hxxps://mega[.]nz/file/TNUhxIAC#2bEP_TeW8wG3sGY-3Vh635QJi5VYoakWHjSgmLcTISU

Analysis

user interaction
yes
max time kernel
376s
max time network
379s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/09/2026, 03:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://mega.nz/file/TNUhxIAC#2bEP_TeW8wG3sGY-3Vh635QJi5VYoakWHjSgmLcTISU
Sample260928-ejphsav1ev

Score

8^/10

discovery execution persistence ransomware

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1856	powershell.exe
3856	powershell.exe
5036	powershell.exe
1188	powershell.exe
6732	powershell.exe
1320	powershell.exe
1856	powershell.exe
3856	powershell.exe
5036	powershell.exe
1188	powershell.exe
6732	powershell.exe
1320	powershell.exe

Executes dropped EXE 3 IoCs

pid	Process
4564	5gk3e3axxCF9.exe
708	21Ml2e12T8io.exe
6316	evhj9pqBGhDk.exe

Enumerates connected drives 3 TTPs 6 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 2 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	5gk3e3axxCF9.exe
File opened (read-only)	\??\VBoxMiniRdrDN	21Ml2e12T8io.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 9 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1524	cmd.exe
2864	cmd.exe
4300	cmd.exe
200	cmd.exe
1476	cmd.exe
3952	cmd.exe
5200	cmd.exe
7048	cmd.exe
3932	cmd.exe

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4348	msedge.exe
6208	msedge.exe
2024	msedge.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	msedge.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 14 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-461973139-3212354679-1508698038-1000\{6CD44958-D34C-4BEA-92E1-418CE0532A1B}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-461973139-3212354679-1508698038-1000\{1E0D24FD-ADD0-4361-B481-A63308F70ED1}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-461973139-3212354679-1508698038-1000\{3188082D-D50D-424A-919C-D463F693AF4D}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
1856	powershell.exe
1856	powershell.exe
1856	powershell.exe
3856	powershell.exe
3856	powershell.exe
3856	powershell.exe
5036	powershell.exe
5036	powershell.exe
5036	powershell.exe
1188	powershell.exe
1188	powershell.exe
1188	powershell.exe
6308	msedge.exe
6308	msedge.exe
6732	powershell.exe
6732	powershell.exe
6732	powershell.exe
1320	powershell.exe
1320	powershell.exe
1320	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
6520	msedge.exe
6520	msedge.exe
6520	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1856	powershell.exe
Token: SeIncreaseQuotaPrivilege	1856	powershell.exe
Token: SeSecurityPrivilege	1856	powershell.exe
Token: SeTakeOwnershipPrivilege	1856	powershell.exe
Token: SeLoadDriverPrivilege	1856	powershell.exe
Token: SeSystemProfilePrivilege	1856	powershell.exe
Token: SeSystemtimePrivilege	1856	powershell.exe
Token: SeProfSingleProcessPrivilege	1856	powershell.exe
Token: SeIncBasePriorityPrivilege	1856	powershell.exe
Token: SeCreatePagefilePrivilege	1856	powershell.exe
Token: SeBackupPrivilege	1856	powershell.exe
Token: SeRestorePrivilege	1856	powershell.exe
Token: SeShutdownPrivilege	1856	powershell.exe
Token: SeDebugPrivilege	1856	powershell.exe
Token: SeSystemEnvironmentPrivilege	1856	powershell.exe
Token: SeRemoteShutdownPrivilege	1856	powershell.exe
Token: SeUndockPrivilege	1856	powershell.exe
Token: SeManageVolumePrivilege	1856	powershell.exe
Token: 33	1856	powershell.exe
Token: 34	1856	powershell.exe
Token: 35	1856	powershell.exe
Token: 36	1856	powershell.exe
Token: SeDebugPrivilege	3856	powershell.exe
Token: SeIncreaseQuotaPrivilege	3856	powershell.exe
Token: SeSecurityPrivilege	3856	powershell.exe
Token: SeTakeOwnershipPrivilege	3856	powershell.exe
Token: SeLoadDriverPrivilege	3856	powershell.exe
Token: SeSystemProfilePrivilege	3856	powershell.exe
Token: SeSystemtimePrivilege	3856	powershell.exe
Token: SeProfSingleProcessPrivilege	3856	powershell.exe
Token: SeIncBasePriorityPrivilege	3856	powershell.exe
Token: SeCreatePagefilePrivilege	3856	powershell.exe
Token: SeBackupPrivilege	3856	powershell.exe
Token: SeRestorePrivilege	3856	powershell.exe
Token: SeShutdownPrivilege	3856	powershell.exe
Token: SeDebugPrivilege	3856	powershell.exe
Token: SeSystemEnvironmentPrivilege	3856	powershell.exe
Token: SeRemoteShutdownPrivilege	3856	powershell.exe
Token: SeUndockPrivilege	3856	powershell.exe
Token: SeManageVolumePrivilege	3856	powershell.exe
Token: 33	3856	powershell.exe
Token: 34	3856	powershell.exe
Token: 35	3856	powershell.exe
Token: 36	3856	powershell.exe
Token: SeDebugPrivilege	5036	powershell.exe
Token: SeIncreaseQuotaPrivilege	5036	powershell.exe
Token: SeSecurityPrivilege	5036	powershell.exe
Token: SeTakeOwnershipPrivilege	5036	powershell.exe
Token: SeLoadDriverPrivilege	5036	powershell.exe
Token: SeSystemProfilePrivilege	5036	powershell.exe
Token: SeSystemtimePrivilege	5036	powershell.exe
Token: SeProfSingleProcessPrivilege	5036	powershell.exe
Token: SeIncBasePriorityPrivilege	5036	powershell.exe
Token: SeCreatePagefilePrivilege	5036	powershell.exe
Token: SeBackupPrivilege	5036	powershell.exe
Token: SeRestorePrivilege	5036	powershell.exe
Token: SeShutdownPrivilege	5036	powershell.exe
Token: SeDebugPrivilege	5036	powershell.exe
Token: SeSystemEnvironmentPrivilege	5036	powershell.exe
Token: SeRemoteShutdownPrivilege	5036	powershell.exe
Token: SeUndockPrivilege	5036	powershell.exe
Token: SeManageVolumePrivilege	5036	powershell.exe
Token: 33	5036	powershell.exe
Token: 34	5036	powershell.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
6520	msedge.exe
6520	msedge.exe
6520	msedge.exe
6520	msedge.exe
6520	msedge.exe
6520	msedge.exe
6520	msedge.exe
6520	msedge.exe
6520	msedge.exe
6520	msedge.exe
6520	msedge.exe
6520	msedge.exe
6520	msedge.exe
6520	msedge.exe
6520	msedge.exe
6520	msedge.exe
6520	msedge.exe
6520	msedge.exe
6520	msedge.exe
6520	msedge.exe
6520	msedge.exe
6520	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
6520	msedge.exe
6520	msedge.exe
6520	msedge.exe
6520	msedge.exe
6520	msedge.exe
6520	msedge.exe
6520	msedge.exe
6520	msedge.exe
6520	msedge.exe
6520	msedge.exe
6520	msedge.exe
6520	msedge.exe
6520	msedge.exe
6520	msedge.exe
6520	msedge.exe
6520	msedge.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2056	Main.exe
4136	Main.exe
300	Main.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5096 wrote to memory of 4688	5096	msedge.exe	91
PID 5096 wrote to memory of 1552	5096	msedge.exe	92
PID 5096 wrote to memory of 4348	5096	msedge.exe	93
PID 5096 wrote to memory of 1552	5096	msedge.exe	92
PID 5096 wrote to memory of 1552	5096	msedge.exe	92
PID 5096 wrote to memory of 3612	5096	msedge.exe	94
PID 5096 wrote to memory of 3612	5096	msedge.exe	94
PID 5096 wrote to memory of 5864	5096	msedge.exe	96
PID 5096 wrote to memory of 5864	5096	msedge.exe	96
PID 5096 wrote to memory of 5864	5096	msedge.exe	96
PID 5096 wrote to memory of 2888	5096	msedge.exe	97
PID 5096 wrote to memory of 2888	5096	msedge.exe	97
PID 5096 wrote to memory of 2888	5096	msedge.exe	97
PID 5096 wrote to memory of 4892	5096	msedge.exe	98
PID 5096 wrote to memory of 5592	5096	msedge.exe	99
PID 5096 wrote to memory of 4892	5096	msedge.exe	98
PID 5096 wrote to memory of 4892	5096	msedge.exe	98
PID 5096 wrote to memory of 5592	5096	msedge.exe	99
PID 5096 wrote to memory of 5592	5096	msedge.exe	99
PID 5096 wrote to memory of 4776	5096	msedge.exe	101
PID 5096 wrote to memory of 4776	5096	msedge.exe	101
PID 5096 wrote to memory of 3584	5096	msedge.exe	102
PID 5096 wrote to memory of 2448	5096	msedge.exe	103
PID 5096 wrote to memory of 3584	5096	msedge.exe	102
PID 5096 wrote to memory of 2448	5096	msedge.exe	103
PID 5096 wrote to memory of 2056	5096	msedge.exe	105
PID 5096 wrote to memory of 4696	5096	msedge.exe	108
PID 5096 wrote to memory of 4696	5096	msedge.exe	108
PID 5096 wrote to memory of 4980	5096	msedge.exe	110
PID 5096 wrote to memory of 3828	5096	msedge.exe	111
PID 5096 wrote to memory of 4980	5096	msedge.exe	110
PID 5096 wrote to memory of 3828	5096	msedge.exe	111
PID 5096 wrote to memory of 3828	5096	msedge.exe	111
PID 5096 wrote to memory of 4796	5096	msedge.exe	112
PID 5096 wrote to memory of 5536	5096	msedge.exe	115
PID 5096 wrote to memory of 2456	5096	msedge.exe	116
PID 5096 wrote to memory of 1404	5096	msedge.exe	143
PID 5096 wrote to memory of 5916	5096	msedge.exe	119
PID 5096 wrote to memory of 5916	5096	msedge.exe	119
PID 2056 wrote to memory of 1524	2056	Main.exe	121
PID 1524 wrote to memory of 1856	1524	cmd.exe	123
PID 2056 wrote to memory of 2864	2056	Main.exe	125
PID 2864 wrote to memory of 3856	2864	cmd.exe	127
PID 2056 wrote to memory of 4300	2056	Main.exe	128
PID 4300 wrote to memory of 904	4300	cmd.exe	130
PID 2056 wrote to memory of 4564	2056	Main.exe	131
PID 4136 wrote to memory of 3932	4136	Main.exe	133
PID 3932 wrote to memory of 5036	3932	cmd.exe	135
PID 4136 wrote to memory of 200	4136	Main.exe	136
PID 200 wrote to memory of 1188	200	cmd.exe	138
PID 4136 wrote to memory of 1476	4136	Main.exe	139
PID 1476 wrote to memory of 2388	1476	cmd.exe	141
PID 5096 wrote to memory of 4844	5096	msedge.exe	142
PID 5096 wrote to memory of 4844	5096	msedge.exe	142
PID 4136 wrote to memory of 708	4136	Main.exe	146
PID 5096 wrote to memory of 576	5096	msedge.exe	147
PID 5096 wrote to memory of 576	5096	msedge.exe	147
PID 5096 wrote to memory of 576	5096	msedge.exe	147
PID 5096 wrote to memory of 1124	5096	msedge.exe	148
PID 5096 wrote to memory of 1124	5096	msedge.exe	148
PID 5096 wrote to memory of 6448	5096	msedge.exe	149
PID 5096 wrote to memory of 6448	5096	msedge.exe	149
PID 5096 wrote to memory of 6448	5096	msedge.exe	149
PID 5096 wrote to memory of 6684	5096	msedge.exe	150

