hxxps://oldgamesdownload[.]com/game/zoo-tycoon-2-ultimate-collection-wf6/#game-downloads

Analysis

user interaction
yes
max time kernel
869s
max time network
872s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
14/10/2026, 10:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://oldgamesdownload.com/game/zoo-tycoon-2-ultimate-collection-wf6/#game-downloads
Sample261014-mhbvastsas

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5268	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1826067017-2692080558-3687773357-1000\{D3E5072B-CAE0-4A16-B14C-7C6DE3348D41}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2884	msedge.exe
2884	msedge.exe

Suspicious behavior: LoadsDriver 8 IoCs

pid	Process
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 29 IoCs

pid	Process
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5520 wrote to memory of 4228	5520	msedge.exe	81
PID 5520 wrote to memory of 5268	5520	msedge.exe	82
PID 5520 wrote to memory of 5264	5520	msedge.exe	83
PID 5520 wrote to memory of 5264	5520	msedge.exe	83
PID 5520 wrote to memory of 5264	5520	msedge.exe	83
PID 5520 wrote to memory of 856	5520	msedge.exe	84
PID 5520 wrote to memory of 856	5520	msedge.exe	84
PID 5520 wrote to memory of 1752	5520	msedge.exe	85
PID 5520 wrote to memory of 1752	5520	msedge.exe	85
PID 5520 wrote to memory of 1752	5520	msedge.exe	85
PID 5520 wrote to memory of 3988	5520	msedge.exe	86
PID 5520 wrote to memory of 3988	5520	msedge.exe	86
PID 5520 wrote to memory of 3988	5520	msedge.exe	86
PID 5520 wrote to memory of 3500	5520	msedge.exe	89
PID 5520 wrote to memory of 3500	5520	msedge.exe	89
PID 5520 wrote to memory of 3500	5520	msedge.exe	89
PID 5520 wrote to memory of 5576	5520	msedge.exe	91
PID 5520 wrote to memory of 5576	5520	msedge.exe	91
PID 5520 wrote to memory of 5576	5520	msedge.exe	91
PID 5520 wrote to memory of 2336	5520	msedge.exe	92
PID 5520 wrote to memory of 2336	5520	msedge.exe	92
PID 5520 wrote to memory of 2336	5520	msedge.exe	92
PID 5520 wrote to memory of 1708	5520	msedge.exe	93
PID 5520 wrote to memory of 1736	5520	msedge.exe	94
PID 5520 wrote to memory of 1708	5520	msedge.exe	93
PID 5520 wrote to memory of 1736	5520	msedge.exe	94
PID 5520 wrote to memory of 2960	5520	msedge.exe	95
PID 5520 wrote to memory of 1636	5520	msedge.exe	97
PID 2960 wrote to memory of 5556	2960	msedge.exe	98
PID 5520 wrote to memory of 3624	5520	msedge.exe	101
PID 5520 wrote to memory of 3624	5520	msedge.exe	101
PID 5520 wrote to memory of 3624	5520	msedge.exe	101
PID 5520 wrote to memory of 5656	5520	msedge.exe	102
PID 5520 wrote to memory of 5656	5520	msedge.exe	102
PID 5520 wrote to memory of 5656	5520	msedge.exe	102
PID 5520 wrote to memory of 1388	5520	msedge.exe	103
PID 5520 wrote to memory of 2568	5520	msedge.exe	104
PID 5520 wrote to memory of 5196	5520	msedge.exe	106
PID 5520 wrote to memory of 1000	5520	msedge.exe	107
PID 5520 wrote to memory of 5380	5520	msedge.exe	108
PID 5520 wrote to memory of 3908	5520	msedge.exe	110
PID 5520 wrote to memory of 5232	5520	msedge.exe	111
PID 5520 wrote to memory of 1388	5520	msedge.exe	103
PID 5520 wrote to memory of 1388	5520	msedge.exe	103
PID 5520 wrote to memory of 2568	5520	msedge.exe	104
PID 5520 wrote to memory of 2568	5520	msedge.exe	104
PID 5520 wrote to memory of 5196	5520	msedge.exe	106
PID 5520 wrote to memory of 5196	5520	msedge.exe	106
PID 5520 wrote to memory of 1000	5520	msedge.exe	107
PID 5520 wrote to memory of 1000	5520	msedge.exe	107
PID 5520 wrote to memory of 5380	5520	msedge.exe	108
PID 5520 wrote to memory of 5380	5520	msedge.exe	108
PID 5520 wrote to memory of 672	5520	msedge.exe	105
PID 5520 wrote to memory of 3908	5520	msedge.exe	110
PID 5520 wrote to memory of 3908	5520	msedge.exe	110
PID 5520 wrote to memory of 5232	5520	msedge.exe	111
PID 5520 wrote to memory of 5232	5520	msedge.exe	111
PID 5520 wrote to memory of 672	5520	msedge.exe	105
PID 5520 wrote to memory of 672	5520	msedge.exe	105
PID 5520 wrote to memory of 2400	5520	msedge.exe	109
PID 5520 wrote to memory of 2400	5520	msedge.exe	109
PID 5520 wrote to memory of 2400	5520	msedge.exe	109
PID 5520 wrote to memory of 876	5520	msedge.exe	112
PID 5520 wrote to memory of 5852	5520	msedge.exe	113

