1ce7da6f2813c2ad1d2e496be6714e08cd618e6d9fe2df26c2bd4d894c9a6ec1

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/09/2026, 22:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
AutoClicker.exe
Size 1.1MB
Sample260919-14th5acb46
SHA256 1ce7da6f2813c2ad1d2e496be6714e08cd618e6d9fe2df26c2bd4d894c9a6ec1
MD5 913a423f66aa1c41e374e21a911a3c20
SHA1 449df612d0f02e868992faabfbf4d5d37c727936
SHA512 ee01f1a322e982bfd6618920e4ec9decf23317628f39dc9b771ff4f758fef3c9266cebbeaeb8ba1e4bbb1f0b683cba1aa3a533bce62a706e7dfd2a7d3bdd1f73
SSDEEP 24576:pRaZROMOm8FN7TjsPnzt2heeRhQbJpOQam1Mfu37d:zkxOm+7TjsPnztyDMBayMc
TLSH
T169455B5523A44199FE6AF0F68A52C106D6B17C4A12B6CB1F01B039B52F736B3DE1E31B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Drops desktop.ini file(s) 7 IoCs

description	ioc	Process
File opened for modification	C:\Users\Public\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	wmplayer.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	wmplayer.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\I:	wmplayer.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\A:	wmplayer.exe
File opened (read-only)	\??\N:	wmplayer.exe
File opened (read-only)	\??\Q:	wmplayer.exe
File opened (read-only)	\??\Y:	wmplayer.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\J:	wmplayer.exe
File opened (read-only)	\??\L:	wmplayer.exe
File opened (read-only)	\??\R:	wmplayer.exe
File opened (read-only)	\??\T:	wmplayer.exe
File opened (read-only)	\??\Z:	wmplayer.exe
File opened (read-only)	\??\H:	wmplayer.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\D:	wmplayer.exe
File opened (read-only)	\??\M:	wmplayer.exe
File opened (read-only)	\??\S:	wmplayer.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\G:	wmplayer.exe
File opened (read-only)	\??\V:	wmplayer.exe
File opened (read-only)	\??\W:	wmplayer.exe
File opened (read-only)	\??\X:	wmplayer.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\B:	wmplayer.exe
File opened (read-only)	\??\K:	wmplayer.exe
File opened (read-only)	\??\U:	wmplayer.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\D:	unregmp2.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\O:	wmplayer.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3692_1896349437\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3692_1178481079\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3692_1178481079\protocols.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unregmp2.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4180	msedge.exe

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	svchost.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134343296393260769"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1704430598-3087477806-3297458608-1000\{56EAE56A-1E1C-4688-82F9-65C90A48E38D}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-wmplayer	wmplayer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-wmplayer\CLSID = "{cd3afa96-b84f-48f0-9393-7edc34128127}"	wmplayer.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5636	mspaint.exe
5636	mspaint.exe
5884	mspaint.exe
5884	mspaint.exe
4236	mspaint.exe
4236	mspaint.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
3524	AutoClicker.exe
5484	wmplayer.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4552	unregmp2.exe
Token: SeCreatePagefilePrivilege	4552	unregmp2.exe
Token: SeShutdownPrivilege	5484	wmplayer.exe
Token: SeCreatePagefilePrivilege	5484	wmplayer.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5484	wmplayer.exe
3692	msedge.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
5636	mspaint.exe
5884	mspaint.exe
5636	mspaint.exe
5884	mspaint.exe
5636	mspaint.exe
5636	mspaint.exe
5884	mspaint.exe
5884	mspaint.exe
4236	mspaint.exe
4236	mspaint.exe
4236	mspaint.exe
4236	mspaint.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5484 wrote to memory of 1408	5484	wmplayer.exe	90
PID 1408 wrote to memory of 4552	1408	unregmp2.exe	91
PID 3692 wrote to memory of 3844	3692	msedge.exe	104
PID 3692 wrote to memory of 4180	3692	msedge.exe	105
PID 3692 wrote to memory of 5412	3692	msedge.exe	106
PID 3692 wrote to memory of 5412	3692	msedge.exe	106
PID 3692 wrote to memory of 5412	3692	msedge.exe	106
PID 3692 wrote to memory of 4604	3692	msedge.exe	107
PID 3692 wrote to memory of 4604	3692	msedge.exe	107
PID 3692 wrote to memory of 4572	3692	msedge.exe	109
PID 3692 wrote to memory of 4572	3692	msedge.exe	109
PID 3692 wrote to memory of 4572	3692	msedge.exe	109
PID 3692 wrote to memory of 3660	3692	msedge.exe	110
PID 3692 wrote to memory of 3660	3692	msedge.exe	110
PID 3692 wrote to memory of 3660	3692	msedge.exe	110
PID 3692 wrote to memory of 3092	3692	msedge.exe	111
PID 3692 wrote to memory of 2408	3692	msedge.exe	112
PID 3692 wrote to memory of 3092	3692	msedge.exe	111
PID 3692 wrote to memory of 3092	3692	msedge.exe	111
PID 3692 wrote to memory of 2408	3692	msedge.exe	112
PID 3692 wrote to memory of 2408	3692	msedge.exe	112
PID 3692 wrote to memory of 3376	3692	msedge.exe	114
PID 3692 wrote to memory of 3376	3692	msedge.exe	114
PID 3692 wrote to memory of 4492	3692	msedge.exe	115
PID 3692 wrote to memory of 360	3692	msedge.exe	116
PID 3692 wrote to memory of 4492	3692	msedge.exe	115
PID 3692 wrote to memory of 360	3692	msedge.exe	116
PID 3692 wrote to memory of 3452	3692	msedge.exe	118
PID 3692 wrote to memory of 2064	3692	msedge.exe	119
PID 3692 wrote to memory of 2064	3692	msedge.exe	119
PID 3692 wrote to memory of 4164	3692	msedge.exe	120
PID 3692 wrote to memory of 4164	3692	msedge.exe	120
PID 3692 wrote to memory of 5820	3692	msedge.exe	123
PID 3692 wrote to memory of 2700	3692	msedge.exe	124
PID 3692 wrote to memory of 6072	3692	msedge.exe	125
PID 3692 wrote to memory of 4088	3692	msedge.exe	126
PID 3692 wrote to memory of 4088	3692	msedge.exe	126
PID 3692 wrote to memory of 3468	3692	msedge.exe	127
PID 3692 wrote to memory of 3468	3692	msedge.exe	127
PID 3692 wrote to memory of 3468	3692	msedge.exe	127
PID 3692 wrote to memory of 1800	3692	msedge.exe	128
PID 3692 wrote to memory of 1800	3692	msedge.exe	128
PID 3692 wrote to memory of 1800	3692	msedge.exe	128
PID 3692 wrote to memory of 1856	3692	msedge.exe	129
PID 3692 wrote to memory of 1856	3692	msedge.exe	129
PID 3692 wrote to memory of 1856	3692	msedge.exe	129
PID 3692 wrote to memory of 3112	3692	msedge.exe	130
PID 3692 wrote to memory of 3112	3692	msedge.exe	130
PID 3692 wrote to memory of 3112	3692	msedge.exe	130
PID 3692 wrote to memory of 4500	3692	msedge.exe	131
PID 3692 wrote to memory of 4500	3692	msedge.exe	131
PID 3692 wrote to memory of 4500	3692	msedge.exe	131
PID 3692 wrote to memory of 3520	3692	msedge.exe	132
PID 3692 wrote to memory of 3520	3692	msedge.exe	132
PID 3692 wrote to memory of 3520	3692	msedge.exe	132
PID 3692 wrote to memory of 1588	3692	msedge.exe	133
PID 3692 wrote to memory of 1588	3692	msedge.exe	133
PID 3692 wrote to memory of 1588	3692	msedge.exe	133
PID 3692 wrote to memory of 4996	3692	msedge.exe	134
PID 3692 wrote to memory of 4996	3692	msedge.exe	134
PID 3692 wrote to memory of 2380	3692	msedge.exe	136
PID 3692 wrote to memory of 2380	3692	msedge.exe	136
PID 3692 wrote to memory of 2380	3692	msedge.exe	136
PID 3692 wrote to memory of 5680	3692	msedge.exe	137

