2144519ec73be891c93d29ae30a47c30925dceb2c9bd0719f40a4a04f65d0a23

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
05/02/2024, 15:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2144519ec73be891c93d29ae30a47c30925dceb2c9bd0719f40a4a04f65d0a23.exe
Size 896KB
Sample240205-skk4msaha5
SHA256 2144519ec73be891c93d29ae30a47c30925dceb2c9bd0719f40a4a04f65d0a23
MD5 bab65dd3a372c1958a09961ac3a5a762
SHA1 014155f21acfd2159f37e062268c1ffe045fe9d8
SHA512 f23b37005821796eaed48e675ffdaeb57768b8ebd134176b5917fafef50c225316829b6ca4b3ad0be3914956a44c9f15743e687a64bba9cbeece66486b35db67
SSDEEP 12288:gqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgawTj:gqDEvCTbMWu7rQYlBQcBiT6rprG8aIj
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation	2144519ec73be891c93d29ae30a47c30925dceb2c9bd0719f40a4a04f65d0a23.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 15 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe

Enumerates system info in registry 2 TTPs 10 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1497073144-2389943819-3385106915-1000\{A8A3CA46-977A-42FB-B227-2F529D23D297}	chrome.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
3312	msedge.exe
3312	msedge.exe
5116	msedge.exe
5116	msedge.exe
2972	msedge.exe
2972	msedge.exe
5400	msedge.exe
5400	msedge.exe
6052	msedge.exe
6052	msedge.exe
6440	msedge.exe
6440	msedge.exe
3184	chrome.exe
3184	chrome.exe
8948	msedge.exe
8948	msedge.exe
8948	msedge.exe
8948	msedge.exe
8532	chrome.exe
8532	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeDebugPrivilege	2532	firefox.exe
Token: SeDebugPrivilege	2532	firefox.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe

Suspicious use of FindShellTrayWindow 59 IoCs

pid	Process
976	2144519ec73be891c93d29ae30a47c30925dceb2c9bd0719f40a4a04f65d0a23.exe
976	2144519ec73be891c93d29ae30a47c30925dceb2c9bd0719f40a4a04f65d0a23.exe
976	2144519ec73be891c93d29ae30a47c30925dceb2c9bd0719f40a4a04f65d0a23.exe
976	2144519ec73be891c93d29ae30a47c30925dceb2c9bd0719f40a4a04f65d0a23.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2532	firefox.exe
2532	firefox.exe
2532	firefox.exe
2532	firefox.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe

Suspicious use of SendNotifyMessage 55 IoCs

pid	Process
976	2144519ec73be891c93d29ae30a47c30925dceb2c9bd0719f40a4a04f65d0a23.exe
976	2144519ec73be891c93d29ae30a47c30925dceb2c9bd0719f40a4a04f65d0a23.exe
976	2144519ec73be891c93d29ae30a47c30925dceb2c9bd0719f40a4a04f65d0a23.exe
976	2144519ec73be891c93d29ae30a47c30925dceb2c9bd0719f40a4a04f65d0a23.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2532	firefox.exe
2532	firefox.exe
2532	firefox.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2532	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 976 wrote to memory of 2420	976	2144519ec73be891c93d29ae30a47c30925dceb2c9bd0719f40a4a04f65d0a23.exe	85
PID 976 wrote to memory of 2420	976	2144519ec73be891c93d29ae30a47c30925dceb2c9bd0719f40a4a04f65d0a23.exe	85
PID 976 wrote to memory of 1396	976	2144519ec73be891c93d29ae30a47c30925dceb2c9bd0719f40a4a04f65d0a23.exe	87
PID 976 wrote to memory of 1396	976	2144519ec73be891c93d29ae30a47c30925dceb2c9bd0719f40a4a04f65d0a23.exe	87
PID 2420 wrote to memory of 4668	2420	msedge.exe	127
PID 2420 wrote to memory of 4668	2420	msedge.exe	127
PID 1396 wrote to memory of 4536	1396	msedge.exe	122
PID 1396 wrote to memory of 4536	1396	msedge.exe	122
PID 976 wrote to memory of 2972	976	2144519ec73be891c93d29ae30a47c30925dceb2c9bd0719f40a4a04f65d0a23.exe	121
PID 976 wrote to memory of 2972	976	2144519ec73be891c93d29ae30a47c30925dceb2c9bd0719f40a4a04f65d0a23.exe	121
PID 2972 wrote to memory of 3800	2972	msedge.exe	88
PID 2972 wrote to memory of 3800	2972	msedge.exe	88
PID 976 wrote to memory of 4336	976	2144519ec73be891c93d29ae30a47c30925dceb2c9bd0719f40a4a04f65d0a23.exe	120
PID 976 wrote to memory of 4336	976	2144519ec73be891c93d29ae30a47c30925dceb2c9bd0719f40a4a04f65d0a23.exe	120
PID 4336 wrote to memory of 312	4336	msedge.exe	90
PID 4336 wrote to memory of 312	4336	msedge.exe	90
PID 976 wrote to memory of 2148	976	2144519ec73be891c93d29ae30a47c30925dceb2c9bd0719f40a4a04f65d0a23.exe	89
PID 976 wrote to memory of 2148	976	2144519ec73be891c93d29ae30a47c30925dceb2c9bd0719f40a4a04f65d0a23.exe	89
PID 2148 wrote to memory of 4468	2148	msedge.exe	104
PID 2148 wrote to memory of 4468	2148	msedge.exe	104
PID 976 wrote to memory of 2208	976	2144519ec73be891c93d29ae30a47c30925dceb2c9bd0719f40a4a04f65d0a23.exe	103
PID 976 wrote to memory of 2208	976	2144519ec73be891c93d29ae30a47c30925dceb2c9bd0719f40a4a04f65d0a23.exe	103
PID 2208 wrote to memory of 3020	2208	msedge.exe	92
PID 2208 wrote to memory of 3020	2208	msedge.exe	92
PID 976 wrote to memory of 3184	976	2144519ec73be891c93d29ae30a47c30925dceb2c9bd0719f40a4a04f65d0a23.exe	91
PID 976 wrote to memory of 3184	976	2144519ec73be891c93d29ae30a47c30925dceb2c9bd0719f40a4a04f65d0a23.exe	91
PID 976 wrote to memory of 2144	976	2144519ec73be891c93d29ae30a47c30925dceb2c9bd0719f40a4a04f65d0a23.exe	102
PID 976 wrote to memory of 2144	976	2144519ec73be891c93d29ae30a47c30925dceb2c9bd0719f40a4a04f65d0a23.exe	102
PID 3184 wrote to memory of 5112	3184	chrome.exe	96
PID 3184 wrote to memory of 5112	3184	chrome.exe	96
PID 976 wrote to memory of 4500	976	2144519ec73be891c93d29ae30a47c30925dceb2c9bd0719f40a4a04f65d0a23.exe	95
PID 976 wrote to memory of 4500	976	2144519ec73be891c93d29ae30a47c30925dceb2c9bd0719f40a4a04f65d0a23.exe	95
PID 2144 wrote to memory of 1220	2144	chrome.exe	94
PID 2144 wrote to memory of 1220	2144	chrome.exe	94
PID 4500 wrote to memory of 4612	4500	chrome.exe	93
PID 4500 wrote to memory of 4612	4500	chrome.exe	93
PID 976 wrote to memory of 4984	976	2144519ec73be891c93d29ae30a47c30925dceb2c9bd0719f40a4a04f65d0a23.exe	98
PID 976 wrote to memory of 4984	976	2144519ec73be891c93d29ae30a47c30925dceb2c9bd0719f40a4a04f65d0a23.exe	98
PID 976 wrote to memory of 808	976	2144519ec73be891c93d29ae30a47c30925dceb2c9bd0719f40a4a04f65d0a23.exe	101
PID 976 wrote to memory of 808	976	2144519ec73be891c93d29ae30a47c30925dceb2c9bd0719f40a4a04f65d0a23.exe	101
PID 4984 wrote to memory of 2532	4984	firefox.exe	97
PID 4984 wrote to memory of 2532	4984	firefox.exe	97
PID 4984 wrote to memory of 2532	4984	firefox.exe	97
PID 4984 wrote to memory of 2532	4984	firefox.exe	97
PID 4984 wrote to memory of 2532	4984	firefox.exe	97
PID 4984 wrote to memory of 2532	4984	firefox.exe	97
PID 4984 wrote to memory of 2532	4984	firefox.exe	97
PID 4984 wrote to memory of 2532	4984	firefox.exe	97
PID 4984 wrote to memory of 2532	4984	firefox.exe	97
PID 4984 wrote to memory of 2532	4984	firefox.exe	97
PID 4984 wrote to memory of 2532	4984	firefox.exe	97
PID 976 wrote to memory of 2632	976	2144519ec73be891c93d29ae30a47c30925dceb2c9bd0719f40a4a04f65d0a23.exe	99
PID 976 wrote to memory of 2632	976	2144519ec73be891c93d29ae30a47c30925dceb2c9bd0719f40a4a04f65d0a23.exe	99
PID 808 wrote to memory of 4640	808	firefox.exe	100
PID 808 wrote to memory of 4640	808	firefox.exe	100
PID 808 wrote to memory of 4640	808	firefox.exe	100
PID 808 wrote to memory of 4640	808	firefox.exe	100
PID 808 wrote to memory of 4640	808	firefox.exe	100
PID 808 wrote to memory of 4640	808	firefox.exe	100
PID 808 wrote to memory of 4640	808	firefox.exe	100
PID 808 wrote to memory of 4640	808	firefox.exe	100
PID 808 wrote to memory of 4640	808	firefox.exe	100
PID 808 wrote to memory of 4640	808	firefox.exe	100
PID 808 wrote to memory of 4640	808	firefox.exe	100

