acrstealer | hxxps://switchromz[.]com/zelda-skyward-sword-hd-switch-rom/

Analysis

geolocation tags

asiadelhiinindia
user interaction
yes
max time kernel
206s
max time network
196s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/09/2026, 17:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://switchromz.com/zelda-skyward-sword-hd-switch-rom/
Sample260912-vmcamattcv

Score

10^/10

bootkit defense_evasion discovery execution acrstealer persistence ransomware spyware stealer

Malware Config

Extracted

Family

acrstealer

Version

4.3.8-alpha2

imap.brightloop.cc

Decoy

azureedge.net

Attributes

ddrs
app-api.clearflux.cc
guids
4d0bf37a-3180-4974-a873-a6ec4d4dc9f9
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36

xor.hex

Signatures

Family: ACR stealer,GrMsk
ACR stealer (aka GrMsk stealer) is an infostealer written in C++.
stealer acrstealer

Detects ACRStealer V4.x 6 IoCs

resource	yara_rule
behavioral1/memory/4932-1232-0x00000000005A0000-0x0000000000667000-memory.dmp	family_acrstealer_v3
behavioral1/memory/4932-1246-0x00000000005A0000-0x0000000000667000-memory.dmp	family_acrstealer_v3
behavioral1/memory/4932-1271-0x00000000005A0000-0x0000000000667000-memory.dmp	family_acrstealer_v3
behavioral1/memory/4932-1285-0x00000000005A0000-0x0000000000667000-memory.dmp	family_acrstealer_v3
behavioral1/memory/4932-1320-0x00000000005A0000-0x0000000000667000-memory.dmp	family_acrstealer_v3
behavioral1/memory/4932-1345-0x00000000005A0000-0x0000000000667000-memory.dmp	family_acrstealer_v3

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 4932 created 1300	4932	VectorCompi64.exe	83

Executes dropped EXE 2 IoCs

pid	Process
3632	EgpRZxI8e.exe
1000	VectorCompi64.exe

Indirect Command Execution 1 TTPs 1 IoCs

Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.

defense_evasion

Indirect Command Execution

T1202

pid	Process
4968	forfiles.exe

Loads dropped DLL 7 IoCs

pid	Process
3632	EgpRZxI8e.exe
3632	EgpRZxI8e.exe
3632	EgpRZxI8e.exe
3632	EgpRZxI8e.exe
3632	EgpRZxI8e.exe
4932	VectorCompi64.exe
2960	memu.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	VectorCompi64.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4932	VectorCompi64.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3632 set thread context of 4932	3632	EgpRZxI8e.exe	153
PID 3632 set thread context of 2960	3632	EgpRZxI8e.exe	158

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3032_2022864194\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3032_968030525\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3032_968030525\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3032_1278698631\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3032_1278698631\nav_config.json	msedge.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\Downloads\tmp-28052-cN0KuYWyClff\EgpRZxI8e.exe:Zone.Identifier	Setup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5620	cmd.exe
4964	cmd.exe
3736	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VectorCompi64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	memu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VectorCompi64.exe

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4832	msedge.exe
2008	msedge.exe
3344	chrome.exe

Checks SCSI registry key(s) 3 TTPs 9 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	Setup.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Setup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	Setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4057491610-3392471755-192832105-1000\{10B8AAF6-2257-4B8D-AC77-42D60252E13C}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	taskmgr.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings	taskmgr.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4057491610-3392471755-192832105-1000\{C492CDF0-B513-43EB-BAB2-C9961C737F3B}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings	msedge.exe

NTFS ADS 19 IoCs

description	ioc	Process
File created	C:\ProgramData\MSVS\vcruntime140_1.dll\:Zone.Identifier:$DATA	EgpRZxI8e.exe
File created	C:\Users\Admin\Downloads\tmp-28052-cN0KuYWyClff\sessiondef59.cfg:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\Downloads\tmp-28052-cN0KuYWyClff\msvcp_win.17q:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\Downloads\tmp-28052-cN0KuYWyClff\vcruntime140_1.bw:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\Downloads\tmp-28052-cN0KuYWyClff\mesh_base.map:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\Downloads\tmp-28052-cN0KuYWyClff\concrt140.2i:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\Downloads\tmp-28052-cN0KuYWyClff\EgpRZxI8e.exe:Zone.Identifier	Setup.exe
File created	C:\ProgramData\MSVS\concrt140.dll\:Zone.Identifier:$DATA	EgpRZxI8e.exe
File created	C:\ProgramData\MSVS\HeadTrackerLib.dll\:Zone.Identifier:$DATA	EgpRZxI8e.exe
File created	C:\ProgramData\MSVS\sessiondef59.cfg\:Zone.Identifier:$DATA	EgpRZxI8e.exe
File created	C:\Users\Admin\Downloads\tmp-28052-cN0KuYWyClff\msvcp140.ta:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\Downloads\tmp-28052-cN0KuYWyClff\ucrtbase.ynd:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\Downloads\tmp-28052-cN0KuYWyClff\HeadTrackerLib.lc0:Zone.Identifier	Setup.exe
File created	C:\ProgramData\MSVS\mesh_base.map\:Zone.Identifier:$DATA	EgpRZxI8e.exe
File created	C:\ProgramData\MSVS\msvcp140.dll\:Zone.Identifier:$DATA	EgpRZxI8e.exe
File created	C:\ProgramData\MSVS\vcruntime140.dll\:Zone.Identifier:$DATA	EgpRZxI8e.exe
File created	C:\Users\Admin\Downloads\tmp-28052-cN0KuYWyClff\vcruntime140.m0x:Zone.Identifier	Setup.exe
File created	C:\ProgramData\MSVS\msvcp_win.dll\:Zone.Identifier:$DATA	EgpRZxI8e.exe
File created	C:\ProgramData\MSVS\ucrtbase.dll\:Zone.Identifier:$DATA	EgpRZxI8e.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
1148	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
3632	EgpRZxI8e.exe
2324	taskmgr.exe
3632	EgpRZxI8e.exe
3632	EgpRZxI8e.exe
3632	EgpRZxI8e.exe
3632	EgpRZxI8e.exe
3632	EgpRZxI8e.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2324	taskmgr.exe

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
3632	EgpRZxI8e.exe
3632	EgpRZxI8e.exe
4932	VectorCompi64.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
4348	chrome.exe
4348	chrome.exe
4348	chrome.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	2324	taskmgr.exe
Token: SeSystemProfilePrivilege	2324	taskmgr.exe
Token: SeCreateGlobalPrivilege	2324	taskmgr.exe
Token: SeShutdownPrivilege	4348	chrome.exe
Token: SeCreatePagefilePrivilege	4348	chrome.exe
Token: SeShutdownPrivilege	4348	chrome.exe
Token: SeCreatePagefilePrivilege	4348	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
2324	taskmgr.exe
5848	Setup.exe
5848	Setup.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2488 wrote to memory of 5664	2488	msedge.exe	88
PID 2488 wrote to memory of 3060	2488	msedge.exe	90
PID 2488 wrote to memory of 4832	2488	msedge.exe	91
PID 2488 wrote to memory of 3060	2488	msedge.exe	90
PID 2488 wrote to memory of 3060	2488	msedge.exe	90
PID 2488 wrote to memory of 1508	2488	msedge.exe	92
PID 2488 wrote to memory of 1508	2488	msedge.exe	92
PID 2488 wrote to memory of 3428	2488	msedge.exe	93
PID 2488 wrote to memory of 5224	2488	msedge.exe	94
PID 2488 wrote to memory of 3428	2488	msedge.exe	93
PID 2488 wrote to memory of 3428	2488	msedge.exe	93
PID 2488 wrote to memory of 5224	2488	msedge.exe	94
PID 2488 wrote to memory of 5224	2488	msedge.exe	94
PID 2488 wrote to memory of 1820	2488	msedge.exe	95
PID 2488 wrote to memory of 1820	2488	msedge.exe	95
PID 2488 wrote to memory of 1820	2488	msedge.exe	95
PID 2488 wrote to memory of 2984	2488	msedge.exe	96
PID 2488 wrote to memory of 2984	2488	msedge.exe	96
PID 2488 wrote to memory of 2984	2488	msedge.exe	96
PID 2488 wrote to memory of 6024	2488	msedge.exe	98
PID 2488 wrote to memory of 5676	2488	msedge.exe	99
PID 2488 wrote to memory of 6024	2488	msedge.exe	98
PID 2488 wrote to memory of 5676	2488	msedge.exe	99
PID 2488 wrote to memory of 6112	2488	msedge.exe	101
PID 2488 wrote to memory of 3832	2488	msedge.exe	104
PID 2488 wrote to memory of 3832	2488	msedge.exe	104
PID 2488 wrote to memory of 3832	2488	msedge.exe	104
PID 2488 wrote to memory of 4128	2488	msedge.exe	105
PID 2488 wrote to memory of 4128	2488	msedge.exe	105
PID 2488 wrote to memory of 4128	2488	msedge.exe	105
PID 2488 wrote to memory of 5672	2488	msedge.exe	106
PID 2488 wrote to memory of 5672	2488	msedge.exe	106
PID 2488 wrote to memory of 5672	2488	msedge.exe	106
PID 2488 wrote to memory of 4964	2488	msedge.exe	107
PID 2488 wrote to memory of 4964	2488	msedge.exe	107
PID 2488 wrote to memory of 4964	2488	msedge.exe	107
PID 2488 wrote to memory of 5300	2488	msedge.exe	108
PID 2488 wrote to memory of 5300	2488	msedge.exe	108
PID 2488 wrote to memory of 5300	2488	msedge.exe	108
PID 2488 wrote to memory of 5884	2488	msedge.exe	109
PID 2488 wrote to memory of 4156	2488	msedge.exe	110
PID 2488 wrote to memory of 4872	2488	msedge.exe	111
PID 2488 wrote to memory of 5196	2488	msedge.exe	112
PID 2488 wrote to memory of 3452	2488	msedge.exe	113
PID 2488 wrote to memory of 5196	2488	msedge.exe	112
PID 2488 wrote to memory of 5196	2488	msedge.exe	112
PID 2488 wrote to memory of 3452	2488	msedge.exe	113
PID 2488 wrote to memory of 4760	2488	msedge.exe	115
PID 2488 wrote to memory of 4824	2488	msedge.exe	116
PID 2488 wrote to memory of 4824	2488	msedge.exe	116
PID 2488 wrote to memory of 4824	2488	msedge.exe	116
PID 2488 wrote to memory of 2112	2488	msedge.exe	117
PID 2488 wrote to memory of 2112	2488	msedge.exe	117
PID 2488 wrote to memory of 2112	2488	msedge.exe	117
PID 2488 wrote to memory of 2560	2488	msedge.exe	118
PID 2488 wrote to memory of 3032	2488	msedge.exe	120
PID 3032 wrote to memory of 3320	3032	msedge.exe	121
PID 3032 wrote to memory of 2008	3032	msedge.exe	122
PID 3032 wrote to memory of 4428	3032	msedge.exe	123
PID 3032 wrote to memory of 4428	3032	msedge.exe	123
PID 3032 wrote to memory of 4428	3032	msedge.exe	123
PID 3032 wrote to memory of 4644	3032	msedge.exe	124
PID 3032 wrote to memory of 4644	3032	msedge.exe	124
PID 3032 wrote to memory of 4896	3032	msedge.exe	127