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://mega.nz/file/TNUhxIAC#2bEP_TeW8wG3sGY-3Vh635QJi5VYoakWHjSgmLcTISU
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ff981f9c188,0x7ff981f9c194,0x7ff981f9c1a0
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1768,i,2304329001422814259,17340516041895288133,262144 --field-trial-handle=2364,i,8698780863611764569,2264374681616605135,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:2
  2⤵
  PID:1552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1908,i,6533787954585710275,11527101453210907228,524288 --field-trial-handle=2364,i,8698780863611764569,2264374681616605135,262144 --variations-seed-version --mojo-platform-channel-handle=2412 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2376,i,3374544383937691722,97743844212893434,524288 --field-trial-handle=2364,i,8698780863611764569,2264374681616605135,262144 --variations-seed-version --mojo-platform-channel-handle=2680 /prefetch:13
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3584,i,15280555523299076974,2126994706418439878,2097152 --field-trial-handle=2364,i,8698780863611764569,2264374681616605135,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
  2⤵
  PID:5864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3588,i,12616654092924967725,12605431469847668275,2097152 --field-trial-handle=2364,i,8698780863611764569,2264374681616605135,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
  2⤵
  PID:2888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4288,i,18079453109878954341,12211412997805920338,2097152 --field-trial-handle=2364,i,8698780863611764569,2264374681616605135,262144 --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:1
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4300,i,4051622352942916691,3568233262257321033,2097152 --field-trial-handle=2364,i,8698780863611764569,2264374681616605135,262144 --variations-seed-version --mojo-platform-channel-handle=4928 /prefetch:9
  2⤵
  PID:5592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3484,i,1437248942944236273,18407350962617726997,524288 --field-trial-handle=2364,i,8698780863611764569,2264374681616605135,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:14
  2⤵
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5632,i,18168331394384025208,12398494809217618287,524288 --field-trial-handle=2364,i,8698780863611764569,2264374681616605135,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:14
  2⤵
  PID:3584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5628,i,10724103475228037429,2652141955114077228,524288 --field-trial-handle=2364,i,8698780863611764569,2264374681616605135,262144 --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:14
  2⤵
  PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6336,i,2095747944933757062,16050835239779272141,524288 --field-trial-handle=2364,i,8698780863611764569,2264374681616605135,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:14
  2⤵
  PID:5280
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6336,i,2095747944933757062,16050835239779272141,524288 --field-trial-handle=2364,i,8698780863611764569,2264374681616605135,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:14
  2⤵
  PID:2056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6804,i,6468488704144090454,5104989025947054617,524288 --field-trial-handle=2364,i,8698780863611764569,2264374681616605135,262144 --variations-seed-version --mojo-platform-channel-handle=6692 /prefetch:12
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7060,i,7239846646873451155,12734425848038126237,524288 --field-trial-handle=2364,i,8698780863611764569,2264374681616605135,262144 --variations-seed-version --mojo-platform-channel-handle=7016 /prefetch:14
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=7040,i,16178294421194675651,16840503248245638407,2097152 --field-trial-handle=2364,i,8698780863611764569,2264374681616605135,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:1
  2⤵
  PID:3828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7200,i,3801395972302558357,6611334257525414217,524288 --field-trial-handle=2364,i,8698780863611764569,2264374681616605135,262144 --variations-seed-version --mojo-platform-channel-handle=7072 /prefetch:14
  2⤵
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7544,i,14207902466843928303,8424165324536525060,524288 --field-trial-handle=2364,i,8698780863611764569,2264374681616605135,262144 --variations-seed-version --mojo-platform-channel-handle=7352 /prefetch:14
  2⤵
  PID:5536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7552,i,15450081613171125169,9397908031464286872,524288 --field-trial-handle=2364,i,8698780863611764569,2264374681616605135,262144 --variations-seed-version --mojo-platform-channel-handle=7580 /prefetch:14
  2⤵
  PID:2456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7312,i,6620562651204275070,18023467621290149009,524288 --field-trial-handle=2364,i,8698780863611764569,2264374681616605135,262144 --variations-seed-version --mojo-platform-channel-handle=7576 /prefetch:14
  2⤵
  PID:1404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5720,i,12767574913836484491,393662352147824874,524288 --field-trial-handle=2364,i,8698780863611764569,2264374681616605135,262144 --variations-seed-version --mojo-platform-channel-handle=5732 /prefetch:14
  2⤵
  PID:5916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6468,i,3092911391803254138,336520839972492152,524288 --field-trial-handle=2364,i,8698780863611764569,2264374681616605135,262144 --variations-seed-version --mojo-platform-channel-handle=7212 /prefetch:14
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7604,i,16292904426236258573,1441629946918949528,2097152 --field-trial-handle=2364,i,8698780863611764569,2264374681616605135,262144 --variations-seed-version --mojo-platform-channel-handle=7532 /prefetch:1
  2⤵
  PID:576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5088,i,17364170796713942084,3631868928830608211,524288 --field-trial-handle=2364,i,8698780863611764569,2264374681616605135,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:14
  2⤵
  PID:1124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7768,i,7595314787334944674,13774719518218832911,2097152 --field-trial-handle=2364,i,8698780863611764569,2264374681616605135,262144 --variations-seed-version --mojo-platform-channel-handle=7652 /prefetch:1
  2⤵
  PID:6448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7884,i,5986628992615211451,5947977779713105522,2097152 --field-trial-handle=2364,i,8698780863611764569,2264374681616605135,262144 --variations-seed-version --mojo-platform-channel-handle=7664 /prefetch:1
  2⤵
  PID:6684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7928,i,7029119972830370029,1516351570574792710,2097152 --field-trial-handle=2364,i,8698780863611764569,2264374681616605135,262144 --variations-seed-version --mojo-platform-channel-handle=8128 /prefetch:1
  2⤵
  PID:6788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5860,i,4435773211405277464,6228976161641216166,262144 --field-trial-handle=2364,i,8698780863611764569,2264374681616605135,262144 --variations-seed-version --mojo-platform-channel-handle=7956 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6132,i,17020729003489522050,2993664031065594177,524288 --field-trial-handle=2364,i,8698780863611764569,2264374681616605135,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:14
  2⤵
  - Modifies registry class
  PID:6732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5660,i,4539243606816270528,13127532095366529771,524288 --field-trial-handle=2364,i,8698780863611764569,2264374681616605135,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:14
  2⤵
  PID:5564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3868,i,9223937053707299439,803896827071349630,524288 --field-trial-handle=2364,i,8698780863611764569,2264374681616605135,262144 --variations-seed-version --mojo-platform-channel-handle=3856 /prefetch:14
  2⤵
  PID:7144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7996,i,10577462401738897289,8683333462686112070,524288 --field-trial-handle=2364,i,8698780863611764569,2264374681616605135,262144 --variations-seed-version --mojo-platform-channel-handle=7552 /prefetch:14
  2⤵
  PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3672,i,15341532806368656778,11533505098180076849,524288 --field-trial-handle=2364,i,8698780863611764569,2264374681616605135,262144 --variations-seed-version --mojo-platform-channel-handle=4160 /prefetch:14
  2⤵
  PID:1824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:6520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x270,0x7ff981f9c188,0x7ff981f9c194,0x7ff981f9c1a0
    3⤵
    PID:2836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,10071202114596530630,2777953295946027627,262144 --field-trial-handle=2320,i,11138681563970250883,4495099278508125141,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:2
    3⤵
    PID:5976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1804,i,6392311278400061334,4126645332594249553,524288 --field-trial-handle=2320,i,11138681563970250883,4495099278508125141,262144 --variations-seed-version --mojo-platform-channel-handle=2396 /prefetch:11
    3⤵
    - System Time Discovery
    PID:6208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2564,i,1931445759133289060,10605711769013118294,524288 --field-trial-handle=2320,i,11138681563970250883,4495099278508125141,262144 --variations-seed-version --mojo-platform-channel-handle=3112 /prefetch:13
    3⤵
    PID:5376
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4328,i,13743505212862405272,15259223551729649886,524288 --field-trial-handle=2320,i,11138681563970250883,4495099278508125141,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:14
    3⤵
    PID:2156
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4328,i,13743505212862405272,15259223551729649886,524288 --field-trial-handle=2320,i,11138681563970250883,4495099278508125141,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:14
    3⤵
    PID:6932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4552,i,13588049928479172326,11211755827132765378,524288 --field-trial-handle=2320,i,11138681563970250883,4495099278508125141,262144 --variations-seed-version --mojo-platform-channel-handle=4560 /prefetch:14
    3⤵
    PID:2236
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4660,i,4534908617200318140,10498064842150297318,524288 --field-trial-handle=2320,i,11138681563970250883,4495099278508125141,262144 --variations-seed-version --mojo-platform-channel-handle=4592 /prefetch:14
    3⤵
    PID:1172
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4928,i,17453692763172596227,17688663523368488146,524288 --field-trial-handle=2320,i,11138681563970250883,4495099278508125141,262144 --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:14
    3⤵
    PID:1888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5012,i,11631285998965172786,4925817052013184762,524288 --field-trial-handle=2320,i,11138681563970250883,4495099278508125141,262144 --variations-seed-version --mojo-platform-channel-handle=4968 /prefetch:14
    3⤵
    PID:6600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4592,i,8684500850815638825,4278852839543499118,524288 --field-trial-handle=2320,i,11138681563970250883,4495099278508125141,262144 --variations-seed-version --mojo-platform-channel-handle=4612 /prefetch:14
    3⤵
    PID:4476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5100,i,1300058921281867753,7355482340105925420,524288 --field-trial-handle=2320,i,11138681563970250883,4495099278508125141,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:14
    3⤵
    PID:4920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5196,i,9821624788549183626,12716454296970585248,524288 --field-trial-handle=2320,i,11138681563970250883,4495099278508125141,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:14
    3⤵
    PID:3700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=4604,i,7926309776997504565,1857480444886607072,2097152 --field-trial-handle=2320,i,11138681563970250883,4495099278508125141,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:1
    3⤵
    PID:6840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5020,i,14585042794594033050,10974843931610458022,2097152 --field-trial-handle=2320,i,11138681563970250883,4495099278508125141,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:1
    3⤵
    PID:4612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5708,i,6668523870013602303,8031539925187747378,524288 --field-trial-handle=2320,i,11138681563970250883,4495099278508125141,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:14
    3⤵
    PID:252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5712,i,3290820222853169332,10600554844204735273,524288 --field-trial-handle=2320,i,11138681563970250883,4495099278508125141,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:14
    3⤵
    PID:3728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6256,i,11568265656446939319,13830676921315475650,2097152 --field-trial-handle=2320,i,11138681563970250883,4495099278508125141,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:1
    3⤵
    PID:1228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
    3⤵
    - Enumerates system info in registry
    PID:4696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x238,0x328,0x7ff981f9c188,0x7ff981f9c194,0x7ff981f9c1a0
      4⤵
      PID:916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1892,i,9994247918065804497,14802262692052975866,524288 --field-trial-handle=2244,i,9619758931470928384,5949890160183057173,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:11
      4⤵
      System Time Discovery
      PID:2024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1592,i,36856923097820700,10564497801642483694,262144 --field-trial-handle=2244,i,9619758931470928384,5949890160183057173,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:2
      4⤵
      PID:4148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2536,i,16880681708550118582,18036863386783625535,524288 --field-trial-handle=2244,i,9619758931470928384,5949890160183057173,262144 --variations-seed-version --mojo-platform-channel-handle=2804 /prefetch:13
      4⤵
      PID:3824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4252,i,712113627515578889,7873833266221175821,524288 --field-trial-handle=2244,i,9619758931470928384,5949890160183057173,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:14
      4⤵
      PID:5636
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4252,i,712113627515578889,7873833266221175821,524288 --field-trial-handle=2244,i,9619758931470928384,5949890160183057173,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:14
      4⤵
      PID:2100