C:\Users\Admin\AppData\Local\Temp\AutoClicker.exe
"C:\Users\Admin\AppData\Local\Temp\AutoClicker.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:3524

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play -Embedding
1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5484
- C:\Windows\SysWOW64\unregmp2.exe
  "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1408
- - C:\Windows\system32\unregmp2.exe
    "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    PID:4552

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\RenameMeasure.jfif"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5636

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\RenameMeasure.jfif"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5884

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
- Checks SCSI registry key(s)
PID:6132

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\RenameMeasure.jfif"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4236

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
1⤵
- Drops file in Windows directory
PID:5932

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\JoinRestart.xhtml
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ff8c4a7c188,0x7ff8c4a7c194,0x7ff8c4a7c1a0
  2⤵
  PID:3844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1996,i,10689669867120103774,5152742893703037264,524288 --field-trial-handle=2320,i,6200980738158129150,9738442078879908470,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1860,i,15900586319524817462,607826436728452584,262144 --field-trial-handle=2320,i,6200980738158129150,9738442078879908470,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:2
  2⤵
  PID:5412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2752,i,4756818449706521620,3973695059215228070,524288 --field-trial-handle=2320,i,6200980738158129150,9738442078879908470,262144 --variations-seed-version --mojo-platform-channel-handle=2888 /prefetch:13
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3588,i,4061407756326851229,4451320417323726474,2097152 --field-trial-handle=2320,i,6200980738158129150,9738442078879908470,262144 --variations-seed-version --mojo-platform-channel-handle=3784 /prefetch:1
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3512,i,7964610443769371937,1454573386150620525,2097152 --field-trial-handle=2320,i,6200980738158129150,9738442078879908470,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:1
  2⤵
  PID:3660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4260,i,4130327903999303597,5731081164061523170,2097152 --field-trial-handle=2320,i,6200980738158129150,9738442078879908470,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:1
  2⤵
  PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4196,i,6651668324471629574,4872932221487229615,2097152 --field-trial-handle=2320,i,6200980738158129150,9738442078879908470,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:9
  2⤵
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5264,i,9420299862276442152,13340404524300600355,524288 --field-trial-handle=2320,i,6200980738158129150,9738442078879908470,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:14
  2⤵
  PID:3376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5512,i,3298513563649357545,4726346677177754184,524288 --field-trial-handle=2320,i,6200980738158129150,9738442078879908470,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:14
  2⤵
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5572,i,3719320340327762276,14865626641059241437,524288 --field-trial-handle=2320,i,6200980738158129150,9738442078879908470,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:14
  2⤵
  PID:360
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,2423568161358770424,14361627084687978862,524288 --field-trial-handle=2320,i,6200980738158129150,9738442078879908470,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:14
  2⤵
  PID:204
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,2423568161358770424,14361627084687978862,524288 --field-trial-handle=2320,i,6200980738158129150,9738442078879908470,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:14
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,12132653857854738468,14255211725489738166,524288 --field-trial-handle=2320,i,6200980738158129150,9738442078879908470,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:14
  2⤵
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6668,i,13825360453160404658,12880028260229529852,524288 --field-trial-handle=2320,i,6200980738158129150,9738442078879908470,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:14
  2⤵
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1396,i,16501181438810011531,3520769178969551849,524288 --field-trial-handle=2320,i,6200980738158129150,9738442078879908470,262144 --variations-seed-version --mojo-platform-channel-handle=1380 /prefetch:14
  2⤵
  PID:5820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1404,i,13453059306028781726,3393575768763650483,524288 --field-trial-handle=2320,i,6200980738158129150,9738442078879908470,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:14
  2⤵
  PID:2700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1412,i,9711440284618646838,16364901169190861124,524288 --field-trial-handle=2320,i,6200980738158129150,9738442078879908470,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:14
  2⤵
  PID:6072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5348,i,14455077871828957607,15566357283602855915,524288 --field-trial-handle=2320,i,6200980738158129150,9738442078879908470,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:14
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=4276,i,3204328002583028028,7558181266451563297,2097152 --field-trial-handle=2320,i,6200980738158129150,9738442078879908470,262144 --variations-seed-version --mojo-platform-channel-handle=6712 /prefetch:1
  2⤵
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=5812,i,12980191081381853593,248668840778143064,2097152 --field-trial-handle=2320,i,6200980738158129150,9738442078879908470,262144 --variations-seed-version --mojo-platform-channel-handle=6792 /prefetch:1
  2⤵
  PID:1800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6360,i,5473006415037694683,16824360486180532810,2097152 --field-trial-handle=2320,i,6200980738158129150,9738442078879908470,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:1
  2⤵
  PID:1856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6920,i,3134645692402025861,10437937562199941597,2097152 --field-trial-handle=2320,i,6200980738158129150,9738442078879908470,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:1
  2⤵
  PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=3832,i,3519041099347471508,12964999304186357403,2097152 --field-trial-handle=2320,i,6200980738158129150,9738442078879908470,262144 --variations-seed-version --mojo-platform-channel-handle=7096 /prefetch:1
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=4916,i,11251116566734016078,3296808776129081662,2097152 --field-trial-handle=2320,i,6200980738158129150,9738442078879908470,262144 --variations-seed-version --mojo-platform-channel-handle=7204 /prefetch:1
  2⤵
  PID:3520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7304,i,8093491290764304174,2205636283381670277,2097152 --field-trial-handle=2320,i,6200980738158129150,9738442078879908470,262144 --variations-seed-version --mojo-platform-channel-handle=7528 /prefetch:1
  2⤵
  PID:1588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3832,i,3938101284091402646,17729540684104851224,524288 --field-trial-handle=2320,i,6200980738158129150,9738442078879908470,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:12
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7192,i,4573081062955071665,13812506252316073166,2097152 --field-trial-handle=2320,i,6200980738158129150,9738442078879908470,262144 --variations-seed-version --mojo-platform-channel-handle=7872 /prefetch:1
  2⤵
  PID:2380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7612,i,11160951605786362716,4183536240527450533,524288 --field-trial-handle=2320,i,6200980738158129150,9738442078879908470,262144 --variations-seed-version --mojo-platform-channel-handle=7116 /prefetch:14
  2⤵
  PID:5680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5332,i,14140151467010325675,8190285063844629344,524288 --field-trial-handle=2320,i,6200980738158129150,9738442078879908470,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:14
  2⤵
  PID:360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5792,i,17421307734610720021,11867308326329592482,524288 --field-trial-handle=2320,i,6200980738158129150,9738442078879908470,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:14
  2⤵
  PID:6076