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://oldgamesdownload.com/game/zoo-tycoon-2-ultimate-collection-wf6/#game-downloads
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x278,0x7ffeb4f8c188,0x7ffeb4f8c194,0x7ffeb4f8c1a0
  2⤵
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1868,i,13490952316231963461,4936568650385279834,524288 --field-trial-handle=2084,i,4335105046626386332,8498002700530583445,262144 --variations-seed-version --mojo-platform-channel-handle=2128 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1564,i,7380157507201360191,17015193256624843558,262144 --field-trial-handle=2084,i,4335105046626386332,8498002700530583445,262144 --variations-seed-version --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:5264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2312,i,13012834046205918940,17813579468913273327,524288 --field-trial-handle=2084,i,4335105046626386332,8498002700530583445,262144 --variations-seed-version --mojo-platform-channel-handle=2844 /prefetch:13
  2⤵
  PID:856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3516,i,14557210208949516482,14354188722900766912,2097152 --field-trial-handle=2084,i,4335105046626386332,8498002700530583445,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
  2⤵
  PID:1752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3520,i,9886044656583543037,16091611186352568155,2097152 --field-trial-handle=2084,i,4335105046626386332,8498002700530583445,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
  2⤵
  PID:3988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4308,i,9601836515428496306,18406582011057487732,2097152 --field-trial-handle=2084,i,4335105046626386332,8498002700530583445,262144 --variations-seed-version --mojo-platform-channel-handle=4784 /prefetch:1
  2⤵
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3980,i,5693779202362504159,13247282020528331735,2097152 --field-trial-handle=2084,i,4335105046626386332,8498002700530583445,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:1
  2⤵
  PID:5576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5132,i,10225779600879981763,57629055348554158,2097152 --field-trial-handle=2084,i,4335105046626386332,8498002700530583445,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5288,i,18169753038866430479,499893019307318556,524288 --field-trial-handle=2084,i,4335105046626386332,8498002700530583445,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:14
  2⤵
  PID:1708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5264,i,17915903119323844780,9018334357654549492,524288 --field-trial-handle=2084,i,4335105046626386332,8498002700530583445,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:14
  2⤵
  PID:1736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6320,i,5870658132132133733,14061178226267714448,524288 --field-trial-handle=2084,i,4335105046626386332,8498002700530583445,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2960
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:5556
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6376,i,12049190801889758702,11769020658903639562,524288 --field-trial-handle=2084,i,4335105046626386332,8498002700530583445,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:14
  2⤵
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6376,i,12049190801889758702,11769020658903639562,524288 --field-trial-handle=2084,i,4335105046626386332,8498002700530583445,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:14
  2⤵
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=3940,i,3334510174327210588,834492036966547293,2097152 --field-trial-handle=2084,i,4335105046626386332,8498002700530583445,262144 --variations-seed-version --mojo-platform-channel-handle=6772 /prefetch:1
  2⤵
  PID:3624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=3984,i,8506027626149473893,1974561685347118934,2097152 --field-trial-handle=2084,i,4335105046626386332,8498002700530583445,262144 --variations-seed-version --mojo-platform-channel-handle=6896 /prefetch:1
  2⤵
  PID:5656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=4848,i,14521176173308138038,7527360814600468577,2097152 --field-trial-handle=2084,i,4335105046626386332,8498002700530583445,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:1
  2⤵
  PID:1388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5056,i,11426956168510593517,17168744337897028360,2097152 --field-trial-handle=2084,i,4335105046626386332,8498002700530583445,262144 --variations-seed-version --mojo-platform-channel-handle=6932 /prefetch:1
  2⤵
  PID:2568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=5104,i,15964262147288484684,15412253644081778081,2097152 --field-trial-handle=2084,i,4335105046626386332,8498002700530583445,262144 --variations-seed-version --mojo-platform-channel-handle=6908 /prefetch:1
  2⤵
  PID:672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6376,i,3479167229461721783,5905635247918530427,2097152 --field-trial-handle=2084,i,4335105046626386332,8498002700530583445,262144 --variations-seed-version --mojo-platform-channel-handle=6996 /prefetch:1
  2⤵
  PID:5196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=5040,i,6708044168646195098,487538305563620713,2097152 --field-trial-handle=2084,i,4335105046626386332,8498002700530583445,262144 --variations-seed-version --mojo-platform-channel-handle=7024 /prefetch:1
  2⤵
  PID:1000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5096,i,4951538241536942872,9151605818907111386,2097152 --field-trial-handle=2084,i,4335105046626386332,8498002700530583445,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
  2⤵
  PID:5380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=5112,i,9439750035675097371,9766693908707819624,2097152 --field-trial-handle=2084,i,4335105046626386332,8498002700530583445,262144 --variations-seed-version --mojo-platform-channel-handle=6976 /prefetch:1
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=3480,i,10583315861044374707,9484059290461534238,2097152 --field-trial-handle=2084,i,4335105046626386332,8498002700530583445,262144 --variations-seed-version --mojo-platform-channel-handle=6948 /prefetch:1