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2144519ec73be891c93d29ae30a47c30925dceb2c9bd0719f40a4a04f65d0a23.exe
"C:\Users\Admin\AppData\Local\Temp\2144519ec73be891c93d29ae30a47c30925dceb2c9bd0719f40a4a04f65d0a23.exe"
1⤵
- Checks computer location settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,3953352458081715827,4433746614911596925,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,3953352458081715827,4433746614911596925,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
    3⤵
    PID:4372
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8c68e46f8,0x7ff8c68e4708,0x7ff8c68e4718
    3⤵
    PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1924,13130007693332847423,9729878235812876759,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1944 /prefetch:2
    3⤵
    PID:5308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1924,13130007693332847423,9729878235812876759,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0x7c,0x104,0x7ff8c68e46f8,0x7ff8c68e4708,0x7ff8c68e4718
    3⤵
    PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.facebook.com/login
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff8c68e46f8,0x7ff8c68e4708,0x7ff8c68e4718
    3⤵
    PID:4468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,1581134170798244105,16203609204377732308,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2084 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:6440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3184
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8c6789758,0x7ff8c6789768,0x7ff8c6789778
    3⤵
    PID:5112
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1716 --field-trial-handle=1920,i,15864077877782424691,9533550964601017768,131072 /prefetch:2
    3⤵
    PID:6956
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3112 --field-trial-handle=1920,i,15864077877782424691,9533550964601017768,131072 /prefetch:1
    3⤵
    PID:7376
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3128 --field-trial-handle=1920,i,15864077877782424691,9533550964601017768,131072 /prefetch:1
    3⤵
    PID:7444
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3784 --field-trial-handle=1920,i,15864077877782424691,9533550964601017768,131072 /prefetch:1
    3⤵
    PID:7568
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4884 --field-trial-handle=1920,i,15864077877782424691,9533550964601017768,131072 /prefetch:1
    3⤵
    PID:7940
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4048 --field-trial-handle=1920,i,15864077877782424691,9533550964601017768,131072 /prefetch:1
    3⤵
    PID:7616
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2072 --field-trial-handle=1920,i,15864077877782424691,9533550964601017768,131072 /prefetch:8
    3⤵
    PID:7272
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1796 --field-trial-handle=1920,i,15864077877782424691,9533550964601017768,131072 /prefetch:8
    3⤵
    PID:7264
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3880 --field-trial-handle=1920,i,15864077877782424691,9533550964601017768,131072 /prefetch:8
    3⤵
    - Modifies registry class
    PID:6332
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5108 --field-trial-handle=1920,i,15864077877782424691,9533550964601017768,131072 /prefetch:8
    3⤵
    PID:6328
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4996 --field-trial-handle=1920,i,15864077877782424691,9533550964601017768,131072 /prefetch:8
    3⤵
    PID:5836
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=852 --field-trial-handle=1920,i,15864077877782424691,9533550964601017768,131072 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:8532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" https://accounts.google.com
  2⤵
  - Enumerates system info in registry
  - Suspicious use of WriteProcessMemory
  PID:4500
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1904 --field-trial-handle=1972,i,5420954351733628017,2422502010592614023,131072 /prefetch:8
    3⤵
    PID:7696
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1788 --field-trial-handle=1972,i,5420954351733628017,2422502010592614023,131072 /prefetch:2
    3⤵
    PID:7624
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4984
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com
  2⤵
  - Checks processor information in registry
  PID:2632
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.facebook.com/login
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.facebook.com/login
  2⤵
  - Enumerates system info in registry
  - Suspicious use of WriteProcessMemory
  PID:2144
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1924 --field-trial-handle=2008,i,13804870364331894081,15649702401729927172,131072 /prefetch:8
    3⤵
    PID:7292
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1720 --field-trial-handle=2008,i,13804870364331894081,15649702401729927172,131072 /prefetch:2
    3⤵
    PID:7284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://accounts.google.com
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,2796646755202396119,7297895753594483556,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2076 /prefetch:3
    3⤵
    PID:6488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.youtube.com
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,12309836490871903523,3901911427125492007,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4268 /prefetch:1
    3⤵
    PID:6516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,12309836490871903523,3901911427125492007,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4432 /prefetch:1
    3⤵
    PID:6744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,12309836490871903523,3901911427125492007,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4216 /prefetch:1
    3⤵
    PID:6876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,12309836490871903523,3901911427125492007,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4588 /prefetch:1
    3⤵
    PID:6492
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,12309836490871903523,3901911427125492007,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:1
    3⤵
    PID:7000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2060,12309836490871903523,3901911427125492007,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6564 /prefetch:8
    3⤵
    PID:6392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,12309836490871903523,3901911427125492007,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5820 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:8948

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff8c68e46f8,0x7ff8c68e4708,0x7ff8c68e4718
1⤵
PID:3800

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff8c68e46f8,0x7ff8c68e4708,0x7ff8c68e4718
1⤵
PID:312

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff8c68e46f8,0x7ff8c68e4708,0x7ff8c68e4718
1⤵
PID:3020

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8c6789758,0x7ff8c6789768,0x7ff8c6789778
1⤵
PID:4612

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff8c6789758,0x7ff8c6789768,0x7ff8c6789778
1⤵
PID:1220

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com
1⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2532
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2532.0.498007541\1010858043" -parentBuildID 20221007134813 -prefsHandle 1852 -prefMapHandle 1844 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {28c147d1-9bf2-4b22-80ce-1301f837a25a} 2532 "\\.\pipe\gecko-crash-server-pipe.2532" 1944 2b3c2cd7658 gpu
  2⤵
  PID:1072
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2532.1.2047056683\1280375982" -parentBuildID 20221007134813 -prefsHandle 2400 -prefMapHandle 2388 -prefsLen 21565 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {437c53f7-7a25-4daa-a28a-e4853715b22c} 2532 "\\.\pipe\gecko-crash-server-pipe.2532" 2428 2b3b64dfc58 socket
  2⤵
  PID:6292
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2532.2.1175223155\47355324" -childID 1 -isForBrowser -prefsHandle 3260 -prefMapHandle 3048 -prefsLen 21603 -prefMapSize 233444 -jsInitHandle 1144 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7cd0c01a-0a98-4db3-add2-7251322aef8a} 2532 "\\.\pipe\gecko-crash-server-pipe.2532" 3044 2b3c6906258 tab
  2⤵
  PID:6268
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2532.5.1989691113\134313390" -childID 4 -isForBrowser -prefsHandle 3032 -prefMapHandle 2916 -prefsLen 21709 -prefMapSize 233444 -jsInitHandle 1144 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {078a23e0-d225-41e6-b3b4-a6e5ee70e8ce} 2532 "\\.\pipe\gecko-crash-server-pipe.2532" 3056 2b3c6a8e758 tab
  2⤵
  PID:7952
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2532.4.1989472576\327491146" -childID 3 -isForBrowser -prefsHandle 3944 -prefMapHandle 3948 -prefsLen 21709 -prefMapSize 233444 -jsInitHandle 1144 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a2d25cd7-5b39-4b01-93c0-c9b08331277b} 2532 "\\.\pipe\gecko-crash-server-pipe.2532" 3936 2b3c6a8e158 tab
  2⤵
  PID:7848
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2532.3.1204687854\1048277246" -childID 2 -isForBrowser -prefsHandle 3792 -prefMapHandle 3796 -prefsLen 21709 -prefMapSize 233444 -jsInitHandle 1144 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {72d85c4f-866b-4baf-b49c-aa660f7ec82b} 2532 "\\.\pipe\gecko-crash-server-pipe.2532" 3652 2b3c6a8db58 tab
  2⤵
  PID:7840
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2532.6.2097794552\1231330688" -childID 5 -isForBrowser -prefsHandle 4644 -prefMapHandle 4616 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1144 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {189d5972-86ce-4ccc-b24e-b98efba389a5} 2532 "\\.\pipe\gecko-crash-server-pipe.2532" 4656 2b3c8382158 tab
  2⤵
  PID:6672
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2532.9.1797203639\1000656818" -childID 8 -isForBrowser -prefsHandle 5912 -prefMapHandle 5916 -prefsLen 26381 -prefMapSize 233444 -jsInitHandle 1144 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {04469574-0477-4c2b-ae34-8443e82c9381} 2532 "\\.\pipe\gecko-crash-server-pipe.2532" 5904 2b3c9b86558 tab
  2⤵
  PID:8872
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2532.8.1030049419\516130877" -childID 7 -isForBrowser -prefsHandle 5720 -prefMapHandle 5724 -prefsLen 26381 -prefMapSize 233444 -jsInitHandle 1144 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {aee42f24-934a-4851-be37-6e2e3aa07e4e} 2532 "\\.\pipe\gecko-crash-server-pipe.2532" 5712 2b3c9b86b58 tab
  2⤵
  PID:8856
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2532.7.1037706734\816157062" -childID 6 -isForBrowser -prefsHandle 5568 -prefMapHandle 5564 -prefsLen 26381 -prefMapSize 233444 -jsInitHandle 1144 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {427ee107-60d8-41f6-b187-30c9de04a2c1} 2532 "\\.\pipe\gecko-crash-server-pipe.2532" 5580 2b3c952f558 tab
  2⤵
  PID:8848
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2532.10.347539346\1813982973" -parentBuildID 20221007134813 -prefsHandle 6244 -prefMapHandle 6240 -prefsLen 26381 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4a970917-f621-42e3-a169-690790d5a7cf} 2532 "\\.\pipe\gecko-crash-server-pipe.2532" 6248 2b3ca590e58 rdd
  2⤵
  PID:8680
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2532.11.526115653\921617953" -parentBuildID 20221007134813 -sandboxingKind 1 -prefsHandle 6368 -prefMapHandle 6364 -prefsLen 26381 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1dd50b71-6d92-436a-9282-1453406a2e31} 2532 "\\.\pipe\gecko-crash-server-pipe.2532" 6380 2b3ca4e0e58 utility
  2⤵
  PID:8776
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2532.12.1193009204\1831145183" -childID 9 -isForBrowser -prefsHandle 6528 -prefMapHandle 3940 -prefsLen 26381 -prefMapSize 233444 -jsInitHandle 1144 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {350cb6b3-cb83-4146-a65d-3e9f7f5584c9} 2532 "\\.\pipe\gecko-crash-server-pipe.2532" 6668 2b3cac19758 tab
  2⤵
  PID:5376