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4164

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2520

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:1056

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 68f353a62995fc87917d7d1eef768abe00ffab02e1d3e469100f99b6987f6488
MD5 5ba62d3fe2ddefdf87e8dd139f3e421b
SHA1 1986deda7bda2ac5b490eacb9fe2784fb6d01648
SHA512 4e6a767b24298d2e01c8dbefa41509e1bc67cf2c2f34fd0bf866fc1017e1d15a470a5a95feb8ee1cccf4b8ccf5fa9054bcbb93919c00de89eeffec199b68baf9
TLSH
T19CD02BB5DFFCCC62D54820B802518E116085B41519490040DA03FC04DD110814D03555
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 648887a89dac8888df245d8758dcd78e85ae79931c9464f19b0967fcd69c3d2f
MD5 b053e18c94ac6f6c60a9e0a281e1687b
SHA1 17ed2d8ae6844c2878132336a2fea7d044381f8b
SHA512 abf3d05979a55f573445c0c7a95529a5899c0d9f55f350b3eb35132d8502e23e6c764ffc98e92f4374754aa22e9292fd03f8e6e8113c0e919f428e797e339bfa
TLSH
T151D02BB9DFECCD62D54820B402508E116095B4156D490040D903BC04DD110814D03569
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000086

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000086
Size 66KB
SHA256 58899d70cb2bc1aac7a772e9aa94caa1157a409bd18a7786e823d78e4df0cc92
MD5 30fea4b836005d70c500c301451d91b9
SHA1 82cb6feb5a2ce6af675835d6489e32dfcd140a0b
SHA512 47ec83c281ec7269ae7e48c61f29eee426c3df28b9f613b60bdaae6c4d01ff9545daed7e2f0e4f00f5e435cd2def21b36d592e54b6edc9630decb76ac9cd9813
SSDEEP 1536:205lChoTLn1b2DaixCCiXjLARidQNGcpA3NU3uDSqrW3b6w/:20nCmXJ2Daix0Xjfd6pA4TqObD
TLSH
T129631200EB2BB14DA35D2ACDDDCDE79B0436745489B36D15C0A9031C84FDEA5DDE2A2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000087

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000087
Size 68KB
SHA256 aa8aa822dcc877a0002877631fd1888141da53bfa4838119a05e25ae6082c3bf
MD5 110c2e941f1ec2d409ba64e9076d05a6
SHA1 3112c99e2bcd5fa11dd1b28410b2c0a1bc76c0fd
SHA512 9ae278820122336eedfbef12aecd0ed14ea9947fb51bd52253c6c72f8b0df58284a38bd3baec36743dcdf026ad8ca383ca7eb2794cebd3886a02a4f405686157
SSDEEP 1536:a8ZGkKYRIqNz2tDACsUf76Z+AGYguWv0KxwhneRy4Y1R9s82yCENwYJoYl:tkVYR7NOAXX9GjuW8Kxwhne04Y1Ds82I
TLSH
T149630267DFF657B536E17808FC6CDA2698DE11684B438A900FBA7CC50F86C6284CD48B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000088

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000088
Size 19KB
SHA256 c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f
MD5 2e86a72f4e82614cd4842950d2e0a716
SHA1 d7b4ee0c9af735d098bff474632fc2c0113e0b9c
SHA512 7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1
SSDEEP 384:eV4Eqc1qgk/XDVGi8m7JEM9TUKPqivdjfommfP974oNF38:eV9qlxhVEM9UKPpMV74kFM
TLSH
T1D692D043765579E9AF1280C82397E6A4EAAD9A88D6C0FD0950F56CBECF708D32261825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000089