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
PID:1300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://switchromz.com/zelda-skyward-sword-hd-switch-rom/
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffa1cecc188,0x7ffa1cecc194,0x7ffa1cecc1a0
    3⤵
    PID:5664
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1576,i,12689742763535853748,9952398139897024769,262144 --field-trial-handle=2244,i,12686321289438567239,8307993189478612825,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:2
    3⤵
    PID:3060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=1700,i,18189449963505802558,3653292416470626063,524288 --field-trial-handle=2244,i,12686321289438567239,8307993189478612825,262144 --variations-seed-version --mojo-platform-channel-handle=2740 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=2484,i,5894976816870658112,9782544214349532449,524288 --field-trial-handle=2244,i,12686321289438567239,8307993189478612825,262144 --variations-seed-version --mojo-platform-channel-handle=2636 /prefetch:13
    3⤵
    PID:1508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3512,i,16503823632472111398,8849007782497607035,2097152 --field-trial-handle=2244,i,12686321289438567239,8307993189478612825,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
    3⤵
    PID:3428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3524,i,5808418046231794222,9563627194329191612,2097152 --field-trial-handle=2244,i,12686321289438567239,8307993189478612825,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
    3⤵
    PID:5224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4292,i,17860955749049245371,6633675582378449837,2097152 --field-trial-handle=2244,i,12686321289438567239,8307993189478612825,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:9
    3⤵
    PID:1820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4252,i,5372026034057657842,884182609716064045,2097152 --field-trial-handle=2244,i,12686321289438567239,8307993189478612825,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:1
    3⤵
    PID:2984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=3764,i,16926108850864341387,61997663111423898,524288 --field-trial-handle=2244,i,12686321289438567239,8307993189478612825,262144 --variations-seed-version --mojo-platform-channel-handle=3768 /prefetch:14
    3⤵
    PID:6024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5388,i,13753775209556277709,4448925686333633102,524288 --field-trial-handle=2244,i,12686321289438567239,8307993189478612825,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:14
    3⤵
    PID:5676
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6068,i,6485328252579525150,8333134942178130796,524288 --field-trial-handle=2244,i,12686321289438567239,8307993189478612825,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:14
    3⤵
    PID:564
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6068,i,6485328252579525150,8333134942178130796,524288 --field-trial-handle=2244,i,12686321289438567239,8307993189478612825,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:14
    3⤵
    PID:6112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6304,i,1448263736933766409,4846947780472166953,2097152 --field-trial-handle=2244,i,12686321289438567239,8307993189478612825,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:1
    3⤵
    PID:3832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6524,i,12964099875376192353,13550965630976324048,2097152 --field-trial-handle=2244,i,12686321289438567239,8307993189478612825,262144 --variations-seed-version --mojo-platform-channel-handle=6564 /prefetch:1
    3⤵
    PID:4128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6484,i,10301782705889933160,3071633648589993533,2097152 --field-trial-handle=2244,i,12686321289438567239,8307993189478612825,262144 --variations-seed-version --mojo-platform-channel-handle=6740 /prefetch:1
    3⤵
    PID:5672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6752,i,5205747265964598813,14101363932610400212,2097152 --field-trial-handle=2244,i,12686321289438567239,8307993189478612825,262144 --variations-seed-version --mojo-platform-channel-handle=6772 /prefetch:1
    3⤵
    PID:4964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6520,i,12416642062747473383,16978922282801138951,2097152 --field-trial-handle=2244,i,12686321289438567239,8307993189478612825,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:1
    3⤵
    PID:5300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6708,i,14731060522150566835,5506779962141021312,524288 --field-trial-handle=2244,i,12686321289438567239,8307993189478612825,262144 --variations-seed-version --mojo-platform-channel-handle=5016 /prefetch:14
    3⤵
    PID:5884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=7144,i,10924680803201884502,4867751131324445696,524288 --field-trial-handle=2244,i,12686321289438567239,8307993189478612825,262144 --variations-seed-version --mojo-platform-channel-handle=3744 /prefetch:14
    3⤵
    PID:4156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6648,i,13735159631885689128,1443682866060076604,524288 --field-trial-handle=2244,i,12686321289438567239,8307993189478612825,262144 --variations-seed-version --mojo-platform-channel-handle=7232 /prefetch:14
    3⤵
    PID:4872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=7376,i,9974336663758592978,16637147640312282361,2097152 --field-trial-handle=2244,i,12686321289438567239,8307993189478612825,262144 --variations-seed-version --mojo-platform-channel-handle=7372 /prefetch:1
    3⤵
    PID:5196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6192,i,11911725382592735838,8522154768359065495,524288 --field-trial-handle=2244,i,12686321289438567239,8307993189478612825,262144 --variations-seed-version --mojo-platform-channel-handle=7224 /prefetch:14
    3⤵
    PID:3452
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=7792,i,731616977226284857,952511595904513845,524288 --field-trial-handle=2244,i,12686321289438567239,8307993189478612825,262144 --variations-seed-version --mojo-platform-channel-handle=7796 /prefetch:14
    3⤵
    PID:2512
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=7792,i,731616977226284857,952511595904513845,524288 --field-trial-handle=2244,i,12686321289438567239,8307993189478612825,262144 --variations-seed-version --mojo-platform-channel-handle=7796 /prefetch:14
    3⤵
    PID:4760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=2104,i,14645030714367816618,1495050276998095359,2097152 --field-trial-handle=2244,i,12686321289438567239,8307993189478612825,262144 --variations-seed-version --mojo-platform-channel-handle=7916 /prefetch:1
    3⤵
    PID:4824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7888,i,9400210176235852628,275691624161416512,2097152 --field-trial-handle=2244,i,12686321289438567239,8307993189478612825,262144 --variations-seed-version --mojo-platform-channel-handle=7908 /prefetch:1
    3⤵
    PID:2112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=8160,i,7619957842790095845,7230961000846795873,524288 --field-trial-handle=2244,i,12686321289438567239,8307993189478612825,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:14
    3⤵
    PID:2560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:3032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x268,0x26c,0x270,0x264,0x25c,0x7ffa1cecc188,0x7ffa1cecc194,0x7ffa1cecc1a0
      4⤵
      PID:3320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1856,i,14458920664832859590,15379022056850475113,524288 --field-trial-handle=2036,i,10911864079940454514,7878937226652979885,262144 --variations-seed-version --mojo-platform-channel-handle=2088 /prefetch:11
      4⤵
      System Time Discovery
      PID:2008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1684,i,12876957066157914250,16482578325801030184,262144 --field-trial-handle=2036,i,10911864079940454514,7878937226652979885,262144 --variations-seed-version --mojo-platform-channel-handle=2032 /prefetch:2
      4⤵
      PID:4428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2628,i,5424325200133910141,955230726706206550,524288 --field-trial-handle=2036,i,10911864079940454514,7878937226652979885,262144 --variations-seed-version --mojo-platform-channel-handle=2648 /prefetch:13
      4⤵
      PID:4644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4324,i,780732762771162712,14354121395393969877,524288 --field-trial-handle=2036,i,10911864079940454514,7878937226652979885,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:14
      4⤵
      PID:3176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4324,i,780732762771162712,14354121395393969877,524288 --field-trial-handle=2036,i,10911864079940454514,7878937226652979885,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:14
      4⤵
      PID:4896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4888,i,17463936615811476810,816440595754309327,524288 --field-trial-handle=2036,i,10911864079940454514,7878937226652979885,262144 --variations-seed-version --mojo-platform-channel-handle=4856 /prefetch:14
      4⤵
      PID:4444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4900,i,20268750263908055,5943730498828114371,524288 --field-trial-handle=2036,i,10911864079940454514,7878937226652979885,262144 --variations-seed-version --mojo-platform-channel-handle=4888 /prefetch:14
      4⤵
      PID:5804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4992,i,9458115190468918262,13202129945839877468,524288 --field-trial-handle=2036,i,10911864079940454514,7878937226652979885,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:14
      4⤵
      PID:3332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4888,i,10922502553025163334,11582293625317041035,524288 --field-trial-handle=2036,i,10911864079940454514,7878937226652979885,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:14
      4⤵
      PID:5688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5020,i,2514367129715082390,2577719884949434177,524288 --field-trial-handle=2036,i,10911864079940454514,7878937226652979885,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:14
      4⤵
      PID:2544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5040,i,4469695284979229138,15870472656928268660,524288 --field-trial-handle=2036,i,10911864079940454514,7878937226652979885,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:14
      4⤵
      PID:2020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5184,i,2808953977742087240,8935727942556363491,524288 --field-trial-handle=2036,i,10911864079940454514,7878937226652979885,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:14
      4⤵
      PID:4824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5188,i,4445964802255408912,17066746976406165594,524288 --field-trial-handle=2036,i,10911864079940454514,7878937226652979885,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:14
      4⤵
      PID:2304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5300,i,13158045110087315037,3266365530314278485,524288 --field-trial-handle=2036,i,10911864079940454514,7878937226652979885,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:14
      4⤵
      PID:1148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5284,i,16312348163415058338,1036707899089643647,524288 --field-trial-handle=2036,i,10911864079940454514,7878937226652979885,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:14
      4⤵
      PID:4964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,14609857977465339292,10642912578790796963,524288 --field-trial-handle=2036,i,10911864079940454514,7878937226652979885,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:14
      4⤵
      PID:5036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=812,i,13602241741994613659,6863223009282455040,524288 --field-trial-handle=2036,i,10911864079940454514,7878937226652979885,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:14
      4⤵
      PID:1856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5592,i,10049608848705097824,5197229693256797756,262144 --field-trial-handle=2036,i,10911864079940454514,7878937226652979885,262144 --variations-seed-version --mojo-platform-channel-handle=816 /prefetch:10
      4⤵
      PID:5196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4696,i,5129213696711665773,18322524362483407743,524288 --field-trial-handle=2036,i,10911864079940454514,7878937226652979885,262144 --variations-seed-version --mojo-platform-channel-handle=1084 /prefetch:14
      4⤵
      PID:4660
- C:\Users\Admin\Downloads\Legend_of_Zelda_Skyward_Sword_HD_NSP,_XC_Archive_get_2696\Setup.exe
  "C:\Users\Admin\Downloads\Legend_of_Zelda_Skyward_Sword_HD_NSP,_XC_Archive_get_2696\Setup.exe"
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Checks SCSI registry key(s)
  - Enumerates system info in registry
  - NTFS ADS
  - Suspicious use of SetWindowsHookEx
  PID:5848
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    - Executes a command shell one-liner
    PID:5620
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    - Executes a command shell one-liner
    PID:4964
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    - Executes a command shell one-liner
    PID:3736
- - C:\Windows\SYSTEM32\forfiles.exe
    forfiles.exe /p C:\Users\Admin\Downloads\tmp-28052-cN0KuYWyClff /m EgpRZxI8e.exe /c "cmd /c call @path"
    3⤵
    - Indirect Command Execution
    PID:4968
  - - C:\Windows\SYSTEM32\cmd.exe
      /c call "C:\Users\Admin\Downloads\tmp-28052-cN0KuYWyClff\EgpRZxI8e.exe"
      4⤵
      PID:3788
    - - C:\Users\Admin\Downloads\tmp-28052-cN0KuYWyClff\EgpRZxI8e.exe
        