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.facebook.com/login
1⤵
- Checks processor information in registry
PID:4640

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,12309836490871903523,3901911427125492007,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2744 /prefetch:8
1⤵
PID:5132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,12309836490871903523,3901911427125492007,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
1⤵
PID:5380

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,12309836490871903523,3901911427125492007,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
1⤵
PID:5372

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6080

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,12309836490871903523,3901911427125492007,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3896 /prefetch:1
1⤵
PID:3704

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,16600029531117211113,1231220607413648918,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 /prefetch:3
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:6052

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,16600029531117211113,1231220607413648918,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
1⤵
PID:6044

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,12309836490871903523,3901911427125492007,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:3312

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,12309836490871903523,3901911427125492007,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
1⤵
PID:4684

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,12309836490871903523,3901911427125492007,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3912 /prefetch:1
1⤵
PID:5932

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6948

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:7792

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:7692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 5874dbe9583546eb24cfb2b237d58f97ef186cd72866dd224df82e62817744ae
MD5 bc16ebe41a9fc2938c4060992a92b0af
SHA1 1719af3e339b187d984a76437eb80cae5dc50e6f
SHA512 c78d4be86a3f35ae07375b37fd39f869d317a6ec6699d7673731e6f9b255d7bcbfacf58ca71c3f51baac1e2b2bbee7da58603efa5bd51a31162c481aab7a912c
MD5 SHA1 SHA512

Submit Download

f_000016

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000016
Size 34KB
SHA256 ea3a8425dcf06dbc9c9be0ccd2eb6381507dd5ac45e2a685b3a9b1b5d289d085
MD5 b63bcace3731e74f6c45002db72b2683
SHA1 99898168473775a18170adad4d313082da090976
SHA512 d62d4dddb7ec61ef82d84f93f6303001ba78d16fd727090c9d8326a86ab270f926b338c8164c2721569485663da88b850c3a6452ccb8b3650c6fa5ce1ce0f140
SSDEEP 768:tVmSx/bOqvDd2XiIkTFS8P5YsZIpKE09wpzdnyu4CmxsdRhNUA8tq7:twStOw2SIN8YsGpuOpzmIhmHq7
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000017

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000017
Size 16KB
SHA256 4e57f4cf302186300f95c74144cbca9eb756c0a8313ebf32f8aba5c279dd059c
MD5 9978db669e49523b7adb3af80d561b1b
SHA1 7eb15d01e2afd057188741fad9ea1719bccc01ea
SHA512 04b216bd907c70ee2b96e513f7de56481388b577e6ccd67145a48178a605581fab715096cfb75d1bb336e6ad0060701d2a3680e9f38fe31e1573d5965f1e380a
SSDEEP 384:m60n76CIHRODbU9VBUaiXB+F8NRYwiINmLGL0luobcIOgHMHFvUFG:90nkmg9XUTBU8iLIZ0luobcIOgH+MG
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000018

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000018
Size 46KB
SHA256 bb77e10b27807cbec9a9f7a4aeefaa41d66a4360ed33e55450aaf7a47f0da4b4
MD5 beafc7738da2d4d503d2b7bdb5b5ee9b
SHA1 a4fd5eb4624236bc1a482d1b2e25b0f65e1cc0e0
SHA512 a0b7cf6df6e8cc2b11e05099253c07042ac474638cc9e7fb0a6816e70f43e400e356d41bde995dce7ff11da65f75e7dc7a7f8593c6b031a0aa17b7181f51312f
SSDEEP 768:wBeHNyL6MdIqdOnJzH2K5Qc3v2IJVSFTj9c443vMv3SgqwS4RxkmKHsn0S/q86UK:w7LhdynJzH2Kp3v2wVSFTxc44i3SzwSX
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000019

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000019
Size 49KB
SHA256 dada70d2614b10f6666b149d2864fdcf8f944bf748dcf79b2fe6dad73e4ef7b6
MD5 55abcc758ea44e30cc6bf29a8e961169
SHA1 3b3717aeebb58d07f553c1813635eadb11fda264
SHA512 12e2405f5412c427bee4edd9543f4ea40502eaace30b24fe1ae629895b787ea5a959903a2e32abe341cd8136033a61b802b57fe862efba5f5a1b167176dd2454
SSDEEP 768:WuI84bAhSakFKzyQWwqwZP+46j4DKQn5YuFSTdMq5Bgh5RbLmPnfB:2DvE9nZP+HjQK2yuEWq5Wh5NmPJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00001b

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001b
Size 46KB
SHA256 b6c5da3bf2ae9801a3c1c61328d54f9d3889dcea4049851b4ed4a2ff9ba16800
MD5 621714e5257f6d356c5926b13b8c2018
SHA1 95fbe9dcf1ae01e969d3178e2efd6df377f5f455
SHA512 b39ea7c8b6bb14a5a86d121c9afc4e2fc1b46a8f8c8a8ddacfa53996c0c94f39d436479d923bf3da45f04431d93d8b0908c50d586181326f68e7675c530218ed
SSDEEP 768:HTsawO0zGMoKDhy4NNlHM2Uq0QC2buj/nHub5DlJK/8VK5IIbqGtXpw07vds:YU0iMJVhNNZM/GOP8Ho/8Q6IbPtpC
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 4b82bc84c6af30112541fc3b22b0197f90842b3571fc7f1db8d21a9d18514f28
MD5 6f0ab457af749c03642ac7163655e3d2
SHA1 242e60948eb2a0e39514cc526c9adaee278f0308
SHA512 db2bbc8df74e60f9882fd92d7749ee729f428ae44e5f02941f97c1fada2b6b6fa511e8e207b8c8e561251ce5d6e5249e2bbe66d3d4aa70053075a33d5d216723
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 c1a3e063910512420d97f758c15f32746bda9dfe4875e484e46330919918e48c
MD5 07cc617817bab0ea565a412901ca64dc
SHA1 12a5e3b59529b2c70c01ecf30c2f1fb7c43fff8c
SHA512 1456ad630a5b5d49be15ce1f6b9badff85a214287971417d973e83fa097e229b113f4579499459db4b47b07e1c2a2b055a7c3528f5ceec69f72f16acefd1599b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 7ce200ee22b606b4cbb2e0577f6ef6bd26adc685109a883d3d20ecc62765a286
MD5 5c673c0de17e765f7da1f9a1baa1e771
SHA1 e8208d83534d62bcc972a50c709cb1dafa7021f6
SHA512 602a9522d69111f7ec9dbce19d69ba6257d0022c1a920ea6f064a3e2fade2014a3284f4a6f2638f96d8040814f84080a979e75600696cf25115ca49f638db41f
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 863932d16421b50e091cd4bf7c4ff01b1b674f738f3b930ed7f2472a7b00350e
MD5 885e71a3312b96598e311c88e79eace1
SHA1 c513a113e174cd8c1a80d27a1988e2885ad4828b
SHA512 10b94086c0b068442e6b529bbf7d6ca9540c799a55c13e1eb1192d5d0e6c925df3741e3d4b39fb3c460a9471a24336092b663081d573edb32ee40a635b645424
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 ed52d0c02dc75dd491729ff2a691c0c01b969c756ac21d833a206302ff41d867
MD5 31b770908b4b494b0695ab4d206b426a
SHA1 274616f69d114b5e4b295e71ba9988ed80845e6c
SHA512 57f6ffade930e168afe2cfe94ff1aefbf26c1b4d706c2696def5ce1fa6beccd7155288860c3ef557b28cfcc7a9f8fd2035c4211176518a7abe9c30200026b41b
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 e510ce5daa5a9d9d065c6c1fcf08d1ea671f76c4d39e3ba30cc0301c606c5b43
MD5 9085c23abed92f812513b76638675796
SHA1 1e77bbd9537f236a712d0812bdfdac119989de45
SHA512 2923a8481a256d2504fd11fd524fc34e961a2a852998d64f626c28787b102420d2423b6ae7b734438d36010af7f8ca3569298de1f53d1d8ad5af81ade19cefd1
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 707B
SHA256 a87a03e18a8644900c421d47cf13daee7f61afe784fae18c6fc577d6dbe63b91
MD5 6a4d0519eafff29b7cbedab9e5457c2c
SHA1 7681fdfa2d89f7ca274a6ae1380d41e0a4b8c641
SHA512 1a4ff984b3d8f4358f1247a4de5a350633ad0399d7206438aefe7dda73e94e60b850a1819b3e925176932f9dbc2402f9be21616a6009d36738d0f70b223a6496
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 ba4683b973866a632608b323e643302118d3a9da14c740c427b89b10cca7092e
MD5 dcadf26c8e13007fa5a3293fb3f7e2bd
SHA1 dc8df8e89fc8f9c8749d4cd9105db2b93afcb966
SHA512 7835ec941dd598600ae25627eaf55e317f0e65d26606892025a065ec1bdcedb74766b229af4ca1bcbfcc6a7e36b416f4008bf69bf2f270e10308e67cfe337201
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 8fb3c462624e031d9d0b366c0ecf0865271c0143f2497032bdbdd1615fce4d75
MD5 1bcaafc5752b3459d9f7c80407357318
SHA1 5e4b6b7906764c4ffd4298c6b6de9ae28c67848e
SHA512 8053e92692fc728436dda5d1205af49528344e3cc6b4c4355d23a048eb8788a27d299aeba15a5143ff8f6beba240e010906e41f3e613ee3ea3dae61476c9f175
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 7KB
SHA256 8b7b95966bd5c37fb1dc5c94e4c9aa84017de779d562aa1f35efaf2cd15f2b8d
MD5 bc036c7b6416de6b21030eee84ca89f3
SHA1 d9a31e561d08de020ae2e5937d75258df3b2a0e6
SHA512 b28e82ed1ae57c08472a11f650cb729cd5ea09a04dab76eb90c421184bccef3b1819bc8f14fdfa8a1b51f75c12a4f055c6ad8bdacbf079d81b80331f98bbc00a
SSDEEP 192:LqLK7YB8zG+yy+FikfrkXwkNCvotjEsXtScPS:LqW/yxrIHCQtIsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\62fb3508-a79b-4025-b634-d88a60903ef9\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 176B
SHA256 7be1957dca28c5c7a1336c8cb0f3d47ed9f20dd8377921ac93293dc6627a7c4a
MD5 c1d1cd1bb5a732e5c42c7889feb91ba9
SHA1 eaa98f872dced76bfe51793b955ebe79602b8eb2
SHA512 0f4345819fa1ca61d19783c63414a31a61ae856a5b3dd174284652f94fa6fa26d2fbb1332a9ead8c216f8722db1c505af4a2f0aefd8504206a6ced72ce4611b9
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 112B
SHA256 b1342ae0270b5ead943fc08c708f85666f9a4248ddb1cb74890ad9f643439689
MD5 c26984cb69416f03a6134f1e7a36b239
SHA1 04d077de55b47ddbb0e3d1b34711d983d0374592
SHA512 daa361d1ff0195e6b0e68bb5c4389fe0749841135bcd04f3625f183fd7b8e0bd09d50b18710939b50ae0ccc8a7825c6f2b96cd981a78631050bab7a1dae0d34f
MD5 SHA1 SHA512

