f420c406989ebfb13bab39c465b906dda1f8905ea5d7a38dd1c73bf776f13536

Analysis

geolocation tags

asiadelhiinindia
user interaction
yes
max time kernel
231s
max time network
232s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/09/2026, 16:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
z012d45.html
Size 213KB
Sample260922-vgd72ayhrf
SHA256 f420c406989ebfb13bab39c465b906dda1f8905ea5d7a38dd1c73bf776f13536
MD5 0f889e3aa2198f7901194efc1d83bf30
SHA1 d7803f87ad260b653b76b8b9cac9790f850a1819
SHA512 ba96da0061bc96b6ba6790c17ee9ec319246c4e28fae5dac5d19d652a91ba184407d110fec4f62536f48d3a39efb09290b09b7e16076db4be9fb913fd1beca37
SSDEEP 3072:LTWzEGkhPSJDTGeOGy7GqzfvxNmzp9EFnX4dnR/3wN3XXZiF3o1KX4:tGkJSdTGeOrfzfvx09zdhJBm
TLSH
T1CF24FA626606203DB437E0BBE6246BCDB125D513FE1352E6FAA0A336C5C6DF20635B5C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery persistence ransomware

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
341	raw.githubusercontent.com
342	raw.githubusercontent.com
352	raw.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1812	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134345698625593920"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 11 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-461973139-3212354679-1508698038-1000\{2176450F-AD29-4F63-AD0A-69690AC12C4B}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2488	msedge.exe
2488	msedge.exe
4248	HITMAN 3 v3.10-v3.260 Plus 13 Trainer.exe
4248	HITMAN 3 v3.10-v3.260 Plus 13 Trainer.exe
4248	HITMAN 3 v3.10-v3.260 Plus 13 Trainer.exe
4248	HITMAN 3 v3.10-v3.260 Plus 13 Trainer.exe
4248	HITMAN 3 v3.10-v3.260 Plus 13 Trainer.exe
4248	HITMAN 3 v3.10-v3.260 Plus 13 Trainer.exe
4248	HITMAN 3 v3.10-v3.260 Plus 13 Trainer.exe
4248	HITMAN 3 v3.10-v3.260 Plus 13 Trainer.exe
4248	HITMAN 3 v3.10-v3.260 Plus 13 Trainer.exe
4248	HITMAN 3 v3.10-v3.260 Plus 13 Trainer.exe
4248	HITMAN 3 v3.10-v3.260 Plus 13 Trainer.exe
4248	HITMAN 3 v3.10-v3.260 Plus 13 Trainer.exe
4248	HITMAN 3 v3.10-v3.260 Plus 13 Trainer.exe
4248	HITMAN 3 v3.10-v3.260 Plus 13 Trainer.exe
4248	HITMAN 3 v3.10-v3.260 Plus 13 Trainer.exe
4248	HITMAN 3 v3.10-v3.260 Plus 13 Trainer.exe
4248	HITMAN 3 v3.10-v3.260 Plus 13 Trainer.exe
4248	HITMAN 3 v3.10-v3.260 Plus 13 Trainer.exe
4248	HITMAN 3 v3.10-v3.260 Plus 13 Trainer.exe
4248	HITMAN 3 v3.10-v3.260 Plus 13 Trainer.exe
4248	HITMAN 3 v3.10-v3.260 Plus 13 Trainer.exe
4248	HITMAN 3 v3.10-v3.260 Plus 13 Trainer.exe
4248	HITMAN 3 v3.10-v3.260 Plus 13 Trainer.exe
4248	HITMAN 3 v3.10-v3.260 Plus 13 Trainer.exe
4248	HITMAN 3 v3.10-v3.260 Plus 13 Trainer.exe
4248	HITMAN 3 v3.10-v3.260 Plus 13 Trainer.exe
4248	HITMAN 3 v3.10-v3.260 Plus 13 Trainer.exe
4248	HITMAN 3 v3.10-v3.260 Plus 13 Trainer.exe
4248	HITMAN 3 v3.10-v3.260 Plus 13 Trainer.exe
4248	HITMAN 3 v3.10-v3.260 Plus 13 Trainer.exe
4248	HITMAN 3 v3.10-v3.260 Plus 13 Trainer.exe
4248	HITMAN 3 v3.10-v3.260 Plus 13 Trainer.exe
4248	HITMAN 3 v3.10-v3.260 Plus 13 Trainer.exe
4248	HITMAN 3 v3.10-v3.260 Plus 13 Trainer.exe
4248	HITMAN 3 v3.10-v3.260 Plus 13 Trainer.exe
4248	HITMAN 3 v3.10-v3.260 Plus 13 Trainer.exe
4248	HITMAN 3 v3.10-v3.260 Plus 13 Trainer.exe
4248	HITMAN 3 v3.10-v3.260 Plus 13 Trainer.exe
4248	HITMAN 3 v3.10-v3.260 Plus 13 Trainer.exe
4248	HITMAN 3 v3.10-v3.260 Plus 13 Trainer.exe
4248	HITMAN 3 v3.10-v3.260 Plus 13 Trainer.exe
4248	HITMAN 3 v3.10-v3.260 Plus 13 Trainer.exe
4248	HITMAN 3 v3.10-v3.260 Plus 13 Trainer.exe
4248	HITMAN 3 v3.10-v3.260 Plus 13 Trainer.exe
4248	HITMAN 3 v3.10-v3.260 Plus 13 Trainer.exe
4248	HITMAN 3 v3.10-v3.260 Plus 13 Trainer.exe
4248	HITMAN 3 v3.10-v3.260 Plus 13 Trainer.exe
4248	HITMAN 3 v3.10-v3.260 Plus 13 Trainer.exe
4248	HITMAN 3 v3.10-v3.260 Plus 13 Trainer.exe
4248	HITMAN 3 v3.10-v3.260 Plus 13 Trainer.exe
4248	HITMAN 3 v3.10-v3.260 Plus 13 Trainer.exe
4248	HITMAN 3 v3.10-v3.260 Plus 13 Trainer.exe
4248	HITMAN 3 v3.10-v3.260 Plus 13 Trainer.exe
4248	HITMAN 3 v3.10-v3.260 Plus 13 Trainer.exe
4248	HITMAN 3 v3.10-v3.260 Plus 13 Trainer.exe
4248	HITMAN 3 v3.10-v3.260 Plus 13 Trainer.exe
4248	HITMAN 3 v3.10-v3.260 Plus 13 Trainer.exe
4248	HITMAN 3 v3.10-v3.260 Plus 13 Trainer.exe
4248	HITMAN 3 v3.10-v3.260 Plus 13 Trainer.exe
4248	HITMAN 3 v3.10-v3.260 Plus 13 Trainer.exe
4248	HITMAN 3 v3.10-v3.260 Plus 13 Trainer.exe
4248	HITMAN 3 v3.10-v3.260 Plus 13 Trainer.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid
4
4
4
4