  2⤵
  PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=3960,i,820280670461876426,14507240046491613174,2097152 --field-trial-handle=2084,i,4335105046626386332,8498002700530583445,262144 --variations-seed-version --mojo-platform-channel-handle=6900 /prefetch:1
  2⤵
  PID:5232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8040,i,2125902722399357937,14263456979516065567,524288 --field-trial-handle=2084,i,4335105046626386332,8498002700530583445,262144 --variations-seed-version --mojo-platform-channel-handle=8024 /prefetch:14
  2⤵
  PID:876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8044,i,10014555381994680342,6860410551264214052,524288 --field-trial-handle=2084,i,4335105046626386332,8498002700530583445,262144 --variations-seed-version --mojo-platform-channel-handle=8080 /prefetch:14
  2⤵
  PID:5852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8032,i,18110199573592727300,1667354332098635876,524288 --field-trial-handle=2084,i,4335105046626386332,8498002700530583445,262144 --variations-seed-version --mojo-platform-channel-handle=8084 /prefetch:14
  2⤵
  PID:4256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=8188,i,5740186550301852386,12981424120887262628,2097152 --field-trial-handle=2084,i,4335105046626386332,8498002700530583445,262144 --variations-seed-version --mojo-platform-channel-handle=8244 /prefetch:1
  2⤵
  PID:6104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=8384,i,9377289504348727036,9457249366742049252,2097152 --field-trial-handle=2084,i,4335105046626386332,8498002700530583445,262144 --variations-seed-version --mojo-platform-channel-handle=8392 /prefetch:1
  2⤵
  PID:5140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=8524,i,11698692597178181679,3512077858997148399,2097152 --field-trial-handle=2084,i,4335105046626386332,8498002700530583445,262144 --variations-seed-version --mojo-platform-channel-handle=8536 /prefetch:1
  2⤵
  PID:5528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=8676,i,16064880258499059895,11243968957992623283,2097152 --field-trial-handle=2084,i,4335105046626386332,8498002700530583445,262144 --variations-seed-version --mojo-platform-channel-handle=8680 /prefetch:1
  2⤵
  PID:2664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=8828,i,1789632544496903373,6202658747913518059,2097152 --field-trial-handle=2084,i,4335105046626386332,8498002700530583445,262144 --variations-seed-version --mojo-platform-channel-handle=8832 /prefetch:1
  2⤵
  PID:4252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=8984,i,4996487941278806608,6892610623879490539,2097152 --field-trial-handle=2084,i,4335105046626386332,8498002700530583445,262144 --variations-seed-version --mojo-platform-channel-handle=8892 /prefetch:1
  2⤵
  PID:5844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=9036,i,14762943800440889840,12831852550688034390,2097152 --field-trial-handle=2084,i,4335105046626386332,8498002700530583445,262144 --variations-seed-version --mojo-platform-channel-handle=9004 /prefetch:1
  2⤵
  PID:1264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=9008,i,5126027401108514792,15480691299603766520,2097152 --field-trial-handle=2084,i,4335105046626386332,8498002700530583445,262144 --variations-seed-version --mojo-platform-channel-handle=9276 /prefetch:1
  2⤵
  PID:1352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=9392,i,14025176494823291323,10505338433726323407,2097152 --field-trial-handle=2084,i,4335105046626386332,8498002700530583445,262144 --variations-seed-version --mojo-platform-channel-handle=9436 /prefetch:1
  2⤵
  PID:1984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=9564,i,14729520625173918778,4058292238096487803,2097152 --field-trial-handle=2084,i,4335105046626386332,8498002700530583445,262144 --variations-seed-version --mojo-platform-channel-handle=8692 /prefetch:1
  2⤵
  PID:1348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=8408,i,4608295203914969156,15416986052916399895,2097152 --field-trial-handle=2084,i,4335105046626386332,8498002700530583445,262144 --variations-seed-version --mojo-platform-channel-handle=9672 /prefetch:1
  2⤵
  PID:1800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=9784,i,5193037083361407796,11626271249710308730,2097152 --field-trial-handle=2084,i,4335105046626386332,8498002700530583445,262144 --variations-seed-version --mojo-platform-channel-handle=9144 /prefetch:1
  2⤵
  PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5376,i,10350863994968276615,10248771956074141249,524288 --field-trial-handle=2084,i,4335105046626386332,8498002700530583445,262144 --variations-seed-version --mojo-platform-channel-handle=9848 /prefetch:14
  2⤵
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5540,i,12329337866316600410,10636565634809754753,262144 --field-trial-handle=2084,i,4335105046626386332,8498002700530583445,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6232,i,2517957141318637149,14807045340798130649,524288 --field-trial-handle=2084,i,4335105046626386332,8498002700530583445,262144 --variations-seed-version --mojo-platform-channel-handle=1036 /prefetch:14
  2⤵
  PID:5836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2796,i,7109024299115937023,7133819349285077717,524288 --field-trial-handle=2084,i,4335105046626386332,8498002700530583445,262144 --variations-seed-version --mojo-platform-channel-handle=2800 /prefetch:14
  2⤵
  PID:568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5392,i,13338609012127088849,11861718655888669308,524288 --field-trial-handle=2084,i,4335105046626386332,8498002700530583445,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:14
  2⤵
  PID:5864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5656,i,1229853451510027354,11446401749823295251,524288 --field-trial-handle=2084,i,4335105046626386332,8498002700530583445,262144 --variations-seed-version --mojo-platform-channel-handle=3060 /prefetch:14
  2⤵
  PID:4448