        "C:\Users\Admin\Downloads\tmp-28052-cN0KuYWyClff\EgpRZxI8e.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        NTFS ADS
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        
        PID:3632
      - C:\Users\Admin\AppData\Local\Temp\VectorCompi64.exe
        
        C:\Users\Admin\AppData\Local\Temp\VectorCompi64.exe
        6⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Loads dropped DLL
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        
        PID:4932
      - C:\Users\Admin\AppData\Roaming\MSVS\memu.exe
        
        C:\Users\Admin\AppData\Roaming\MSVS\memu.exe
        6⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:2960
- C:\Windows\system32\taskmgr.exe
  "C:\Windows\system32\taskmgr.exe" /4
  2⤵
  - Checks SCSI registry key(s)
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:2324
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\RenPy\tokens\security_keys.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --no-default-browser-check
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  PID:4348
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffa34dbc728,0x7ffa34dbc734,0x7ffa34dbc740
    3⤵
    PID:6080
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1636,i,11620864276925390413,578015232252396801,262144 --field-trial-handle=2000,i,13906145608684552352,8334282988976503831,262144 --variations-seed-version --mojo-platform-channel-handle=2004 /prefetch:2
    3⤵
    PID:5432
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1892,i,10129874423189047791,10781765429499935420,524288 --field-trial-handle=2000,i,13906145608684552352,8334282988976503831,262144 --variations-seed-version --mojo-platform-channel-handle=2072 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3344
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2328,i,15887886545644026044,10735052779073680723,524288 --field-trial-handle=2000,i,13906145608684552352,8334282988976503831,262144 --variations-seed-version --mojo-platform-channel-handle=2400 /prefetch:13
    3⤵
    PID:4136
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3228,i,8587164886828956798,2287736381820578811,2097152 --field-trial-handle=2000,i,13906145608684552352,8334282988976503831,262144 --variations-seed-version --mojo-platform-channel-handle=3252 /prefetch:1
    3⤵
    PID:4804
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3232,i,2440707590687090053,13099638929491146967,2097152 --field-trial-handle=2000,i,13906145608684552352,8334282988976503831,262144 --variations-seed-version --mojo-platform-channel-handle=3272 /prefetch:1
    3⤵
    PID:548
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4488,i,91199897646884844,11492493862799455225,2097152 --field-trial-handle=2000,i,13906145608684552352,8334282988976503831,262144 --variations-seed-version --mojo-platform-channel-handle=4520 /prefetch:1
    3⤵
    PID:3488
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4772,i,14706271708273321191,15487946868164963754,524288 --field-trial-handle=2000,i,13906145608684552352,8334282988976503831,262144 --variations-seed-version --mojo-platform-channel-handle=4788 /prefetch:14
    3⤵
    PID:4304
- C:\Users\Admin\AppData\Local\Temp\VectorCompi64.exe
  "C:\Users\Admin\AppData\Local\Temp\VectorCompi64.exe"
  2⤵
  - Executes dropped EXE
  - Writes to the Master Boot Record (MBR)
  - System Location Discovery: System Language Discovery
  PID:1000