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 22 IoCs

pid	Process
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4248	HITMAN 3 v3.10-v3.260 Plus 13 Trainer.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4916 wrote to memory of 4276	4916	msedge.exe	89
PID 4916 wrote to memory of 1248	4916	msedge.exe	90
PID 4916 wrote to memory of 1812	4916	msedge.exe	91
PID 4916 wrote to memory of 1248	4916	msedge.exe	90
PID 4916 wrote to memory of 1248	4916	msedge.exe	90
PID 4916 wrote to memory of 1400	4916	msedge.exe	92
PID 4916 wrote to memory of 1400	4916	msedge.exe	92
PID 4916 wrote to memory of 1820	4916	msedge.exe	94
PID 4916 wrote to memory of 1820	4916	msedge.exe	94
PID 4916 wrote to memory of 1820	4916	msedge.exe	94
PID 4916 wrote to memory of 4816	4916	msedge.exe	95
PID 4916 wrote to memory of 4816	4916	msedge.exe	95
PID 4916 wrote to memory of 4816	4916	msedge.exe	95
PID 4916 wrote to memory of 5140	4916	msedge.exe	96
PID 4916 wrote to memory of 1120	4916	msedge.exe	97
PID 4916 wrote to memory of 5140	4916	msedge.exe	96
PID 4916 wrote to memory of 5140	4916	msedge.exe	96
PID 4916 wrote to memory of 1120	4916	msedge.exe	97
PID 4916 wrote to memory of 1120	4916	msedge.exe	97
PID 4916 wrote to memory of 4904	4916	msedge.exe	99
PID 4916 wrote to memory of 4904	4916	msedge.exe	99
PID 4916 wrote to memory of 1748	4916	msedge.exe	100
PID 4916 wrote to memory of 1748	4916	msedge.exe	100
PID 4916 wrote to memory of 4680	4916	msedge.exe	102
PID 4916 wrote to memory of 2268	4916	msedge.exe	105
PID 4916 wrote to memory of 5004	4916	msedge.exe	106
PID 4916 wrote to memory of 2268	4916	msedge.exe	105
PID 4916 wrote to memory of 2268	4916	msedge.exe	105
PID 4916 wrote to memory of 5004	4916	msedge.exe	106
PID 4916 wrote to memory of 5004	4916	msedge.exe	106
PID 4916 wrote to memory of 5376	4916	msedge.exe	108
PID 4916 wrote to memory of 4420	4916	msedge.exe	109
PID 4916 wrote to memory of 4640	4916	msedge.exe	110
PID 4916 wrote to memory of 2864	4916	msedge.exe	111
PID 4916 wrote to memory of 2864	4916	msedge.exe	111
PID 4916 wrote to memory of 200	4916	msedge.exe	113
PID 4916 wrote to memory of 200	4916	msedge.exe	113
PID 4916 wrote to memory of 200	4916	msedge.exe	113
PID 4916 wrote to memory of 2216	4916	msedge.exe	114
PID 4916 wrote to memory of 2216	4916	msedge.exe	114
PID 4916 wrote to memory of 2216	4916	msedge.exe	114
PID 4916 wrote to memory of 5380	4916	msedge.exe	115
PID 4916 wrote to memory of 5380	4916	msedge.exe	115
PID 4916 wrote to memory of 5380	4916	msedge.exe	115
PID 4916 wrote to memory of 5276	4916	msedge.exe	116
PID 4916 wrote to memory of 5276	4916	msedge.exe	116
PID 4916 wrote to memory of 5276	4916	msedge.exe	116
PID 4916 wrote to memory of 4908	4916	msedge.exe	117
PID 4916 wrote to memory of 4908	4916	msedge.exe	117
PID 4916 wrote to memory of 4908	4916	msedge.exe	117
PID 4916 wrote to memory of 5988	4916	msedge.exe	118
PID 4916 wrote to memory of 5988	4916	msedge.exe	118
PID 4916 wrote to memory of 5988	4916	msedge.exe	118
PID 4916 wrote to memory of 2488	4916	msedge.exe	119
PID 4916 wrote to memory of 1328	4916	msedge.exe	120
PID 4916 wrote to memory of 1328	4916	msedge.exe	120
PID 4916 wrote to memory of 1328	4916	msedge.exe	120
PID 4916 wrote to memory of 2200	4916	msedge.exe	121
PID 4916 wrote to memory of 2200	4916	msedge.exe	121
PID 4916 wrote to memory of 2200	4916	msedge.exe	121
PID 4916 wrote to memory of 4072	4916	msedge.exe	122
PID 4916 wrote to memory of 4072	4916	msedge.exe	122
PID 4916 wrote to memory of 4072	4916	msedge.exe	122
PID 4916 wrote to memory of 5320	4916	msedge.exe	123

