dc486b42ca9507e4769ee261ee71c208fd3a7781d560d7682f4f53bca88600b20bde249dccbfd9f166674274e
TLSH
T17FA00224025C0041E44106B451421158B355DC19020D430749D754AA8C572ED8F111C4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c830d63b-5cfb-48b8-b278-1efadfc9a453\index-dir\the-real-index
Size 96B
SHA256 4663a208dce60c28f0f0cb9e5fcc4ff04137ece02190550c81501f578453cea1
MD5 53529c23a79269bae027de051b7b258d
SHA1 ee3f1f6f68111ab1972edc867da7304f980e309c
SHA512 308aa97e2558f688312906bf6e12c5ef107010ddbabf62a607598b3cafe99bfde4145312755b6d5f05c083e1b11480d187f4c6897882504413c242d140832cea
TLSH
T1A6B011A83202880BE00302B0A0E20230BB30C828838A230B23C020BBAA30B0BC202280
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a5d54.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c830d63b-5cfb-48b8-b278-1efadfc9a453\index-dir\the-real-index~RFe5a5d54.TMP
Size 48B
SHA256 701d045e44efa1979a14205bbf767ace41ef7841a7867cc57ffbb300ffd0d92d
MD5 5765ab4678e082827867ec940dd5d68d
SHA1 390df6201e4db866fce3667f80fdf472c41cccf8
SHA512 8ac0098b7527767e0a8f378965e21df213e3e57e72e875c497b0d68db0f7e255f8a288f0a0f0466b73250dac7698c99671063a71fe0211794cdca79863e1eb90
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\cdf12dee-6673-4e91-954c-23b338c514e6\index-dir\temp-index
Size 3KB
SHA256 bf47141d6a97efd92a78a8f95ea351c61e768a24b1cb11523b24f58b0ef22fb1
MD5 ba910c619ecedda3639faea85275d951
SHA1 30050304e7d54e032754ff8bcbca72cd1552dcfa
SHA512 c9e6b0f97cd00b21d43f32cbd0fc4fa924cdd64dde1a70f90e5a33dfea4c224775b293c982bd59140ade910db0c0a7594c7303aaa43f7ec85387eade1567cb49
TLSH
T1D851C70F0D670F6ACEAC123204B50849377869CC23A8291BD1FD8234F8C772C9CED6A9
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\cdf12dee-6673-4e91-954c-23b338c514e6\index-dir\the-real-index
Size 2KB
SHA256 65eb0a54679ab52d4c3ab1f6372a1c96c05f58056cf6f4f5ba5dddbe2cf40f50
MD5 39f6cf7102f89676937dfc8956814c17
SHA1 9e4ff4d170619fec3424cee4a4f0dda43c300821
SHA512 a44b24f17984e6f2027852313ba7aaf1bccb74277495eefc9c2b7da949e3d9743bec2ed9c339f11efcf59a125112b9ac3400c634f71c55bb81e6296db3fdc179
TLSH
T13951C68E4C118A6BCD9801B104B2649833B098CD2A1486238CFC673AAC5736D296F79C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe596855.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\cdf12dee-6673-4e91-954c-23b338c514e6\index-dir\the-real-index~RFe596855.TMP
Size 2KB
SHA256 c7137ff04f30af7844f2b1c8fdc257cc7365c83a8673853f79f6cc8ff6826057
MD5 820f9d5d4d0ec3798e21267f2e6b960f
SHA1 14f300f9206088f7fbc03b4575c594ba8acb4a83
SHA512 dac8bb8ee71d6feda80196a884d093d4013d387e0ac7cdad4782aed37b7362d5b62c2893f99f92f54a2d1df67a01713b83899d03baf9828655f7b449c0a70437
TLSH
T19851C88A4D42823FDC9404B3099264B4333A980097557F47B4FCA6366CD23AD3E4E3D4
MD5 SHA1 SHA512 TLSH