Submit Download

index.txt~RFe57921e.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe57921e.TMP
Size 119B
SHA256 069adbad45561809a64a1a0f5c42dc635a2268e7eca0c8234ccac1160ba18673
MD5 f0ec5ec3b4b6d615e1ff8d546a0c6406
SHA1 3560e287a35ce40647a42f38d75e0470a63ac63d
SHA512 341267250a1c59381e7763a563365af1cd9eb170e39e42403940702fa600d20c0367b1d8d468a80a7740cb52908ddbb31240c4d2b5373403eff692fb768e8f55
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 2004c49fb3cbf8054158cc92568caf20bde0ebeae8f1a8c7909477d64954b038
MD5 1e3ce1e0897c1a89a450618dca38dad2
SHA1 4e82eae41c292737217e4ab341a0f5f2225de3a1
SHA512 86ba631239115470723e1b926ba4a12fe1e7b9a68b9bd55f680df11f6ec232776ee9088e23076277f1312afe971b3e162451d9e68930accb19305f5c063b4407
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe57ec25.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57ec25.TMP
Size 48B
SHA256 664dd896f1bb7923ae369ddb771a2a09615912cea193fd3184232d3d5f1074c5
MD5 e589bc33a8aac41848e661434385454c
SHA1 47308d02bdfdc84ed9a28c0dd9978199d6e3ecbf
SHA512 06114a6018eae2d0a13a12b3b7e5f545fa202300f05b277617189badfdc8a04a96685908b1c7e9aa8896a87b4be72dc5715cc16ec80adca395ac2bc1a09662a6
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 114KB
SHA256 227234fc81b1b2af85af49348f9b214da2664208f816ab298099348f0f76c5cb
MD5 65805262399ed915936ca8570fdc56bd
SHA1 7c960fb75a90f4438ae94ed6feeb3b59c04e8724
SHA512 5e475222ad4776ff52d5acc1c3dc81d833cdc8ba39746ebcaa2e9aeb76e1578df931ba184beba2ccbde6439c6c58274cf79b4212ee79a2d92ee87fbe3a3da475
SSDEEP 3072:qjl+RZ3ExBmTyNAccce6M1OvEOnf5SD2A0hea11o9MCw:qB+70xBmboJnf9/ToS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 8e26de402e725f95eb7c0c1e09d0e71ade2d3b052b13763e444688bcf7232f12
MD5 386366b01ae52b3a9df526a4a19a55a1
SHA1 b6319e6dfcd02b0eac2f5a65a8da9da5a1956e40
SHA512 f40f57a7916fa23a87d30bb0282492b73f4441ea1aefbb9f2cfa398e04add86207ea30083400941fc2c5b2f4024941f6ebf983d65f001c3261b2473e32293e66
SSDEEP 6144:VR3gKS9QmYlvFKfnK+HOB+70xBmboJnf9/To0:z3gKSb6vmKwCxBOinf9bF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 114KB
SHA256 054091334352db28206b4dca089445713aabc2d666012d82d87fdc5b3f63e5dc
MD5 753a1cdca8e07d09d67fca5c332a916d
SHA1 54a990e9add504b50efea4e769fb63b9195eeb32
SHA512 12b54275d3e06d2b117a3755a69a252ab8976a2bb2ba5268b01e9485118ebe236a18732b2cef411c71b78064a58f8e225d88a61630c61f8532bedddec83ff127
SSDEEP 3072:9jl+RZ3ExBmTyNAccce6M1OvEOnf5SD2A0hea11o9MCw:9B+70xBmboJnf9/ToS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations
Size 85B
SHA256 7ca5a3ccc077698ca62ac8157676814b3d8e93586364d0318987e37b4f8590bc
MD5 265db1c9337422f9af69ef2b4e1c7205
SHA1 3e38976bb5cf035c75c9bc185f72a80e70f41c2e
SHA512 3cc9b76d8d4b6edb4c41677be3483ac37785f3bbfea4489f3855433ebf84ea25fc48efee9b74cab268dc9cb7fb4789a81c94e75c7bf723721de28aef53d8b529
MD5 SHA1 SHA512

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations
Size 86B
SHA256 474d668707f1cb929fef1e3798b71b632e50675bd1a9dceaab90c9587f72f680
MD5 16b7586b9eba5296ea04b791fc3d675e
SHA1 8890767dd7eb4d1beab829324ba8b9599051f0b0
SHA512 58668d0c28b63548a1f13d2c2dfa19bcc14c0b7406833ad8e72dfc07f46d8df6ded46265d74a042d07fbc88f78a59cb32389ef384ec78a55976dfc2737868771
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 32e343d2794af8bc6f2f7c905b5df11d53db4ad8922b92ad5e7cc9c856509d93
MD5 4d6e17218d9a99976d1a14c6f6944c96
SHA1 9e54a19d6c61d99ac8759c5f07b2f0d5faab447f
SHA512 3fa166b3e2d1236298d8dda7071a6fcf2bde283f181b8b0a07c0bb8ba756d6f55fa8a847ca5286d4dbabc6dace67e842a118866320ac01bd5f93cccd3a032e47
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 6e881c02306f0b1f4d926f77b32c57d4ba98db35a573562a017ae9e357fcb2d2
MD5 0bd5c93de6441cd85df33f5858ead08c
SHA1 c9e9a6c225ae958d5725537fac596b4d89ccb621
SHA512 19073981f96ba488d87665cfa7ffc126b1b577865f36a53233f15d2773eabe5200a2a64874a3b180913ef95efdece3954169bdcb4232ee793670b100109f6ae2
MD5 SHA1 SHA512

Submit Download

f_000005

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005
Size 34KB
SHA256 cb357178d5e09917800b0669d958b5517c4f8b322c01f2adeca3ea7fa4e707c1
MD5 d1a0d8504b6a46215e2a4cf521ddb7b5
SHA1 3d6e16808a1e17ccdaca99f37ed30468391c62e0
SHA512 2ee68d71b04a78e1bc353f66daaeac1ab9f2e1119d7b6974571f8ef1a7a20fc1ea3903f3d90f3feffe7d820339abed4a26cabb230ddba3baa415309daad2d570
SSDEEP 768:SFJOqyHWjhlM1DKa6SeQ6fH/744puqFel7HT:SrONHEhl0ua6StKRUGE3
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000007