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3756

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5720

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1aee717f-42ff-43fd-874f-c6a241f1fcbc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1aee717f-42ff-43fd-874f-c6a241f1fcbc.tmp
Size 27KB
SHA256 deb1471979efea6b7b3a51b4abb7f342a84a070bfb476e799a5e6faa655aaf5f
MD5 c23006aec5c09cd73406e3b4529a7c78
SHA1 4705d1ae46d5593c12c22e46af983ffb7576dd65
SHA512 b65dea8f076aa58bf8d85bf36fcaaaa71bcccdae52b08365018db9463d6b81752c48b70287f30ef4d06b2fcdfaffea1934f94ffbf7c5d143b23d370b7c816b49
SSDEEP 384:nsiF+QkUSvM38Nq8TUNTUlIRRCC7rvUQXoxzyfoBjfOxAJhtZwHVowvmPPJAxJsX:XFuM39wgmCXLSdBywoVv4PkJsoL4
TLSH
T1A6C24B36ECA4DAB7EDE64E95A34E3A43DEE04253D98C5AD4D5C91D5C00DB1CE230BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1c6e3056-68aa-49ab-a3f4-203192b06506.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1c6e3056-68aa-49ab-a3f4-203192b06506.tmp
Size 25KB
SHA256 c2fcac60e28295efa224d561909eb4c86136abcec7e787a15f75b269cd165f34
MD5 803755621e035ed285b718c814c528b3
SHA1 4e9bfa1f4c4e043eaf207c1f220ef68579dc5874
SHA512 aedb0e04d25e2b5b1a33d610f89fa40aafc0af5fa998037e1518bf23b6dba6e1c91899222a84fd72d7da3dda20b60920d4037f843b3e852b575746888abb6df5
SSDEEP 384:n9iFiZcI638Nj8TUNTUlIxBCC7JTycxzyfoBjfOxAJhtZwH1Qs7O6R2Feoy7gL/P:0FQ63cwgCCNyWdBywous7TRDRA
TLSH
T11EC25B35ECA4CABBE9EB8FD9A74E7A07EEF00163959C89C0D5D85D1D009719E130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2b7f57e2-80e2-4a9a-b350-957210690ccb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\2b7f57e2-80e2-4a9a-b350-957210690ccb.tmp
Size 32KB
SHA256 0de84840bfbf3c59482c215329a55ff0ed6fca6e78d2c58a6406e6782b7adbf2
MD5 dc3ade063c1c47c827786fdd5969f5b2
SHA1 dc0e23ab9e8ed8e913e0ede11da7d8896006449e
SHA512 a762d404639d21bf76b1fb2ec6d2bba6adfc2c2f56b4ab1f26f6ed09e53997bc33c8d7fe39149b22677c5b265a7818b0b7dff8521a7d6573ee98485f9097a4e6
SSDEEP 384:nniFgQkUSvm8Nq8TUNTUlIRRCC7rvfQsoxzyfoBjfOxAJhtZwHVoZ/mPPJAxJstF:iFIm9wgmCXBSdBywoV64PkJsoL4
TLSH
T1E1E2B1F598D78A77D8AE4B97A37E2D0299FCC113B9884994B7C51C1CCC861BFD30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