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\z012d45.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2c8,0x7ffdc386c188,0x7ffdc386c194,0x7ffdc386c1a0
  2⤵
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1552,i,18097856173088035933,5044192413949468979,262144 --field-trial-handle=1944,i,10282615209161956053,8627371743870136928,262144 --variations-seed-version --mojo-platform-channel-handle=2168 /prefetch:2
  2⤵
  PID:1248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1852,i,7750289490569045369,2175292360474984781,524288 --field-trial-handle=1944,i,10282615209161956053,8627371743870136928,262144 --variations-seed-version --mojo-platform-channel-handle=2224 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2416,i,3116215643028692784,15124896451983951807,524288 --field-trial-handle=1944,i,10282615209161956053,8627371743870136928,262144 --variations-seed-version --mojo-platform-channel-handle=2920 /prefetch:13
  2⤵
  PID:1400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3624,i,8663683352944465896,7212162115121987973,2097152 --field-trial-handle=1944,i,10282615209161956053,8627371743870136928,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
  2⤵
  PID:1820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3652,i,13830115456361564246,640327421288374531,2097152 --field-trial-handle=1944,i,10282615209161956053,8627371743870136928,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:1
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4276,i,5261127312030086573,533530916379356189,2097152 --field-trial-handle=1944,i,10282615209161956053,8627371743870136928,262144 --variations-seed-version --mojo-platform-channel-handle=4992 /prefetch:1
  2⤵
  PID:5140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4288,i,4452753005619017810,3405312839035646635,2097152 --field-trial-handle=1944,i,10282615209161956053,8627371743870136928,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:9
  2⤵
  PID:1120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5468,i,17990175078468612743,2291617727225040772,524288 --field-trial-handle=1944,i,10282615209161956053,8627371743870136928,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:14
  2⤵
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5500,i,232066278498800073,3063761693021874915,524288 --field-trial-handle=1944,i,10282615209161956053,8627371743870136928,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:14
  2⤵
  PID:1748
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,8724646347156710332,5835938829819216,524288 --field-trial-handle=1944,i,10282615209161956053,8627371743870136928,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:14
  2⤵
  PID:3540
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,8724646347156710332,5835938829819216,524288 --field-trial-handle=1944,i,10282615209161956053,8627371743870136928,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:14
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6472,i,11002898342686299697,8157262063866904366,2097152 --field-trial-handle=1944,i,10282615209161956053,8627371743870136928,262144 --variations-seed-version --mojo-platform-channel-handle=6504 /prefetch:1
  2⤵
  PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6508,i,9167353345835566649,6985973100490491604,2097152 --field-trial-handle=1944,i,10282615209161956053,8627371743870136928,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:1
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5024,i,15920349888422331982,11916663966234731799,524288 --field-trial-handle=1944,i,10282615209161956053,8627371743870136928,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:14
  2⤵
  PID:5376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5032,i,16329531679271405269,12050754195991130281,524288 --field-trial-handle=1944,i,10282615209161956053,8627371743870136928,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:14
  2⤵
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5208,i,872129628238334915,7036648178180112620,524288 --field-trial-handle=1944,i,10282615209161956053,8627371743870136928,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:14
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5672,i,14756788282524085239,17125962634615642995,524288 --field-trial-handle=1944,i,10282615209161956053,8627371743870136928,262144 --variations-seed-version --mojo-platform-channel-handle=3180 /prefetch:14
  2⤵
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6548,i,12734201154669981721,10622699583035461244,2097152 --field-trial-handle=1944,i,10282615209161956053,8627371743870136928,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:1
  2⤵
  PID:200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5420,i,3394761928683118193,13923204481667212500,2097152 --field-trial-handle=1944,i,10282615209161956053,8627371743870136928,262144 --variations-seed-version --mojo-platform-channel-handle=3756 /prefetch:1
  2⤵
  PID:2216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6896,i,5143863973360897257,16140354247073654997,2097152 --field-trial-handle=1944,i,10282615209161956053,8627371743870136928,262144 --variations-seed-version --mojo-platform-channel-handle=6900 /prefetch:1
  2⤵
  PID:5380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6632,i,12724913638739703508,6476203040485297036,2097152 --field-trial-handle=1944,i,10282615209161956053,8627371743870136928,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:1
  2⤵
  PID:5276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=5252,i,8595946100045958949,3853109590409837210,2097152 --field-trial-handle=1944,i,10282615209161956053,8627371743870136928,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:1
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6704,i,4136025529044301040,5121836834400659943,2097152 --field-trial-handle=1944,i,10282615209161956053,8627371743870136928,262144 --variations-seed-version --mojo-platform-channel-handle=7064 /prefetch:1
  2⤵
  PID:5988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7140,i,12478702024448076079,17709050796421416360,262144 --field-trial-handle=1944,i,10282615209161956053,8627371743870136928,262144 --variations-seed-version --mojo-platform-channel-handle=7148 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6936,i,10797838695954186228,16578458446822651736,2097152 --field-trial-handle=1944,i,10282615209161956053,8627371743870136928,262144 --variations-seed-version --mojo-platform-channel-handle=6884 /prefetch:1
  2⤵
  PID:1328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=5052,i,13357357836746635476,10426142945001503257,2097152 --field-trial-handle=1944,i,10282615209161956053,8627371743870136928,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:1
  2⤵
  PID:2200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=5220,i,14036593793032744819,12183916043018390045,2097152 --field-trial-handle=1944,i,10282615209161956053,8627371743870136928,262144 --variations-seed-version --mojo-platform-channel-handle=4104 /prefetch:1
  2⤵
  PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=5536,i,7930876961403494116,14030423630297440256,2097152 --field-trial-handle=1944,i,10282615209161956053,8627371743870136928,262144 --variations-seed-version --mojo-platform-channel-handle=7056 /prefetch:1
  2⤵
  PID:5320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=7052,i,13672243869568809165,13089960362710737263,2097152 --field-trial-handle=1944,i,10282615209161956053,8627371743870136928,262144 --variations-seed-version --mojo-platform-channel-handle=6596 /prefetch:1
  2⤵
  PID:5752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=6668,i,2275460354617043575,7807522181320593975,2097152 --field-trial-handle=1944,i,10282615209161956053,8627371743870136928,262144 --variations-seed-version --mojo-platform-channel-handle=6764 /prefetch:1
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=2808,i,8106937419506660097,8193242524672019688,2097152 --field-trial-handle=1944,i,10282615209161956053,8627371743870136928,262144 --variations-seed-version --mojo-platform-channel-handle=6684 /prefetch:1
  2⤵
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=6916,i,9929955598148553646,9603894142023374977,2097152 --field-trial-handle=1944,i,10282615209161956053,8627371743870136928,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:1
  2⤵
  PID:3340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=4124,i,3690712915383300035,10597400167388134606,2097152 --field-trial-handle=1944,i,10282615209161956053,8627371743870136928,262144 --variations-seed-version --mojo-platform-channel-handle=3048 /prefetch:1
  2⤵
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3404,i,5676105686975738680,7098513032196162129,524288 --field-trial-handle=1944,i,10282615209161956053,8627371743870136928,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:14
  2⤵
  PID:5468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6496,i,9855980162188142100,11828332016334591264,524288 --field-trial-handle=1944,i,10282615209161956053,8627371743870136928,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:14
  2⤵
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2448,i,8965541453604149324,3015279790410606519,524288 --field-trial-handle=1944,i,10282615209161956053,8627371743870136928,262144 --variations-seed-version --mojo-platform-channel-handle=7372 /prefetch:14
  2⤵
  PID:5808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7536,i,5403466496707520315,5501746566910549007,524288 --field-trial-handle=1944,i,10282615209161956053,8627371743870136928,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:14
  2⤵
  PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7684,i,2936322485159844102,12120398423014336217,524288 --field-trial-handle=1944,i,10282615209161956053,8627371743870136928,262144 --variations-seed-version --mojo-platform-channel-handle=7176 /prefetch:14
  2⤵
  PID:5560

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5800

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4312

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:796

C:\Users\Admin\Downloads\hitman3trainer310t3260plus13\HITMAN 3 v3.10-v3.260 Plus 13 Trainer.exe
"C:\Users\Admin\Downloads\hitman3trainer310t3260plus13\HITMAN 3 v3.10-v3.260 Plus 13 Trainer.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4248