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000089
Size 63KB
SHA256 caecff4179910ce0ff470f9fa9eb4349e8fb717fa1432cf19987450a4e1ef4a5
MD5 226541550a51911c375216f718493f65
SHA1 f6e608468401f9384cabdef45ca19e2afacc84bd
SHA512 2947b309f15e0e321beb9506861883fde8391c6f6140178c7e6ee7750d6418266360c335477cae0b067a6a6d86935ec5f7acdfdacc9edffa8b04ec71be210516
SSDEEP 1536:tLQFdWY1+jAIuhc5s3JBP2ffX195jJqu1H5g60:qFdv+jA/cizOfTdRJ260
TLSH
T10E5302D829DC2DF4466490C19420E379C6FACED8E4485B6F5B2A2E0DF78DD7527C7242
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008a
Size 60KB
SHA256 a221cbf72963df1c02c8bc202b159379f26e3d0d06225a5933209e745040e35b
MD5 b90c0e06b88c09158b13db21c7fc9ef7
SHA1 a4b968f5abcd2addd2d8f2d3e6fc01f4127c95a3
SHA512 430aadb5315738f414c2d4ca0d9e2be42f5242a3b28765993602aed4b34e334d854a88a051e6519877b7ffd8a5bf4ee7276885d6daec541826dba878f8c07f2e
SSDEEP 1536:iw916VqIkIFHzR32SF2Sjm+KW3IS7uchJEsZP8:nngaGzR32ceS7uchJ1ZP8
TLSH
T18C530227CA3085D2572D05004B9EF35A1A6079FDEA09CD7E920157F772ACAACFE20E21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008b
Size 44KB
SHA256 66360c0a99a563333896bb448e6c1b87ad5ff68f1813dae48164bfa534ff6f6b
MD5 3a4672e51b85020d154586a448a20b3d
SHA1 4269e60250d255275bd96601098979fb043c1100
SHA512 5027936d327f32a5380fe56092c8fadc33ef6cbfa2f7e1e45ccc68a6301ec4cfc8a0b06af4ef47519e02e05d8357639f8a975db7774bfc1b2d4043a5ce12bba4
SSDEEP 768:hq0hNfF0IOcOGt0foN90TSe1nczggkXqS8CrXuM8xBFEpTqgYIxk/uQlzolQ:hqafpOs0oNKTSe1nsgqrMiFcYIB6oi
TLSH
T1F41301F0705688FC366B5C61864A2BF21227B8CD702DEBDB46C4357075AB1588612DBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a1
Size 24KB
SHA256 1c295c5eb4078e94b5b5211239355f77fb9f88807896ac21f1bb89b38913fe64
MD5 361a1d27fefd402bd8c8e8b35392dfbb
SHA1 8550e36897eca38cf7de163c0ee15bbc6603f9f3
SHA512 ba5c2e28770fa880567d232582e58dd60b0d9f504bfde13c2287b843944f8541dbaf171b5b59ae549e73fe3f92234507f120a409b5ec7483470353eb31028d84
SSDEEP 768:9KPJLKpfBa1Is6qGt+1eHBmE4X/DGr6hHqxNFhai8sOLn:9KRW5MIsZkBmETmHwNbaidOj
TLSH
T171B2E1F4E7D5837AE51669707DA870471D50310719AEA3FE3C5029E2AC64781F533C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 6940de7c00598bf7fe1fffd28efb8f85b3fd6723b26164c160df08dff38df3f2
MD5 f90f764d861e9a2b496a8bc32084ac8f
SHA1 c0311e35692f06513d48c85b42111178c4ecbb08
SHA512 8482d0f6d441c77050341a322f8b8fe97f95858cad4de68f5f70c1a3f1a2d8dbceaa318f594a35e0e566dc7bd81f1d63b03a3946ea4542d9fbca60179b52ba7c
SSDEEP 96:hy89W886WJMhlELTGLZlL6MCrUnpVrYz+UKRd0s64MOYPtkWvQjknieJzk1tO6tB:hAf94mPFWYmY6tBQ4pYy/Ka
TLSH
T1E5E1B9E790AA299FFB9F393025D8BC923632D4CC1C470D050E6AEE37ED467726640AD4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 8dca712605f8b00b10653d42c7eea6ea5cd05c5433179de2e8c7f7be03bd3da7
MD5 13a567ccf1d0097abedb5ed5730e8a65
SHA1 aeea70a896da7753719db8def8b00104951f8440
SHA512 24fdfe67fb1371067dc079bc10ceaecac07792a26c9bee276815c0a1c227f9572dd1f429cb349bf0beef3d87906ae95b87ec6ac7d495c59733904577b4df3227
TLSH
T17161A8F710BB66DFFBDB2D3099D09C973636E48921871D0A09A8FB78DC0676662443C4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a1e76.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a1e76.TMP
Size 3KB
SHA256 8cfc1dec38364183053f8ac74f4e66c32c07fd17b250bfcdd1d2ee2d19059ef2
MD5 6829f0a599e2ecf05407758466548c8e
SHA1 9184cfe05c2fa480a07494950fd874a87aae4fab
SHA512 d7c8e2144b59418cee662761fc82d91147ec090ce0cda06ed9540d6bee980d39869bb4d3b413ba78f87eb6f04064af045bb282d25c95879de8005b3757033b93
TLSH
T14E6196F711BB66DFFBDB283099E09D973636E48921871D0A09A8FB78DC0676662443C4
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 f2e7a7354ed39cb02493fde6c50b1fbb02075cb7c0931b3eea1ba5de95367bfb
MD5 3e327f5f1aab12c609bc1fcc456685e9
SHA1 6e97509b46f5dd9bd7bb366311571f7887c1c5e2
SHA512 8458b855eee368ed2211cca83a93399eae9ecd6cec3696811de8ff917000071a47707ed2e88338a17f07fb1781f1ac665fd14880dad48f7113bb3a16e63a6e46
SSDEEP 192:D+klRWZjy4QeXjmWoJaeUJ6RaRa8jhLVii4iD2mTr7liLEqZp3qqb/ge0vSDdN:D+klRWZjy4QeXjmWUaewKaRa8RVii4iE
TLSH
T11F128BF3C7E8876ED91156F09A683E1BCE1D0D5982283C4AC5E4DE4B93E1071E2D1E6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 9037e6c5d9e67d08e2b68bd1623147a236ae2819607e26e156f84063607430b5
MD5 c60032539637645fa0a64b28fc844339
SHA1 5adc4aa54616c955cf2b3929b059777379bcf940
SHA512 5b967cf28a68cee3dd408f68ba7a4c66727817e833da17226dbfe65558190f63f144381730a2a99777650b2d2769e0b4ddd0499bdc11da6eaa0a0394e6c106ba
TLSH
T1F9D022235B0132F7B5ADBF86506BACEFDB2A00620882DDD413D0AD9D09354BC0597248
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 9718d489364474abd8f33465efb15429df96217dfbf3eda600cb0936afc54786
MD5 78f1208f04a6d6825524b04524a181ef
SHA1 b2851651b7caf44684c3dcc8891f7b2b19bdd5dc
SHA512 63aa2902ab773e6668b2ed21a7f61ced1101eb4a7bcc9a2d650cce473bd84e5a2249791e0d6183e2d0832aa9ffa583fde20b3fe2a4db3841165149e6eb66ab5b
SSDEEP 192:sxRbRqCr/feTsGlYSZhWNzoA8p4r/g6+WNIYcAXtiTQDGPIgD4DJ:sxRbDr/feTsGu0vm/5Ig9iTQcM
TLSH
T1EE32B819BE28A93B9CCBD21DFB557F53D6F85032A0951E48A6FC8A1C05E76DD220380F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 903589d4039cea46e696fdbf19fe4c91ed12d49d4c779f892d59759dc355073e
MD5 b31d1b1a2e33e8b42f908d1618cd6c5d
SHA1 73218bf4fd26eceb3b7575b9f2ad5ae19e9904a6
SHA512 6452d25bb17dd3f0c63f5973b10e7e8c137b48e56a818289f3c5894386aba1dc33250d8cd61954db6ee8b6c3ff3c582d187461db45aa0c17428c706dfa7fa7cb
SSDEEP 384:sxRb/mWr/feTsGk0wVY/5IJ9iTQcWofGi:sv/mWr/fenkLY/5IJ9iTFfGi
TLSH
T1CA52C759B924A97B8CCBD609FA757F13D7F85033A4951E4CAAFCC61C04EA5ED220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 ad247e876c789a4f2361729ceb6c3e039ce5a2a1a3116d769c0ac904e7b98890
MD5 1f26a38b6c94da8382c84cc61dd47caf
SHA1 5f160990481a658358a7949dab258205b7c8ce50
SHA512 afcced6f13dff27872b57c627426fae9326917855d2f6b6578f20ea7218be5a68e4cf6fd4b4b81e598db7c388e91c2598495ef24d27853723603d1493dbf60e8
SSDEEP 192:sxR0RqCr/feTs2RYSZhWNzoA8p4r/g6+WNIYcAXtiTQDGPIgVDJ:sxR0Dr/feTs2K0vm/5Ig9iTQcf
TLSH
T12332A715BD28A93B9CC7D21DFB657F53D6F85032A0951E48A6FC8A1C05E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 43e6c76f2f7e2df92cfbdae72d6acad88484df4acfbd0fd02402664b5827f55e
MD5 2ca03ae99ddeb976daa1e2b8b90c5438
SHA1 d77908e1269dcce33b7fd0b3df13fb60d5ab6099
SHA512 657dfc6b7807501d2ae87cf0405f21449df3c780ca9dcb51672e0be946ee2a0e01fbb77a2fd03c7ded1002687e16aad68b39c73e1e66998714a4ab1809b72f94