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1752

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5416

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5548

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4752

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5900

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2824

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Indirect Command Execution

T1202

Pre-OS Boot

T1542

Bootkit

T1542.003

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 8a0ad46fa3e2ac0b0848ca835e65522ab33edffd41370fa6d2d371102c3f9288
MD5 6d10d3c4e7278fd4ed81ca5d0c931e6b
SHA1 5e3c9dd7523d7ea84b9875081d24a3304e421aca
SHA512 3055cfa81f4a4487fdb7dfb59ce01cc63dca04218c760bef5ec5fd0a1a48ac8c6efc99279d303c901714535575f470ae0586a80b7618dbaf6a7196352a5358d3
SSDEEP 96:uC0d+6K6ujgRdfB7rsM6abCRDotok5bbDtB6RGyvLsTFZebQMUpv4a:uC0CvgFrp65DUDzzJVTFZeb3UF
TLSH
T1ADA1F931E0A9597B15F6D4C9B8816B03CF74617BB951AF84D9ED5E1C24B70BC1382623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 fe09a9e94fbd795d6fab442dc426ef79e7bd47dbd80086b003cb1cd34d18db58
MD5 4da51a25f1a6b822ac642c6eae6f9a72
SHA1 9d4f1d1e83270c8d54d24725cd3d7f406de5967d
SHA512 c027a48a18b3b282e84d69320ca44ca416bceb43057eee8fcf4b2647669c307720f00240e17a22310df0488100938fd8b34a0660ca73adaa5f0433a1657b325a
TLSH
T16CD02BBCB76CC476E40210744042050052617004AC1704D10F0562448984080804114E
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5086fa1490469214fe2ae35e3565b5da3028f9c2e984d75c2c02e36ec2c272d8
MD5 0f398018d8e5588b3bb1e19c23698eac
SHA1 e2086a177861cc702c7cf48c2184e29ba40ed7f5
SHA512 715b5c2f319a29a49ec5633c50c48d4ee002cd5bf070595faaa67538df45c1d58d17ff144ac14da22f07ee9af456a5629e77b1201b6dd9de8246b1f9bacf5a8c
TLSH
T10DD080589B7896F8F433303D41210501739C6655AD131556D9901B55CDE91C240E58FD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 dd16f3e19cd6476038fd2f811f76beab8c72ab7d967e8991ff8a4452075261c9
MD5 08fa96a2a7ce9da8b5f32ea5ad144f93
SHA1 eef1d804a1de20a0e59f56f668f8855fd31f91d4
SHA512 ae4219b4e1d5bb368b41f86ad52dbff7c6988b3a132b473b47bae7de694cb601b66b872980bb54bea8eec0f769a815edd7c123263a42fe44c3973a43444061c5
TLSH
T149D08C8CE798D9B8E81720B590164241B3DEA82CB8131A9B89D423959A9FA6250E50BE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 54a604899198f01e1a2f5ec52bac53679a6d2775840ba8c81ab97c59f718adf8
MD5 b266cfe7dc8e59a4693bec2c7307d768
SHA1 0ff4c63ce201552fd340f72d3376df63989a21f9
SHA512 6832b9d56510cdd21708734b256b052e90f313f920ebc959b4845a1a4fc17cfbfe75dfa04c5252540531ead21e0662a341763e79030c36867f2823312c51c0f9
TLSH
T1C1D02BB8B77CC476E40210784043050052517004581704D10F05A2448984080804014E
MD5 SHA1 SHA512 TLSH

Submit Download

875ce64b-98c9-4a7c-8899-627d4cf3f5a3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\875ce64b-98c9-4a7c-8899-627d4cf3f5a3.tmp
Size 23KB
SHA256 717c6cf79ad533ae457277b0ed80ce1204289b811fe64382a45e09b676b1bed0
MD5 7e45c40031d57bdfb0d1dee2d7eca069
SHA1 361f83f6d91c1ad6e915c9f53ae08c75a95ffed6
SHA512 b43c27b79789a03c6ae1d3b6ba7fa6421453926d01570a82544cc7839e9544299297fd76d70de7100c53430e6d80c1e4bb88a5ef0d628f2836aeff10c6213b4b
SSDEEP 384:64qajXwfCtgmcFfsO7nKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OV+a9mWRu1roO:6JajXKWgm0fsO7n8F1+UoAYDCx9Tuqh+
TLSH
T17FB2C93B640DCB7F5FD00AAD9C19AF976D9802CB96588D4047FE984C02C77EA921A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 155662b3477aae662ec7f019606317025b299f69e9de1c72d113772ddbed3115
MD5 4baa82bccbea3993b8ff5c0bb77389a1
SHA1 4986b00d51b5e74c13992501d8334884f82acfe4
SHA512 da2b9bc25d2c149a59f10fd7fb1d1b1d789b292bb3df32840d64eec736c332cba71ad890538b0c4c70d9bdc1266fdbecde545386b1f4135bb5402d35d86d2ad1
SSDEEP 192:K4yNYKc4zjHU+eU+uU++4Gz+/MopgOyNMJvtCGK07LqKjizqYfpYz/Be9SC3N6os:gNlJziz+te9Nk8GRqKehYz/BW6oKFUi
TLSH
T19A13293E3215AD95D3D688BD0C1B5B302BF8D07CC6C55E67423AF492A72132A0F5E46E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 9b1b3d84e5594e50351b953dd2602b56d7217f1780f37f13a6e82a5200a90953
MD5 d9608ec1d7cc2a543cb57c1a07676c6d
SHA1 749174be25de44d6b8bbc3cf830995dc68808ac4
SHA512 106f8a0f998163ae96ebd5b387539c59b34e5ec62c86816a3f642b53d02d23a5561fcd79ee6aae646baa7c8909bc644f975e6e1583b54fbb1a6846f595d6a564
SSDEEP 1536:ymL/NmvL/2bpXVZemhfnLMna4AtZPO/DIAQvR89GFUyx+gDyx3:ymL/YvL/8cmWa4MO/DIAQvR8DJ
TLSH
T1494460F70911A01ACBA842F5A2033E3DD27B405D7CD5F9E9E5788CD56825F21B6BCB88
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 c6e065fd0c971d0bcd20b3d4c98e0c36984e1794531489a3baee33cb556d3406
MD5 279f3aa0cbf48469189bba65d5365e02
SHA1 97e89eb830391cf50bf58011bc6e781c0d57c283
SHA512 9559bd18242c627f93f60ca6118a619e9074aaad407bbe18a8c6625f04fb3591e968deb21ba71e0399c0b09e1165272493f779bcc27641eac9a7b0df239784a9
SSDEEP 3072:Tv9G+0WrRtHvxYjNMjdpVtytQ5fouoUyhKfqr5LRD0y8I2p+:TQK4jNMBPtNZUQfq11Iy8I2p+
TLSH
T1B2256EDF8B682D92DF67DA7074D0C80B3D7021C3BA9DD0C36941C5A956C2BC17AE92AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 9c41a109b776870ba6c5b1cf3be47973cf161ea98fee5d0a8c3565be19e9ee7f
MD5 d8832953ca8c1eff44e49d5c14e1aff2
SHA1 72caab99a16270992bf2443a6d37cac8d4642485
SHA512 a29d9b4d17f4ea82cbd2b2f4c3f58bf7eaca9308b807064576331f984ad52ce1971ab5f12946389edd2b3bd0b11c63d7a9c8293bd77294c8226e5061f3b8daa0
SSDEEP 12288:8ZAzC6tU2Ga+HVjAEVb6XFpwYMXZARJezAwDdrkyVXhhdZ0SQNG8NDgBDspcXT03:KWH2ICUOPBn99nKj6K6yd1GL5LqLX
TLSH
T1C4167CEDC97858C3DD63AA30B4F0E9477C7413C3F955C1D28898C58402AB7C5BBAA76A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 2e92a83af11bd436902e235af8da65abf2cbdd295eb330789c630707a64cb043
MD5 3ec82eb0ef1c13aec69e79f01abb1b0a
SHA1 e2d32f3b7dffbe8a616923eb132c3836b0ca4dce
SHA512 00d8f9661dcc4bd06337545c329e3c2597000be78d9252962eb569e381fb53ff4188e57efefeac4c4e366ba885b5d3f74ecae09c4be4b2459fd1ca573dcca301
TLSH
T119715DE543968E47DF7C8032BFC13E8732FA32BC92CB2E9D2594D17A664271C4B241A4
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 342B
SHA256 39dfdec86949f152a1471442545245ac5f3372b56428a6f61dffac0a3ec159e7
MD5 829a3c6987490c82e6ba954662c1d61b
SHA1 3799630075c4e24b21e810bb5896dd5ecb96c9b5
SHA512 0fe38650c2f79854b11bb4f6564fa45639e74cf8e644f7913c55cc92ee0ebe58c20307360aa83432e6521c046c39ccf2d2e1098695cae563817d0f4af593e30a
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 319B
SHA256 70ea226b477aa714ab6206f436858623eeb202b889b3f8d466b99e11ed57f36a
MD5 74a6ff52731a89ef849baa8708ccf968
SHA1 8f25ffe67c8a98aa04ec10dcf588619b79cd99a5
SHA512 7ee4c593d245b0e334ffc469d96520631cb4a5f52da389899d1172603d4cd1fdd3d3f0acaf4e4a5ed8d0ac07497a80b4dd0353f1aed22a5b11ee113d5fcfbfc9
TLSH
T1F4E0264C44DCC2A9D7586A93C37C474C86E2350BB3CC3B02274E8C40A203A56E2C6296
MD5 SHA1 SHA512 TLSH