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4fc7dcf7387fe20ebfe8604da12039dc01420b7c4f9203598cac361fa8e97926
MD5 c3187641f7a33614939d03f0d43ad5e0
SHA1 82b3d0d3fa3092b29b9c8b55ce9fb9bba31c9c23
SHA512 ac0b9a042b5883e5cb0458cdeae19e251d85b3b88bb576dec24d66444085275504065eccb22c8674162977df0a0d2f69723a5923be85a9c5ea85f46af2ce9edc
TLSH
T13FD02B3176B99CA1D193103900C286A014BAB000EC0501843A2280050C40109133120A
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2faa1b1440ef2e1a669881f74143ac7857706d1524c89e682f713c8f3d38ab23
MD5 6a131a77b0edda45a2895a3d33a867a0
SHA1 2be1a2b3794fa396138562716cc7e4a4f17caa66
SHA512 20cb3d576349a78e3fec9e8b5e0726835f04e7dd74bb2a15edba4417611cdd35bc2d2525fdae7879e8d01d4643f26df1c05a44fb125105ad0bcee8ccd0257571
TLSH
T1F6D02B3176B99CA1D193103D00C386A014BAB0009C0501843B22C0050C401091330206
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 397f603b118c8e96ac4f074fedd960d33377eee5ccc722bad2f7e90368484080
MD5 1bf19da1c01144aac42551a9d46e9d64
SHA1 37b5713152366dfb9a1307ae52fbf2c979962a25
SHA512 31ef78c38dd25332728cbca96cb6b19bd38ca7de4ad6f33575dc05fe5d36e9dd3371f172cdfcadf2d3f7d34cd47ad585569513a3d26dcb13ba694d7f83f5ce7a
TLSH
T164E078C817D5C32D731474C741745F4C8180371BE2CCBAF5170084C47902A40BBC1B71
MD5 SHA1 SHA512 TLSH

Submit Download

f_00006b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006b
Size 138KB
SHA256 b31026915d230c351fa8b64d386717eeff59bbde73a7956fe61d471f3119016c
MD5 0d8f9ec4c148933f98b9cb97c86981f9
SHA1 3d20f7bb7b658ef86808b982fce13cce15f5dd3d
SHA512 9dc17c3776fffaec0ed2b7289ef24567f64e8d0ed5f6a977e2aa701eaffe01f5220b7e172802fc64351e60daaf7c48798cbb1af8a8e1320512a1e1e109ada05c
SSDEEP 3072:7StkBllW50FiRyzsiv8O8l0xSidIU5WXhvCmqMR1GXNeplWs42GMiycd1Zz:GOPW50A47v8QdX5oTdRfl2Frd1t
TLSH
T1CBD31395B4CEAE4A3157C0392E1015ACD63ABDA3DC4C7584FB429DC2EAB94BDC90B06C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006c
Size 19KB
SHA256 c75641b12d7a4fa2ac3e8d84ef960292f3ad3514fdaa89dea2bea91b1b8d897d
MD5 6ffc8fe346c561443db7fff58c8bf068
SHA1 e7126efed307d4afbb667ee092a6c759b294376a
SHA512 d9a1b7922ed7ef1e78e8ac2f9135f89c0a8f1964eaf748c9094b6888ce313e8d4b0eda77853984e6047319a33a186a0ed6c104c3b866565d44baf31454366e08
SSDEEP 384:k3O4ujHC7YRA1p6XawanwOHYWlle+me8okOZcarWgvu1lRO68mR4sZE:w9TY+PwOHYcrme/kvNtPEETE
TLSH
T13B92D0D430282670DBF82D7C68EA3AE30A5C194C2BF44DA25CDB38D71943B91AE7D4E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006d
Size 190KB
SHA256 bcb9050090afbefad5e8468ad709118db12fe014ec6cc8c50b4b1feffcb43c02
MD5 2baf7dd854be7c415ba8becf028803ba
SHA1 167481389d6a70e52140eee2c510e33febcc65af
SHA512 f0a4cd7fa3ace9bff71133dc157821fff0753c1640b213114ea52ace9a9791b90245d79b571ae7c42e191789f0d4b8e7397548a0765cb613ef6db628c6c28cdd
SSDEEP 3072:4v9jw7o7AI+dQ5vxXJsDmVrEAnEW/H8O3QNibVXPFiwMgo/tEqRi6DmB:4vpds65Dv4w8O3QaVKgetli6DE
TLSH
T1F5141257AD7F48C0157859CFAC2F18B280C5149CDEDFC360A2A86E0ADDADC8856D4E6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006e
Size 33KB
SHA256 5c677af2d6e78de58c66b09577213d4b1c23cf0409822378053f1c457ff465aa
MD5 68eae8ae528b3cf4965c780505e8274b
SHA1 23eea22c5ced491f0933dbdc428503548ae48636
SHA512 7fb225df90deaeff597ea4513985545b5ca6d3b4478dbe5969554f15ff4b2c1652c6220b970304884adfc2860be045599130534f1c45586a7adcfb29a8e72ac7
SSDEEP 768:9jlkCoC13VkNqcPyuMGV6lChDWaLGn7XfTpaY3UGJ0:9J913Vk5YlCRU7b15y
TLSH
T1F8E2F23016BD271E0D371D51A11984A31D0A86E5764A4B23DB20B0FDDE706E16F5FF6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000070

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000070
Size 59KB
SHA256 b8a29d94fa8d2cb03173d61ecd0533c9afc12226521f975e170b737d3c238201
MD5 29ba17e8ecf4857870f9b5c170333c94
SHA1 da0e821e0f10ca76608be712c397f61cd452c266
SHA512 e0fa3be0984a9b3a5ebdb3668590697c35ddc3b65cb741c080eda7a3547f065baa96f9fcc4b2d7d882c0dcbd26feee90dae83b53e02538fa3b976354a2522787
SSDEEP 768:laXTDCQw+tmYvQgJh+Ulvrz2YP+v0Uc5Bz6KEgtoX9DzkwkIP5wWQNMhY/+zwLcc:aI+EYvQcsYPhb5N6K32hFkISNGY2n0v
TLSH
T10153020428C9ABBAD53C572E43457F942ED28ADE26157F62AAB570C7EC71C2DC0B2528
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000071

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000071
Size 164KB
SHA256 729fd5b4b682c2e6439fe4bbaf66e39c35d96639776b431cda838b83c1ae31a2
MD5 0cd7387381a567d8a6161fb11b8e7963
SHA1 3f6e12affa937d08809d4bfcedc43f6904b1fdb0
SHA512 f4387b95e1247e38119dcbfb09b52ea1c5e7a72fdca88084acea5c67c5de71b68acbcf2d544445bdeb0e8c8606cf2dee5adeb5197f06ad72d6a153404d9efc26
SSDEEP 3072:+QvhV4n3vsaphlNBwvLk1GreFEdZnPO1LOintySjkC1yXGwZ+lluswh2:1h+3/j6Tk1ASEDGHtySjkVXGwIuso2
TLSH
T1FAF31283D302E60E5D7F44C9D76662F881E26C20677F5A9102667EBFB78893EB160D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000073

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000073
Size 133KB
SHA256 9c541c12e85440f5a645098f768129dd760ae524a19663e33a64677204c343b9
MD5 fe98639e55264741780af690b77157de
SHA1 bd33875cf53e64e725cb359665dbc7edcde2a590
SHA512 9f9a390ec552c39ae92ad505bf468bcb4086a97ade36d7008bf43c833bb31f9c4dee1525408be22bb167754f5c20c5608b54bcafcc0eb7250cb5c397b5fe1eae
SSDEEP 3072:zqS+CGGGbSSOLa7a+hwi9KuprS1xsrtGeBj8CisT8Ol:GSWbSzCa+P9KsSbsr/RRLl
TLSH
T15DD3230F27AA98B39330590272833179766EF813FDAD4426CD0C19EF0652997B4BCF26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000074