SSDEEP 192:sxRbRqCr/feTsGlESZhWNzoA8p4r/g6+WNIYctXtiTQDGPIgD4DJ:sxRbDr/feTsGG0vm/5IN9iTQcM
TLSH
T1A642A819BE28A93B9CCBD21DFB557F53D6F8503260951E48A6FC8A1C04E76DD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 ef81d346524f99dd53f55f7c45744c15abc78d5ea19fb162686f54f315e5cf47
MD5 f56f3d765451bf70c048a7afa6c0f9a3
SHA1 13c22e27faa8cf3498572d887e5650456c99c248
SHA512 961f7c0c713915a93057628285c6b4d74ed9a8ca699ff2dc2cfe76a3915e6f721a0d36403cb102ffba12811cde19a528ae74b068b23f335ff802c71a764b7474
SSDEEP 768:DFak24yG7pLuLbs5Wg1Bf9t8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEEJ97gwroMOq:DFak24ymEbs5Wg1Bf9tu1jaTEJxgbMOq
TLSH
T1E9D2EB3B744CCB7E4F804A9DDC197E9B6DA802CB9598CD4047FD941D03C6BEA521A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 ba31ff9df060048d1c1ce932c7421255f8ba02d2eb8d06e557426197a4c380b2
MD5 175ba3cc2db273b0d33e23f756851c2d
SHA1 037b5a8fdd62d77d932e2095dfd644ea806304ee
SHA512 6a32dcf42229d687814ee9a83328fc1500309739f2b03d5597a9aed290a2980526ed3e53e118a59e363e6568485538f5fe412544d612495ba6381a71d1326419
SSDEEP 96:KQfSKIkWWB0Nxj37kL3uPtJkKVBtbk5RxOjvq8Kjiqg:MxWB0Nxj37K3uVJ1BtbaRxOjAPg
TLSH
T1D2910650307B16843D7E7A0DE0E5D79E568233933058EA2B3BEA049A4E6BE140DFC6DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 74B
SHA256 8d41be113b5f7bb62effb33dfde256eaf48686094e8257b7320a8863d8c2a87c
MD5 5f932db1c20e969ba0a634be87ee01e1
SHA1 69526c610898af6c5fba1b7773ef484285577b47
SHA512 707797aa46915bd3d9330b51d4345928493e1f466e9207729db6ac271ffc33d26eda499a4ba5fe15e7cfa87668cb669f2f9f4932b6cc5b8190d1e6d00b819ed5
TLSH
T16BA002F70941809E8F34A9E92039BA1DE44B828C8CC0EDF1C448C042323CB3300038D0
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 155B
SHA256 b4e554b1f443b1974f29e828e74a8bfc8cb91e68f733a66d26a95e6576b5acc9
MD5 8dcb572bb3067a211aebab781a7048b5
SHA1 349bd791390ae61e6395fe694518232f271feeae
SHA512 5d2d2d8a4dae25a1b96d5237a4d21449222f7473f9cfd0d66a0a32d63e7938e2be9ba6d70725c10abc732938d5e3a15186806624eef07a549c9013e6c9deecc0
TLSH
T149C08CF30160028687B46BD91138760DC5174D588CC0ECE0D905B002323D73784028A0
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5a9878.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt~RFe5a9878.TMP
Size 158B
SHA256 a59414a392048a42fce1ae36b13582203bd1077909d2d6948880ba8adcd7e60c
MD5 a6d4c98129e5c43ddb84eedb1c2a9411
SHA1 0c98a80dec5aac5a1439b5919e4bb352c961ef48
SHA512 057b6cfaca8563f2ae183194af1cca126dbbaa052546e2e22dd0343485ae48af2f737498a485e8084b594acbfd8ab51348d266ababd0195bb8185be892d13355
TLSH
T158C08CEB8632402A6F329ED5A037350CD0A64C0C8CC0E8F5C800B082397C733C0068A1
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\IndexedDB\indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5ab8c2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5ab8c2.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 bb8eba184502531bee68559f58dc847c16461f2dc2e44fa045c8c37ed8c3a32e
MD5 bfe08918188d1133b36e33c75d86edb4
SHA1 20ea55ec42f659a7e82d993884a93e6f064061d2
SHA512 ef44bdf4f8ef0488d94b71fa22baf55826f4b784e7ee51d9ec7e18a2b5032d757f085af0003969208c855f3eec251a7741a32aa71c996e3441d1974c675ae319
SSDEEP 768:3Qm3VogSieOo9qonUPO4Qp7cPAiSm2eo4w4cciGrTFlmcTRRX:3Qm3KNQowQpYoimeoR4ccFFYcTRRX
TLSH
T1EBF2CFB0A8E4EE636CF79245765A3B42BFF055A3A8C91E84D6DD5B0E0043BAD131BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 8827ab17c2f0792de252e5bf406959eb43e23603a3ca4624ce0b2ddab5b33c42
MD5 c7d7710e67d5b3281b8bc790f18dd599
SHA1 b257fb6149eb80fe703135e02be109912e030b27
SHA512 6f838c72639037e9be822fef766582e12ef2bde78913ad1d0ee3c26040718d649d77b6ff7285a0bc7aa0c7d213f494a5f12f2bdf3f94db2269664ffd69fe2e8c
SSDEEP 768:30m3VmgSieOo9q4nUPO4Qp7cPAiSm2eo4w4cciGrTFlmcTRRX:30m3MNQ4wQpYoimeoR4ccFFYcTRRX
TLSH
T100F2BFB0A8E4EE636CF79245765A3742BFF054A3A8C91E84D6DD5B0E0043BAD131BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 92ad1c15768be69ac0cdcfb1cf35cd039224585aeacca4e2ade4b79a81c1c45e
MD5 bb6f26054fb6349aa97f0d87155d8784
SHA1 e53c10b2a0061f0d573b1529dc1fa663091af5e3
SHA512 23751d4fdbb16dbfde53385352de406570b098f59e6aaa427fead8661098a8755edb5bda731f000c3e574b0c118f50f69d324c269da06b9262828d85ec7b905d
SSDEEP 768:Rh3S9gSieOo9qonUPO4Qp7cPAiSm2eo4w4cciGrTFlmcTRRX:Rh36NQowQpYoimeoR4ccFFYcTRRX
TLSH
T156F2BFB0A8A4EE636CF79245765A3B42BFF054A3A8C95E84D6DD5B0E00437AD131BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 82799e3194c75d3ed07067cfa805d4d4fae9470c81923748bec7af2f3f66de7e
MD5 a7c66aa64fc3f8c55787ef7cd39e811a
SHA1 c6dfd9ff1e97f00a66e3f446cc47a8c8c744be7f
SHA512 ed64926efac1621c5bb772a6c638efdba7d67ce106477d7d3a77ad8b47470d40acc80300f1b3c88a683e94cf51954b0a771ab2ee251a4508e29ee269375f455d
SSDEEP 768:vw/UxvxjgC+5j39V028oieOo7jFnUPO4Qp7cPAiSm2eo4w4cciGrTF5dAgZbCM3s:vdZj3+5j39a273jFwQpYoimeoR4ccFFG
TLSH
T10403CFB5A8A8BE77DCF3A744365D6342EFF041A395C12A94CAED1E0D42873AC530BC56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 843cb8c3b268f413c4e9d2295ca612b8bb2659cdd78e1426241a2c6266e59314
MD5 96337c9ef556572ad82c75b9ac5a7854
SHA1 5a229ce74bad3a4f955abfc5addf14aa0a5252ae
SHA512 4401469b238a6ea4340d9047b6e37141f1007163d04f48d051b57d3116a4edfc9ee3eff40832b88c4110f6e32f2726141a55c94888189f1d04dd39dbf0261126
SSDEEP 768:Rb3S7DGieOo9qonUPO4Qp7cPAiSm2eo4w4cciGrTFlmcTRRX:Rb3K6QowQpYoimeoR4ccFFYcTRRX
TLSH
T131F2BFB0ACA4EE636CF7A245B65A3742BFF055A3A8C91E84D6DD5B0E00437AD131BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 1f337da218e7abe656e0edc45230c22a8054615c999d95e39cac9134962e7453
MD5 5e8b01d9cf81250a5c5b9fbb78ec7e79
SHA1 2795dccc061fb085da5167626fd89c4bfe610aa8
SHA512 cd66c19128d1c46fc17714c737c5eb6b93358dea47f84c099868e975fd0ae466dbb35caade3549c448f0a37160d15a815c9ff04a822540875500d3d9eb173d7b
SSDEEP 768:RT3SoGmieOo9qonUPO4Qp7cPAiSm2eo4w4cciGrTFlmcTRRX:RT357QowQpYoimeoR4ccFFYcTRRX
TLSH
T140F2CFB0A8A4EE636CF7A245B65A3742BFF050A3A8C91E84D6DD5B0E00437AD131BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 2522b2f3d0f70ad90e1b9f9b200e230f744ee4873aeece923b0d97b5377ba4b5
MD5 5ce9df0181d918181eb7dceff8246391
SHA1 fa65e4541faa835a44df9675176218a3db264839
SHA512 6bc2eeafed172aec493293fa3b412de4b39e94b5ed531a44665eefc8ef6a40013e15e1dc39efcf355b8d4fc75df6ec630ef4f742ff6e9499b522c1cb32259c98
SSDEEP 768:yFHO3wwgj8GYuOo97LnUPO4Qp7cPAiSm2eo4w4cciGrTFlmcTRRX:OO3/sLwQpYoimeoR4ccFFYcTRRX
TLSH
T1EF1306F198D79A76E8AE5383673D6E429EBCC093B4885984F7D85E0DCC425BFC306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