Submit Download

ExtensionActivityEdge

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ExtensionActivityEdge
Size 32KB
SHA256 475f12864892aa7b74be2630191c6d8f0223c403e99ba88c526ed36a19ab91bd
MD5 eec0746e532e1aa3315a9bcbaaec4a2e
SHA1 b3092a8c10c8f3ae716f6e3bc8beec6eccc0e4d4
SHA512 dbb680492930aaf08078604ab14d0d1e63853a735d0a896644c8eb4d4ed380aa94f0cc9f573a04a7abc1c06fa1ad335a082b07b9242e5b463f1c06605f0a2bbf
SSDEEP 24:TLlWK3iOvwxwwweePKmJIOAdQBVA/kjo/TJZwJ9OV3WOT/uReQQ:TWm+/9ZW943WOT/
TLSH
T156E24B2A5E7C7121CD667136AC2194665CB910DA977336F23EE000796F8228BC535CEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 28KB
SHA256 e0d96e3b5208a0309f6faa7f2343d949cfa0d9b3a6c190341e3c11d4a5d595fd
MD5 cf825372e51eb859a60cce5ae480dc46
SHA1 b7bd5064b50697f440b8a647fa7ad41c440b82a7
SHA512 579cf2ce3b333d906007c428548efbe42d2788f4120bbb252ceea8ea3dbedf145fdce5d5c9e112fa20df2ed557f42856962981957263936484fceffb690e7144
SSDEEP 192:3ay4bB1DmAvbpfSD8WGL+5SnWqvPUQzLAtLRQWY:qyO1DmAVfSD8ie34QZ
TLSH
T126D26C679A3C7651DB050F38742F4838DE3BA2AF5A860F5DB1624428ADBE55AF07807C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 224KB
SHA256 fcc77253836de2cfaa6029c8156e3b6fd771235297ec37c9fb5d314c9748a918
MD5 593c7c07dd388075739c34dd7481ac19
SHA1 261eeb887011e8aba240f3c763ed6b62ab978953
SHA512 8b283c68779f086aae6d62bf9a80dfc4f146487561b9ce10bc83a09262a6a76b0c3951e47d88b51f6efc154b48f174f44b17a982774d7ed1d6910b4d30b18e67
SSDEEP 384:SC1b2e4IkUI3ijVoWN3qL/78IUqOWfgVncA:92eV4i93qDL
TLSH
T13124936F6F343311CA6D813538EB55675D6DF06F8B531689387008A4DEE3796B02C4BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 9KB
SHA256 fa402b9e3599bfbff778fbe695b743b200f90880adb824d7c69aa9f883087e47
MD5 342b93504a02a9ce3141e34648bfffd7
SHA1 c2c6d6e0c6a67b542beab0712814264a2574e926
SHA512 6d5eded33166e5fba2817a85364676c6ba13ff0fd0699e3e7127039138a2057b89f2b001e4fbd1afacdab959ac2563de9eea499eb436aa3284922aa3cb60953e
SSDEEP 192:NJVMFJJ/YBn80/0RnX6jGgj4PPtzyvBKPE6Mjih8wbPvNQGEgjq6J54uXrrmDiRU:NJyFJJ/YBnZ/oXYRjwyZIEkOwbPeGnj8
TLSH
T18722C75AF7F30435A34760B80E91BEB4571A61BA0672FCB48714F84CE26939217775DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 334B
SHA256 a782f173f96d0455778c8665581e55daf14193ed1e02f18f26cef38ce35a1524
MD5 83f727b6e535df57648c3e7cf4963147
SHA1 e6419fdac89809d7b6a2855f7080a32992de5f59
SHA512 ded4f64a0a131bd549e98ca6fbc1ac988c99869737486b1f2a51edca30a39289d4fd384372f3c438b176836a308ff37c7fff9ebd5ac1e053f7e5c6e951ffa7fb
TLSH
T1A1E0DFA445DDC3AAA34A218B82286B0CD7A13617FBCC6B022B05AC40F281444E2C22E6
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 24KB
SHA256 269b5122fa0f3b9b3a848ac3aafe9bdf0a99f0df8d741540bafe4f58231846ee
MD5 a6ae190774fbbee14a14a12c3a3fa894
SHA1 d308dda8f0209489d71efe7f6f7da47a81280113
SHA512 10d572592ac47ac89db099b59f5d88b160091e642b39b66bcc9b7a7bf657a93dd0e4d29064d5af53d0043560ae6e67577bbc56a423ad511b529b01490c657419
SSDEEP 48:TWt/LopFMaty423w/a9NUuTkMDrwoSkb8oHPQTKrNRoRcJwKMNQKb+oHAwGKBB8:6DeMatha9KMDrXYTK8cmKMxfA+O
TLSH
T198B264CE2F343211C4F15B77DDD149263F7C101E9773718AA92560B2CE626ABB6058EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 c5690cb09b73032e093399c3d729d84a3b18e90f3dffd6e5cb627035a73fcf7b
MD5 5a1cb36f3a8bc28ea627201bc2f65a69
SHA1 0c93f6b428c275613dc3c977192a0d4d115d5536
SHA512 b7e6ecd4a1fd93dc4487b809ae998c9f4966ff1f3390a4593bed3b2b7951466e2ab664db13af111d373844dc8a8a44d5dad1ddb3267801ac301fc205fb8f33c2
SSDEEP 192:D7eumuwJ6/eKJ18TaJuJW1mjvP3l+4jhnYUG7I117Du33Ky9nPPVWmJ3BdsPMQQb:D7eumu86/eKJ10yuJW1mjvP3l+45YUGF
TLSH
T13D325DF3C3E4872DC81656F0AB147D17CE6D0925422D3D5AC9D5EF8BA3E24B2E24164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 11KB
SHA256 c735ae7201bd8393ad01f6cc26271171deb4facb743fe50835c625a29c9c3fdd
MD5 e79af5cd146c0c8319be44f26c32c647
SHA1 bf848900775297a27d8e852acd0ab557a4d585ff
SHA512 eb9c0aef54eafcf081bdb7f645cf7f4931cca6748d7ca1a225ac48b7a525de17db3a3af4d1b96b12ebb074d34b0ebe61a4f948646fb709a23ef7e7b921cfd2f8
SSDEEP 192:D7eumuwJ6/eKJ18TaJuJW1mjvrgiLjhnY17I117Du33Ky9nPPVWmJ3BdsPMQQPkT:D7eumu86/eKJ10yuJW1mjvrgiL5Y17IV
TLSH
T190326EF383E8872DC81656F0AB147D17CE6E0924522D3D5AC9D5EF8BA3E2072E24164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 bd9da76124968fb53dd90630ce621c1edeece6224332bb6afa6252b953066f39
MD5 5d87e0c7cfd6d4e3a51e04cfd08ded95
SHA1 365c21500ff4d7319598f0b84cc92b01950de19a
SHA512 cd4d188acd36a8a4dd1af91cb036651c09db00f7eb89f3376c6d9ffdfde7675a295e598c22e3458c2c403fa94821ecdad16f82d7cad1dda4e1f699f4a7a95679
TLSH
T1F631ADF3C3E8467D8A4151F87A142E1BCE2D0965532C3E5AC4D49F5F93F28B1E29099E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 4f7e8f0fc5882c4977286a8051171fd1bebfe3cf0a8686a0cfccd9d0391c0de6
MD5 b7ef78272ec9b34ed6302595aef3a2d8
SHA1 f2a4eec21c6d9eaf231cfccb1e2e38aa48407f28
SHA512 813982d72bb09c0e33f2cf959b7afcc0b6a26f712a3bb00d9ef2ee18a3b31034282c7e1901ee13a4bc40bc230a72ce7833f97171a4f6da8c905dd51d4109033a
TLSH
T113F05073C1AEF06F107855771EC07846A77AA830058264F4D555A63D70C00F76A1702B
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 66f56a70759672f6fdae1aef490470a0e7afff373b93e123b5a1a1849238405b
MD5 9ed3f3e59d3a72cac2ccea6d138ef28b
SHA1 12b53dad0fdc380cb39e241f10fa0a6b2b83b761
SHA512 7cb8f131dc5061c7bc4bd28f2cb35ac28a1cd795a1dfa174b91b523694c026aab3a3e37cf71717ce1a28e07d0254d676d31002602d2eef08c8186f9bc24b9b39
SSDEEP 192:sxR9RZbN/fOsGjMzoA8pP16/g6+WNYICZh/YU2C3RyG/IgDfJ:sxR9zN/fOsGj9g/5C/LF
TLSH
T13132A656AE28697F8CD7D21DBB65BF53D2FD1032A0912E48A7FC861C00E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 0ae7a1bdd38357be30f6f30bcae50bc332ae23dee9435366da9689a67043743d
MD5 2a209a740f7bb8a7d4be072bdf5758da
SHA1 297b5567518e64208e3dd1f33be6959340c24464
SHA512 ddc691999cbe0fd01bdbca93d360a6c65f3840e27d4c156da37731d53f149498bdb8f10d02b93ad865e2fa9853e4a965d69d8260ee9a4c61c594a8b92cab9783
SSDEEP 192:sxRCRZbN/fOszjMzoA8pPX/g6+WNJZh/YU2C3RyG/IgIJ:sxRCzN/fOszj9//5Z/Ls
TLSH
T188329516AE28A93F8CD7D21DBB65BF53D6FD1032A1912E48A7FC861C14E76DD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 9ee757b0540e6b4ccaafbcbff5710a3cc0914839d2cb293d2aca80fcf517f3e1
MD5 6849d876f9bdc7834276371631a4ad53
SHA1 839b13a9de24f438561d6ab1f6d16ac2c63d0aea
SHA512 d8b641897953ab6f54bbb7748b596cd56e38719ec87c01af2a06a9648f152f01a015978e42b8e6496b29f7f58acb212609496a14d7504d9889680e03adb00cc2
SSDEEP 192:sxR9RLON/fOs0WpVwPMzoA8pP12/g6+WNn58II8nZh/Y82mgGRvg/IgDfJ:sxR9AN/fOs0WvwP9s/55l/6F
TLSH
T122528456A934697B8CE7D21DFA25BF13E2FC207291D12E44A6FC8A1C10E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 5abc2cba0e4faf0f121fc10084e3816051f188ae1567eb29e3ad16b9b16ab4fe