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3360

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5636

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4388

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5568

C:\Users\Admin\Downloads\RC7\RC7 Launcher\Main.exe
"C:\Users\Admin\Downloads\RC7\RC7 Launcher\Main.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2056
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C powershell -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath $env:TEMP"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1524
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath $env:TEMP"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Enumerates connected drives
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1856
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C powershell -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\ProgramData\Windows\Microsoft','C:\ProgramData\Microsoft\Windows'"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2864
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\ProgramData\Windows\Microsoft','C:\ProgramData\Microsoft\Windows'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Enumerates connected drives
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3856
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C gpupdate /force
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4300
- - C:\Windows\system32\gpupdate.exe
    gpupdate /force
    3⤵
    PID:904
- C:\Users\Admin\AppData\Local\Temp\5gk3e3axxCF9.exe
  "C:\Users\Admin\AppData\Local\Temp\5gk3e3axxCF9.exe"
  2⤵
  - Executes dropped EXE
  - Checks for VirtualBox DLLs, possible anti-VM trick
  PID:4564

C:\Users\Admin\Downloads\RC7\RC7 Launcher\Main.exe
"C:\Users\Admin\Downloads\RC7\RC7 Launcher\Main.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4136
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C powershell -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath $env:TEMP"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3932
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath $env:TEMP"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Enumerates connected drives
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5036
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C powershell -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\ProgramData\Windows\Microsoft','C:\ProgramData\Microsoft\Windows'"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:200
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\ProgramData\Windows\Microsoft','C:\ProgramData\Microsoft\Windows'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Enumerates connected drives
    - Suspicious behavior: EnumeratesProcesses
    PID:1188
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C gpupdate /force
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1476
- - C:\Windows\system32\gpupdate.exe
    gpupdate /force
    3⤵
    PID:2388
- C:\Users\Admin\AppData\Local\Temp\21Ml2e12T8io.exe
  "C:\Users\Admin\AppData\Local\Temp\21Ml2e12T8io.exe"
  2⤵
  - Executes dropped EXE
  - Checks for VirtualBox DLLs, possible anti-VM trick
  PID:708

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:1404

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\RC7\RC7 Launcher\README.txt
1⤵
- Modifies registry class
PID:752

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4676

C:\Users\Admin\Downloads\RC7\RC7 Launcher\Main.exe
"C:\Users\Admin\Downloads\RC7\RC7 Launcher\Main.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:300
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C powershell -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath $env:TEMP"
  2⤵
  - Executes a command shell one-liner
  PID:3952
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath $env:TEMP"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Enumerates connected drives
    - Suspicious behavior: EnumeratesProcesses
    PID:6732
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C powershell -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\ProgramData\Windows\Microsoft','C:\ProgramData\Microsoft\Windows'"
  2⤵
  - Executes a command shell one-liner
  PID:5200
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\ProgramData\Windows\Microsoft','C:\ProgramData\Microsoft\Windows'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Enumerates connected drives
    - Suspicious behavior: EnumeratesProcesses
    PID:1320
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C gpupdate /force
  2⤵
  - Executes a command shell one-liner
  PID:7048
- - C:\Windows\system32\gpupdate.exe
    gpupdate /force
    3⤵
    PID:3652
- C:\Users\Admin\AppData\Local\Temp\evhj9pqBGhDk.exe
  "C:\Users\Admin\AppData\Local\Temp\evhj9pqBGhDk.exe"
  2⤵
  - Executes dropped EXE
  PID:6316

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Downloads\RC7\RC7 Launcher\gup.xml
1⤵
PID:4104

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:7160

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f7d227d405ece8bd8098a8e44971faf9280940a051f6b8e73acb76d6c46cedfe
MD5 6ee9ea967814fbfe7aa7c6dfc4f88c9f
SHA1 df9305406195f563be880e53b14b3461d85f326f
SHA512 6d518871b5de645fdaf42a7316dfa5c0f1b8e2c6b079d109bc811e20d8b453549e734fab95f51143e8ddab482c075fa1cc1ab1bfade794bdf772d04856a37e61
TLSH
T118D0801559756EF0F133113D02A1465175ED9652ED03110DF5A145574CA434316B1DBD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 af1a4ea36b4b665804bfaa9b6fdc751c51901aff8ba37df480b15a9afc22aab7
MD5 6b391dc049f0d75e3d7fe5f95a9400c4
SHA1 70eb07413a1c7a02851a68eeebda690cb2bcdb57
SHA512 bed4f20d6bae9d5b0d07b3ddd05d6c7d86f7e6a11bffe1bec3207e0990d8a1cdf3d734611fff9ef35866d644e9f3825ec2ebdebd95a1e9bd220596762b725d0e
TLSH
T1E4D0C084A1700DA0E123003C0042531130DCD310FC032008F0A29112385521113700B9
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 724f185485d929584b5bcf5ef08812a007ea97fb599353176b0ab16da26f3456
MD5 c7b28ce461a89cdbb7c0b05bbed2fbad
SHA1 5f71346b86fa038231c089d043c27ad103969aef
SHA512 95b07b6c7dc2ebd922f92d465c2a10a5b1373e645ca950a2e70801be36fc25c1236fb4250d6284b4366298a7642c425a618bbdc7c3be3833623dabf74a3d6afe
TLSH
T178D0CC80A2B00CA8E233003C0082A32230CCE320BC032008F0A2822238AA22223B00FA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4fc7dcf7387fe20ebfe8604da12039dc01420b7c4f9203598cac361fa8e97926
MD5 c3187641f7a33614939d03f0d43ad5e0
SHA1 82b3d0d3fa3092b29b9c8b55ce9fb9bba31c9c23
SHA512 ac0b9a042b5883e5cb0458cdeae19e251d85b3b88bb576dec24d66444085275504065eccb22c8674162977df0a0d2f69723a5923be85a9c5ea85f46af2ce9edc
TLSH
T13FD02B3176B99CA1D193103900C286A014BAB000EC0501843A2280050C40109133120A
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2faa1b1440ef2e1a669881f74143ac7857706d1524c89e682f713c8f3d38ab23
MD5 6a131a77b0edda45a2895a3d33a867a0
SHA1 2be1a2b3794fa396138562716cc7e4a4f17caa66
SHA512 20cb3d576349a78e3fec9e8b5e0726835f04e7dd74bb2a15edba4417611cdd35bc2d2525fdae7879e8d01d4643f26df1c05a44fb125105ad0bcee8ccd0257571
TLSH
T1F6D02B3176B99CA1D193103D00C386A014BAB0009C0501843B22C0050C401091330206
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 4918f69702b8aae12da0f484800afedbf8893ff6184e2161bdcc27dd0563f657
MD5 25a84abccaba464b5ae6e84c503fb945
SHA1 ecfe5efbd653bd041cdc44909bf1113bc70fb8bd
SHA512 8d8d2388ffcbcc582c54a936fdf14a719bac661aa8cc93b9ab230d9e71e4bcdf573951ff3566c04dcc9667eae49b8764b0befe9ac03f5e9e6fa513e07430a570
TLSH
T1DDE026891AC8C22EA202744B416C8F4CC281370B9ACC7F1A2700C4D9710A080FBE36A5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 9c15f0e5b726494cad94ba80ddb0e54c886de45815de65583d7a319c9dc87581
MD5 e71bfadb7281ead12549842de094eb96
SHA1 4948fa2a388b9d230fa8435cfebd3894dcf61c61
SHA512 94aab68b8afa4d58b3ded2a02381a0559296cde4f58a2451edaabb4d2cad79b8ed5f82778c130243c275c91cce0cca2ee41b4cdf46bc8160f656ee95d819e320
TLSH
T118E078D93DC5C25F63006447556DC70CC1C13B0FD6CCAB055B0095487A43050F7C79E1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 dda6e101e8005df635af096b6035e61e7571ca7e93f64814a11a29160d01a8f9
MD5 e1377de9a6019bb67a7ce187ad264770
SHA1 c45421defa2a3109922d9966f247f29d7b9173df
SHA512 f68b4d8ad53c2579acdcb8853d3f6f31a966f3de4d881d5d5260306409ebeaddeeb40e27d71b851d32e6ce034a7a8db9c9e5807b152230d0d9ab7d04486cb9e6
TLSH
T1FCE020CE3ACCC29EB204A547416D470DC190370E97CCAE6A1708C9C970020D073C1551
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000065