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007
Size 18KB
SHA256 c8cdeeebc42c8dd3140e12b64b94f1606d9960af22b6feaf834f4eadf8e1ea33
MD5 85b2f70f7cca6ac183b1c48cb0198d98
SHA1 b9c226a60c83280f96ac76c3fcbfcb7547fbacf8
SHA512 79cb317cad7739b3f23988e3f430f8f9ebb4fb42a1fbb3c8672a835fd343c5588e6f912c2831909a1bf0729ddb2c820deed51d7dca050c303975230664570b48
SSDEEP 384:VrsEfkZ9/5NlPnzZRBlEzX614tW0RNwKgg9ivcPoEyQP:OEcTZzZRQrm0LwxvcgEyQP
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000008

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008
Size 202KB
SHA256 22806fbcc9e20d0a5fa377b2915e2adaf86e8ed3ab66220f1ad27e00b3107b25
MD5 c9e9e7c575c62582432f0a182dbc3a59
SHA1 759f00b176a11b59af4a4618a0cd992e760e6e9f
SHA512 e5188285b531bbf830026c776ea115d360c78ac0936b313adeac62d6534094b2ccc5df60f0c98b3f1ef40cabe5f2de87d7a3f626f72be95a813a1aee15837f43
SSDEEP 3072:XC9nDgUNgpqyabWfGPH/bIrJbJduAGOXd64Ew3EzrJWxV2ANGXyVyR6:en8UKPMWfG3bOJdgA7d67w3Ez4zSygM
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000009

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009
Size 22KB
SHA256 d9134e3cf60db564c49cc181251c7308bc568acf060444c443a90c0f464ebfeb
MD5 7a204d478c8dfe822bf86f9103bbd9b3
SHA1 7114b36ea1588d9372d730b2ee5dec7a3aee36d1
SHA512 f5fb06a9808e9370a5fb3b926ffa27746ca7942eba36a2f63135168218e326abc74195453b9bcd8a045d5870a71b7f250dfc281515c7fa51857410acb316763e
SSDEEP 384:nvbrNYUrJVMhJyOObsMcKvg5SLUytc/i4SXOxZewvyLfgURlFj:vbRrJVMvBJMdBEuXKhQfr
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a
Size 21KB
SHA256 7061caa61b21e5e5c1419ae0dc8299142ba89c8169a2bd968b6de34a564f888a
MD5 3669e98b2ae9734d101d572190d0c90d
SHA1 5e36898bebc6b11d8e985173fd8b401dc1820852
SHA512 0c5f0190b0df4939c2555ec7053a24f5dae388a0936140d68ed720a70542b40aaf65c882f43eb1878704bea3bd18934de4b1aac57a92f89bbb4c67a51b983ae3
SSDEEP 384:XWdTGt5usYwb1T9Y9YsxxCT/dwpaRHqbV0EiRdxRhmEyEpWQsZ+QTNxYyHVx:GdTDA++sri6paRWijNmEts/ZNOy1x
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b
Size 20KB
SHA256 d7928d8f5536d503eb37c541b5ce813941694b71b0eb550250c7e4cbcb1babbb
MD5 c1164ab65ff7e42adb16975e59216b06
SHA1 ac7204effb50d0b350b1e362778460515f113ecc
SHA512 1f84a9d9d51ac92e8fb66b54d103986e5c8a1ca03f52a7d8cdf21b77eb9f466568b33821530e80366ce95900b20816e14a767b73043a0019de4a2f1a4ffd1509
SSDEEP 384:KYo+7sitixxLBqKOxKsD1BPe8zZXUMxqSoDeZ54AR7eH7oaNNa6n:KYoysitiHLBq8WTtXnz9K47iNb
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d
Size 17KB
SHA256 00ffe000f78ae3c8c8d5557e3ab0089e29730ed10b2a190bd2b7a569812afd96
MD5 2ba277bbbcc8715291613160a997cebd
SHA1 e64ee67165bbadd3b8bde989c3e5b1d2540cf09b
SHA512 c0f7840f181ad991c45ed1be0fcc0d90be100f8bbf36c54418ebe66f46d776652447eb5b7eaffbd2eb07c04455841d8e5d74f404eddf3c22daa34269d842435e
SSDEEP 384:Fmtt1OFGAVYPmv8Q1iUNHLCEoQfBTAR303IYpUFk+:wX1OF1YPmvTTNHLCwp0303IYpsk+
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e
Size 1.5MB
SHA256 3d62caa23fb0401f551a9f8ce3f492aca9ad3fa33a7b86924bd85843b025bdb6
MD5 7de64ee3e0d052079161ca100c797ad9
SHA1 3135abc12042890b8e6e567afed168e981f18775
SHA512 2d8dbf225d60f5e75f935f714b118aafee02fa23a862e083e08c19eff02943d237f68c0c9d4f4ed4143adff08bdaf30cce5a81ac64fcfb22faf1fe67a09756ef
SSDEEP 24576:Xcs2Wmtcs0RTtp35UvvIoJGyiwGuXYoCbcCbQ/iIF8YFtM9T/GsUWnw3UDfrucCT:Xcs2jd0RJx5UvQ7yibpb/bQ/JF8GDuwB
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f
Size 16KB
SHA256 8b598d7196aef8cb9eacf393e5b2520f5387f125552e1fefb6f373be30f64e97
MD5 d8e56edd91e6a8e254c9df3c3619f493
SHA1 e5bb299b458c95e5575da0a42ff7b49969b880b4
SHA512 46d3bb6eeba235ed9e2621cf6bf89c10c78fbbee1bec31d59347532d9d242de4bb533911d0981d3c1af85a1d51226ca694ccbcef178adda1fb71e9634820027b
SSDEEP 384:oaawOXEE6Szyw2UFm2qEQAf1hUzuKkjpB9ydR:4qSd2UFzqEphUC1pBsr
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000010

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010
Size 56KB
SHA256 fc01d1f63650df9b53e5ed7f8ad20f8ca46a194533f72ab431ce862d1f310b63
MD5 57ae6558fd495a4c05692113c7315b1e
SHA1 edcf35929545ae68664779e0254b67e720e1a0b3
SHA512 51fe9f8eee096ecaec21a1b1ccc72ddefa178627cf8809daf12713c70edc075bd1b03f277a505b2357076a278afd11a4f853132d8fbae53361a36438fd8951f4
SSDEEP 768:HJB34t9DdjyPAF0TG3Oum32aaRX+JJEPq97qJaGUeDuXvGaaHXogvVEWwN9MitoF:HE9D1y80dq2EmnDKBv+NZowXTGt2SL0E
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000016

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000016
Size 37KB
SHA256 118d6f295fd05bc547835ba1c4360250e97677c0419c03928fd611f4f3e3104b
MD5 01ef159c14690afd71c42942a75d5b2d
SHA1 a38b58196f3e8c111065deb17420a06b8ff8e70f
SHA512 12292194bb089f50bb73507d4324ea691cc853a6e7b8d637c231fadb4f465246b97fd3684162467989b1c3c46eabb3595adb0350c6cf41921213620d0cff455b
SSDEEP 768:IvjwwmdktiQ3hQVQ7Uba5Uzaq1nOqaoYCoCXOYtQSuZgNgzPI0FYwvbnsXQE+rr:IvkhktiQ3hQVA5a1OqjXoCXFQS+wF2LJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000017

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000017
Size 31KB
SHA256 b222b23c6ee94816389506d4de8ead66181c8053242e1e1eb784ccac46bc7ee5
MD5 81ac05c6d01d84d913a56c11909cdc7d
SHA1 55f6bd5429c5a35ed53caae2cd50d856edcb7883
SHA512 0925243828f33130cb3b68a6a113f1aabd07a8b19b3b99f45e5a2b1b2473622fa997d833c1d4b7b71781f246154d3a145aea37cda5351dc851eb3f4e550677ae
SSDEEP 768:sWzfeCBJsfRau5EAgzQRLYxSjbminAOvb5oAqLR43U8u:sW6CB8RXraSj5nBqAqLgUR
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000018

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000018
Size 46KB
SHA256 1032fd6f298c16aaae3f1ae2059591f2f5d40e839de4f22a5bb6d41c38a39818
MD5 3ba7e6919bc260bb6ab523197f2be3e1
SHA1 ce2d7fe3aa42d99d733266d023f6aef3766e7785
SHA512 2806c96ff57678813e20abc51ffbcb8ebe8986b3775df5d42812be6b50c905840503486d1b963d1fcc6c3de572da4bf9ee175b802032753785d3de69fb0768fc
SSDEEP 768:ic1INEEbSUda9fckAz8K3Q8LOfpJ7gVrNeaVJtuV4XssFIxn2ycvZzM0nsoZdUjM:ic1INESockKVIz7gBNeaPtE4dy2Jpss9
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000019