25adbe97-258f-404a-855b-8ecbc82a7278.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\25adbe97-258f-404a-855b-8ecbc82a7278.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 1024KB
SHA256 2a237299943e7134bb8f518218c18ca5f40f1ee0b0c66b4b92c4206f4c3ca52e
MD5 3d94196560e46e07631859dca7dc72be
SHA1 d8fd8ed0efcc2f6cfe54b5eab84716c7be96b679
SHA512 335c9be57bbaa8794158495f89e17c7ec287ab6295dc578cd7a6679cad2d9a5b819f2beca42df3316f1b7dee877b4ead91a899f745ad0ade4e755aca94982d69
SSDEEP 768:G0aleDxcg7KGVp3zT13VuI61HOdrrA9abhr8fEwPRzitFrzAqUmNKX08oJImdba9:oZP2tFP3vqY8cqEMZTaBacg
TLSH
T1F1258537D190B0C5CE2C7171E9ED8F09BA63B10B11A052465FF8A57E7A533D98D0B2EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 512KB
SHA256 d07a7a0b5254d1dafce6e34541fa9080aad63d3f6974dac711d68a509d0066e8
MD5 09af4df367d3c3536f40da9a7e7724df
SHA1 32a6cb57742bdcb56e27d252d9284330e7691744
SHA512 6568eadef3fc66ac8f6d21ca48aa0dd6a272c0fb05aca688b3dfd6e9afeaeac18355a5ee712d12d9a1f318ee56f828f7e2cf75c4a0fdcdef7786d6a8c5993b90
SSDEEP 768:rf0aleDxcg7KGVp3zT13VuI61HOdrrA9abhr1vfEwPRzitFrzcooJImdba5aSt3w:r69tQeoVYocxYCutFC
TLSH
T158B41037A560A098DF3C35B1E2AC5F4CBD72650B12E006421F74B57F7A237D98A0B5EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LocalMLS_3.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\LocalMLS_3.wmdb
Size 68KB
SHA256 69d92d1b35d0a1d3ba0bea8c387d457e01eb8a3de96975a22a5fc7506bc04045
MD5 0a2b6b88d4ec41fb93569c9c9f9f0a18
SHA1 2685e6c5e7f95e73a911fd5c9ef000de8db610e2
SHA512 86a45e302fda9e30b249f6f31cdeb021b21a94b7507a51d74d8dbc519f9a7a863f243febb5cae22b4fcb31d2e049f55af58a7f1ca52339fd1b2f5a4da2240184
SSDEEP 96:oD61tYo5wFltcNXtFUMUst97XtWUMbsthUMlstyOXt/L2tELXtctzAtltDj:pt55nSnEnKz
TLSH
T19663AB9123E85669F3B72E707AF656125F3E38995E39D24C120052491EA2F2CD931B3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WMSDKNS.XML.bak