Submit Download

623cd082b6202da0_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\e6392b72-b563-46a0-851d-26cde0dbbb59\623cd082b6202da0_0
Size 76KB
SHA256 30ede4e6373e260480a8d67518aa21565965a161346dc4c935fc6cc35beb2336
MD5 1cebb4c2683868739efe91303df9fc4d
SHA1 8daf5db016d0e163fa9645467fba967f37e3bcec
SHA512 9e1708756f21a9d219b310b9d4bcef66c38e1d1363f7982b8676e4992ef65b7a44087c5ed53440f681a70bda9259f1db90b929325f47c53b7927c3d58bf1da8c
SSDEEP 1536:r6+c++HqsJs0wihp2VMGzGX7HVyOAcU9dP2CsXMoTrJl4sAXRsqHPwqYzGe/kV:rS+nKMVMGzK71yO4Z2dnsu1/kV
TLSH
T10F732BA77261B13647AC11D5541A7B00F22B07891448C5FCF1BDA6963B28E8F63B7FB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\e6392b72-b563-46a0-851d-26cde0dbbb59\index-dir\the-real-index
Size 72B
SHA256 01c6681419ef283df3849e73b06de6a3f4b03e33c61b48b6a37511ba9472cff5
MD5 3725667252c663a73f14e5c13a723e6d
SHA1 21ad47bb2d2cec1bbc348618d12489d9e81ebaf9
SHA512 049820364611ac332dbfab8585db3d387efc0e75d47a849031c34683f06bfce9bcd410c2243316dad2991e5dad7c3254178d56e339a3390f7014cd5d1d647acb
TLSH
T1DFA00260078A4101F15322F029921141F310DC600209132797F34198CD535C45D8155C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\e6392b72-b563-46a0-851d-26cde0dbbb59\index-dir\the-real-index
Size 72B
SHA256 235edb39c6b5e3682260bcc883be8933af3c2158146c7f793826f29f94262c9b
MD5 43dfc83e4d849199f4df6329f213cc27
SHA1 ebcfa560395c2226468d94c60af3b66d10b2f04c
SHA512 f1bda5ee8dbb90112ae3484127504d0afe87f05db34ea9e3dec0708c35b53bb800ebcd34b997fbebd5f5cdd00c62bae9f5ba4500e5a6b36f7db8c1d0ba3d5b3d
TLSH
T1C8A0021013C0C986D05712B29D6203437312D8907100234742D91048CC508505DD154E
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 519B
SHA256 d055871d01463158aa2f9d1cb531325139ed1d981035caf2d6975ea917bebab0
MD5 e7b0f0cb78dbf8da2131edd02acd8676
SHA1 8aaad0d1e1a121fbdaff9842f41d0bd280bde553
SHA512 63f48f342da89f0f7beae543fd745c72b79f5cdd64ebb3087a348d46344b3b365e8c7a2265ffca15ae7de3611d251e5aa6cb02b9219b828afef52855cdee175a
TLSH
T197F0E9F3BFF72850BD7F97D5103148A840167D54C844EE0F6417B28769B235A6059D77
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 619B
SHA256 6bdede360207d3663afb94dc24909f3bf32d1744f1dcada1e5c7e3c21188b45b
MD5 6f7f6f7e91fdcd1d687287bf38955ba7
SHA1 df505a22048a734caa6e327593b9fc7142f45c30
SHA512 6648cf99059060342e95ef4dfe6f8026aaa3beeef4390af8174030dbb70223c3eee7f651733b964317e7acae9c369b1887c39c2c54d527e86e57575a839734f9
TLSH
T120F022B3BFFB2950BCBBD7E6203008B845167854C840ED1F2456A68399B336920ADDB7
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 624B
SHA256 a82b791b1db7e1eddf8d35e42f97c5e8858ed6565856591670dc0417fd5fb8bc
MD5 497b141dccdb2d858b23d3c8862272dc
SHA1 225a36dfc935ab866cbe14cc5e63b229a7603cf1
SHA512 17e24e8a83986ce3f623359f01fbd12011aa6df3122644c2dc569e6393d350513c0f505d266a56ef2ecc19fee42b4f7663874979b7dcbf19cfa35695349abd36
TLSH
T1E5F022B3BFF72D50BDBB97D6203008B844257C54C840EE1F2812B28395B2359206DDB2
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 7ea301d4eb35cfe7a200ca336147bf94504b200c185b5b3c432733447acbae04
MD5 1e2c56d8f18b89b440ba5c807bdc6f9e
SHA1 f9968ea6ed99790cc9bf66a152af014f820bf3b3
SHA512 edf677429a6787cb97664d6ba32fbc923090ac43e68c724441173d5b4c06ede7a36bebfe8f34b49e794ec7ddff156320782188a2843d42abfd88e2e804e8aef3