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000019
Size 771KB
SHA256 f38e1d77aa0173d1c110ebbc24f55704f74d28b33c70302f1170c1f4213f611e
MD5 3b2df667a176193cba046f74787e731d
SHA1 0525109b7a249a66df8c8eb7d24b49852cd076cc
SHA512 f6a90da9852126be776f2b7b488e04d8ff3cc6e0f4b222e1d9fb7aa2c938d586d4c88150dae1fecc24606c5a80270eb7c70ca4286a0efd2c2478aa2701056ebf
SSDEEP 12288:ZdYMj0dqFJo3uMCpDIijTCKIyvHCkCBoyh7qKzxQmRRwyELlRaxQhYNcYbpLOuPP:ZdYMhFJBhpjTBCB7oTmRNUlFYNc2Jn
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00001a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001a
Size 30KB
SHA256 0d950d310c06f5df42df4c095f087e9e04f1df621baed053ad73b6c526cdb75c
MD5 aaba5e872ba07d60f556b78df854279e
SHA1 93d1494959f4027195f527db143e5aa89d60925b
SHA512 fb9f3fe53d97caf3624a5cfc952daa6fc486e153f9fb33a3456c7f86c655214b520432d150286dbe383bb30fee251f1f63e89e6bb5b45618a541ec03f8a94346
SSDEEP 768:qbaAAK7SHlv75jWg7lK2hBCAquQPWp2SDi+1XSF6uWsr:qbaS7SL6QKuBGuQOp23+1XSF9
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00001b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001b
Size 32KB
SHA256 b286f84ee8d1ad423d6c6d681d44ec338a542abff016773fd133db9eecbcb3a3
MD5 bbac7bb99faedea9a0cb17dfcad195af
SHA1 409312e9c3a5eaa03f2c8227a3693e8a6dc850ff
SHA512 727cc47adb0225730fa4dc9b2a791fc9b88660082bc9ab4e2bb65633a666772a75bac12cede3feab5609fcbb3c4807fad4a3b499d5633ab273e625b3650e2e5e
SSDEEP 768:5aevySScvRTWMhqs9ofbVrc6KpuK6IxS+yF0kb+8jqUvoBwX:0evvScvYMhd9ec6uuayF0ki8jqUQaX
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00001c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001c
Size 19KB
SHA256 c8376c9fa189541da0b65cbac556fea079eba00755803b97808f79b6d2b07c95
MD5 e337014ceba65092b027bdeddc48b00b
SHA1 98ad97b8adbb411d6d4623fab506924aa6772304
SHA512 24dc7ea8954498d7eb926f6ff07d245d82dff98ecbf77093b717351328434306d37c0a95aac208f711c8f3bb901ffa05daa974aa719518eeb14bb844df5e3d6d
SSDEEP 384:7J+p8c4Jdo71eNAPpj8zBl+z7fATGMU5i6PSiRP4mNgTQ:7IeVJE1pClyZ3JSip4mSc
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 87ef32b38fadec3e092d71f393c165535d4f5e4f3394282cd1caec94d7806422
MD5 77359a051fa06ac630d2b8b4b4995ffb
SHA1 4d21e6364f5b6b0b13e355b13b653159da826724
SHA512 d2b38d11825df985072bd8b5adce2f8169d72e46eb2cc3e40a69909a1ac8e480663fc90391a03d094c3957841f5fb318497ac86a3a77b5d13013e40c51e21746
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 e797f7a6fe6acfa871e11c1855801c3f06e1b45ee23ea6a5fad6966af02544f3
MD5 c968cf240f26a017a0f353a8744afcf1
SHA1 6098a8ab5f42c750c1355282470e08b94cf1fb0e
SHA512 8fc06925c4855f21134a7699e3aaaaf5b7be43b0ccca414acaca7fe41b013a4aba73bad6c5e490c184e3e9cda42be24394e8876cbfc331f47e981f709f2a18a7
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 056b9fc1176e8ffc4a3967866f74ad17197cbb75705704866958df108a4282aa
MD5 65710cd77a14bd9db78e9bb8be2ba075
SHA1 b6e26cc607fb7ea8f51ff12044aed0132079f5bc
SHA512 427e8f3c971908f026b012757febc643d31419af053fbe80d69d8f91afa1aef5fcbf272ad0e84bcd892f3f893c82c14f1d4728b4aec5f72c8384b60186474b86
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 984894334b809f7b2811e928a98abacb45700306fcaa1928f19162fe466a8896
MD5 01bfb77c83df94d5aa93de3f4c8bccec
SHA1 c809a460bcffae9f47075567dacd6a60596ca5ab
SHA512 388bef199724b3d6405f4ed0c12e9ce2a04df9950b5f3b9bd8e3bef7d858d014ea0f953c1d0912086550bf8f2e2c779f6c8afc7d77e849939417eadccef8d7ab
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 d85852644ade4bacb68161ad426ea8c20d96e28d3379bf1dbca153d6f1b9d824
MD5 52bcedc14982520d216186958d73d1e1
SHA1 062a5b6fed444eec7a0772964762911456ea48ea
SHA512 723748089a5844024b50b7a925a9adbb6b4f7eb4a1deb302c9490998ce76a5fc629e590e32ab3d36cc01e2f672e179a77479185306b90d40ac20c278046fcff4
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 da502caaf51e41c27816cb8fc7aaaef406a65d1e573ff9146dc938d2cb784964
MD5 5136afef776b50ab2cdc6161bf67a3be
SHA1 bc068d25a3df8f2bbb2b83070147ef9f511a7d84
SHA512 4798cf898c6023ac34a9fa50f9cf3b02d77013235e77c70f07ffda30f120331c10745d1cd9f5541405bc13448aa19fb3c7c513a336ef7848327a40398dc602ba
SSDEEP 96:nEkA61Vh3wpvWMoiVmdeHPYJ+UWQyV+VDCzia:nEkDj5GWMXPG+rj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 4bf8846e7b166057fa8190e340b5520ae2867489230b9cff2bf96a1a411797f1
MD5 c679f36db395cdf7d1b921e6bc50699b
SHA1 a0353888cbd043351c3ac600d75b2a142b4f82d4
SHA512 a5d028b9c29184cc3de255e7aa80edb7f37cea45a9f03e88c1236417aecc8d6644a54d3427121329629bfc91c6538112cd9d49f140d566a56e345d752caa1ede
SSDEEP 96:nmk761Vh3wpLH9WMoiVmdevYtMk7uT1+DYPMknx0QxYTC+UWQyV+VDCAiEwb:nmkWj5aH9WM/Yt3uTaYPzx0Qxj+rV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 b13e783e7fc6408cb46697d1178103c340ca06b0c0ef968db5ed290912ef1d11
MD5 678d2a22c595e8ccef6306f26bb1775e
SHA1 755e0fab178200e4659c9b8fb418099b8319214f
SHA512 091e619cf3d940e2c35c1a593696ca3e688d00487305232cbff67db83a1bf329936c1478f4db8cc85c470d632f50f1ff660053cb38ad266b8056de5d7646a895
SSDEEP 96:nmkj61Vh3wpLH9WMoiVmdevYtMkBYBMkMDYPMkM9JcQxYDC+UWQyV+VDCAiEwb:nmkOj5aH9WM/YtdYB6YPo9JcQxL+rV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 24KB
SHA256 185450d538a894e4dcf55b428f506f3d7baa86664fbbc67afd6c255b65178521
MD5 c2ef1d773c3f6f230cedf469f7e34059
SHA1 e410764405adcfead3338c8d0b29371fd1a3f292
SHA512 2ef93803da4d630916bed75d678382fd1c72bff1700a1a72e2612431c6d5e11410ced4eaf522b388028aeadb08e8a77513e16594e6ab081f6d6203e4caa7d549
SSDEEP 768:nFeW8o8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOLl+YrU7C:nFeW8ou1jaTLI7C
MD5 SHA1 SHA512 SSDEEP