MD5 809b0dc41cd6f9b71bdb0d8791201e49
SHA1 eb585863920b15a893a9196e07ead63172142665
SHA512 080f4b91193f92c4fd1d03da8d0789633957715c71960ba24c21b735e1e7da3bd7da7f0bde960facae3690c0276ab7ffab74dc5880dd0f3cb107e5addcec9051
SSDEEP 192:sxR9RZbN/fOsGAMzoA8pP12/g6+WNn5mICZh/YU2ChRyG/IgDfJ:sxR9zN/fOsGA9s/55k/pF
TLSH
T1AF32A556AA38697F8CD7D21DBA25BF13D2FD1072A1912E48A7FC861C14E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 a93d2f1421ff85fc343c77c982d8c266a81a3ca78d7103337437e40cf9cd8328
MD5 d5b80f50a854002d0979da6b72889888
SHA1 63a6967f4fac302e7ad48487a72ef7d0d991de96
SHA512 e41fec8b319835a10bd85d5432a4a1cf5fc56df155429d8a325a67573079e6cdb293d6fe60d5c1ccd98a66e814309206fdeb5eef29d14e2fb14d15bc7ce1f8ba
SSDEEP 192:sxR9RLON/fOsHWpVwMsMzoA8pP12/g6+WNn58II8nZh/Y82mgGRlG/IgDGJ:sxR9AN/fOsHWvwB9s/55l/+u
TLSH
T1F052A656A924697F8CE7D22DBA25BF13E2FD207290D15E44A7FC8A1C00E77DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 e448e8f15d94348a4006a26870a550fe4fd7934611403c71c707ad7f525a2066
MD5 9e2729e77b6ad7a7ab4ac69566de625c
SHA1 70664dd0bff82ef7db95c03fe0a538d8f9e03e13
SHA512 7cf06370c6e2e482c92cc96b85eb5c30a563fceddedfc24da567ecedfeb7ca3805a6259359441c6a08d329135673703077c7fd339bb5b149f6cc35714e25c05c
SSDEEP 384:64qajXwfCtgmcFf4O7nKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OV+a9mWRu1roa:6JajXKWgm0f4O7n8F1+UoAYDCx9TuqhK
TLSH
T1E5B2CA3F640DCB7F5FD00AAD9C19AE976D9802CB96588D4047FE984C02C77EA921A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 44918fb6b068e8456824419b28cc8f018c6ce629fbea779293f162ca10cde54d
MD5 8fcd21d27ce3df01ef8347537e982374
SHA1 e43bf9244ebaf3253de9e23686c86b46f8af65fb
SHA512 16ee79d697e85a46ea1db0fc79446f761effddf59e3d9e08efa4c5074d3b4e3ce10d4263ff7ee6680cba5b70a2db58534b48dbad09da4f8ac88ee73ffba43a8b
TLSH
T166E0261415C8C2BDA3963247C6248B0C82F5790BF3CC3F023F89CC80A242957F1E2190
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 184B
SHA256 0f19458b75bc37c6300d3bbd1676539e9053a5c2f802bd6f39d37d92769404c0
MD5 60f2769e5cca45ae8bc7d15325472b7c
SHA1 b35ef5aa9bcde7ae03ff3083d5e30c7f2a2ba838
SHA512 af661b1b64a92a07c77160b68ea90fdc6687192fb7b76aba0c953a378da3eb8c1de6c56bf88aac740e46c90b1d2bffc1968511bb19499efee43d8b9cab653d73
TLSH
T179C08C71BF806416CF0D2E330D95EB687386D20302439667CA6E9E104FC32EA1E055F9
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 fe32d07b894f2b7c49aa356a43017ae6723d2c8e7f309fd12eae0649c285e5cb
MD5 5cf9676698d343a00443dc124c12665f
SHA1 2942b8f53b4389b2afd82ed156f74520ff8c33e8
SHA512 bf599cb361839863057bda365794e05aeee9c2e98bfef82753394ac185a953da07dc830482d6d245e2a94a2b57a103f1f1db23bdc5f1833398ffecd5913c5d88
TLSH
T141E0DF3416CDC76AE39931CB9235E70C82A3B913F7DC6B222B099C80B306964B2C3290
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 33a541c1fcd7ed33d2fd6a6c66755c800982a5f7b3b85daa9ff83068ff1fdeaa
MD5 8fa1e4ca519560b76b67ac0c2bdc0a5e
SHA1 54b0dc58c8e3c623caaee35af14dbd7010957356
SHA512 2816bab896e4098035c83167a5dade7ec4a2907e6773e6bb3add3d9eae2fdbc0932c888246097a2577dcb7402b3473fc77955ba2f44932fe8dda34f81ca0960f
TLSH
T123E0DFB445C8C7F9934071828374AF0C82A17D0BB3CC3B4257089C94E201511B3AA5A8
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 ae1b50cf9918633fdd200e16774e4be405e1a5a4ff4c76636f3c6832e7b5f68a
MD5 6f81f99146fdb162f44176c9a1e90563
SHA1 c16c949830557f3f8dcede0aa2ea469fa4843b4a
SHA512 4cf0db1227d8ab2131332ea070f7ee52283a8307520cc441e38b16852ac9a30ecdf72b5886b4642085828d01f088533cde1ef3557708def734692d050a028ba0
SSDEEP 24:KFfITETIDKfh61iSmFryXSpa1k5IfK1hi1ySgDfytyoYIxKmhw1SSHwtyXuJ2W:KM4IDK560nyBKIfKziU7TIxKQw0zyK
TLSH
T10D911DD0317A4200397D394982D4D7AB6A4235633039EB2B7BEE61A19E27E491DFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 c6d4c8f4fa6f13eff32e949e1242a5217e931355ff2c661c9eb2f1f88399b12f
MD5 98aaa0a1aa082ccc64235ca4087bc492
SHA1 b4fe1016b6c0d89468aa01be8b3832f32b69517a
SHA512 bbe1eb80d0354516304bacf42d909a796346f77c36a2c0fbdc3d25f7cb2eabac0add67cece39f87c0234b433eff44bfd300a4b299cf2df867c60b812af8c130f
SSDEEP 384:DNrRZyCSDnxTICrpMEhIKyll7svbFKfk7:xFZJSDnieOyI1l7svbF9
TLSH
T16F44840A7B747001EDE6DD725CB080771E3CB16D8F22A6916DA254694DB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cb94ae02-6418-4d8b-8f74-11cc755d4bd0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\cb94ae02-6418-4d8b-8f74-11cc755d4bd0.tmp
Size 414B
SHA256 64abe68f82759bc8fbcd8a6dec1fca34affbc941346f7180ac258796628434bb
MD5 c2ecb42f4e181d7bd8fd9f4c35316150
SHA1 4ee05a75ec84122d08e4034e60d8ff2322d10005
SHA512 b59918197f78e04741f00552c3fcb1055f5d79dd9d8929076cfb479aae50215d0ccf643269ac5c593a0944fc73402eb2227d835123c174955db069c66a487460
TLSH
T189E02BAACD21EC2708FE176851658A4AE754135B2E804D4F3E3C821D8FF1A374589C5C
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 14KB
SHA256 db901f0b7301a92706044514571a63fd5c29cd95e9fa1519666a488ccaf91566
MD5 4249bc775269213abee7594dbafb801b
SHA1 2c7ed29993a149facc48d40e4ba313bacac77fcc
SHA512 ca9c466159bdcf6263d4337a1dd1e53c92b4792def7e33554ab352a2f565f4ccdac3765fcd85a2048c81caca58630c9f1ae238f46eba33400e43d343bfae12a7
SSDEEP 192:YQrIII6b6MIME1YcY94IOUpAsGl9qPrsgJ8ekele5XeAZ1:YQrIII6b6MIMiB/UKskWspekekXeW
TLSH
T12562956B26051B33E0AF1F3E1A7286405BF8DCC10966126D7152380F9DF7BA386D62F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 319B
SHA256 4c99e9796337f2eaf8a6011d6f9fb521aef4c03294e1768f1806c7ca32e59601
MD5 a64455ec7b1b013bb80ca68e8f84df26
SHA1 1023fe88485b55d731297e9900af5e12c63f8679
SHA512 9f1cb686b865934969562553bd79d3a272fe81449a5cfec97fe8ba2897b1dd26510922c225575f05aa7f27532f0dc6ed30decc02d6852acae7ef918650128608
TLSH
T110E02614A8C8C2AEE36421CF41344B88C282BA03FBCC2B065F03CC44E303502F6CB591
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 34e09e3acb7b0d6f0b477042d8766b1aa1a19bfe35fb5dd0a9e24f643b3471a0
MD5 8afa7843d7107d85624b95526299d03f
SHA1 7ccc3ed8abc3d1f85593032bc6db57d219711e02
SHA512 3b3fbf0492023b5c84ddc6dfdc8b480544b7508ee9dd995efeeea394a58b4950eede74126e64f75bbb980dfd87d20a6c8fee0f4e6434efcca6b780d803fd7a5e
TLSH
T1E1210455F320C519E14D863A607E8B351338E8578FBCED0F44B921396EB2B191D4B2E6
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 337B
SHA256 a3d5452271e48fbb15f96271b8c006adecbd031778425ddc4d111288ca4198df
MD5 286bbf644f0f0d61f38f4ff55d2ce50f
SHA1 c93db55d432fd5a7d9519a9c768e288a47bf54c3
SHA512 168d5a461081f66b3af5acec07e53d711cf98abfba1f084ebfce84de29002df98947ece372a9145c5c4785c0fa24a40a603c8a90f2b14d2c27a175ec7d7a01ad
TLSH
T17AE02654A8C8C3EFD36021CB41749B888292B943FBCC2F022F03CC44E702942F6DB191
MD5 SHA1 SHA512 TLSH