TLSH
T18CA00215C9D594C5C40212F490E5169863118C9C160D621DA0ECD5758C911C042A6314
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59c133.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59c133.TMP
Size 48B
SHA256 64b9a5d88d17bc1924c985741a8cfaa7d181520a1b51f23c7c0f7089ac953310
MD5 f1dd54a13031d2093e6c5967e76ce16e
SHA1 cefcd9d9a66223c1517e847163069ada533ac72a
SHA512 328096c79889912b5071e96dca890d4ab938b0b1eff1de0e819e06ac837aeebfd3e3adc476c396d78d4862efc68b52d2ca4ad308adbc4739a5819b38e78b260a
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 c477ffe00c4f511a6af926f52c54309469e7fb38622866ed7edfebdc61d35b77
MD5 e61f0fbf8c4f5141a01ce14a84533f4d
SHA1 f37d1f800df9f5a1d48b7ef9e92569213ec71279
SHA512 a8b5b1ae402f70e45f8b2ee55d8e29bea5d439842da79899dd77e94285228b8080f5f33b2c4d0f3a07acb7de5d6e0d5cd9e3e06b63986ebd6423f691bddb0e9b
SSDEEP 384:0LppY93PBZJPtN53ATy3jJlZEdQ3bvV7RMrbAxzd5:0LppY93PBZJPtN53ATy3jJlZEdQ3bvVl
TLSH
T1FAB2695A703A0211393E2988B39696364F4235A37058E4EF7FB814A54F67E225CFDCED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 85cfd1c642348390ef5b9f03f912f911cb289361f21ac6481c0950d1a13f9b8c
MD5 84ad9b98e0fe4035479475bb79b6b2dc
SHA1 58187377e0c70ff5130a799396053a6bd89ae989
SHA512 0ecc3902ff31a14f2f8e24c890905e82d84faffd7b038dc594e730cd60942af821a2e87149e32837b9ee7478a4dcf28b3145af45756fe35e29c8e34e75a73ac5
SSDEEP 384:nKiFPZcITsNo8TUNTUlI4cTgckCrgxf2phiftGfFmmEEXIQ/4dWnjnVMA7O6R2Fr:BFHTdwgXkTfooGpENdwjnVMA7TRqF1
TLSH
T117C25B32E8A4DD77ADEB8BC9A75A3A03EEF44163898C99C8D9DC5D5D04871DD030BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 66973d0eda6e8540ac5b829f965ecb79aec3d7222dc0c49e70021ed4491bcb8d
MD5 046ccc779bfada712cc36acf2315d30f
SHA1 e5e675393bd74b8a8973c03daa4a6eadf79df8f5
SHA512 e422d717c8bf71c4a8a74cfc22cf7fc6a11ef07f7d0508d9b9796ab2fc7bfc6078ba0d6b930ca536b1fd970762eed148e88142ad0cf28602999fd5a6ceb7ea99
SSDEEP 384:npciF9CcmyWCAsNo8TUNTUlI4/QckCrde+phiftGfFmmEEXIQ/4dWnjnqMAXzwtc:pHFccpAdwgUk3goGpENdwjnqMAXD
TLSH
T109B22932E898DEA7ECE74B99E75A3943DEE04163898C99D8D9DC1D1D009B1DD430BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 75a60aaa7b9ade40e2f12adc7c437e917097a860d714b4a187fb391ffde3c7cc
MD5 b4b9583a8ff5346d40c99e3065f44d97
SHA1 8697b81fc10aff325ee3d2a84e39fe3c12b54f86
SHA512 d594c9d0b6b8b8629d6f46f2b2b6424051068f8c55e9f32a236371c58575ffb67d1d0955b5a4f4a1ea52bfb712c446c01f36ca50fb43ab4b797a6ec6e7a38996
SSDEEP 384:nKiF+ZcIOsNiK8TUNTUlI4fTgckCrzBCphiftGfFmmEEXIQ/4dWnjn2MA7O6R2Fr:BF8OTKwgAkmMoGpENdwjn2MA7TRqF1
TLSH
T15FE2C4F298D79977E8AE4B87A73D2D029AFCC013B5885984B7D85D1DCC861BFC30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 831277e8d8ff886964234680c90a7a189b93e6999e0a0e9412ecceb549556726
MD5 321e898f49a431875efda68916f8d477
SHA1 be30dcf8c9f378c98e2c29fce1c926c4f3bd8909
SHA512 d413ae64a16f1fe9f612d9cfac0a1bec00580b3a9fffdc8d8e955bd260f14502037d22d83835b384f49dceac7ddbd311a681463902813e4b4c3759ede0f3ad88
SSDEEP 768:pgFccps3twgbkUYBoGpENdwjnOMAI8p0KS:us3XwHOxI8p05
TLSH
T13DC25B32E898DEABECD74F99B74A3907DEE04223868C9AD8D9DC1D5D10971DD430B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 f41a6465621b58505366a622b13529d9fabbbfd49975fa6749508950dc12992f
MD5 a718046266ce1d8f5a8eaeed800df041