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000074
Size 24KB
SHA256 1c295c5eb4078e94b5b5211239355f77fb9f88807896ac21f1bb89b38913fe64
MD5 361a1d27fefd402bd8c8e8b35392dfbb
SHA1 8550e36897eca38cf7de163c0ee15bbc6603f9f3
SHA512 ba5c2e28770fa880567d232582e58dd60b0d9f504bfde13c2287b843944f8541dbaf171b5b59ae549e73fe3f92234507f120a409b5ec7483470353eb31028d84
SSDEEP 768:9KPJLKpfBa1Is6qGt+1eHBmE4X/DGr6hHqxNFhai8sOLn:9KRW5MIsZkBmETmHwNbaidOj
TLSH
T171B2E1F4E7D5837AE51669707DA870471D50310719AEA3FE3C5029E2AC64781F533C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000078

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000078
Size 77KB
SHA256 7db2bf4467ec28269ea43f0d2dfd1c80902a7f1c4d5b2e6cf16db62b9b764978
MD5 ba34921210785c01545a5345ec4d6e16
SHA1 a593a39db0b6aedaede428d9b6663c63f6479696
SHA512 7c23cc4b5cb61c541481825c53ec21d03944439480a109e766c438e3efc9568f95b09959a4c5cf7584d31c36937e4662f7e37ac9efe2b03f275280ea7cfaff32
SSDEEP 1536:e62o2/n0XJNml/OueCT1IrB44DahbTd7MyiK/EE0wt2sa0n:tMn2HcOuheLahH9MfKD0wt2sBn
TLSH
T140731227CD0DB4B4014B4B2B192B08D219A2983F0679E6F7D6FE1D9388BC7DA4E514B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000079

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000079
Size 29KB
SHA256 24d5feed760286123da0e7ee8644cec31426d07d1037991f6aa2859b5850166f
MD5 5327c12736f5a4d004d37596c74a02d5
SHA1 cfd85acac66c55310bbe1a578235293fc7e9718b
SHA512 31a575cd96b7f2775fae436de71bfe7a7998811c202f58b0805191448a5ec38987c82fe2820e37fa7e50208c654df0c91622882084c953b29db8c4c08766396a
SSDEEP 768:Ee95ph9yrPkTfQ5GtAPuhgAL9iu3e6GRr1k2G5f7OQuMNFN:Ewzh9iafQY+0gABiTRe2G5f5D
TLSH
T174D2E1EE0D2AB0C16113C7023BDEBA95F97E6352379FE1F115C4E7682C78B885228167
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007a
Size 56KB
SHA256 709f0fc78160ffa94fea226c7d92a349897d1a662983037dec2a4c0706c81567
MD5 06d740ead20be34d1218d4e01d89cf4a
SHA1 76eafe443e4f1bb7670fb41aa5d86753f555f5d0
SHA512 98747d2526af323799c45110cdc96dab7b28fbca46e1f4fa255d3ffa811cd0d40cdfa55ba5d743dfd7b391f192b9b3bc319d70123c4266291316aa4d47070877
SSDEEP 1536:RAeDTMOKzlV07L5QWJHT3U5IAD/l1hvpOTtYDnoGmXHPGMuC6:RLTolVqKW1ADPhvpmtYDnoGmXPGh
TLSH
T1B94302F6ADF30EF9A78F1119385DB43B1988395CCDDB3299C81C25A52CDA9CA006C5C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007d
Size 22KB
SHA256 7c6d2d7e58b03e8bde407a6bd55014ff946e5bd60ce17aa2f75df3cb844801db
MD5 ebb4d9bc90d2b1cd270c0b21c10e54b9
SHA1 bde4522ee43ea165ba8d92cfa87310bdf6e588c7
SHA512 ba80bdd79bc5f7c052ea9c671e5087190ffc7ecfd623a4a23f295bd3bce0c7817f8f56290990716425a991e2acdb0fe370be72b63c0d9c5496f4e035499a4f57
SSDEEP 384:7vk9jmrJYPttj0F7Y/CnDh3wC/N779OaK3ayawuM8tyAV1ESas5BaGesd9BskdO8:7YCJYPg2/MwC11Oz3rqvaGaGesPBskdT
TLSH
T186A2E0FAFDB8B61E509AF8D9B420F0EA50D161325CC01B6BCEDFC186A6785756800AC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000080

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000080
Size 57KB
SHA256 886b10ef26412217fb6f08dd14dea44c6e7e481feff73a7fa70e7f83f75f6cc2
MD5 aec730daaaf9d5e461f6363c87befac9
SHA1 9ab21914b0a6b90c2ebe060c54785e1a465ed8a6
SHA512 32daa128d58c7b9c1eef274b1c196572ee9546c5ddc7025d6c9832c0a52ec369f8a659071fc7f9eef7eaca6b82cfa3bfb9ae4b41ba379e3c6c51f9c0427c9b39
SSDEEP 1536:N5XPJLuKCHepuLZaXUl4kGnk8tVNVazpQ3zvd6E:NxhLC5ZeUlXGTtVNVH3z8E
TLSH
T15A4302A17B44FE951B6A60BB63000E18429357FFEC36A5680DDECFB87D897620466C64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008d
Size 48KB
SHA256 cfb59c0a0ced109e2cd72e5d6db6ffaeb9962642c5dd9e883b8a4770892426c9
MD5 6c80c379a5ccf57cbefb3103e774fc9b
SHA1 3d97ec05e2670381f4d1a31df0de2ddfa8721d1e
SHA512 669f5ec68bd048e1119c65125134be45e11ae92487772b1c706e754e9ac6d35e0cdaedab755399ac1cc009d47f44423b3e764629842a8ca0f7098744c2939cef
SSDEEP 768:ifNaXkwxtz/DTMMZXrdrxRqS0tSfd2DZ/2YQ4FY12VME1Z/OfukTQn59Molbmcb:ewxtzcGlxOx5E4q12VnsWkPolf
TLSH
T15333F17A5CFC6B2E57DB0687A60E6FB90F879385D92F4173E21A8E807821508D4BCC65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008e
Size 114KB
SHA256 2f9b89db6bcc8c2c9cf39ae85dec9d4ac27335296a287dabb2c3d77bb9cbf15d
MD5 bd8d9796e552220f4342bdc68dd3f68a
SHA1 a96329ec2fd5ae042333ba929c1968a683d49a81
SHA512 2ea07bec33597d737ee8027da6014131d265d4dc446d9e871b30ad1d5151cf6e25d45219ea36e2dc72d17b4280c655eebf460f4833fdb53649ba483c1736b508
SSDEEP 3072:9C45CLKHTEGo7AEi4fKA/M+qW2ffImLf3jhmRR:hoKzEK4SA/MFWifImLPjhmRR
TLSH
T192B3125B76FD921A806CAA3393D17FC58181DCB36311234638D94D149E6D3BCDFAC68A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