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 89B
SHA256 1eef94ffda770c10f75c7a53a955bd250287a9fe890da0b65adb89c2047adb2c
MD5 73026aa4759fb510b46894cad6d8ea14
SHA1 ce76be2783d91d33a553dbdd51ca45adde4e5238
SHA512 d90677d907f1561b766c0e001dd2dc2b19ed10066adfbaac9360e01c69cffae3f82878cab852ea8569dc19a856c2a084a31a248e709bca3528e0f31977d5626f
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 146B
SHA256 af85389bb4a4f61f33f8a2de8ba0a83967b59039e087b3fc0ee0ef016bd1be58
MD5 44804253e5511136f2099d8faddbb517
SHA1 96b1be0e4b316409b67943fe50eaaac543254f62
SHA512 01f4a09ac869acadee089d199caae8cc61ba6b9a2e9b2a0d19ed5350e479bfe2be3cce38cd5e6049d4094ece4d000e7c19110335b0c1bae5cf8876982b099b1a
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 82B
SHA256 62e5e335ce7598210567b4810f0d54c4648cd4c9b9716b26ee26079da299b7ea
MD5 99c2acf9e15685105b07887aa71b3f37
SHA1 94c3720bb5e9f4e380885fde4d1be41d0155a598
SHA512 aada31060c37736332068d14725889214dfb228b4a13022e0bf6215bd8eefd9c0c62ffd8742aba3b97c9e14a4826513c8e3bda779512ebbceb2410d50df0c0c1
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 146B
SHA256 9addba0053b84cf97a3264017e5a8557ac68a45d8d53bb74af1d6222bbfea2ed
MD5 bb2c64b2a6f5e8b078a8ec6ac0ed8c0c
SHA1 1b1c4f920482f05cb045d27b9b71a3122fad0fea
SHA512 bd82d709ba16ae86a16f1764529c3d9be8629561350ac39122dfc3967ddb5d6132abc31f7cc2b985de102c68336d6fbf928993da7101b99bfe4546d06320289e
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 43102aad63966f350458c01a36eed2ede49684defe36073b138efb4f25a634a7
MD5 eb065c44d481192f7dd6d3499b63a010
SHA1 074d52099d7d4a8e83d090c9a568376315f8dd9a
SHA512 be3586ea8ecc6d2b46ba54eb6674eeed6b15285459999ca51eb79afa20c118dfe77f6834a35d5bd11aaf9739220e21e5e80e24cdba7d3babb85630d536603737
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe583a45.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe583a45.TMP
Size 48B
SHA256 0612803157db814e29e56a15cfbeb897d1d5d7eeaa9401d110191413a39bd9aa
MD5 e944237b3b62c8d45cf5f7aae5b5fd93
SHA1 93fcbaab02c99b25e9215a48f00e6f2667005379
SHA512 72c5c6ecb46c3c7ffbb4bf5c211859c203fde54226d09ca6b4663b6f6b82e84a992db86d082cb8203dd263c0bcc917df60d52b98d6ea4f56707031b58d642b6a
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 1e0b9cd5342a772772dff930ac2c630cfed4a28be54def6ea7d5fbcb8c1e467f
MD5 23e2cda7d8a4dd38340abb81a62ead69
SHA1 0a836b076156dbe5154ff9eca6aecb82bff17848
SHA512 62a526ece00e20a910a943bb39f56e3db94613b379a59de4b97d2ebc2662fbb603a9cdd22ce45489869b1ce31ade9c2b8e8fb5ab4ad7ad0a888636aca8c4edcc
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 bdb204e65c1fd2f78e305c76d04aa224a510252fb65313904049fe4fcaac4feb
MD5 226a94e0f0fcd178fd58a8495c3eed40
SHA1 c5ad6544934be1c486792199d942e477f9d8ac9c
SHA512 4c8d76a2769a867870e67729937656059074a4840d8b0bc1fccb015e1efa5254248c870a620e2ea29a7c738417ee140718a95edbab98037f4722496d861cf079
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 c43eb1d7ee2c5ca439044bd0b0b80ab33454757fe10ca61f0d50085a39bea79a
MD5 2209a81e77ff40de768191178d91a18a
SHA1 c51087835ec4a031ba9937fefd5e0c77be05a082
SHA512 d8fced511358065ecfea5d7715d13e9d660522186f01d8785c5af89d6fe28e8807686043e7ce7fb5a799e2233d639bf270ac5acf1614a004b66d89433b9d37af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 61f8e94ae88aa7da81d2b6c3cc2c2c4000f5acc6700f4a366b3e62a048e7de8b
MD5 7c1346ec7f6d58fb4a55106ea564ae4f
SHA1 c4eaa93545eadb217cd73396665610e43cede412
SHA512 1c0907449841f3b7783931705d34b449fd9ad301bdde3ebe99b673407e041a90f67a6f579d701302bacd4142ec542775c2bf4c4aa523a875f17509bfa9bcc899
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 97732658b6f651743219843ba45eb965d927e204264ca45781975ef296ee8e9a
MD5 a3cbc1471e37caceff3c2140567f667e
SHA1 e457e793410a15c115de71e0888c3b0c52447f6f
SHA512 2b7a4f32dfea363b9b1a2fc97fa79aea2e01cd4e281ebaba2b908b1d9beb9d1c1eabff2b350a6822fa9b8639452a9df9abf4f232f26097051e39f9651b3269a4
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57a0c4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57a0c4.TMP
Size 874B
SHA256 a160d673ddbd396ad02fd55b8e011c4c9d338c4d250ef9277d8d9f53808943d3
MD5 c69dfecfbb88f114a70dfd1fd4d73004
SHA1 e2f056134afafb8da17442a10d07eed5e7d3be74
SHA512 0b32c4e99b54a5572e3bf2dfa4c3d5ee7518a641d18fe40bc59c8a54eb207e070f2c3194a3d427c83eb31a05116ba7c12dae57a6ed486d09165bd93cba8f292e
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 2KB
SHA256 a567c9bb2939b9439044b3f220864197c1fa47cdccc2f399075e3da18f8dc13e
MD5 51254eed5a453f48cacb0d2e34914c6b
SHA1 70ccd79dab7fe41e006dc7a442f0401553b54308
SHA512 f198d3300f98711bc8ad3bffa8bc8ab042df9acd152b630238c02234febd8f0dfb7118c76a4f69df8a87e1396bee97f2314686c6b3b3acbc54c5c81ca556d04f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 2KB
SHA256 99f958e6288bf632cf82c9475888f070c5d1e47ae3b64618c072f9d1a8af9296
MD5 364b2828b6eb24bbbaff6aada35be16f
SHA1 085f640286daa389f2aae5c729c4b66ada809ae4
SHA512 ac1a0b802660265ba13f301996e3d0976ce0549a767bc83c9097bd39c81b83f96b85e077888a1a66e911104ae9de44b12d03873801681f4ea7b423c04fd4dbc9
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 2KB
SHA256 18fe645246a9078d50d08cbe977e96c344af26273298649f387daea4151bd6d3
MD5 33557219d50ca31f91c5422d9ef9fe3b
SHA1 b566871b7c45d153debad5fad55e4a93ba9b672d
SHA512 0d3e1ba3d13f28962aad1c1744b0a197e559f0181af4e1d7cc96249e2ab48e035f1a31c9d2c50b685f063783580f93878c83844f64755c7567cfff2025f93454
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 2KB
SHA256 6ec8f7b7a2c337245c9c9d8643250edca7913da644655fdabf8dfb0f69eff001
MD5 3d67b9042c900bcac0aad4ffde55b490
SHA1 b11e22615ec15c5f1bb2c864aa7bb5324500c51e
SHA512 7226dafa211e530323d1f5f0735f91049338ef4f55be475db20de23eb3fd779d3d70be250df9b4a5a21cc47824c17f22d4a0dfdf953fa47a66ac8245f2dc61a4
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 2KB
SHA256 5e42db154f367cd5b1ac51cd60f81f6227760c62065afa902bcae6d2bd04e426
MD5 57fe18114c902fbd93922baf3c1ade5d
SHA1 60a17987434d48dd5149230b58142194ef9c2b9c
SHA512 846f044120704649e0587a93a7075fec9f44109570d78f57bc46ef5404c6312b147487c453e0c011d8e25854026ea8186ef5b6734e617aa95e22999d24f647a2
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 5d7526e3cf8b8f325c2e6642906c6c92db4e17d4b39ddc8ccf8b05f264f26c36
MD5 9f50c4422c8cb8f994e05f5216ba58e4
SHA1 b633b9c2aa8a228baf70d7ee7aea7832ba9c2130
SHA512 e23e015ddc5685f84f2c24b1db658cc3b2c73bc1e8b2eacbe852a457e125d62d1518e05dd6b8461cedc1f971eb7ee039cf3c2c7d0fdbbb2b493a428199d9c9e4
SSDEEP 192:WoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupae2RUpUsvhTw8AftwKC8Fu:S9iIxuERzA83h09RZxY06a86W2S7
MD5 SHA1 SHA512 SSDEEP

Submit Download

2BB62A5F508187291BB477E79601AC81B652604E

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\92qyi9k9.default-release\cache2\entries\2BB62A5F508187291BB477E79601AC81B652604E
Size 30KB
SHA256 818ec19dfd1a001465816441193005f1c98cec6eb7445864ea9a7491cdc569aa
MD5 ec55ff62e25489ebed6f595df70cf255
SHA1 32dca363f42ddc7a2b86a6a4b516c19e84d4d5eb
SHA512 aaf0f45a81847477899aa064b554244f6232d3a9132f8412d84f2957d152a5ac4eb90d570cd1ee7db538597756762a7960b443be81882ca580f90855939b38a7
SSDEEP 768:5bfiBWlRPm5fjrruYJGTiqlO3fo/+z5kQXODudL4vBHJmvOR1:AWLivuYJGTiqSUI5kQMVWOR1
MD5 SHA1 SHA512 SSDEEP

Submit Download

F96A1A8368D3C3DD1FA81D170326E6C1C65D342F

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\92qyi9k9.default-release\cache2\entries\F96A1A8368D3C3DD1FA81D170326E6C1C65D342F
Size 30KB
SHA256 db30cdb99c018aa264880f2d168788159f0cb662bbe9ff6e23807a9ff0d2b03e
MD5 f478a071f54d7b3d5c76e12de95b0415
SHA1 f33c381fa8dd6e343aa551ef85a27b01cd71c19d
SHA512 6eb63d22ddb54fdaa3e447589d959adbc02d723d0d97127ba47d80a7495eb117c99c39502a734adc9794f53a37eab2aa13ba5444face8a1af3deb346e7faa7df
SSDEEP 768:UaxmXXSdiQPCjMvyugNiu5z5kQXODudL4vBHJmvORl:U7nSdTCt5kQMVWORl
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 442KB
SHA256 a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e
MD5 85430baed3398695717b0263807cf97c
SHA1 fffbee923cea216f50fce5d54219a188a5100f41
SHA512 06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1
SSDEEP 12288:tESTeqTI2r4ZbCgUKWKNeRcPMb6qlV7hVZe3:tEsed2Xh9/bdzZe3
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 968KB
SHA256 4cf80d766e86f3924a01feceae0eaf606b5700dbecfef96e4c871a6f9a304a95
MD5 b21a1cd98c4f128a25dece30548fc1fb
SHA1 465b68b63ebaab98305911875c5f8655e47e1f86
SHA512 60d111eda0816f48189261cd7e3eeb2a22d6d3eca963ed7cdaa79495efb99445c686c3371b1acccb9f1b0cdbc1e51f2c165689dd30b927d58c7adf9cd4fde20d
SSDEEP 24576:wXQL6kcfhvATSyiP0RpSUm9/5Q1mxl7DZNr5PqNoMb:wXQ1cJvEZR7+56mfLrZqNl
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\datareporting\glean\db\data.safe.bin
Size 2KB
SHA256 694f58f46dfd632dd03a50e5d668f16c8df6240fa6110f30f6f82ee24beb8dbf
MD5 d5eb36128c6e741ea09e473cca9a6b09
SHA1 ae3ac612594ea1e16b0b53012debcc052cd2644a
SHA512 ddf94aaaeddbf7c111a8c3d0525814f278c3faf4615b7b89c710af991d6615169768e0a213a3315cfba2bd9ad15d1fa73503094cb28383182bfc739de31b2cb1
MD5 SHA1 SHA512