SHA1 7a96b344002cbf4da2697a67c66a2160225c9560
SHA512 fd4145e9f9046a868a1d559e1f2641d1e62cfb33f4c311350e73e97a7ea2229e959308eb2117f47e11851d19e539fb0d035f14521aebee781e8559d4cfcca1fd
SSDEEP 384:nhiFfZcIssNo8TUNTUlI4cQckCr0he+phiftGfFmmEEXIQ/4dWnjnqMA7O6R2FeQ:IF3sdwgrkigoGpENdwjnqMA7TRqF1
TLSH
T144C23B32E8A4DDB7ADEB8BC9A75A3A07EEF44163898C59C8D9DC5D5D00871DD030BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 df64669ee5f4c85ce6f9dbba576b6ad472bca81e0e97f559da954bb85d9e2262
MD5 833089f34439b12d31e72c3b4a1519bc
SHA1 8798805cefaf088430c256bb7dc36c2cc3c04c26
SHA512 78e7d144630df80205cb1d1c636ee619e2755ca6e61ab4b251390e1f92c87b4806c3c5fc9a7657f2a08878c84af536bdd20a458755fc0de89964321277c42870
SSDEEP 384:npciFfZcIssNo8TUNTUlI4cQckCr0he+phiftGfFmmEEXIQ/4dWnjnqMA7O6R2Fr:pHF3sdwgrkigoGpENdwjnqMA7TRqF1
TLSH
T102C23B32E8A4DDB7ADEB8BD9A75A3A07EEF44163898C59C4D9DC5D1D00871DD030BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 ca97defc9df55c0ea5f68b93200843bf782b9373945f3b3bf31c376d72707b1c
MD5 22a0e7f03c6a82ae263f565ce0475f23
SHA1 3b7d6b304d1ff870a1b82330e819eac1198cf1c8
SHA512 b57bbaefe09ceed849d8ab1e27409ae9a6e0d867eafc3cd4fb97bc58d6dfc7b9877f7608cc2bee47e369eaf450d29d33715d5754e4e69f163810e03ffffb6aee
SSDEEP 384:npciFiZcIWsNo8TUNTUlI4AQckCrde+phiftGfFmmEEXIQ/4dWnjnqMA7O6R2FeQ:pHFQWdwg3k3goGpENdwjnqMA7TRqF1
TLSH
T121C24B32E8A4DDB7ADEB8BD9A75A3A07EEF44163898C59C8D9DC5D1D00871DD030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 ad41f441d24a910bf38adbafc7a31d7548680f1de59791839e3c50a4a00928ea
MD5 99c42cc9bfb0f895954e91c583e6922a
SHA1 980b6ef8fa0cf77c40607dda2fc2cdaf62ae0436
SHA512 90e7cc5f943bd2c8ba5d5d5bf3c855fac0b8fd1732dcc8ed850810d19a64521aadb94b691948447f4e5759ab8fc95a901e535abc282ff5def31c712591d9ed90
SSDEEP 384:nKiFHZcIKsNiK8TUNTUlI4fTgckCrKvCphiftGfFmmEEXIQ/4dWnjn6MA7O6R2Fr:BFvKTKwgAkbMoGpENdwjn6MA7TRqF1
TLSH
T192E2D5F298D79977E8AE4B87A73D2D029AFCC013B5885984B7D85D1DCC861BFC30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 358d792d0f045b44922ea4fcd5ac6390218d8b084316dc882b6eb5dfd9fd38d0
MD5 5ebdeaaeafa77bf58ea8c10e161d2ae6
SHA1 0ea8e463d46cd46a4e81eecb55f9fe96030e6e54
SHA512 cee2ae10b2252d7f19e47a6f3d4a75a1ddbca9e5df5c735234edcc6762d8a0cf4733f64e08ebb7a4a43a7c0fe4c08b98a18dcf1767c67cea7002529d122d8776
SSDEEP 384:nKiFTZcI/sNiK8TUNTUlI4fTgckCrkBCphiftGfFmmEEXIQ/4dWnjnsMA7O6R2Fr:BFL/TKwgAkPMoGpENdwjnsMA7TRqF1
TLSH
T1EEE2D4F298D79977E8AE4B87A73D2D029AFCC013B5885984B7D85D1DCC861BFC30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 709288ad0d2d19d0f8fb5ad3d62818632e568f30c85eefccbb2c2ca30d044624
MD5 a9b379995fdbf5de9aa1c9c575e1b3ea
SHA1 78b5838d94eea550bc1c1237345a767995630dd3
SHA512 6e2308a3648ad17f70e8cac6c4f9b66e03ea0544c50d323afd29bb34bade2c39f50ee14174e6568a98d41e8c4b30dc0fd161d65f6afb26afb2ab2b2a70fa037b
SSDEEP 384:npBiF9CcmyWCs3sNK8TUNTUlIm2QckCr9lLKphiftGfFmmEEXIQ/4dWnj2jpde4a:poFccps3bwgbkU9koGpENdwj2nI8p0KS
TLSH
T191B25B36E858DEABEDE74F89B74E7A07DEE0122785DC5AD8DAD81D0D009319C430B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 b514e896157efd344a00cb6fd95dfe7eaa7a05d52a62dc135b3f84505b91cdd3
MD5 4343f7a4120ee5b42dd741c1d869740c
SHA1 c7298e65fa578f28f1ab53c4b08fb93cebec9698