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000065
Size 416KB
SHA256 e005e7c659d8ecb0e22ab812441fe994f65b27ebfc7b35e7e8d60bb12a6820d3
MD5 e1bf2fdbc0f04cc64f4ef4fe99b1f67d
SHA1 14bd8bf4d0d932191b0b0240960c7b0e2719b73b
SHA512 2b743974cbe3db526a377289aa867e34e885c952cf4659a46ce93acecb08bd1d112119906818ed574460784c10e2b470dd035edb73aa47ec805d0177ba4a3c50
SSDEEP 12288:+SHC66TjhX40sJswpxBCeQ5XLQB8GYB0ZspRQIn:hHCzHhX4d1CtQ6++pRQIn
TLSH
T1799423295599B04367B2AB7B09B261337D1AC0336B5F00152E20DE29FCBAF8F9D85D71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007c
Size 39KB
SHA256 e7ed20696f6775f854bccad4436da6af6e1d2b0b8a7e2928b5c56d1461fa5207
MD5 9c169564ea03436127ca99428994d691
SHA1 27a259f38695e2422fe850a14c804b12f6d5a081
SHA512 1821ae046ae480577becf1e28f1102673b36fd3367abcd266451a0261c143114b02150a09ab8779db0d8c7bdb85c819f127fd0e28e45fb324af129d259d8bfbb
SSDEEP 768:sfrbZmmnUnNP8SflXtrmsrWwcbBb/n13yUwozjaEd:sXgmnUXflXlmsro1CFoz5d
TLSH
T18B03F19C9D7F7599FA418EEE88B201DA20C903113FDEB734C97D91989A8CD442362C5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008d
Size 45KB
SHA256 96dbd3f9de6fcd819dd7a012116a9192aaa29723fcf7b47ec261a02e8299ca43
MD5 28f4f08b97691345eebc881794bf21ca
SHA1 88aa13c9ffc2baa4c85bf12f561711a0d999b81a
SHA512 8bd1bd1c5fb8084789c104d870c4169d6ff8d46cb4d48914cba5e35d769cc158b12b1595209ef2613a6f3d32b47a36346beb6242b5fb337c2c936b38dcafbd0e
SSDEEP 768:IzRjFs7mNAHMDtN13DngFwR5mkcEYlwNT0Gg+mWu6vQGi66hxSjRnaTO8BB:Kr1NOitN13DnbIvWDgiuQi60OaieB
TLSH
T1492301EE925D13DFFFEA2A058B9CA2088CCD41F55BE544E8D35E4B1079823EDC974026
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 6KB
SHA256 841371d434e7a7027fb0513831bd021b5ec2c2eb6db0fd2a546cbc1f5ed5175a
MD5 3dc599c59e118da55d9427be82577831
SHA1 e96382e0d43891106c82d2b8832cd33224ea2641
SHA512 3667fa8f93b009039bae332ed169718bae387434309d1a6e88dc1603c0026388ad9fc9a89b6149f25185a1170d3ab14632ca1a6f7b3e17ea7c839c5aeac52248
SSDEEP 96:t6uw0jyBEI98k5uUwBRabkJY1slc4ZjXqbZdx4WlCAQoMOP3QF4IqjqZQhpW:oBlCIak56ssigjXqdd6eMOP3QSQAo
TLSH
T199D1E89997F179FDFF6C2670B9843CAA3DA43A9998C64F4F4104D894BE43EE04290308
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 726de56e81aba058e0703d4f508606f41de15f12e626a6832fce0d6c323fb428
MD5 c81653a9927352795076c5bb5fc57132
SHA1 7946242bbd1d69fbd92db57a001bf1af81a33e7f
SHA512 2f861973beb3116659a61c4f6b8e9f2dfd72e87bd8868b958beef99d052e4727a10a1a101c8ee536affb157f14a0fdbd316d582ab4a3905acf7f7a40b67de7af
SSDEEP 96:DzqN41udeqxnHr28UbRY0VpPn0DzVaRPB760cHvbBhUZETJ:3NInHrfwGb2pIDU0
TLSH
T16DC1C69CD3E276FDFF7C2630B8883C966CA4BA59A8D25F5F51009CA47E53ED14185318
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 51fb7327fefb7cbfc5eb7b9316b2fed3231f7d49137217b325c3cd70a0c18e30
MD5 1871678f7c561db02be1541a17d57ad8
SHA1 51a91dbb2c34cf153cb6c3951804a998b49bcd51
SHA512 d4e5cab8baa52770c0b5658b57efe19163c0eaa0f1bc81ad53f6a9a2d2f7c52283f0c501340cb908facab5abf27fad53eee22f6f3f02e95b7b789b52fa758a2b
TLSH
T19041924196B57294FFB93B71C9C076873AF08681E4C3AE470594CCBA8F093D483C4308
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 ced5aefe292ce199531a8ee44f3aeb54bb6d5dd5512f31518674fedcde38fcf4
MD5 8139bf41b071dd7112d38f8caeaf3f65
SHA1 951994288d790a0833311eca484b27f14c2c5603
SHA512 b629b9d9feed93471525bc5be232a4352e1b1518202d0353422132fa33a39b00620d42646a0c94efacd90c06594ff00ca8e23dcd0abd82d637e4b6b6eefebaeb
SSDEEP 96:76uw0jyBEI98k5uUwBRabYY1slf4ZjX99ZYLK4WlCAQoMOP3QF4IqjqZQhniW:+BlCIak56Cs1gjX9jQxeMOP3QSQAp
TLSH
T1BDD1F99997F179FDFF6C2670B9843CAB3DA53A9998C64F4F4114D8A4BE43EE04290308
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 4e578846120306c3fe7b28cacb71394b8eedc6a33c30661a94a609ee6f090f79
MD5 9d09dc078b144cd23d03e5957d1cfd01
SHA1 a83206bb0adfeefbf4e5a8606f90a7fae73db253
SHA512 f3f42171f846cb8887ea396203b559f526525a7d8f1f1e95a1f151f843de3e8fc8c0343319494d79d01d5766ff889a9b7c074daec407d5294853bdf91593fd50
SSDEEP 96:d6uwBjycEN98k5uUwBsabYYRslg4/dXpZU9ZYtKbWlCAQoMOd3iF4IqXqZQdnH:YBUxNak53qs26dXpaj6ceMOd3iSEgH
TLSH
T1E6E11B8993F279FDFF7C2670B9843CAA3CA57A4998D60F4F4104D8A4BE43EE15294308
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 3caedf81f6bfcbf331daadbb97272000da3294905b19b3b7d4ad0f636e24ce6c
MD5 db323d5559ecdfd7c30e7485f7a87f85
SHA1 e34c9f85bcc70cdf1891ee7446c81205650855b9
SHA512 a339a6e509da1629f8e9ba768b90aeca2df1d85507cf8868817d59350c896661d47a40581f1f290fbabe6c2f34663e68c0c57cd781eb937470a131cdf9eb233d
SSDEEP 96:g6uwBjycEN98k5uUwBsabYYRslg4ZdXpZU9ZYtKbWlCAQoMOd3iF4IqrqZQdnF:9BUxNak53qs2gdXpaj6ceMOd3iSkgF
TLSH
T120E11C9997F279FDFF7C2670B9843CAA3DA1BA5998D60F4F4104D4A4BE43EE14294308
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 319B
SHA256 d945fb795e0b4cb6b815806faec1537931b3a21140749af84bbc03c2192e498e
MD5 6042aa09a479720c414654ca63dbc34e
SHA1 99fed633534515384d167a7fb2fcc4ae3055c982
SHA512 1d262493d80df5dd2c6927d0a16467c351ff5919f46023a357d913c883ba50c6fbe739ea30e980219c8bf070e003ff23a20d3422343f5a578a39b312d534c9d2
TLSH
T1CEE07DC815CEC129905E78D38778D749C3D03703FB8C3E021748C84C7143641B7A7281
MD5 SHA1 SHA512 TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 28KB
SHA256 f246e1cb936cdb5ccc76093192f39e1b46aaffe5499c93cb16f68c069b084c76
MD5 7f2be612193180bac2fff7e7be7a0067
SHA1 4358b7b573ecf2eb03b396dc71ad4ffe0890a359
SHA512 df8de9942839bdd15285c4157461f1fe5b084c06a0661d3e7b0a0cc2a36ce00f7a0547d314c0d8ee611968ab7c0da7474dd359b68b4c5d316452a61924f170b1
SSDEEP 192:EarbuaVTfrbuaVuKzSJ5xFgyNeqJomyoaNWKmF4TRBH:TBypFjvJoAfF+X
TLSH
T1B1D27D6BEF357814CBC21FBB635D28799C3B815DDE668C88360CD0282EFC45346592AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 224KB
SHA256 3b247c38dc156b6def8e1494a23fa1dd517f96f740b73acc54021b3c08f0c625
MD5 9b5abf306919ee83f2cd4a39ccbeb82a
SHA1 a8be04ec4d291ce5ad47d817fe304d0302ac62cb
SHA512 3a0ef48858eb591adbbca47ded4567fcc793fa4e67def45b08be1e6715882b7d0198f3285f8442925f93793fd92037174618db0e47a6a5a83bf23ac353be26cb
SSDEEP 192:c9Mt6Vx4H+bF+UI3iWGV0WN3qL/PMVVV63:c9n4IkUI3ijV0WN3qL/PMA
TLSH
T10F245E5E5B602712CDBD813668EB44B35C6DF03FCB5366DA686114B4CEE2652A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Size 50KB
SHA256 d0ae9ba67b064385a35d6d349b787d3b7fbb79c52d331cb05317f2ba5d8e9758
MD5 892033a19f1c88a9442f590811e0c424
SHA1 1b8840f50e90a399d3f8a5e0c6d789855d8f9002
SHA512 3dd41c320e77a008d1f3dd827818b4c04fd4fc397e4a8c74efd7f1a5da5817a11f1aac291e5c3525aef697d3635a5da002ba7d0757596e4f018406102f458d47
SSDEEP 96:ckYUCn8MouB6w9fUP3mwilmqUvJKLRebG32ff445:eUG7Iw9f2ixcf4g
TLSH
T18733331F2B682801C8698632BCB155F2AE7DA03F8B53AED22CB554254D75862F02D5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 0e0991b44a7b1a0cd9d16ca988b9fc7dc126a44ba286a1b1e617e7c62a2f787b
MD5 35df6d77429bfa9be14dad664178fe28
SHA1 6a79c54b644b41359145ea4b6e9e51632e1cb792
SHA512 bcb3081ecd1fbae6c9c61c480c8911f7da464edb5835446c272bbf3661836b94ee4f2750e612a781ad38245c7410b0d941048b149147327f4343748ea4f2322a
SSDEEP 192:DWTZM08+FI1eomjhnZ12qLqjhGMHu9fXcnj8Aj4m2HxnQDyvgiIk75TntC+Gk:DWTZM01S1eom5Z12qLqjhGMHu9fXcnjM
TLSH
T1C402EEF783B5866DDA1196F0EA04AE1BCF5C0521436C386A89E4BE17A3F3471E141B9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 a0b279a60a4893e1d9b54e9e7153c020c9f6243f05fbfd0817be6d91cddd7498
MD5 e35599573601558098e2bf401dd3741f
SHA1 906ce0d294c84efdf7a7a7dc3d474ee43bb721b4
SHA512 d4d39e2a498c3da735f10cf58158bcc07fab1f85111bb8d5ef1eacda07fda2b10020193703777dc503c6352ca6ae3bd94af46ab8ac5cbe3e28c227cf3873d6c0
TLSH
T18E51C9F7C3F4867D9E0196F4AA046E2BCE580515536C3C5A89E4AE1BA3E28B1E141A4F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 d55381c1f828936dd2752c35c0c5f8200434be65d7ba9cbe2e0ed960d671b4b1
MD5 92271081a6c5df9c4b7199535b904bca
SHA1 fa859349a54b7597505945772836f9fa12b92ec5
SHA512 b142c3767244dce747a8582f6fefaff99c3f1331c2e3ef15a544b243a1ecf8fd44ea63a9a4145a4a591f604d90fc8d56ee7f51ffa6a38e82802b6f4db40b0efe
SSDEEP 192:DfTZM08+FLaimdjhnu12qLj44qkjhc75GMaHxAu9fXHcTaS2GtnmQhG7:DfTZM01xaimd5u12qLE4qkjhc75GMaRN
TLSH
T135F1DEF783F5866DDA1196F0EA04AF1BCF580525036C386A85E4BE17A3B34B1E101B9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 02cb11bd4e894c13b6c03f2d2ced59eaa0fb7e9be743ff2d0304d70cc130b13f
MD5 8702e9ff36a113ec9bf0dc066c5fe652
SHA1 88dc8368c9242d8f6d7ab251e17204bdf8896f03
SHA512 9c8403f58dfaa027305ade5a47b41cf9a715576b23659568550f6963db2cce011c63eb3343af522abac72eecb1050aa2651718b0a6aeed69f7df6b3981dc22a0
SSDEEP 192:DWTZM08+FIeaimdjhnZ12qLqjhc75GMHu9fXcTaS2Gtnjk8Aj4EI2HxnQ+:DWTZM01Seaimd5Z12qLqjhc75GMHu9fN
TLSH
T149F1CEF783F5866DDA1196F0EA04AE1BCF5C0521436C386A85E4BE17A3B34B1E141B9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 ea41ade43c163f9371226ff035d60b99a413c6c3c7342d32e0add00fc87aab6d
MD5 f524eac94a770d4816ad457a31602cd1
SHA1 76a61f115c8c59a074c6a6db57559e6ec495c37d
SHA512 302873dd94f29fa9342986f34320e19872e8793adfba330ea38695d1f303a48c32e3886802240f71f2b0e903e4199d86e09647ae314b7aac29489ee2a3107dd6
SSDEEP 192:DfTZM08+FIeaimdjhnu12qLj44qjhc75GMaHxu9fXcTaS2GtnmQTk8AiVx:DfTZM01Seaimd5u12qLE4qjhc75GMaRb
TLSH