Submit Download

b9e0babb-7459-4f29-bf79-0a276e7e6370.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\b9e0babb-7459-4f29-bf79-0a276e7e6370.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 64d2e3f7215fc46339522114f784ff97f039c7ef69e9de4f15745cd412cceec9
MD5 2ad777526e4f644df2dc8d33cad9000b
SHA1 134148cfcab65d963bf3bbb637219ac4a6bdeddb
SHA512 f21470fb4f7fe0abf928f6a732adc05bcd0cbb16105fd0b5515966506027eba3518deab94437d9e6e83193744fcfa9206af5da68a2fe6c8152dce569c45807eb
SSDEEP 3:MsEllllkEthXllkl2zEelRfr:/M/xT02zN5r
TLSH
T1CF44040C7FC41455C514543041D3C37003F0DC344D1357C3345144135CC7F400C01014
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 b59471cb35085fb98823903bcbeab2c778b85aac647c0a7a655abf8060091446
MD5 57377d53f01197bf2e0852ebd82b5327
SHA1 9efbd57f22e449f72760aee1479e9b0eb5dae51d
SHA512 001cd789a3895fbde63d56a359a34c5052c41ee0ab327c6f4868d0565f7331c47b2d71ebf05f69d29555c6b1e178d4cea0ed6b173f91e17d6d31db867d253e11
SSDEEP 3:MsEllllkEthXllkl2zEelWll:/M/xT02zNW/
TLSH
T17544040C7FC41445C5345C344513C3500370DC10551157C73451C4135CC77410C50004
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 66500f3dd5c781430469bb4f1329d4ee43ae3fcda72d4c745564a4d7d01551f0
MD5 bccc974d3818fa4594f69cf3212ebe43
SHA1 06cd2b4996cb6b78357dfca25acc1187dedc2251
SHA512 d4fc904675c373138d81c88e01a54c160437cf25943d621b842085ce440aeb7bae6b7242db742b05c2f50df871313ea11a1522cd36122cfb3c1a5c351e5be5c1
SSDEEP 768:n/UxvxjgC+73hMtKXaiE57Y0GZxJsXBdK8Zg17VaaBjO:aZj3+73U70/JsXf7u17VaaBjO
TLSH
T1E703C031E8A06D779DF6D790370A3387EEB44AB3C5C54E6489ED6F0D058B6AD130781A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 a2ec58bc41618a6e5e3f110f2e7373ddab8c889677b1f77a301f316975187e5b
MD5 278e2986109a4c59050ea607f17604b2
SHA1 508fc3a13cfd3920cf4fc759f7cd0597374a1f11
SHA512 d4b395c54bd188ac3caadc7d8f1f7b7be823ef96714ed8a71e5a8d4f465c17fe3a18729d85eb331efcfb8f59a71a90412a9fa71967748e5ee9069f53c2d064df
SSDEEP 768:/J3vZKXaiE57Y0GZxJsXBdK8ZY89ge17VaaB+74HY:/J3d70/JsXf7Kle17VaaB+7IY
TLSH
T15C037C3C9CA19D3E89BEF740360E2666ADA80277D5B44D58C7E99B0DC073969F71380A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 4eaadf84042fc75d9d3b933accc510ad7627ac8459713beaba49423d38e22e90
MD5 b5ebd7313878765ac6e31657543d028c
SHA1 a35ecd8f063dcd1d5f9f4b02094f63b330ed5dc4
SHA512 89b7157331d395f68577fd3d06539f73e7cfb7665d4d50894e4aa19c6848872db52e26155d0271044de589ddb7ba1b9f5344c629b4125dacf1d335a0063958c2
SSDEEP 768:A/UxvxjgC+I3l7KXyE57Y0GZxJsXBdK8lISHUPpMs:tZj3+I3E70/JsXf7aSfs
TLSH
T1E103C034E8A09D775DF7939037097397EEF446B3C5C54EA48AED6B0D028B2AD030395A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 4145a72d61eaf61857589db75969e863e76504ed1325e6095db1c5dcae3fb906
MD5 940b2f03786007e6065658acdaa38036
SHA1 adb81b03001a8082343e6e83bcf924b528de5f55
SHA512 36f8b43c1eb410a1be2134f51b8b50a9dac37d792ea4aaeb77d3825eca4c08db080e885781b144d41c5c2f6ea1eac5abc35aa45e34274889d568919675eb66ef
SSDEEP 768:rJ3gZKXahE57Y0GZxJsXBdK8yU17VaaBk74HI:rJ3r70/JsXf7317VaaBk7II
TLSH
T1A0F2BF30E8A18E779DBAD7D03A0A3383BEB416B3C5C94E54D9E99B0D04475AE171781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 60KB
SHA256 4880c6af4bdfcfb8eae493ffbc633a82f8b5d51578fb874d0ceeef0862b4b79c
MD5 12f0de5b7c6b0ee703b4390f379c1695
SHA1 11232cf4f3fce2f46d91f2e1d51e5f3456874a79
SHA512 f9762e75231568f26cb6954211b68c9569d5d279a63b4e13f5425eb2511adf694a00aa651cd1d810b9647c83864dbf77f9668d73ab0625b48d30a0ea0385eee2
SSDEEP 1536:fJ3s70/JsXf7W8dKJzTvjmhizQA7B7VaaBk7II:fZsIJszjuzmkz9DfGN
TLSH
T1FD535AF59CD3893AD8AEA787273D2E0699FCC167B5944994F7944E0DCC924BFD302811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 e828203b62eded8a5ce124e04e9165785fa2f9adc4af8feb3f6e74fc87daf1ab
MD5 b5964b7a50a8971ee3669da84d7bf03d
SHA1 6bd627c972e4c1c20b80a83817f3a3b4f17c7252
SHA512 3f5676f7187dc349a4bded80cfdd009362691937cce7cdb9030ee4e55e574a4aa7a8f1a7113dba589e97463ab3c34d920ac1bb6388d9c964393d7c60a343b25a
SSDEEP 768:wJ3gf8d5E57Y0GZxJsXBdK8yTD/Qwdd507VaaBk74HI:wJ3i70/JsXf7qzQA707VaaBk7II
TLSH
T110039E35DCA18E7B88BEF7C0360E3656ADF45673D6980E58D7ED5B0D00639ADA30381A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 4040469010c358bc0d6108d9268e06c11285df27295165490d1b3b638f76d275
MD5 67e06a80dd5a5a6fa792184a28ce635d
SHA1 fb9f768d0f3900366ec82f25a4c5daf40a7473b5
SHA512 91874c15d4272de4b55d50c2a9fb91cd165b4e603309084d63738134bc52fb84f549fbfc94aa81eb1943dc8169b4607c6413f158cef3cf6b0d870808864e5765
SSDEEP 768:PG31bTZKXaiE57Y0GZxJsXBdK8Zg17VaaB+74HY:PG3370/JsXf7u17VaaB+7IY
TLSH
T1E5F2BF30E8E19E779DB6D7D03A063343BEB446B3C6C94E54D9EDAB0D01975AE130381A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