SHA512 d1791271156c5ad59b484d1e2db8b722398de524d0fbbde8719581dff553923f8188046705eefa4b468506a0760adbf3e833256643719548d4c18c74750ccfe2
SSDEEP 384:nhiFPZcIssNo8TUNTUlI4cTgckCrggf2phiftGfFmmEEXIQ/4dWnjnRMA7O6R2Fr:IFHsdwgXkefooGpENdwjnRMA7TRqF1
TLSH
T137C24B32E8A4DDB7ADEB8BC9A75A3A07EEF44153898C9AC8D9DC5D5D008719D030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 1e0330842c3ec972bf853a646d8f9a845cdbd03803de25fbc206ecc261b86c23
MD5 7eb473066f647da7e722eb74bc45ba6e
SHA1 4f283e012694839c3ffbc54ac9bc0d8aea94878a
SHA512 8c983259609a2909aa608038775c84f346d3d0e74c9ec7e7ab12e726bdd4cf906e0157e44df15a7d831cbd4b818b27f5cc737cb7106578523d88206e918b29f0
TLSH
T1A0E00212630111BEC53C033411432B3057E2C4650BF603866E2042645C233002E71F9C
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 c8809c24ba761f36feb740c77e0dc6aba2b756da38589bfd93e96de23b9f7c6b
MD5 e40891882f0cb0a75c19f89857ab47e5
SHA1 8f17a620b85130037e761db0629cd3e838ebbb14
SHA512 3fc7c180a01786d432415c56b397c0133b8481d1b9d7ff657f30f1b412240030e2ce7ec74ddfa7cfb3919350dd310779640ea66e88ac0fd4e12e2ab1c99a9601
TLSH
T160E00127A30111BAC56C03345087276463F3C82607F74387AE108275AD133442F71F8C
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 e6937be8a73330678a3a0bd47cdedd912b0527fae0e5dc20e7d450e3f246b3b9
MD5 457b80a61f1cbc6f067d021568ce7092
SHA1 c1a72c402dc1ed8eda304a953138d213de6a4443
SHA512 540fed929e3817ed2c1f0755541a4f1f4edad4375093af27cda2014390ae3fb67648c588cd2fd5b841903be6eb9e3cc4e668b94830dca71f48fc1f005087789b
TLSH
T188E00126630111BEC53C03341083273062F2842507F703866D1042605C133002F71F98
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 dc963321e54459fae4b19d30f0e287c0cd1dab842690cf6c47c109a9a28d99be
MD5 b2d661bbfc74c28962eaf6fed7fcf458
SHA1 32801fa34f5b7e710c97e34bfe9ed6e0d62850b0
SHA512 a8716754b858a624662137259996718c72b265210c8cc726e4a77df7eb076aca7a6472da810a32bf1965aef90b45bacb3b1fe93dcd10911642f98d7fe0b03d59
TLSH
T153E00202A30101B9C13C03301103273046D2C4650AF50386591042546C132001E70F5C
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 6d60d5de9bc6f9fe76e2a2380c7495dd4e7af38973e7db124163dbddfb7a018f
MD5 518297c325e22243edddfd96b6cd200a
SHA1 ee317b877eb645db839d007ce3b56a07221194b9
SHA512 64303c90900869fe95c3d9c496be5a1b4a1b3c47ffed610c2fa1229253b2a73c57348c6186ef7d4ee953c1d92b7863d9298f1e0c4945f0492758af81ce86795e
TLSH
T17BE00401F3010175C13C03301143373057D1C4540DF503C7551043543C133001D70F0C
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe59799b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe59799b.TMP
Size 392B
SHA256 8c1cc1b7cc81975451ca215eb9e12c4056e4f7f0d38300e7568643628f37e53b
MD5 abc361cb20a045d70a687b309835d99f
SHA1 832783cc8b8353655545d1f234dd55f826cc892e
SHA512 4010f9006d2c5d0fd59980bee09604d9ab7af149ad68a0cad4abef79f83ede7397166be15ceeb535b5690780c65e1db487f575a6bd8b369eb23c22749aefe75f
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 94de33ea611fbb1f264830e7697a51da05fa98d797b9c143cf118017d47428b1
MD5 3747614ff4bc74d212ad242af051fe31
SHA1 edfe7ef331bf58cc4456d39f2616052e9a73b64a
SHA512 1ec09d2be760abdb6366b344b4452dbe13a5346ac772f434ca01bba332c80fd9019b1af360818ffaddeb87a1aaf95d2910b33d31d8a4359a855338bd6a7c0a85
TLSH
T1A9415D58A6F91108B3B7BF16ABF7586D487B7C772E4AC45D10010E4E0663B41C972737
MD5 SHA1 SHA512 TLSH