55ef43f0-877a-469c-b2a6-df27d60c8839.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\55ef43f0-877a-469c-b2a6-df27d60c8839.tmp
Size 27KB
SHA256 83ece58a9e443db1bc54b21eb8e04344dd1b9a749cf39097a83854e9dc367cd3
MD5 a0994964126b866dfac1286f1a23c224
SHA1 f4c6344bfcc17d4666cd65099cf62d88f6f5586a
SHA512 9026fa1f4bff8eb0082135f3cf4adccdabba920be31e5af5dd773f2597582936411d56c09a0cc2d0cdb2c87c59c68c68d56a9c801748d837a97781828da4914b
SSDEEP 384:nsiFzQkUSvQ38Nq8TUNTUlIRtCC7rvLQXoxzyfoBjfOxAJhtZwHVowvmPPJAxJsX:XFdQ39wgmCXuSdBywoVv4PkJsoL4
TLSH
T181C24B36ECA4CAB7EDE64E95A34E3A43EEE04253D98C5AD4D9C91D5C00DB1DE130BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5aeaa125-8fe9-4c83-a03a-a0e0afbe084c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\5aeaa125-8fe9-4c83-a03a-a0e0afbe084c.tmp
Size 26KB
SHA256 da109168856d5a07efcd89e37e26d6ef89b6eef91cb54ffcd8a38288852a614f
MD5 ad9ed58cd0d4f0ba0ce69fa6421d753c
SHA1 6542a9027bb4c85f3794e652764faf30c13a1a35
SHA512 c18901c1a5ab642c02153a933755b0b79205c3e88b46c3ab03debe2777be4a3be4aad51f5d1d6a525fa32c51de84e43820f4a4856082b631b6405732a5834b25
SSDEEP 384:nuiFiZcI638NG8TUNTUlIxBCC7GrYlxzyfoBjfOxAJhtZwHVosvmP7O6R2Feoy7S:FFQ63NwgCCHXdBywoV947TRDRA
TLSH
T189C25B32ECA4CA7BECEA8EE9A74A7A03DDF54163D58C99C0D5D81D1D009B19E130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 00fd53d4e341ca585361bfbe699a2c8a3fdbc255133db935051b0958a30a7abf
MD5 e720824e80db33ac2843bf1ebb30faec
SHA1 f511d38f1de46ab026d3c6963050a3f1f512b92d
SHA512 09eb559f6018245581b30678d5f9952fcadb0adcee197127c7448f39c53ff841dddd8b077678d837d33d8e01126c7d80b7ec77764938cb5368f955ce628ed81c
TLSH
T1E3D02B5CEFD99290D436343A4035428531CFA904D1035200E090010319811410061865
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ef8e0a91cc3656fe639527b7c461215de3584a9b32168d8efc58c800c3fcf45a
MD5 7611be076e62556d26aa1ad65d6c21ee
SHA1 3b62033283275e165c1cdb998b2b174841695892
SHA512 949a38fce52f98059e4356f1465fa0cb57397b5b5a79c468fea50c81a884f46ee37ab38ecf492df88f7280e9e041eedad365f8eab019be95f1d7b37d95794929
TLSH
T110D02B58EFD58290D432343A4075428532CFA504D1035200E0D0011319C11410061865
MD5 SHA1 SHA512 TLSH

Submit Download

1468d576-6c89-4c3c-a82e-da03114607d7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1468d576-6c89-4c3c-a82e-da03114607d7.tmp
Size 414B
SHA256 64f850d10ca9c0b8915b0a8ecada73ef7d16c5fe120a51296e4d0adecc2efc9b
MD5 15a2423905b9b13ed60ee9dab560a6cf
SHA1 60c98d14e671250cc2c763466e5f787d2deeb8ac
SHA512 ec28d778211dd192af1a3bb9e8a695e2cead0163092230f35e317118620707e7daa40e9215e296471b2238cf7b0bbbb4ec0222c75757b7f3c4efe5cbd8b3baa6
TLSH
T119E022ADC922BC3B88FE0B2D20941B8AEB5503572E50850F3B3C81088FB463A86C5D5C
MD5 SHA1 SHA512 TLSH

Submit Download

1ee98c32-90b7-4437-98bd-7b11860ec95e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1ee98c32-90b7-4437-98bd-7b11860ec95e.tmp
Size 27KB
SHA256 36a06230f3aab2e6320bf216b9bdc7febe06dee20f20906b24e88832be8c5e8d
MD5 d5329110a6581c023fed1bf3352307b3
SHA1 f3cbcd97a8428270c890f4b33ac56e9bc17c8a03
SHA512 8d2862ed228f3ef1bd30da3d2ceeabf75320440c46d8c395ebc27eaddf43b00f966bd55bb19ec1fb9a40e456e11785b66ab83e53ba337233e1118f7a99d151e8
SSDEEP 384:sxZPzeb/fHs066s8qMpRiYnazAW8pZS15posJWeT+T7qhl/bhx5Sd4F8qO:snzy/fZ4Mnc7WeT+Te7/bf5s40
TLSH
T1D2C20805A824C83B9EC39D18657D7E33EAEC50522286DEDA1AECCE1C019E1FDAB07457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