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak
Size 9KB
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
TLSH
T10022A2A194818DD206290E275DB95C0DDA8CE9D3832C24997C9EEB7FDFB1C00355FB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3692_564340888\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmsetup.log

Path C:\Users\Admin\AppData\Local\Temp\wmsetup.log
Size 1KB
SHA256 5d88233f84d0519455a9721501bf02a1f0b8fb9b32a9a9fa72b6b1a9cf2b7255
MD5 7c5df68c1a0218efb3a6cbe64b27f0ef
SHA1 e21cd178f3bbb69118603c5e93da4f7d70f44f09
SHA512 ef4b1ed2a84ad2e42a4d5b81df42398bb1ec98db56f1e3219042982c3d999c1e105b4515b2f64d4a9f69b5d3847901deca84dde00ddd8c79c1702070facbb39a
TLSH
T176213A574A09E8B5CDA247B359CC8A2773BAA7CB5364D01573CEA05E880253E233D17D
MD5 SHA1 SHA512 TLSH

Submit Download

74d7f43c1561fc1e.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms
Size 1KB
SHA256 8f56a52f4ef002a6e89afcd54de2ecea0eacc91ac6babe317b2bb24f53c0d020
MD5 1b65378da57b254ed4ace18dad6a6e35
SHA1 1b5b86cfb708a5372a701d7ef50ed3232184c1e7
SHA512 3b6becd9766f6dbef0b6d55c60398f2c0b8c8532b0bed497596cd21167967025d0812e71a4148a5095d474c2d256771c3711e16611dff6c93935fb1b942eea68
TLSH
T19931EF1067D4164EE1E39673BD376702AB31F806AB1D468F028D81090DA2600BA7BBFF
MD5 SHA1 SHA512 TLSH

Submit Download

74d7f43c1561fc1e.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms
Size 3KB
SHA256 637933189cfb944d949fd323a8e729890c2331af629d9bd12584098138c038aa
MD5 35ae5ff5d82eff648bb7c23395bd4c14
SHA1 d48d8601008121e26137e5eaee4f5e4b99ac3874
SHA512 07456dba9e907cd97fe588419cafec3cd6ed38c1f4d57c12104008f439a024a1d1f5634d21b6272ddf11a2450b8a6c3c033575d772b161dd4872d0eb8ad514ef
TLSH
T11E71E31067E5654EE1E2967379376701AB35F8067B19878F028D415A0CB2600F97BBFF
MD5 SHA1 SHA512 TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 3KB
SHA256 bfa6dac29ef8a108696d5bd50b545c31ab73372ac9dd70ed6de1c3a30847dd3a
MD5 17daccc0e6c1a5bb004da2ab21a2329f
SHA1 042bcd4a25442b17167dc471ae93ef78c2379bb3
SHA512 9c3ea7a3ab71c9cb1acde165e30a700740a81eeef940c315e915c48786b91eed7b645f65662ab98db2475b370c3a7a1066f26b97ce7e662116ea532613a07cf5
TLSH
T14C518AD5C8922C1FD78B701BCA9810C42B5FA9D659E22021497FBADAF1AE149C3E7486
MD5 SHA1 SHA512 TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 4KB
SHA256 3ca6178aa89b907ba8f33264aabcb764048de6c2dc48956572ebd915d72ef9d4
MD5 21a9cc7465ce285823d7ac33c5b10581
SHA1 f85aa168e76dfee281dd45ed89fba150fd179356
SHA512 2e55cea8b9b0fa16c578e11056661535b0552804c9cdbc9fe1a25b9c223861e24b41b7392f78ff76fedde0418d6759e710799fad289f20cdbba7db60485131eb
SSDEEP 96:02WSmZWS2FoWSd/WSwXWS3RzoAfRHRA+WS3RzoAfRHRSlvIGSmXSjS3Rzo3RHES7:0NSmwS2FSASwmS3RzoaRSVS3RzoaRCvs
TLSH
T127A1CFD9C4922C4FD79B301BCB9411C41B9FE9D659E210214D3FBAD9E1AE14CC3E7896
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5484-342-0x0000000004040000-0x0000000004050000-memory.dmp