Submit Download

Setup.exe

Path C:\Users\Admin\Downloads\Setup.exe
Size 35.3MB
SHA256 6b645c510f7485bdd10b132751a54604d98c5bd01e847b7f6b3e669342c29eec
MD5 21656544ece64da2a50efb5eadde8c1e
SHA1 ca6bc9e008d952b48228dc90c11dc31aabcd234a
SHA512 f2f825b07684fddec5d42694256716e99c6c2f1ba985496bc200f043f39c27ca0d12649c0ea9fa0635c1b0d2fad91e3cd39f22efb4da554b066781e28aefa350
SSDEEP 786432:fY1XHftXNlNCxdpGIpPQXRUvoMo0h3248y4kkAWOQDrqykAq:8dNORBvoMo0vGxmyk
TLSH
T14387012AB3B69D1CC863BB3065A7631596B56808871BD3FF83131A656CB52F04F7A3D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2388-443-0x00007FFBFFCC0000-0x00007FFBFFCD0000-memory.dmp

Download

memory/2388-437-0x00007FFC01E70000-0x00007FFC01E80000-memory.dmp

Download

memory/2388-438-0x00007FFC01E70000-0x00007FFC01E80000-memory.dmp

Download

memory/2388-439-0x00007FFC01E70000-0x00007FFC01E80000-memory.dmp

Download

memory/2388-440-0x00007FFC01E70000-0x00007FFC01E80000-memory.dmp

Download

memory/2388-441-0x00007FFC01E70000-0x00007FFC01E80000-memory.dmp

Download

memory/2388-442-0x00007FFBFFCC0000-0x00007FFBFFCD0000-memory.dmp

Download

memory/5632-411-0x000002D0ED740000-0x000002D0EE740000-memory.dmp

Download