59243eb1-7fb0-4bf6-be74-5f1834f20563.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\59243eb1-7fb0-4bf6-be74-5f1834f20563.tmp
Size 12KB
SHA256 58fe560be284aefd11878ba36ea09a30b7b4549bea10f28403ccc64d59db6475
MD5 fa1f4a8113963378b4253905bdb659ba
SHA1 b64a9f78c661cdbaaf95a6aff91bfe6d63c36d16
SHA512 ad747c30a7341b32b3ed9eaaa80b550131dcba3fabc918924a5c517851686d90055caa91dbe9a5139dd39175880b4cb376d8d423a7d42b190ec45ee3a297b63a
SSDEEP 192:sxZMYRHFeb/fHs7dI1ZqMqKzodpTQc/W6+WNvZuXY0gG0B3uR+2tIg5wyJ:sxZPzeb/fHsm7qhl/boX5fq4FxqO
TLSH
T16042E915AD24A93F9CC7D219BB59BF53E3FA513261815E48BAFC8A1C01EB6DD220340F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

969a923c-e76f-4bf6-807a-f225e39005ae.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\969a923c-e76f-4bf6-807a-f225e39005ae.tmp
Size 28KB
SHA256 77de40f0455c2a9d155749086e9d62d1652ae02360f0ecfd95ac161cabb4aab0
MD5 fa256e27e54f69d1568933bcf4804154
SHA1 d0004dc9f8d39fdac4fc60806c8b8eb478957be7
SHA512 78e48c64d36fc9165faad7be8202679ee5daf7815617abea3e0a397e3a27d53cb064cfe57f2e70ae86233bcd74630e53de9f8345f130be76d4296c4910027ea6
SSDEEP 768:AvmgC8Ba29tWRmpbQHL8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3HgLl/jR0sVYroXm:AvmgC8Ba29tWRmpbQHLu1jaKHgLpj+s4
TLSH
T105D2093B240CCB7E4FC04E9DDD16AF966EA802D7AA589D4047FA894C02C77EE51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 05056f3aed06808cca873c8c30d12951aebfd6a13f1e5a24af301263b543e8d6
MD5 cedd6b92ff84398199c5b59e5d376287
SHA1 6bf88aa89a01400e3c7169b92bdd7bc1f1a6ff0f
SHA512 9083b413bc0089a889602fd3541ccea095144e6fbdd989ca8b035c2047e640608bc050a97639027b81a27917d9f0d85b7de4c8e55e975af01aeb65caaea1d13f
TLSH
T1ECE026E414CEC33FA31A654B02789B0C83803B9E92F469DE2700CA88700B240B78AEA4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 a61c28d318eef8dadc7231ec04bd012eeffa4eae03b787418c5309886a447046
MD5 08f66378901e249e2837bab936d76952
SHA1 ed75657c5c4c9d3310525aba121cfa73a9d64620
SHA512 ea48424a58a7e9c86cb858abe93054fb6427f3d2d22f8d40fe9d6f790cdce5982a12caea5b121b9d646bad201c8f9b95a4cffd2ce7eac160e0d10ce3bfffebca
TLSH
T19DE026D51AC8C23EE708764B02B8530CC3C1369F92E8AD9E1B05F9857209E50A3C66B8
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 96267925b1f2a1769f02a93bba1d1999a3a907b78d22078529e1a2f09e5d8fa8
MD5 1bcdfaac5ec8c17e1ea5151d3443a719
SHA1 402c737bd238388da0cd16fe50761cb49dc72d10
SHA512 33d9c8ffa82296aabfb13319663e6345607791b89fa1be255d9bd8e02bf6e1789a09027b0780f6d4ff0a0b919e469809a15e49f9c3d71cb957b6b75fc5e92518
TLSH
T14DE026840EC8C23EA7487B47017C574CD3C0266EAAE9ADDF6704C9847109E88A78E6A5
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 af6843d7ddce8f5e07b4ea7bb5a96e3a253a8b183c04527cb880a1ae0bf5f588
MD5 560a04465372fe8370857f243305c56e
SHA1 71f6103079b12badc918c18af77598de1c97d1ad
SHA512 bb21d0b66057fa0928d9424a72b71c331dd4bfe85fb23f17768779dbb620b43d9d1064e6bb58cda546746993e6072d9a8e950844fde81333389d22a892c84bdc
TLSH
T19781CB4106D360DECB5D5079B1EE158B34738494BA8BEF125A5CF7A9E80FBFC598C052
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 531e76136b636a29bde8ec9a494bb8ba7702b392bb55eb90ea104aa93f95199e
MD5 0d06bedc2a4c3282cf8da5cfa22e4a3b
SHA1 45e0fd1177b05c78f28a978cda28194fd23f82fe
SHA512 5e3740fac3a118fcd94daddd124f0326dd2e38449d543e4077910631289f0c75b0f40c8d2e850792cc3d916d349fb5d1b21d1766d9f1888342b2b830cb622e2b
TLSH
T181618481169760DEC76C8078B1EE018B35738494BA97DF161E5CE7B9E80EBFD998C053
MD5 SHA1 SHA512 TLSH