Download

memory/5484-368-0x0000000004040000-0x0000000004050000-memory.dmp

Download

memory/5484-339-0x0000000004040000-0x0000000004050000-memory.dmp

Download

memory/5484-340-0x0000000004040000-0x0000000004050000-memory.dmp

Download

memory/5484-341-0x0000000000BF0000-0x0000000000C00000-memory.dmp

Download

memory/5484-343-0x0000000004040000-0x0000000004050000-memory.dmp

Download

memory/5484-334-0x0000000004040000-0x0000000004050000-memory.dmp

Download

memory/5484-344-0x0000000004040000-0x0000000004050000-memory.dmp

Download

memory/5484-345-0x0000000004040000-0x0000000004050000-memory.dmp

Download

memory/5484-346-0x0000000000BF0000-0x0000000000C00000-memory.dmp

Download

memory/5484-347-0x0000000004040000-0x0000000004050000-memory.dmp

Download

memory/5484-348-0x0000000004040000-0x0000000004050000-memory.dmp

Download

memory/5484-349-0x0000000004040000-0x0000000004050000-memory.dmp

Download

memory/5484-350-0x0000000004040000-0x0000000004050000-memory.dmp

Download

memory/5484-351-0x0000000000BF0000-0x0000000000C00000-memory.dmp

Download

memory/5484-353-0x0000000004040000-0x0000000004050000-memory.dmp

Download

memory/5484-352-0x0000000004040000-0x0000000004050000-memory.dmp

Download

memory/5484-354-0x0000000004040000-0x0000000004050000-memory.dmp

Download

memory/5484-355-0x0000000004040000-0x0000000004050000-memory.dmp

Download

memory/5484-356-0x0000000000BF0000-0x0000000000C00000-memory.dmp

Download

memory/5484-359-0x0000000004040000-0x0000000004050000-memory.dmp

Download

memory/5484-358-0x0000000004040000-0x0000000004050000-memory.dmp

Download

memory/5484-360-0x0000000004040000-0x0000000004050000-memory.dmp

Download

memory/5484-361-0x0000000004040000-0x0000000004050000-memory.dmp

Download

memory/5484-362-0x0000000000BF0000-0x0000000000C00000-memory.dmp

Download

memory/5484-364-0x0000000004040000-0x0000000004050000-memory.dmp

Download

memory/5484-363-0x0000000004040000-0x0000000004050000-memory.dmp

Download

memory/5484-365-0x0000000004040000-0x0000000004050000-memory.dmp

Download

memory/5484-366-0x0000000004040000-0x0000000004050000-memory.dmp

Download

memory/5484-367-0x0000000000BF0000-0x0000000000C00000-memory.dmp

Download

memory/5484-369-0x0000000004040000-0x0000000004050000-memory.dmp

Download

memory/5484-335-0x0000000004040000-0x0000000004050000-memory.dmp

Download

memory/5484-370-0x0000000004040000-0x0000000004050000-memory.dmp

Download

memory/5484-372-0x0000000000BF0000-0x0000000000C00000-memory.dmp

Download

memory/5484-371-0x0000000004040000-0x0000000004050000-memory.dmp

Download

memory/5484-374-0x0000000004040000-0x0000000004050000-memory.dmp

Download

memory/5484-375-0x0000000004040000-0x0000000004050000-memory.dmp

Download

memory/5484-376-0x0000000004040000-0x0000000004050000-memory.dmp

Download

memory/5484-377-0x0000000004040000-0x0000000004050000-memory.dmp

Download

memory/5484-378-0x0000000000BF0000-0x0000000000C00000-memory.dmp

Download

memory/5484-380-0x0000000004040000-0x0000000004050000-memory.dmp

Download

memory/5484-379-0x0000000004040000-0x0000000004050000-memory.dmp

Download

memory/5484-331-0x0000000004040000-0x0000000004050000-memory.dmp

Download

memory/5484-332-0x0000000000BF0000-0x0000000000C00000-memory.dmp

Download

memory/5484-330-0x0000000004040000-0x0000000004050000-memory.dmp

Download

memory/5484-325-0x0000000004040000-0x0000000004050000-memory.dmp

Download

memory/5484-326-0x0000000004040000-0x0000000004050000-memory.dmp

Download

memory/5484-316-0x0000000000BF0000-0x0000000000C00000-memory.dmp

Download

memory/5484-314-0x0000000004040000-0x0000000004050000-memory.dmp

Download

memory/5484-315-0x0000000004040000-0x0000000004050000-memory.dmp

Download

memory/5484-313-0x0000000004040000-0x0000000004050000-memory.dmp

Download

memory/5484-312-0x0000000004040000-0x0000000004050000-memory.dmp

Download

memory/5484-309-0x0000000004040000-0x0000000004050000-memory.dmp

Download

memory/5484-311-0x0000000000BF0000-0x0000000000C00000-memory.dmp

Download

memory/5484-310-0x0000000004040000-0x0000000004050000-memory.dmp

Download

memory/5484-307-0x0000000004040000-0x0000000004050000-memory.dmp

Download

memory/5484-306-0x0000000004040000-0x0000000004050000-memory.dmp

Download

memory/5484-305-0x0000000000BF0000-0x0000000000C00000-memory.dmp

Download

memory/5484-304-0x0000000004040000-0x0000000004050000-memory.dmp

Download

memory/5484-303-0x0000000004040000-0x0000000004050000-memory.dmp

Download

memory/5484-302-0x0000000000BF0000-0x0000000000C00000-memory.dmp

Download

memory/5484-301-0x0000000004040000-0x0000000004050000-memory.dmp

Download

memory/5484-300-0x0000000004040000-0x0000000004050000-memory.dmp

Download

memory/5484-299-0x0000000000BF0000-0x0000000000C00000-memory.dmp

Download