19f38b347c5d9025_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\19f38b347c5d9025_0
Size 81KB
SHA256 c37194ae3697b4503285c85aabbbd32898cd9563da134cb6a05936e03d6c1539
MD5 c145976e037685e441b242a72692467e
SHA1 a169293a8309183c56d6b2f608985754153fa42a
SHA512 a4a8965dde2fdce160b6ac71f61f69f2081045e3d66fe57cef55dce7f2f2cc75114e98027cccd7b6e7710d055d08e968ecc43aabbbb03733071f6734e5708e0e
SSDEEP 768:hWPml2/LbBLFzdh2utkWkP5tllRWt7sJXFv0KsSLXhl5JPxhBWskAIBHTxJM:8ntZtkT/RWs1F8sXNJJhB0BzI
TLSH
T1FE83A8130360994ADB6603F6017BCA17B33984983FC3EB256795B3392C217E65E9DE4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

edf0c7191857448f_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\edf0c7191857448f_0
Size 272B
SHA256 95cfae037e82a27c7b2f2cb9bbc3b34792a2c4617c0350e705f504841228a1a9
MD5 8cdaa88093cc9259ffa69d14c5509bf6
SHA1 231422d1791dbc96067b09b5da0fbf82d732217d
SHA512 39599e92493ccabff9f6421f027774c5917f2571e48d53b0807b4b3f25d0075ccf7370c134fdfde307827aeaab92a887cfc75e502df8a830e02bb6234fb21a94
TLSH
T1B7D0EBE3108226B4CD083F70F28296F0C7622019C0C6D021C000A82F9B213B0DA09102
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 78ba363a8d23609b071e2df185775377a39de5b151e8a848139e723555b9019f
MD5 2fa3c65d7e8da1bdd5cdb0b75265bbcd
SHA1 c46d310a092f25eefc8afbbbec84a1c0bd03ed4a
SHA512 90a9500da17c6acc1269847f09808e53993841d9523e43183526cf6deb86d424c8d2291a357fa3d0b5dfc7ed4a4305a74f525a0b4ada59c90b2023e13add7830
TLSH
T1595168418250E66CFB6916724CDE35E33AB0CAB149DF5D16C994CDB46B4F394E3B41B0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 c27bc87219014a48d67d88ee66b51bbd2fc93081648b66a8d517902c169f374d
MD5 e2d8dc18f363a5f5b9ad56db2d38e952
SHA1 2724e1019c2f22a64d1cb4f7ba8e5025cb67fcf0
SHA512 96a5d6434cd3ca3cc028afa6e1c1a22e2433f039283319749114b29135689152a01b00e1d01a207337c0c678f94d594f218087e55ad57ef5881ed5221a363143
SSDEEP 96:f7GhUuoIuKr9POkn5axVmCW64HH/6MyhHjvAvzkkSk8:UvNOkn5lCW6HhHzuzkJk8
TLSH
T1CD91D9414290E638FB2477360CDE29A23AB0CD7C8A9F5E16D555CE746F0B38463F19B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe59a203.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59a203.TMP
Size 2KB
SHA256 fe1b7bcedd9570ff698f9e98b81ddff6aea70e15a5ac3e843013be04cad97ef2
MD5 eb58ae85430e4ff2ab76c5c2620408ad
SHA1 a59ca3d8a1849fda8da63c8df7328db0456cf1e9
SHA512 9781e74fb4058f6a15c6982cebda1fcc25704c5271defbafcc3938929aae62038dc798c11e0ea958996635022a71e90541f19f68ec374b5488cc7610b8b9eaab
TLSH
T18E5159418250E66CFB6906724CDE36E73AB0C6B149DF9D1AC894CDB46B4F394E3B41B0
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 20KB
SHA256 b5af3c17ddea0c48235867f93765c0cd3cf3bffae24c28b39d9bb96867d0d496
MD5 8f127b662d6a2fbfd8e227fd38c2ee5b
SHA1 218b7373ecb6e5f73336be905f9a63b700fca448
SHA512 fa9cfe7e71998d50f3cfe0bf1056d36c041866ee208bdd87085f875330fe833f111e3103d2cdd5acb004d6befbd299d51119c37717cc6ca788efdc28c779e41f
SSDEEP 384:D+rQbE1jeU0x//dBelta+aimd5K1NckZJphZW0hZIRxges357MBMguRVAwJ0LW6m:zUPbp3FzXNNwZrwlh
TLSH
T1A8928CFBC7E18E6EC91255F8EA146E1BCE180619473C399A89D4AE07D3F34B0E11169F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 c9974b3141bd5920c6f5e648f25002cb260e8bbc2de30578dad6208a71e86a80
MD5 b8de5b0e0fde627a351668a9c1a7d4c1
SHA1 19205795eab80ccd27cfa7635f1d8632b60b20ec
SHA512 cf819397b7d1962e3f7ef841169b6f1217359dab679e0e95bb67bb6a86d8f74d0cc970d1b366b1bb33111e826b7115ae12efe4c5a3ae92faeee1010ad8db1891
SSDEEP 96:DXOJ2ani0FdjhnZZIZW0nAVzBRxBZIstG3nJB7gZMkN4OcwQ:D+oaimdjhnZZIZW0nAV1RxBZIstG3nJr
TLSH
T150B1CDFB83E4477E8A1196F4AB156E1ACE5C051B436C3CA289F4AE1B63F24F0D10169F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 b0187d11a2afdaba9cc57d6f438f0b133e6a10088399f5508d4a1497b835fc6e
MD5 7f2f9a41b1b455729da82af589d34d62
SHA1 ed3f4f9a188e3b2768a9a642c83cc9d8a7449c40
SHA512 f1ebcdb1cde487c70e4180a22b0451c911e0299227549b23e8da46b6467d6002cf8b2ea58cf38b9c9d973d7a0a162dd0b0b71e144c19212c0cdfcdaa63cf63c9
SSDEEP 192:sxR8RKb9/fsSsUyYhboA8pe1/g6+WNIY2Bc6G6IgD5J:sxR8i9/fsSsUbGG/5IMAf
TLSH
T16B32A815AD28A93B5CCBE21DFB65BF53D2F95033A1901F48A6FC861C04EB6DD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 01c35ba37e9d159d2fcd6395973155a58a43d5bb73845d8c4b8166f77d44a28e
MD5 47acda83391cf520e83a6d1095a59fb1
SHA1 2ac60e930c0780ba1d96715320397c3f3b589761
SHA512 83995f39346b0edc02367c84df3a3a8c5e2e69bcf97fe6ad4f83ca153444ac054f9b8ac09f7eeb8b84061bffe9f458a5ec795d15fcb81fb03b7576221e00759b
SSDEEP 192:sxR8RKb9/fsSsUyYhHoA8peXC/g6+WNjzZ/Y24c6G6IgD5J:sxR8i9/fsSsUbiR/5R/bAf
TLSH
T14D42B915AD28A93B5CC7D21DFB65BF57D2F9503391901F48A6FC861C04EB6DD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 313990f99ef43b75d1f44eb60ab25c5affccaa335e9f1ad0ae7af681c15d8581
MD5 b97f11f6da9647b521555ddfec6eb38b
SHA1 ec0717c3e4f0e9f87da16b7de802b1968fd341e1
SHA512 581537f91813c3d76c8444af83e7d319b17a651250359d2b9acb495b5bcf9b3939c01c26ce1e1c0147c57f7d5cb00b07ab07696dede42ce31023033f37253903
SSDEEP 192:sxR8RKO9/fsSsUyYhJoA8peXsl/g6+WNjv9JY28c6G6IgD5J:sxR8z9/fsSsUbAD/5pJfAf
TLSH
T1BB42BA15AD28A93B9CCBD21DBB65BF57D2F95032A5D01F48A6FC861C04EB6DD120380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 f0c514e053c38c20a0ac1258af760a5e9073b6bdb7753344557b4a65af0af755
MD5 362b452cbea8d14b7d1d4042e4a7c57c
SHA1 8480c429160f19aea989160f875af8a7dfd5334e
SHA512 9b13ca63fe5e9a5b814d0d0b44a7eb321e36875d4f582560db900aeea975d41f3d4739a6938e5abe55a5754e99a69b03c60cefe7a5bd01d4302094e7323a847c
SSDEEP 192:sxR7RKb9/fsSspyYhezoA8p4u/g6+WNIY28c6G6IgIJ:sxR7i9/fsSspbDT/5IPAs
TLSH
T18E32A715AE28A93B5CC7D21DFB69BF53D6FD5032A1941E48A6FC861C04EB6DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 7c31b4a5e68f43246105269f5bc598353ab174be5fddc3d4e3c7c648b70f0c66
MD5 fa47cbe53fb0bc256e27e05a7dd733a8
SHA1 7d46c48741be6223b016e5118f48f76fe9030e36
SHA512 cf71c12cf8ec94b462a9f58e3cfa692a66fbeb9a4648f5185021bf6a88cd8ffac3cf456b7b0371ad446f8f3723f7da05c50924936a3dfbea9d827402358de64d
SSDEEP 192:sxR8RKb9/fsSsUyYhr7oA8peX5/g6+WNjv9JY28c6G6IgD5J:sxR8i9/fsSsUb6K/5pJfAf
TLSH
T1AD42BA159D28A93B9CDBD21DBB65BF57D2F95032A5D01F48A6FC861C04EB6DD210380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 0f1ce46d62720e8548a3bad8779dd494c043f5a63bf376956ba1a1b6a5399047