T19402DEF783F5866DDA1156F0EA04AE1BCF580525036C386A85E4BE1793F34B1E101B9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 209B
SHA256 7b4d3dc411988cbb328f3f95bf4dd06b78101ea27e8b7af9cef3c1b825add543
MD5 f95419e7085a2ee49c2fbc30c360b6de
SHA1 a98aeb2e068f33b34c0bff9853fc7e745271504f
SHA512 08eba978f404efb2feff125789f1ca4b1c637e1a2da9c91cfaa2c8bf1cac3b3d3e0cd41c20e98cb925a8402ea9747a2b145cbaeeab568071e98a6393d66bb1ad
TLSH
T15DD02267230C30B5B6AC2EC5406AFCCFCBBB10A10883E9D610D09898267A86C0D87140
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 3KB
SHA256 468cfc32f3ef18bd4a2e42fa4e5cb9bdc9714c0a8bdc70fd67636f7ea7045111
MD5 6a34f98292f47781b11ec171bcac6ac5
SHA1 dd21a4ad3f4cd83480c654e77981727fc4f57f3d
SHA512 cd43da9d3491c4338361fcd62ea8827bba1a758e4b2239e3572e95538f424ca71706176c5cc619452aed838ab646a908b932219b4f9c60305d1f6f2d5cdeace1
TLSH
T12A815C6FC6BEB437202849BB1E59F8095DFBA8361143A4F4DA97823C70C29F31F56026
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 e47f7c385ceb4aecd97961ce5cf0d9bb3a75382b90d590e205fccd938ec9020f
MD5 50a57785976eaab8f4e46be3d9e33bcb
SHA1 deda076e992d7dc51316a219eee49e229882be7a
SHA512 a844f6099e879b791cf32fa2e163d429948204bb233d4ba70392ab14d7b8434a88604c3bc09cc14e2ea29d896f08041f282432dae3186ee5942f768c9e3359c4
SSDEEP 192:sxRARjO9/fsXssCiyYhuzoA8pSW/g6+WNymt/Y24PNGfIgDxJ:sxRAI9/fsXss3bTB/5R/Omn
TLSH
T18742A556AD28E97B4CC7D20DFA69BF53E2FD5032A0915E58A6FC861C04E76DD620380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 58cb9417f87febc7743d6768105d98a812d24ad947de3870cabb57465e9994d4
MD5 900cd18bde4d3a4b45215faafa7209bb
SHA1 128e8c6a64bd5a18183c8268c12b7aafe45375f2
SHA512 16266362e6c9448801cc3b273458fd1a46e71b97a9ed38d2d191fc77b413df910aa523730e922bc222b380890aeec5a37d7f0eebd71c956ce09a32cd78004d9d
SSDEEP 192:sxRDRjb9/fsXsQCiyYhuzoA8pSW/g6+WNymt/Y24PNGfIgIJ:sxRDl9/fsXsQ3bTB/5R/Oms
TLSH
T1FA42B656AD28E97B4CC7D20DFA29BF53D2FD5033A0915E58A6FC851C04E76DD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 8fd4a6bb7067776cba9b77cd39170428be3f0eb86459e22c31d0cfcc95a96da5
MD5 ebb2aecc9c70a95ca6d50209d18b1047
SHA1 eee4a0f701d26f31bc46e7af3022e5adc32b48eb
SHA512 6ecb8aa56090836f25428c455744da0afe8f9a3e742cb2b7a722defa6b52da5fa36267de94f31381cc0ef5ec29192974ee3a7aa1d09a257292eb73ee5f4eefa6
SSDEEP 192:sxRARjO9/fsXssUiyYhuzoA8pSW/g6+WNymt/Y22PNGfIgDHJ:sxRAI9/fsXssZbTB/5R/cml
TLSH
T1DC42A556AD28E97B8CC7D20DFA69BF53E2FD503360911E58A6FC861C05E76DD620380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 51d2f51bd976578c70393b40abd05e4db6beeb1dd5066e1c5c67e8ffee249673
MD5 3db62eddeaea85415961c2f233e64ed6
SHA1 0462623c651de7340ab8b5eac7b04ceedb46010f
SHA512 0d39bfc1aa40645d50e82969882fd32359f5a00bf8cdda7012d34dc01a68d7e9c47cfcf4e74347cc27cf96a738493b5da7614c4a7c2b0dd63565f1dbac5c13e3
SSDEEP 192:sxR2RAO9/fsXssUiyYhLlbM3VoA8pXX9s/g6+WNbdmtq1VDqQZY22PNGfIgDHJ:sxR299/fsXssZbLiMS/5yiBZwml
TLSH
T10C62D646A924A97B9CC7D21AFA15BF52E7FC1033A5815E4CA6FC891C14E77DE220384B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 29KB
SHA256 b451ef2684179f590520b24c0a79894ac67fe362ca4e3f0492a82b0d77e420d1
MD5 cffa60318b02b80651534c4fb4a99245
SHA1 8802cf29b40dbbd64b7fe43a9dea2eb43d87f445
SHA512 24b9271ac3ff08752c6ad59c1a7e5d3a1be20669ec1e91d4e788b189eaaaefd78d8b587f622e99bd8c1ee61bd28adf8b23fdfaf8f9d210482a3fe4963afebb65
SSDEEP 384:sxRHp9/fsXsstWvl66sjqMpRiYnazAW8pZS15posJWeT+HboiMS/5Vaivh1il:srp9/fslYl4nnc7WeT+HboE/5Vb1c
TLSH
T1A9D209059924C87B9AC39D19A83D7E33EAAC106361C5DEDE56ECC91C01DE2FDAB07853
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 bcd3f51d6b6fa7442f20eb9d88d34b7b2601b1327db191ca8084a48cda0ed35b
MD5 da5437c531d5f8d9e1375d63d2336b8a
SHA1 76c69d3039b9f53dd99e6f9e143762c9031f434f
SHA512 e8ceb82927684eedd0c6139bd69cc688aa9f3dfaaab933aae1974a2d5481ad14dd206444f95d6b9f13b8892d407529420e33003e7f952bcba8337440ad5869e8
SSDEEP 192:sxRHRAO9/fsXssUiyYhhlbM3VoA8pXX9s/g6+WNbdmtq1VDdZIFY2tPNGfIgDHJ:sxRH99/fsXssZbhiMS/5yiwFTml
TLSH
T1FE62E646A924A97B9CC7D21EFA15BF52E7FC1033A5915E4CA6FC891C08E77DD220384B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 29KB
SHA256 374f273000a36562276012e754ad6018d283b0583e94f74fbeff3fe5681fe2ac
MD5 4d342924fef0eeb7f74db4ee5b0ef8db
SHA1 e5737260dba7b05006621a903aa04aece281427c
SHA512 cf751494dad831b8e951a20f91c0d3932380d82cec4b0bab504a543f6051f867ed7d5fd0591f0d714d41e12414bc4143789a2d95c15009a11fbd213766951071
SSDEEP 384:sxRH99/fsXssE66sjqMpRiYnazAW8pZS15posJWeT+HbhiMS/5VsiP1Zml:sr99/fsM4nnc7WeT+HbhE/5VZZg
TLSH
T1BCD219059920C87B9AC39D19A43DBE33EAAC505362C5DEDE56ECC91C01DE2FDAB07853
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 d2ad77627edba1a82fe971d034db82199635746f264d19fbfcf78d73c33a3ede
MD5 69a24b3cca4736bf91a54bb3566e38a7
SHA1 5c1d4e75e7c98673be5f5b2bbb981985b024a935
SHA512 5828e9f6eabc4132f26e75e9c60e58c8f91a3c583056411ca6e6214a07a3a85bf38856ff9b3efcaed6d9173ba02e92683bb1db1d7081a54d31a794cdfe1b18f2
SSDEEP 192:sxR2RjO9/fsXssUiyYhebMnVoA8pXX9s/g6+WNbdmtq1VDd1/Y2JPNGfIgDHJ:sxR2I9/fsXssZbj8S/5yib/vml
TLSH
T1D562E746A924E97B8CC7D25AFA15BF52E7FD1033A4815E4CA6FC891C04E77ED620384B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 30KB
SHA256 19aff312dbdcd6dbcb1b24f853045894fbd2fbff33093261e0a96170d31d3b15
MD5 773deeb4385dbe046da98a674a755c64
SHA1 a50b443b58cdad3bb113355fbb27dbf06b16fb64
SHA512 6eee3ee18bd25f15a8363887d70a930f43f4695f6b09303747687d45be1f8bcb0febbbeca4f528d92ee755e4ad097eb4934a24710cf621bb46249b4a3a86defe
SSDEEP 384:sxRHV9/fsXsjWvl66sjqMpRiYnazAW8pZS15posJWeT+H2D6Y6p/5VaivhB7O:srV9/fsiYl4nnc7WeT+Hhv/5VbB6
TLSH
T1D0D209069824C87B9EC39D19A93DBE33EAAC106251C5DEDE56ECC91C01DE2FDA707853
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 30KB
SHA256 b0e416725347d48e4c9ab524b658294a9b3de813ce3a0dcd352d17723fa09cb0
MD5 6eacf99a9fcc705d62826f5d7b004e7e
SHA1 889cb66f3b197214b574219a1aba1dcbada42012
SHA512 c1530a9ee95984a4f5ac94b9fbf224536233034f22022551c7ef5c6623534a9fe166075ae8afc4f5b3323ba0c880663e287ec427312f8183e46311e0daaca8c7
SSDEEP 384:sxRHp9/fsXsjWvl66sjqMpRiYnazAW8pZS15posJWeT+H2D6Y6p/5VaivhgsO:srp9/fsiYl4nnc7WeT+Hhv/5VbgR
TLSH
T1B6D209069924C87B9BC39D19A83D7E33EAAC106251C5DEDE56ECC91C01DE2FDA707853
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 6b7d13fadcab2a94149192bdf18ef94b386c8b89c1632d513886d8386f69e3cc
MD5 c4910cf69ceeebc7986aad321457b2cc
SHA1 5d08535e4ddfa55cb31a3d5860db941c06b49fe2
SHA512 d6cd55d48bca3db5642fb7de91a121487e22396c25df61d8d24d715c8a69aef19ceb224135128cceb916a3a7d8144961f5c5b4d26987ad32a95fc4f2c2ba43dc
SSDEEP 384:LbnaaCTfCtgp/FfvDKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVPH9NvRW6roHro:L7aaCDWgptfvD8F1+UoAYDCx9Tuqh0VE
TLSH
T140B2EA2F644CCB7E8FD00A9DAC596F977D9802C796588D4047FE984C02C7BEA911E4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 03b51e82a1383ada877578afd93b0605185881406a5b76912b704693997c4cae
MD5 a07da78a904d9f218154b4a9e89801a2
SHA1 090b8b09a4e1ef085fb90f662e76b568568864dc
SHA512 a5461d6f56145ca71f73592aaac46ee7723f421eee214d1a3743ac7b76c708c36ac4d873ac57c106f85f5e5efa002185f804370014c0a51e47ec534b6ec176b5
SSDEEP 384:LbnaaCTfCtgp/FfrDKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVPH9NvRW6roHrF:L7aaCDWgptfrD8F1+UoAYDCx9Tuqh0Vh
TLSH
T167B2EA2F640CCB7E8FD00A9DAC596F9B7E9802C796588D4047FE984C02C77EA911E4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\2352507c-c79e-48c7-9ef4-18eb3273ad79\index-dir\the-real-index
Size 72B
SHA256 556934cf3561ea1786b4f5484c70a0be7ffd8002626f0e777f41eb578e31f2ae
MD5 8a4e36d1786bfad380f4e4539e1816bb
SHA1 c6e6e27e446530a56924f3046a65368117c6df51
SHA512 ee4dacba644dc7511335bd796a8f1b8729c39dea925301ad2c2ea4fa1d42dd78fb862dd8f16c19220932c8ff9268ce265cab6132fed501c48762096e22b6754c
TLSH
T15DA0029042F059E6D54296B22BD641422B14CC110351230F51E88294DC50640494631F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5adce4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\2352507c-c79e-48c7-9ef4-18eb3273ad79\index-dir\the-real-index~RFe5adce4.TMP
Size 72B
SHA256 16c48a93bcf4f7a504d5d69bf203970089898d9bb49e3c6c91ff919ae4ad43d4
MD5 8e4d35a808220b9cec5ba20263ce4aee
SHA1 8fd6b645d1600b65fe57727c655dec4a4d1e9bb3
SHA512 c80c364543f529bf3b2445e93601643f1e11ce0a14ddbfd568033fd8b620ffccedfa2ed2a5fe9d0323f78c4f9e904308fdab4a3f2e6362d46afa1c924ee115fe
TLSH
T12BA002600F821005D45252B119D2A2616310D8521280130784E35448CC725484D4110C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\5a391a03-b16b-43eb-8bb0-d7f342500c48\index-dir\the-real-index
Size 72B
SHA256 78491422f5a3e5eabad89c4780b895c54e746a025092e5c0f0e150a5a1130cc3
MD5 125b26ce0fe26b4ce192813b26d2ee50
SHA1 27e46afce6af6d587a91add6459f74c58df27856
SHA512 d2577d51be64202d653f6ad11c07b6cb49f05518b0aa3fc53c7f588cf380e53b9478a54d51f5033d7a24db881069a1dc759d46ffcf6150d17ce373c2c54873a1
TLSH
T15DA0027941540444E3016570650F1590631ADE320001830BC4B48C659C510BEC955544
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\6b021d3f-98a9-48fe-8e73-ae4013509062\index-dir\the-real-index
Size 72B
SHA256 b05aa08947e315da4828d37d949b7c35cf29b5781095daa49c840c95f4a32ffb
MD5 67d6a03b59701a6246bba7c0af9112b9
SHA1 d61644e87a8a77535477715674c855a169dc1dc8