campaign_history

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history
Size 20KB
SHA256 b0925fd7a11e469e4101aa1609bac931457f9606b2550c3d3f7a48fbda4e7b25
MD5 8ce7f8e40119daee0e8e27ae21f412b2
SHA1 ab530f2383d30b29f3863081ca1d1ba215c94651
SHA512 074c34ff2bcae1d4e060b37a5b0fc033f127b8e0701bb8a5dd83b6d1cb83d45a20a32b00dff4a08837879eeec0199b96028fdee1d729a93876b41ac723ec7200
SSDEEP 12:TL6KeJiEZXiDiIF8izX4fhhdWeci2oesJahvGFUxOUDaa1i3isnJazbd6mQQtud8:TL6Rj0afDdWec9sJVUOspe1jy
TLSH
T1D79224276D352033E8EE4B36BC8349900EFD135E89A779549DD849220D71BC2A2856FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 ba2db2a941038a4b861b52a846c2031f134713fc87608d3601b30ee6c9b130e2
MD5 d09e3e9c2b35e719372fef8369535cea
SHA1 f2734917f15f0db7300d659705f132bef7c25d6b
SHA512 0b1827965202fbac25f234fd6dfb27bcbe9581bfab65b5d10c0b788373acdbce6013d2b45260ab602911619061e75df865cda088c3ea5350fd4bc4dfdf3032d6
TLSH
T1C2E00203934001DBC124433100C3113061E38031436711C45C11417068027050F10A80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5a7040.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5a7040.TMP
Size 392B
SHA256 55a79ffcc6cd966859e375ad44a8598497e5c6d6b58677e85ac59ae4604353fb
MD5 31777b4fa72e21be89279e1c0e050534
SHA1 2bcc273f3f46ca15b984651b76c588ca8425373f
SHA512 9576d5159a2b8c41a4c1ffad52673fdf67647c5976663d479a6536bf99c74a5336d59df618152a93bbe2f9171f38dfb4803e9f8fa0e3bc0677e2d1d14f0f4a24
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 edbc2321dcc8ea50da7991fcb54d1678059d3a817a4478b5a96756a79958233a
MD5 d66fcff9092f879da36bd1d07f0f6691
SHA1 4b2c2fde64314f7377e3d206e72ed32c6173a7eb
SHA512 92fb8059b8b62a0343d371599ee41f0bec3fe004fee3031e7f4535e7f65a5a7f64352c663cf42b349ac0a4abad697544ea9aa25f90f11b0f80ba1b7fde72a57b
SSDEEP 3:MsEllllkEthXllkl2zEellc:/M/xT02zN
TLSH
T12A44040C7FD41405D51454304113C3500370FC110D1177C3345544135CC77530C04504
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 59bdae85374b19ef28c78cee822ad961c78c83e3616500017a076115c17d0096
MD5 31390225a4b62c039eb8371070b30416
SHA1 f2ab8dd8eeb493ada6b798ac556f64f9e8d2acc4
SHA512 03edaccc9a3e76fffe157ab5ebc48bedda57cf51202c72a8d1f4417d2466d0d91c16c443a8dd82eb1852bf8c82519221b59fa3bb47b1c65e47908edcfdea01fe
TLSH
T1C1A0120384738407E4144051C45C1341287C84570129C0012068931704240CB039643A
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

edda347a-3a8b-4df3-b935-0ba8245ef8fb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\edda347a-3a8b-4df3-b935-0ba8245ef8fb.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

bdcdff45-2549-448e-b12a-e23d961a8daa.tmp

Path C:\Users\Admin\AppData\Local\Temp\bdcdff45-2549-448e-b12a-e23d961a8daa.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3032_1758855385\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

text.txt

Path C:\Users\Admin\AppData\Roaming\RenPy\Game-1738212058\sync\text.txt
Size 5B
SHA256 314ad142957febe390cc7223b4deb1d1b21c187f84f6e7257a23fe46c27fcae3
MD5 f4020e91252aafd4b18d8acd17f883db
SHA1 748d77dbb8bdb0dd330c099e7fde82da053fb1ff
SHA512 301ddd0e34cbd842dae99a2cc4ccbfeb6ee8b3def39c214a719fa9edc26d7142749bbe6e992d26353dc167febbab0dbc05476b68a86ad93cab5f299f0aaf916d
MD5 SHA1 SHA512

Submit Download

persistent.1789232849.tmp

Path C:\Users\Admin\Downloads\Legend_of_Zelda_Skyward_Sword_HD_NSP,_XC_Archive_get_2696\data\saves\persistent.1789232849.tmp
Size 1KB
SHA256 7892b5f7174fd736d2f48083521bfd090ec8ef12d83b26232fadf728eeb42127
MD5 6a5f2d437f35ccff5691992ebbae059c
SHA1 48fd3011b8bbacc236a1abb2188db5dbf49e81af
SHA512 f3634041c11a855600635d667071918f0963ef3d7cae1399350b5439e262d57f095af558f6d0fae0d887c8071329c6b78dd7e5b50ec5bb5398e79a271d715b48
TLSH
T12331EAEBF79A872EC279704455E30FAA413A655E8D6E34F7618D004B04011E709B56CE
MD5 SHA1 SHA512 TLSH

Submit Download

vcruntime140_1.bw:Zone.Identifier

Path C:\Users\Admin\Downloads\tmp-28052-cN0KuYWyClff\vcruntime140_1.bw:Zone.Identifier
Size 28B
SHA256 3ae4037a8fd8d2de21538efba26e4428961187d29a6cbbfbd7c60e76cf4bc9d6
MD5 c0c0eb75aca089cf8c188e9fb51417d4
SHA1 5641321c8bfdfe3b64d7361aff8c316196d5bc6e
SHA512 d284f57dcb6ccd96ae33c22c5efa89145ab526ec00079187e77869988c9a85f9a57db5b3e35b560538355038d9c9f3b6317b2f7bb30212fbb4630c43f0c4c816
MD5 SHA1 SHA512

Submit Download

memory/2324-1116-0x0000025865EB0000-0x0000025865EB1000-memory.dmp

Download

memory/2324-1122-0x0000025865EB0000-0x0000025865EB1000-memory.dmp

Download

memory/2324-1114-0x0000025865EB0000-0x0000025865EB1000-memory.dmp

Download

memory/2324-1125-0x0000025865EB0000-0x0000025865EB1000-memory.dmp

Download

memory/2324-1124-0x0000025865EB0000-0x0000025865EB1000-memory.dmp

Download

memory/2324-1120-0x0000025865EB0000-0x0000025865EB1000-memory.dmp

Download

memory/2324-1123-0x0000025865EB0000-0x0000025865EB1000-memory.dmp

Download

memory/2324-1121-0x0000025865EB0000-0x0000025865EB1000-memory.dmp

Download

memory/2960-1303-0x00007FFA3EF00000-0x00007FFA3F163000-memory.dmp

Download

memory/3632-1218-0x00007FFA19380000-0x00007FFA193E3000-memory.dmp

Download

memory/3632-1230-0x00007FFA19380000-0x00007FFA193E3000-memory.dmp

Download

memory/3632-1216-0x00007FFA19380000-0x00007FFA193E3000-memory.dmp

Download

memory/4932-1246-0x00000000005A0000-0x0000000000667000-memory.dmp

Download

memory/4932-1271-0x00000000005A0000-0x0000000000667000-memory.dmp

Download

memory/4932-1285-0x00000000005A0000-0x0000000000667000-memory.dmp

Download

memory/4932-1244-0x00007FFA3EF00000-0x00007FFA3F163000-memory.dmp

Download

memory/4932-1232-0x00000000005A0000-0x0000000000667000-memory.dmp

Download

memory/4932-1320-0x00000000005A0000-0x0000000000667000-memory.dmp

Download

memory/4932-1345-0x00000000005A0000-0x0000000000667000-memory.dmp

Download