Submit Download

eb8b674b-8046-41fe-b355-906aab2233ef.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\eb8b674b-8046-41fe-b355-906aab2233ef.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

7a447837-e191-429d-9dfb-11796159516b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\7a447837-e191-429d-9dfb-11796159516b.tmp
Size 16KB
SHA256 4d2e5246e16aa882fb7307d1a001f69b6a3443f829d93db0ab0381d5f4f4197d
MD5 310ecbb4b81a34e1c202666f9606142b
SHA1 5521577e1b9da8faa1f1153a459cec2385446021
SHA512 e1fb9fd98071882043777f8a4ddc9217038d53f1a7d149a7c28f529280aedc235cfc6a9df5697b602a9863f173105774ba318f00f8ca397d78846660e640bf63
SSDEEP 384:D1LrjhhlcBF5eBePFoaaDosyIZfDDgIEAy0g1OAPJS3FwZhV/X/LdbCGc/Foolby:jWmSN1
TLSH
T1EB7257F7D7B847BE9A2151F49D147E2BCE380868572C389681E89E4A93F7430D142BCE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8418b175-0d0c-4be8-9ad9-3ff953b272d0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\8418b175-0d0c-4be8-9ad9-3ff953b272d0.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

988e5da4-da0a-4ff6-a507-1f0e2c7b3c18.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\988e5da4-da0a-4ff6-a507-1f0e2c7b3c18.tmp
Size 15KB
SHA256 7dde66c650aec4936b5c72aed5b5105d639ad4807423767b66e7ddda8fc080e9
MD5 5d4218723ee3f925c40c2588c074cad7
SHA1 652c4b05c1fdfe02af7ef8e50e6e1ee42fdf7c8a
SHA512 54134c07308561a5d9f5e753e18112e59b0aa44ac04dd77680132a3c8771545152c1a85f56f57af72c1405655eed571a62b7c8203119acb0fe387b7161028e88
SSDEEP 384:D1LndydO9ReBePExz5AaaDo1qDgIEAy0g1OAPJDwZhV/X/LdbCGc/FoolbEOFcJc:6nmSvDj
TLSH
T1597226F797B447BEAB2151F49D147E2BCE380864576C38E681E89E5A97F6430C042BCE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ae94b8ea-c9aa-4b0e-9f87-d0c5adb20d3f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\ae94b8ea-c9aa-4b0e-9f87-d0c5adb20d3f.tmp
Size 15KB
SHA256 25b2893d47e65a18fdcda9e26856c5c370cdcd2e5258c96221c439b95a2067bb
MD5 2705e9a2d82fad1b04f53cd39bb88ff9
SHA1 abf96c987c7f3b4935ccb929defa2b86dbefe56a
SHA512 7097daa17da54474c8feb627b5cf4cfbccd9967ba7524acb5a6c18ea50bf1586d4ff8f9470e8cdf65bed306770af6eceefed58af34bf7e3e7f9d029795bc944b
SSDEEP 384:D1LndydO9ReBePjOExHaaDo1qDgIEAy0g1OAPJDwZhV/X/LdbCGc/FoolbEOFcJK:67mSvI6
TLSH
T1576216F797B447BEAB2151F49D147E2BCE380865576C38E681E89E5A97F6030C042BCE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