MD5 a16a1f18f5f2c46471c1909078bce2e6
SHA1 d7439ec7b055813670ee8aa0ab3dde5b72341de0
SHA512 02951d52501bf20540c76f847295eab481e08858e1e700e9782edd2e5e9ba5ef0cd07ea248b06675026b2b26a1dd9512c8852d652a34e007deba858edc72efa4
SSDEEP 192:sxR8RKb9/fsSsUyYh3oA8p4u/g6+WNIY2Bc6G6IgD5J:sxR8i9/fsSsUbyT/5IMAf
TLSH
T124329815AE28A93B5CCBE21DFB657F53D2FD5033A1941E48A6FC861C04EB6DD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 eb7722caa6b6a2469bc2c608a14cd008fc1b39c20c24233af61dccf9d083cbc7
MD5 fb4b6acb6f622b1decf8ecf539ac943d
SHA1 bdec878d0bf75610061000ac6c04cd2e4a968313
SHA512 ac68f5ed025e7e276415ddbcb1138186b64204de2e2fa252fd4a021810700a8dabce2fb4b5330781f2d6c8ba8fc0f0024ddb91aa5ef28edd45fba5dd67f5fd99
SSDEEP 192:sxR8RKb9/fsSsfyYhezoA8p4u/g6+WNIY28c6G6IgDnJ:sxR8i9/fsSsfbDT/5IPAl
TLSH
T17832B815AE28A93B5CC7D21DFB65BF53D2FD5032A1901E48A6FC861C04EB6DD620780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 47fe817cc29505a4fb0e61832a1cbc514c53bdcbce92d547315a9440a63fdc3b
MD5 110e472c2c46bd9db5d2b561f60f031b
SHA1 928d447c7caff6e2686a72eb5872202dae011881
SHA512 c967029ffe5dab809560adb0f539c003b6472e05f570578f322f1fb3d105181917147956119a5053a624bfe7c9088f0a7416cb9b8bf87a7830953f93d7f04261
SSDEEP 384:LbnaaCTfCtgp/FfvDKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVPH9NvRWNroHru:L7aaCDWgptfvD8F1+UoAYDCx9Tuqh0Vz
TLSH
T189B2EA2F640CCB7E8FD00A9DAC596F977E9802C796588D4047FE984C02C7BEA911E4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 cda87e9cf115b64c94b08c0e02c7357f668e0dc72e2c15ec0d7f6995cfe74ec1
MD5 ca04df75f05752c12a7d4fdc36c0b557
SHA1 01ca42aafd36e17520da69b7cf478dbc2f4a10f5
SHA512 727c79520af3b1f1e05207007f63284675a486d425658081e5cba9f7ef44c07413959568b8a4d77eba76e52da43506314dd3f589a576b194ff860c02f4fdb80f
TLSH
T1A8A002650B804222D0362BB56C8103853750CD15550A135398B84054CCA01C04D55614
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 18KB
SHA256 d675bad1a758b07f1ed431a7812bf9fd82a0134557a9f1479faf96798a2a9d7c
MD5 f18b79a3435844f3cd10f1b52c52502d
SHA1 686226dff62991217fcaf2118b30364ed5b08220
SHA512 203b436d074f1f469ce6afb478f21e5847cb9adeecc4318aacd5ca131357810be9a8992d7737bd36a754ccc8f35273e30b64a8a51eacd17024779ac32e0ed767
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/uP:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbA4
TLSH
T15482751CC52C7E3247C92F7D6A2F9D727ACA30CA7081459D798CC69DC31B06DA58A2BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 10a090f40ad9a9e93546e61ef6417a71eb29f933999f0fd965da01c1aca44aae
MD5 ce20f18608c985261e905a2e6128eb96
SHA1 7c7a2d167df035ee95c9802e74ef774323794082
SHA512 d4daa2342d0e7654283a471fd35ab155ecde60b82306714edf01c468e9705717a5bcbdf49a868c0eb2184254ba2a3aefc2e9f2b1d7c6427a20f8e92c6030b03c
SSDEEP 768:YA3jzxgm1m2PKExDmGA5b65Q92RQMPbaq7Vaa5774HY:YA3CEjAF65dQ9q7VaaN7IY
TLSH
T1B6F2BF72ECA0DDB36CF996C03647B2056FF88223D5C84B9095EDAF0D059B9DA431AD1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 8871b1304751abadd86ca7b17cc48443a145609dfab17af59006ba49c4fe4154
MD5 4b176c4036e69a88b3d2e929b16bbc72
SHA1 5719f31eeccd585686f96b9d146933409e1c39d5
SHA512 b75f01d2b7e373a74829e347f3ac964baf45a8913a965c38ada1131253f88167acc9ba2fdd56662bc94921e7f9d598b5c7e4a2ae16b477b377b3170ddd248b03
SSDEEP 768:2A30Lxgm1m2PKExDmGA5b65Q92RQMPbaq7Vaa5774HY:2A3tEjAF65dQ9q7VaaN7IY
TLSH
T130F2BF72ECA0DEB36CF996C03647B2056FF88123D1C84B9055EDAF0D059B9DA431AD1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 3392a12e2d490257b75cd078e8c0d4be11d1defeb1bb0ece964d81bcd1f560b2
MD5 1a4176d2189ade1c0cb2faeb340b5567
SHA1 d489e62d22c9669f824b9412a82521fb340758e6
SHA512 3d2de8748a059178c46e3c01b46b4fcd0b9070b78ec1d5f78f3ff7a7baa68fb842fd5fca437219d10fea5e48ccbf38df61f7cb842255d685a23996bb464903b5
SSDEEP 768:M/UxvxjgC+F3J1xgm1m2PKEVDmGA5b65Q92RQMPbaug:5Zj3+F3OEfAF65dQ9ug
TLSH
T1BE03C032EC64AD73ACF56290365BB346AFB48123C0C99AA409E96F0D06C76DD430BD1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 0490ef0b5a50ed98040ba61183371b79461f3df45e6110487056d34d4fe0639f
MD5 3a0e76bc9420ea5fbd2e394018f21c36
SHA1 ef65c5e37f5b05a80411a1c11e3bffd63fab2890
SHA512 77ca714190843b67528e0539322c7fe42342ff0d8908792ade1f0a84786f2e4a6fa9d5009df083a4f3b3e10bc487acb8226cbc3287b271a0692e99b331e35feb
SSDEEP 768:RFQ33Owg/Lxgm1m2PKpDmGA5b65Q92RQMPbaq7Vaa5774HY:g33/bAF65dQ9q7VaaN7IY
TLSH
T1B103AE73DC90DEB7ADF99BC07A477205AEF48163C5C89690A6E9AF0D009B9DD030AD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 d78e8043e219119bc6ab4c36f4399fdc5f61801a5744e53962eff4df86700fc0
MD5 fb2ae19ea38ba0f70b282371171f8151
SHA1 91cac97144fd123071d21e46c11bfc91b25e37cf
SHA512 1e9d517884caf08b653bc013c204f515bed0101466ceb3613886787563837ba121484110055ec011ac7e9a82c2faad58995c9bbfa32adab5e4b81015d1588e3a
SSDEEP 768:U/UxvxjgC+B3Qx2ogm1m2OtDmGA5b65Q92RQMPbwFj0O:BZj3+B3W+3AF65dQTFQO
TLSH
T1E403C036EC90AEB39CF95280374BB35AAFB84473D1C556A049F96F1D06C768D430B85B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 8c7c63708652e9e965b7d396282238eba19e164504b8e4d9d9313ab3368c7313
MD5 4e451ed134497def23ad59eb1b42500e
SHA1 c6769da8f0d4c6e2c619d928b0d1a7ef13726e89
SHA512 11ac428caacdf435173f382f45b6e7e02d249b407160469f3637e6c16ed325689b1b1da09aec1d1cecef058676d1c027307385a0dd1b5b976fa77a05e161fd9e
SSDEEP 768:RFfb3ewgS1xgm1m2PK0DmGA5b65Q92RQMPbaq7Vaa5774HY:vb3WcAF65dQ9q7VaaN7IY
TLSH
T18603AE73DC90DEB7ADF99BC076577205AFF48263C5C8969096E96E0D00979DD030AC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 cd48314120452369f43afa722a6846d8cc64a0dbf54acb7d8f6499b5c8add68f
MD5 7a91e4cd23421adb6b46e98f62463110
SHA1 a77d0e33d8adaa676f819d4f3568cecc3be9bd93
SHA512 54cf345ffc5ee2a1e1dc795f0a4d8965219b1b3c61ad33c4eae656098eebd5a5d8b6ea1b43e6fefcaf18773200a306aea434b8a44a4e3e2a605ab742415cc749
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 5b5b29cb0b06aa9d90cfb8bcdb5fb55ad3892179e1728de0decd55ed53b037b5
MD5 59bc9fd0f1dd615da1f8293abe98c989
SHA1 463547947e404ee6f1e6dbac1216c7be8ae6a30f
SHA512 604481763d7be8d0fd630412725f5d92dd1b4c69fbf244e4f74a940927696bd452e4e57e7ab4bf974cb25224aa313567daa7f5edfe7167717dad1a0a234af822
MD5 SHA1 SHA512