SHA512 7532ecb9b913e4e376d78dbd7459944e0b3042b9a24d518ee99772cfb7f6c514131db4011d6c83bab866498ca940eb71428cf09e43cdffdfb437e317e563f239
TLSH
T178A0027906418294E00892FC60E303C223586E514810034943B9A8BCACD1050C103351
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5f2479.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\6b021d3f-98a9-48fe-8e73-ae4013509062\index-dir\the-real-index~RFe5f2479.TMP
Size 48B
SHA256 1a1b0ed7018d241810b6d07c691c9a6e6d3c51cdbb97c3a2fd381781770f3f96
MD5 b00659cf5c7787a47c05f18a810df1a5
SHA1 7c7e84d23f6c3f015070fa6a9291333e63127ec4
SHA512 e5b22b083f05e656af6d747a51087368ca457e1763f6e721bfd13e99602cc964bce3803e6019625fb51c4e2c0b1fa9163276403b583f1b9fd7ef05052db759c4
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ca3c23a5-0b45-49bd-9fac-532a302f4fc7\index-dir\the-real-index
Size 3KB
SHA256 2b4e3e5930a6f777b9c9bb06a5237786692a87059a21c26eac7707ebc3796f9e
MD5 0a75454fd9742b075139397cb066820d
SHA1 f8f0b15c7b9ecd0cee4e9def7c6a24d842cbb05b
SHA512 23df95eeff9705ed3dea303ffd2de40a4fba52625afc48a742c704a7f9a3b702cdb231c1c8ca02b4f7b3f119ec2a049b2d18dc4d71b1a0b3faca4b26a2fa8e64
TLSH
T18A51E74E4E072B2FECADA67114B90841337416DC13781E1BA6FE9238FCC3A3919C9758
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ca3c23a5-0b45-49bd-9fac-532a302f4fc7\index-dir\the-real-index
Size 72B
SHA256 740550632b1afbe0641fcfb37c4378aa2f20b73b9abdafa8637965d3904b1789
MD5 f5cef7ad6b78ec50b8d4fc9a62273bae
SHA1 8ef705dad3d9b8ed3f32912cfe4122b939798f05
SHA512 97d531d64db7dd3ae15d78d0c235f1056f6e807b26ce20c3adb78f9a15d99907b3f4a4df6686bbeb02556c11bbb53968906a5287662dc89b45e1afc4aa39754a
TLSH
T12EA002501AC16958E8651770141209F152456D581070823741F58088EEF26DA4285204
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a8667.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ca3c23a5-0b45-49bd-9fac-532a302f4fc7\index-dir\the-real-index~RFe5a8667.TMP
Size 72B
SHA256 b84bfb7db8e682fe802dc2fb008e25c3de1737a3713d642991996c9967ce8888
MD5 26ef85ea33bfc58f8380308b0803ec94
SHA1 5ae361776351547a85e248e7f1a817403439bfcc
SHA512 22c3859cb320aa1a478df0885c70687667a00495bb6eda7b9af13aad84d882c35436ea0dfb189c25cbacf85c8781c774be8282ce679efae3a461a42b812e30cb
TLSH
T1F3A0025057C06989DC611374140306B213008C1014B0833740F2818DDDE21D547C61C0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\f130bc2c-ae72-4674-b5b4-70b8eaa83f18\index-dir\the-real-index
Size 96B
SHA256 9f85f4ff8c5a318d49faf60591cdfad4e5a9491b1390da87ddf4746f92084bd7
MD5 36e4065ba349bc2f78d5c02363197892
SHA1 55cfbb3f9880b0861a76344a421895d368e23d10
SHA512 c65465f1e1a7925ba0c0f3f4cb470a60167be6525955c0c5cfe3cb8012047dc1eeaf4db80a1d88858d7a7e41c932feac0205d79e1099d85696493160b4f9bcf0
TLSH
T167B0122E3101243EF55512F100C3090063805CD011203357524014B59B903008201201
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5f2479.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\f130bc2c-ae72-4674-b5b4-70b8eaa83f18\index-dir\the-real-index~RFe5f2479.TMP
Size 48B
SHA256 fde1a2f7434277cf56ef86f2b6a2ea7f10d21c3e862f62a00326e9749a4d6a85
MD5 067c218d8a44051c4a85e52c8563c580
SHA1 6bb33d526442cf94a63c0210c31a47d9e1608555
SHA512 13c302c1e3f964e7e64e767b4e6926c74d1e520f081262976361a241b9e9ab695c3a690ff57836a1631dd0a46ca3a0850fc7a9b0f0425753d040033539626110
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 624B
SHA256 8ed4410b00cca1a513ce023dc1d52a7e1eadc2ca220a1ca6a6c15cd56f921351
MD5 0e72b42f7aafb45e54f7164d214bf961
SHA1 dd730ea675d24566e9c6b3972cb7abab33af06d5
SHA512 d49e1b74a6011e412eb5c78f2cd0f7acaba72f31ef03916ba370d2bf1696167cc232ec99f1852da9ed86271361808963d51d2598470497718ea1894c8f910cdf
TLSH
T12AF028F77EFB2810F9AB97DA243165B405163D048808EE4FA167B78BA0B27102019D73
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 519B
SHA256 d81f3cd5d6f2585ec149e2fbc0202ead2e14d3d080c2d02ef00c82cda4ad2c75
MD5 6eaace241cf475cf7ab6957744ff13b9
SHA1 751100d7911b9f45f9964111de704caeee01010b
SHA512 80867fc48908098b923a5a01780c40e8ef71104cd0bf533f4942c8b76b612676eead900888b818fb83cf89814ab9bdcf99562996a148a07be0c9319df5fb4586
TLSH
T140F059F7BAFA2410FA7B4BE6543164B444163D04C844ED4F61A7E38F60727112005D33
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 54a9f3f906442375e69d37757aae423ced885d59806eaab2dbe724d585a1834f
MD5 ce96577db33963c6cec60f5fd6ce4f3f
SHA1 c90b125a7afaef58a47403ed3df68bc713d76c8e
SHA512 317e6b181d446f59d15f4dcdca89d3b1906fb5989a15eb79f0910711d42348fe9a883cbfcee47af9a0128188187c4ea2c3efce6d0344bae756ec19492b507514
TLSH
T136E068FBB9BA1410FAAB87D6243161A441463D10C844EC8F20A7D38F60617102402C22
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 619B
SHA256 cb82c4dc1083ef0b24b250f4ff3fec7e74a1d5cb99e9ce3ea9c72fb9349460c5
MD5 a8753a44039552a414ee062cc0476590
SHA1 92c5953f7219a7010f8ab7ce9c3b502efc734f29
SHA512 d91beb8bd0d7a5f8cb393b486f8ff007577dd2e0b16826dff85de6d73e748756bbb459b705d0218c9495be0266a4d7be8c243754188e3f3ec9e53b6f953aef39
TLSH
T186F028F77EF62814F9AB97DA2431657845163D048804ED4F6167E78BA0B27102059D73
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log
Size 4KB
SHA256 69386f1c2b4df36a407be8ab5a57e16fe455df30051244a26c1a4defbf1a1c67
MD5 6abf484251bcd27db3591edc554009ed
SHA1 37515ada090aef31ab86b939cc7db1f263768782
SHA512 65668dfbdba7affd3d2c84d49d701775e4c05f626476ab040561b8a3aad5b676a4f27ed8103e4f314fcf87ca7a84316516f3e3016898c30189cd791b8a8f4228
SSDEEP 96:F1m5HxYqYaVHYPIjd+vQIp+vQevd+vQgfd+vQoHY6:F1YH0aqI+f+vl+Z1+h46
TLSH
T10DA1E1E78B155053C9C965FAA039F6D8551FCA4A6FFE47A614BD8F2E42402D23328F4C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 6ae201f6da2d00a8e2f51b5977b74dea6300c99a457406455ce2bafffad1dea2
MD5 6ca76fe7a6485e076541d08bb649becc
SHA1 42b6f85fa85616109ae891f1c9e1626902574a6a
SHA512 62746d68e7821eb3ca1b86e73f9c68d7948bbe026037ea99198d8e33fdc459e7c41a1ef17c1098d802279dc9b78b7927a6f88a7960fe93c87e7979625ead2eb6
TLSH
T1D5E0265416CAC27D6117B04B4625CF08C2E8F60BDACC3F427F40CC88614B504F3A3983
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 c63280861481651ac4243f124335342878070e6c6cd332cd2bc5db8cbc91f8f1
MD5 e07d5b3744b2215a249ca44f5955e025
SHA1 6cadefab902911b5e94063bfe780ed3b2ef98b04
SHA512 1815e655744830e7ab44300ae8386456102d90a958e5f70550d1f4c1437e18d0ae07ac53d036ea52250f0cf5d502360a72fb2d90a8492681dbadbb42e2120da7
TLSH
T18AA002904982A036C44143F0267332846220CF10D615239590A05486E9D0248A29202C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 790ed112ef6835a5d5443269c64da1f4b0e5d302fa3eab7a7fd81c617d38d3b4
MD5 11b0a8fb3a80d6120d6666989c9f2628
SHA1 022cce80329dadc6f165fff2609de0b33c5f862e
SHA512 2bcd68ff5f69c259a0d2c0798dfe6bf1087ea8a82ff26fc9dcf28ea4477fbffea75e0141d327bf0636cfff716e8ea9e0d9b3fcda53d5420de88eadcb5b54d1a1
TLSH
T145B02400CC07D051C1004371777141403110CD5CC5073F13C0F5D057D54110005C1105
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59c99f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59c99f.TMP
Size 48B
SHA256 8e39dc02a3005f8075ba28156f87dd983e7aff6db6c58d5331ee010692dcf6b9
MD5 7aaea59a076668a705e640662286dcd4
SHA1 601a24ca44046c811b94ee919d964b8226a7c8ed
SHA512 ccf66c43faff2e25e3f541a7f515ef4eb939407f703a50d9a09d31836e4573ae8e8f7c4885737c9aa88c5288877f89c6e066f7514449ed62d3cf582c80de9714
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 259B
SHA256 301551bac2f358fb53e5da404ed82de67b4582aeb6b64352934a08f6d212d88d
MD5 68f51c69b84884524a92bf93fc956d27
SHA1 dfd997cf9c5cf208716c40ff5316555d189d995a
SHA512 5d9db0b9d5e31a430e94b1757f8137cec6183b61e76e00da6f727dc1066910d06f3bf2f2e1ab15d00c5202bad18658fb361729e1f966335e84da255b48af5650
TLSH
T1F5D05E8CBB500193CC671E7023645F95A614E49622659157C98C7E57EB165982F05CE0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 4d83427862c4e02c1ef39f32bbee02449172a2ebcc94f69abc7d2f47c362ea1c
MD5 613f7c04e0680df6779493d1aa24ed0a
SHA1 dc581fe9db87af04560d6b0b45edcb0b223d0b23
SHA512 72ee5b80d86e7a9275fe351b945fbe6bd685e9e534a3783b82770d1a007fa4867196df3841e850cce2e17765c9f4b058edaa48694d53f5ec60606845f04cb84d
TLSH
T16AE0D82426CBC22A7196718B5229D70CC1A27603DBCC3F757B09D4C4630B1C47393541
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 2edb5c4f4910cb602f58db7a7e6b7e06e9178dc723950fa99dc4ca52ac2d47ab
MD5 2272c618dfd30768638cc2453fe8cdaf
SHA1 e84d7c62c227c475ac107afef424a6a38ea50669
SHA512 509c7056c9f95a42a4e4e9982f08d980e163e1bad4099b30a0807f01921142851634eb9ea94bea386146fdbfec0210275c27ba14face770fbeb5bfe4b646979d
TLSH
T159E04FF556CAD27A6006708656799B0EC2E0BA079B893E569708D8D9A107244B3F7981
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 4c943516018c3512abd2e31b4c4effe455841857bbcbc5a623f125dcd0b8cd54
MD5 977da124fd6213ff978ce041731e3729
SHA1 68600ebca048d8262d728d3694a03f322f98e9d2
SHA512 a1f7a4d3eb23c0c488bab8dd3adc20ab2bd623476b132d853c8b7c6d880cb81102cdde62e440af05c850c2cfb243fbc7e39f19588bf78093947b394a828cd88f
SSDEEP 48:KsgIzKxSU/yUGBq2MYUkkYXPIXekKiBK0kOW0R3MW5yxyIfKrC03SHMA6ku:KsgQKxSOGvyKAE2SywKrCASHMA6ku
TLSH
T12291BF5170BE064079BE29C990748B3B524232F33014EA7A7FBD14F58A6BE156EBDCC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