decf3442-3d66-418d-a5fa-f3d1a9d96a3d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\decf3442-3d66-418d-a5fa-f3d1a9d96a3d.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d3bb4403-4629-4f95-9275-60cde5062f6d\index-dir\temp-index
Size 2KB
SHA256 dbcd6bd107dc3b0f1a03809e6c9593155405806dfdb4c90c05c8bdb1d7d08c4a
MD5 1b91a1bb0452bfd0cc43249f9568261b
SHA1 e0809e8f3ad2343f9b558b7dea32304503912709
SHA512 1d9855c3f5d63a00d4b7ab2ca20f8cc693f6367c8916340f8090aa7e6946bd9b1ebc983e6da15d7701c052f5d926aa7106c4a1068da07491159ee9054c5cb36b
TLSH
T1FB41824B8E414A6BED88527214BD399A7334D1CD17943E1BA2FD9035FCD37246C89978
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d3bb4403-4629-4f95-9275-60cde5062f6d\index-dir\the-real-index
Size 2KB
SHA256 d9d338dd85ca2e91f350959a8cd99d47958215f5c086816be29ebf5e2a5332cc
MD5 a9790a65bd956a3f4bbcd750790882e5
SHA1 6253bb3ca3b65fcd31605da4e05cfc93d5870b0c
SHA512 e7cb48ec53067de8e6810ef792d0e31738c5a614be028da51da51db93e6c85cfa101c0112150c4a02876bc70f7f059e3431761d60c10232a09f1f474221bf881
TLSH
T10A41B8574D02472BEC40527209AD6497333DF14547843F0FB2E9D136F8C1B98BC99AE4
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
Size 371B
SHA256 f95c3713615866c62daf9d65e97c9b558e9a345aba88644093ca342535068183
MD5 0182fa27d352cf93445a116c3b62b105
SHA1 6f286db7a85ebd107d6ffb4aa61c3d55e66bf8ca
SHA512 d62aca1765e51c83685d56baa9ed4f33ce1b0670d029bc42cab8e6da95a2d16ec982d973a0a1253b31452eb21e96492066e94acdeae87122f9d70dd3727c0ddd
TLSH
T1D2E0C0F73CF719249CBFD7D624724461841EB86C9504BE0E401A92C350B03983045C21
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 4a4f18f2731628975dc5f385ee6ffe820143e0f18ce49f6b1a2e15df5bc046ce
MD5 34b75cffc23e66a8f455fa62ee92597f
SHA1 02ba85205c21bfd7710d68371dfd20059831c30a
SHA512 cbf58b610283f5c14f0205558857b8c2ceeb96290f27fb1775600cda8035c4b2cd9aeed469343a560fa01e6878f9f7c02cbe0911cd87c9eaecada148ca39e68c
SSDEEP 96:K4JaKygi+ZSKiIX6cKTKE+9eKOUV9eKukoWtGKEgrhOKKQk6QgKFKWDCK4AiyAgf:ohdNdBzXXFPXgRbKvtp0JlznuLvV
TLSH
T1C8B2265031BA12543CFE390890B59B2F528235B3711CE62B7FBD40A68E6BE485DFD9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

b6877a30-2e3d-4637-9e63-11cd015e86c3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b6877a30-2e3d-4637-9e63-11cd015e86c3.tmp
Size 12KB
SHA256 adcefc13e45b53afdf08b20f8327c27951f996b0acd9a2114da5abf4568c9d3f
MD5 c3e572dd0a2f0cb1f89236f690ceed63
SHA1 8518eb040c12bf8406444fc7d145a3dea5bc6350
SHA512 97a8ec71d3a8bf748642acc713097a322ee160af225062b2e365e5d60131c6d1712da1fb17ec96cb1949853740703777b5913a87749435b8fe46d3fda5dc5910
SSDEEP 192:sxZMYRHFeb/fHs+I1ZqMqFzodpTQ//W6+WNvhH/Y0guwb3uR+2tIgjyJ:sxZPzeb/fHsX7q+C/bR/5nS4FxjO
TLSH
T17442EA156D24A93B8CC7D619BB59BF63E3FA513364811E48B6FC8A1C10EB6CD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

df2faa3f-7e06-4e99-85b0-916abd84af95.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\df2faa3f-7e06-4e99-85b0-916abd84af95.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f0335479-fd54-4052-80fc-854be921f660.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f0335479-fd54-4052-80fc-854be921f660.tmp
Size 12KB
SHA256 8a0bc0306b188b54adf1ed3f9e33ea46bc684bb3b895ceb928b39d44716d1ea3
MD5 1e2136a50b6f30b439a9b7a950b37a09
SHA1 4148994c62fbbd90445ed547267f6c8568f084c3
SHA512 041e7028fbf59976069570333b8f1e6c177118bfd70e000c39de43b4627a1f418b436d22cd2213716a9ce7d8d01507856e37a9024515e982b06d42647fd6beee
SSDEEP 192:sxZMYRHFeb/fHs7MI1ZqMqFzodpTQ//W6+WNvhH/Y0guwB3uR+2tIg5wyJ:sxZPzeb/fHsF7q+C/bR/5nW4FxqO
TLSH
T15742D955AD24A93F8CC7D619BB59BF63E3FA513264811E48B6FC8A1C11EB6CD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e9e824cb-0aa5-4809-acba-0d89b3282b80.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e9e824cb-0aa5-4809-acba-0d89b3282b80.tmp
Size 27KB
SHA256 0c13cfb538d23644134b5ba1b5f39b97aa1e15fb7cdfb6a9da3fcc7f39e0ac9e
MD5 dc18436c5c4fac4ec844158518b1e3ef
SHA1 f258b739bfa9b9e532568bd014a029f9b99db7fd
SHA512 62635cc735335324e39babb86ec97cb49666541d70c7716b1f551ae9bb3024fc72e6cf00557221ecfd6d8edecf5b914ebb1baa987286f5d1d31471e9c94003f3
SSDEEP 384:nYiFgQkUSvg8Nq8TUNTUlIRRCC7rvfQXoxzyfoBjfOxAJhtZwHVoYvmPPJAxJstF:jFIg9wgmCXSSdBywoVj4PkJsoL4
TLSH
T115C24B36ECA4DAB7EDE64E95A34E3A43EEE04253D98C5AD4D9C91D5C00DB1CE130BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1636-212-0x000001FC84260000-0x000001FC85260000-memory.dmp

Download