Submit Download

22210da7-29ef-43fa-af0a-b4690c1e599a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\22210da7-29ef-43fa-af0a-b4690c1e599a.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

hitman3trainer310t3260plus13.zip.crdownload

Path C:\Users\Admin\Downloads\hitman3trainer310t3260plus13.zip.crdownload
Size 848KB
SHA256 740d443b0bcab78b5646f2ed8530dd5759799115aeac0f17db9014c509a6aee2
MD5 62d5a50687ff7db70eed03a8e3d7332a
SHA1 cf34f6f79c997bf54d2e87aacb5822f0d18ad981
SHA512 14c4840648b739cb4606aaee306e025325af545e71ff7bf77b2191ea6536baf26021c7e0052f283259bacd8e9a0ce3466277f44e9e055c787ad851ab73d65217
SSDEEP 12288:KD2FkwY+DqXApMS9gyDyRouteRk2Q3K44yJD/rpl5LhWo+uk6MnHiQibvzf9SKAU:/PTqQpt9GqpUK4VJT+/uk6OiQibv7whU
TLSH
T1310533F8E0F8B0FCD219959AA3DB088EB6210D710F2C466DEC0F6A876D67C346B51953
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4248-709-0x000001A6A6F30000-0x000001A6A6F66000-memory.dmp

Download

memory/4248-710-0x000001A6C43E0000-0x000001A6C43E8000-memory.dmp

Download

memory/4248-712-0x000001A6C4400000-0x000001A6C440E000-memory.dmp

Download

memory/4248-711-0x000001A6C4A70000-0x000001A6C4AAE000-memory.dmp

Download