ab0b2771-84b4-48ee-b4bc-05925b2e22d1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ab0b2771-84b4-48ee-b4bc-05925b2e22d1.tmp
Size 414B
SHA256 15b5692b29fbb564ee61ca0f9bc149103111123dd9233fe97289e05341585bf3
MD5 21fd0751118a118e254a3da43d051695
SHA1 258d3ebfe09b2725f676b9d9730d2b35cbb2508f
SHA512 0b33f43f2bc3529ca91cc3f7efef56ec2674d7e4960e1821a4ad053f3f7b3a5d59021f8563bda7ff6862bdc546d009c1647f99e65c33fcbd330ab34349c6e991
TLSH
T129E0E5A6C821EC271CFF0B1950540B46EA5503271641894F3B3D801C4FB523A4185C5C
MD5 SHA1 SHA512 TLSH

Submit Download

f309b325-2d14-4607-aa90-b1265a70b51e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f309b325-2d14-4607-aa90-b1265a70b51e.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 319B
SHA256 4f33f14db13c16abca5f07a7f446f84172d7a589a1dbf22117f303f538133957
MD5 2faf1ee54564ef681fc7ef36d18c4954
SHA1 63e63a2262ce024259774d945a9e24d68c6083e0
SHA512 d0a8121da1ae7965d168321f8dae52cc35d83484488022e37069d7cf40a9e0707b045e5e9524a13cf76f606861641ed402dd62377509f178f642f0e09baa4fc7
TLSH
T129E02694BBC8C26EA116758B41249F8CC2C4BB4FEE8C3E862F00C548A446500F3E7183
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 36644f623ad6bd1bd9c2224822a17464133f8b3393380cea278796017cd30c9f
MD5 edc2acd7aa2aa85594d7697deec68a83
SHA1 d6a53f9389261add5ad8a3c6976b88f5006fe1b6
SHA512 40093eb5e35cfdb06f133b47fb199ba53999a777e85e3c8475f1ca543836f75e4103e71c109530c6273b7eb113f4a046021e7d0c4ebc0f4bd188d3860cea6efc
TLSH
T19821C456F330C549E14EC67E947A9B2A1739D8068FBCEC0F447A20346E79F150E4B6E5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 337B
SHA256 afcd41d89cfb28b1b96ee971542334e74f91ff6dd6a5f356f91f1b8bee7be0ba
MD5 302b6a7da7f2512d5afa887213540b34
SHA1 2d3a028b5b7437ecd8db0998df7ce667fcd57d8b
SHA512 22538b19c934817d845896cc138a4e8bd16bfd9f16c29562c6b57d2eb552a4fbdb47a9782b6761553189fcbf82b3843bdd83c6d5c256bc6b6561acb81517ad2a
TLSH
T11EE0205875C5C25F601270970264DF88C2D57A4BEE8C3F422F00CC486947141F397143
MD5 SHA1 SHA512 TLSH

Submit Download

1c305d04-ada1-427f-92bf-7a2e828a161d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\1c305d04-ada1-427f-92bf-7a2e828a161d.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 b8531c080abb7b8cf0ab4f1bc6418f5f4d5b06a7834a6bbec7531f9a8f94e177
MD5 eb1ed12f8e65773cde8b9b2201bc2899
SHA1 2d43b3d81a5c5b93602663dae84f68f9add2b9f8
SHA512 d0cbe672f19e5ef7c237f8ddb4da327e29418a6c1c83bed1a3cb56abb194880d64ab0c445effde257ac986679f389915f93350c74cf289908fff80e07d268fd3
SSDEEP 768:SM304gm1VXwFWDmGA5b65Q92RQMPbERs1MB:SM3GOAF65dQvRsOB
TLSH
T1C0F2CFB2ECA0DEF75CFA51C17687B2052FB88523D5C9869098E97B0D05875DA430BD1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 836a6a6542b3463d4071055a047176d1de6d9400cb4034abde8e6c4659e03f49
MD5 3d559ed3b5554925e442ff5920b67abb
SHA1 d1f0d1bf1e56305111d3f88afbb97f860107f56f
SHA512 f7507628993ce419af51ad7d52212a80d50b04956d3bd64d88e2c518dfa34c3090ad6cb4e0bb942ffa8afe697e729eed39a91abdb8988eaee8c8724db1245e3e
SSDEEP 768:Fx3w4gm1VXwFWDmGA5b65Q92RQMPbERs1MB:Fx3SOAF65dQvRsOB
TLSH
T1BBF2CF72DCA0DEF35CFA91C17686B2052FB88523D5C9869098ED7B0D05879DA430BD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 d19acc462be79dff15881950a2d3fe4b23944b50ccbe8cb9c23791abe3b6219b
MD5 0b1ac3edf293348122be97f2e53a0adb
SHA1 547386b05cfd0aca5fdcbb66e1d66c0f02678731
SHA512 b347885869d061d967a720106f5829a8432d4eaca49a4906fd75444b176288b9eb154e08d56c547a011a08ff268202e181ae8d2e462128bfe75e43f55e07ee07
SSDEEP 768:qFFX3SwgM4gm1VXwIDmGA5b65Q92RQMPbERs1MB:CX3UAF65dQvRsOB
TLSH
T1EC135AF28CD389B7D8AD4783677E6E015EBCC163B4859290B7D86A0DCD425BFC30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 684118a57cb2ded3aeff751cd6d68dff3a0d09b9f095a598c25936252ad304fa
MD5 4911afbb6438e0c9a63ccc77f4021af4
SHA1 082b0f07b6378fcdec534626ad8de968d33f1fff
SHA512 657bad1b779d35204dc72168a4e11b29492f42530492239af403e51207f9c3ba20656653a20d057a71e7bfec233418892dcccc41cc48e90253c79a290f3a8c9d
SSDEEP 768:U/UxvxjgC+B385jMgm1VXYtDmGA5b65Q92RQMPbeFj0O:BZj3+B3Wx3AF65dQ9FQO
TLSH
T1D403C036EC94AEB7DCF95280374BB35AAFB84463D0C952A049FD6E1D06C769C430B85B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 48KB
SHA256 01ffcbf25e4580ae772ec267ce7bfa70621c56c44bbc38f5b5cf508639d6b6be
MD5 c9d3284033040893d0d93f4b8205bd35
SHA1 5cc9047d78c7fe1f0f25d84ad0aafdbb2bece8fc
SHA512 ceff1cb533eafaa8da6b99e8dbdea5e26daa880ad3c20386ecbaed4c6c4c49fffb8acf720f6bb5e85aea7b7e3d4290ff1fc7d547c57bf0430356d84fb49c4c96
SSDEEP 768:qFMh3OwgejMgm1VXwnDmGA5b65Q92RQMPbLnSKwIr+RRs1MB:3h3DAF65dQuSKwIaRRsOB
TLSH
T1C123D1EA8CD289BED8AE6743677D6D115A7CC133F0A48194F3991B0CCC624BFE306915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 0738df2db0becf2d52d30c1ee604c39ffa58a1a55677410ec343a7a324494e5a
MD5 3c979a45b220c780c03c70c988d4320a
SHA1 158a05e13fc361d74baf372546210b87f4497311
SHA512 73e7c755f128123dec2de9b348421f0e2617b125f41802345135fd8cfef768e927e075fb0e97ef5667ea1f493129c89e4ada360418cfedaa9e131b00fff82ba8
SSDEEP 768:qFHX3SwgmjMgm1VXwnDmGA5b65Q92RQMPbERs1MB:2X3vAF65dQvRsOB
TLSH
T1461359F28CD389B7D8AD4783677E6E015EBCC163B4859290B7D8690DCD825BFC30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 a2ac3224bea35cbc7aacd6bd66ce6ae800356e3f0380a5b801805c9270f57faa
MD5 e14b89f931bea2bbbac4c4ab2d7002b0
SHA1 facf9195c1ec4ed24d69c331b8924fd953289579
SHA512 0e1689941033051201918d33f9374fa7d8a6da5f65917a50a44c0f53e4f478e520ac2e0f59957af28a250ec8d5bdf4f770d5ea6d8aa3cdacf4c5cbba3b86dd14
SSDEEP 768:xFHh30wgajMgm1VXw7DmGA5b65Q92RQMPQ9Rs1xL:3h3XAF65dQfRsjL
TLSH
T1CE135AF298D7C9B7D8AD538367BE6E016EBCC063B4858650B7D5690CCD821BFC30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 aaa702f5fe76efe768e25ba70c5072abe54e3a7752176c331cd4797e1cec6022
MD5 fc24b3f080e8836e76832b78b3bfd065
SHA1 870d8be6c606cac69bffd6bd79c869abe772486a
SHA512 b443d945b7324f22f4e2c46f0ac2d5c133d6c6d178b5acf57efd82c1b0db91e185ad2c3dc39949c7d5a6e64af9f5cf407058d6ba803f194a823e3dd882e33107
SSDEEP 768:eFMh30wg7jMgm1VXwEDmGA5b65Q92RQMPQ9Rs1xL:7h3zAF65dQfRsjL
TLSH
T141135AF298D7C9B7D8AD578367BE6E016EBCC063B4858690B7D5690CCD421BFC30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 47KB
SHA256 c099bbedef4c1ac30fc161434efbe0c17f4f0b28fd1d7e47e10cdf4a46bbd1d0
MD5 30e004a2d1ae3ec1bafa42a789aba944
SHA1 a31f9a4918c0b8eddc7c2926f67584c1917c297b
SHA512 c3b95d843b326b4cad147f4b2d5e6d5b0f04fe9e1b276fd6c8902a648151f7324477199a47723d791feace4566fa9196393eb9d22b44eb397024920502c62f74
SSDEEP 768:xF1T0wgyjMgm1VXw7DmGA5b65Q92RQMPQHo92XdRs1xL:lTpAF65dQldtRsjL
TLSH
T1D223D2FA8CD389BAD8AD6743637D6E012EBCC137B0A49154F7945A0CCC624BFE306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

campaign_history

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history
Size 20KB
SHA256 5e30dd1967b50418a545716c55df193cecf9b0764e8b55a9640efe5db602ca7f
MD5 bc3cca11456176d50c0a90fe472d3bee
SHA1 11e4f470d5c82bf3be0439976d4d88779128f9cc
SHA512 7f70756339dc0414118a5816c0a031b55f7294770bf7193d8cd45a97a844ced12d3f69fd54b1a62b9a18b4aca4bcf287e89f62f04f51ef66413c867ee3d90b7c
SSDEEP 12:TL0yEJiEZXiDiIF8izX4fhhdWeci2oesJahvGFUxOUDaa1i3isJGyzA7dvQQtAd3:TL0Dj0afDdWec9sJVUObs5VzXkGVjy
TLSH
T1FA921C21B9302467E9EF1B76F8534CA00DFC12AF8EBBB50499A04DE10962AC67A551F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 90342b3fdfb435d23fa38fec5a86c5d2145c17c4f1ba5b11ab2f15121a6acdc3
MD5 959df5d55f61e7f7cc6c19a90eeed2da
SHA1 f05fe47e1a40ef5896d75742f0271382a8f7227a
SHA512 0b74f018d792d7521775c4a28d84a9c24cf8bb3a99fd76092ed9bcf51a11a7ede32b3f371cb0acf75c1dbbe6e4aa0a3ab5333c37d301aa230c13ef17d8052735
TLSH
T175E00206521050B8C16C03704007693007C2802850F446459D2041551C132012E30F85
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5aac7d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5aac7d.TMP
Size 392B
SHA256 d5d3f68a60721787e294ff05d5c1a9c1048bd477a6aa383ad0feabb65ec4c416
MD5 c18e500a18e48066e3ac5c22883c1cfd
SHA1 31db90020055682beb43e41e8644343a19b68b93
SHA512 ddb701118ab51d36d8782265dd60f11ee333438bebb49b0e31a73e4c4a9c1f5ebed127ba5bfe755c787659e745f7ef376d257fe2ad438f2ab4f56f47da65d1ba
TLSH
T198E0040553105074C15C007040077F300741C01C50C447455D3041551C103013D30C45
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 18f27ff535c99f03b0afdf37b5893eaa7572de9869edacf0b1e734b23766cf0a
MD5 37e320abf830f7a2daa30154360dd5e3
SHA1 1eb92271cb9cf8e324c3e2d5f68d4e6ff7a97160
SHA512 06f0703c0d17956dd64842b5e8f56ee118a90c85c196adaab363764c78a5ac7eec2322d6195f8692d16541cdff2b8dc8106a2b659eb22ff54f47ae598b7f7036
SSDEEP 3:MsEllllkEthXllkl2zEbPq:/M/xT02zIPq
TLSH
T1874404057FC0145DCD003C304133C37043F5D5101511774FF45144137CC5D4D0C50040
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

d8a6f109-c0ad-4e6d-b7a1-a3c005062561.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d8a6f109-c0ad-4e6d-b7a1-a3c005062561.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
MD5 acbc65123954839a819fa2495d239bf7
SHA1 063cff64444a6e3b4be1445b4cecb477e4d6ae47
SHA512 af07d3f6dcf1779bcc864aabe9e08563b20b8df8238df7bb08a5fe3b4e40d10f2e2a4442a042fe5d7a320e3b8195799ecc885549faa8babb5909eb32271e7b91
TLSH
T170216833B3DD8615CC9A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 177e06616404dba726903467964acc7747851dcc8220c628123fb5bb74b730e1
MD5 3f7b31439699dc01cc7d170e4d1c45ad
SHA1 8e9084aec5d2b3ae9e512c8d3cfe5b3438ff01a7
SHA512 6a6ae1ca1bff6105b72c97a3f147c39593fd15653ed0705ebee4533c432be1c7b31548fcc0d1e039bb465c2a42a18d28340f488c024cfef4582e96a5833cbeb0
TLSH
T110216833B3DD8624CC9A413A10CDAC1036B6C7DB41DECFAB6B84E659A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 4fb025787851a7d907bbb74dbaa2bcf930c1393531cdf7e15b15460ab7045df7
MD5 98a96e7770bb7fc45245188075c743a3
SHA1 4053ea73bf4fd366f0c599af969f6988333b0879
SHA512 ccd89245c49d484fc38e1e4ae00c7306b5bb6e633294cfbecd20a65bb1703152f7ebaf3232f49f4e8787ea9d20055d7ca1d3e4c4d4d77629efb2f3331eb9d108
TLSH
T1C9216833B3DD8624C89A413A10CDAC1036B6C7DB41DECFAB6B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

326549b8-3ce6-47e3-bc38-7ebdc3186654.tmp

Path C:\Users\Admin\AppData\Local\Temp\326549b8-3ce6-47e3-bc38-7ebdc3186654.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

5gk3e3axxCF9.exe

Path C:\Users\Admin\AppData\Local\Temp\5gk3e3axxCF9.exe
Size 650KB
SHA256 cde14130846d784f4ef245eb2c0050b7aa6f67c897a4476f4c4a5d5ba688bfdf
MD5 b468ae28c5d9890ef65d589f0ec4266e
SHA1 9fa60d914b6864c3575d8614b1c9650b33abdac8
SHA512 4c18c8f29af7067e0e1db281f26293138bf7995084099515ec0af1bba48bad94d848c09d119e09d05e1c6ba7c7029a32ad62380b07e258e0656003846b61db7d
SSDEEP 12288:pcXwhpqEbTPr4kMtHjj+/RJzWQ5oOJJA:IubTTRtHzWkoCJ
TLSH
T1E8E4C965D5D264E9E977863DE40A131BB0BE38402645F772151A9E833E74BBF0BAC30B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_31cnmxfx.r0w.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_31cnmxfx.r0w.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6520_956861319\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.acl

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.acl
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

memory/1856-341-0x00000156F2320000-0x00000156F232A000-memory.dmp

Download

memory/1856-340-0x00000156F2550000-0x00000156F2602000-memory.dmp

Download

memory/1856-339-0x00000156F2530000-0x00000156F254E000-memory.dmp

Download

memory/1856-336-0x00000156F2280000-0x00000156F22A2000-memory.dmp

Download

memory/3856-358-0x0000013BA62E0000-0x0000013BA6392000-memory.dmp

Download

memory/5036-369-0x00000239B7750000-0x00000239B7802000-memory.dmp

Download

memory/6732-2412-0x00000237205A0000-0x0000023720652000-memory.dmp

Download

memory/6932-2497-0x000001BB20000000-0x000001BB203BB000-memory.dmp

Download

memory/6932-2485-0x000001BB20000000-0x000001BB203BB000-memory.dmp

Download