Submit Download

c573e8f4-0a75-4b11-a788-0166173c4eeb

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\datareporting\glean\pending_pings\c573e8f4-0a75-4b11-a788-0166173c4eeb
Size 746B
SHA256 1eebfe0762bc410dba6c5510d68c9d9e851183d9a9f28544f8ead8fc8432ccad
MD5 fb51e47c4cc692bcfc3da7fca1718a4c
SHA1 ba8a20825f3185926a2c6754cbdd41ee1a5c9461
SHA512 6259c78be26ab3124861c214c4cb240884353edfc6f2089fa63ce4756a992585178b500f48a45c2983ce604aa11ace73d32a3d9ae479f1ccf039e39eada0d1b0
MD5 SHA1 SHA512

Submit Download

d34c6bff-9233-4fab-89f3-a25da663f8e7

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\datareporting\glean\pending_pings\d34c6bff-9233-4fab-89f3-a25da663f8e7
Size 10KB
SHA256 10f3438e18dd0c6d33f962e98fbc3a419f72a3087f97017e41fc27a3f725d735
MD5 896346119d226e18999f38807c3ee557
SHA1 e724e2efdbc9cf9ce200441b77f0e2a4bf460413
SHA512 5e11e25388456b48ab9be4bdf8a89a306986f99ff4574567ce3dd9126e3784983a38ee98ab599aa86d67facdfecfbafeb385fc90a30b9e2edf3fb3beb8e4e8c4
SSDEEP 192:DuhGgXvUAT494Ty5+QYbkxjtWa+VNw+u35h6CBZEcelE+1OnMuomGAYrH:/gfDl
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
Size 116B
SHA256 f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b
MD5 3d33cdc0b3d281e67dd52e14435dd04f
SHA1 4db88689282fd4f9e9e6ab95fcbb23df6e6485db
SHA512 a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1
MD5 SHA1 SHA512

Submit Download

LICENSE.txt

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt
Size 479B
SHA256 2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539
MD5 49ddb419d96dceb9069018535fb2e2fc
SHA1 62aa6fea895a8b68d468a015f6e6ab400d7a7ca6
SHA512 48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json
Size 372B
SHA256 e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd
MD5 8be33af717bb1b67fbd61c3f4b807e9e
SHA1 7cf17656d174d951957ff36810e874a134dd49e0
SHA512 6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll
Size 934KB
SHA256 38836f438400da8fe0067778953d59435e2785462eccc7a4180230e0ccee831e
MD5 11ca1312017178aa1b1e7fb12d5ca0e6
SHA1 ec6fafa22541286720f0dfc0af90f1c22f873000
SHA512 32e45102d372238147366986375f4e6a315512eabd30bad304552bc948f8ae67b1cc6c1bef401238993f348433dab8f2391d6fca25ba80c91ee963a8398f9b2e
SSDEEP 12288:EUtZJXsJ+8h5q6R6iHxNKqc6xGUETJt59yq75NP11KtD:5Xs+8hHvu59775NPI
MD5 SHA1 SHA512 SSDEEP

Submit Download

widevinecdm.dll.lib

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib
Size 1KB
SHA256 33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237
MD5 688bed3676d2104e7f17ae1cd2c59404
SHA1 952b2cdf783ac72fcb98338723e9afd38d47ad8e
SHA512 7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll.sig

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig
Size 1KB
SHA256 68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81
MD5 937326fead5fd401f6cca9118bd9ade9
SHA1 4526a57d4ae14ed29b37632c72aef3c408189d91
SHA512 b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2
MD5 SHA1 SHA512

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\prefs-1.js
Size 6KB
SHA256 5b986950011852105317986945ec2768f538ebbad1240a2fcdf662225fa9039b
MD5 55053b7dd97537e7b251585fe5b67667
SHA1 6b63c37117c38902abb7f8e025e5fa9e464b95e0
SHA512 970e7b50a977282f11b5f49013fc83d3538cc4444e7c20c10d57aa99985c432557eb60ee68a86b998e4a8716ba568f5b153881c39031b235b747afb0e8f6a36d
SSDEEP 96:xHgxnUTeqGqQdFJ0IXeOTzSs5PXAnpjvH5JpQQBw8HkCHv:WxnIRQdFJ0IXe+5PXk5DZBw8HkI
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\prefs.js
Size 6KB
SHA256 bc974cb96cc603b3d4e505cab48da67de05b3f4b5d13f68b25a23c2c1760ecc2
MD5 18fb2f6330a9ecaecf185a96b829f048
SHA1 9045b3140eb754ba6b35b5bf5eb890065c0c5787
SHA512 dc2f718c9a4797c8fe4036c1b62655c62753c8ac11b768690a87444d69206eac408213451e0deed481f5c50b9c8f28dd9bd1abd1191f6538c51815ea7873a9b7
SSDEEP 96:xH85nUTeqGqQdFlIeOTzSmPXAnpjN2H5JpQEBw8VkCf:G5nIRQdFlIeUPXt5DVBw8Vk4
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\prefs.js
Size 6KB
SHA256 cd676e6e961e5db3a4a5686c794ba5da4d04f9c799adf91b99a9fc54104fc28f
MD5 75a14c705960e938f8d74f494fb5cb77
SHA1 9f72a3b56075fc7c69945bcea5fc66a089276f28
SHA512 4dd291b4cff994b46a0be73643a62e15962cad2204f81bd9c92b7f81c2331f0afe6509961dfb4b63d30c8706ddf9ba9e9c8bab642dfb5d0224bcce5c2dcb7cbc
SSDEEP 96:xH85nUTeqGqQdFJ0IXeOTzSs5PXAnpjvH5JpQvBw8HkCf:G5nIRQdFJ0IXe+5PXk5D6Bw8Hk4
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 97cda97c5375db453be469e4bdf61ea5954e506c5bb2bd6a052de53f12077be1
MD5 68744d7470fcbb07c1c6b57f43700aea
SHA1 0f0917f6a738684d500820e4e96b45f1da7ba7cc
SHA512 02a4cf5dc1510dd3cdc6a7d35f03c96c7e360d784d29c6768c14d2728628f0dcc3e24bb6a211d5e820eae1b7eb6a579327fe7b162de31d2875c4060a336ef854
MD5 SHA1 SHA512

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\sessionstore-backups\recovery.jsonlz4
Size 6KB
SHA256 0d87370de99d8bb6897707f53a48e548d0b477e1790520f9acee25a892dbeab0
MD5 3789accf245aa2d07decdab2858f5f09
SHA1 555a98b37cb2ecf84696c44eca8671700c4b9dfa
SHA512 b010c122f5c0d83ee0a5772a18c5acdf4c99ab33387b2e1148aa9a3655767c1740d6a9dab4de2a5d1f7f13dc011eee2d0e16e12cb3bfd5e97bd69928070ac877
SSDEEP 192:9LRtOqMj7wH2xViF2lMZkcuem5/g+Tem49jilI08Sx:hRtO1j7wWxREu5fTe4lIox
MD5 SHA1 SHA512 SSDEEP

Submit Download

{379c3d0f-55c2-48d2-9f38-c0285aef3122}.final

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\storage\default\https+++www.youtube.com\cache\morgue\34\{379c3d0f-55c2-48d2-9f38-c0285aef3122}.final
Size 192B
SHA256 04cae3c7b208fc55b25763913d0bbdc99232942086efdf705f2a27764be6f5ee
MD5 2a252393b98be6348c4ba18003cc3471
SHA1 40f75302fcbe4a8ac2e33a8d9daf801abc2a9598
SHA512 07af4a7b0d10f1b5e1fe0877b21abc98483d78797608a1763cfb71e25559fdce10d20f03c16f4284d7ae7ab90266f45240425e3a264de9525ec1657345b85198
MD5 SHA1 SHA512

Submit Download

2151137500yCt7-%iCt7-%r0e8sfpeo.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\storage\default\https+++www.youtube.com\idb\2151137500yCt7-%iCt7-%r0e8sfpeo.sqlite
Size 48KB
SHA256 e3a1b1e21fe06964ba4ab4f4d1a8926872f0952d3ee2d514e826171e78d8264d
MD5 4ec915e2fb41def27d9debe6d40cddad
SHA1 0c6c911ac0143a4bb184b17aebb33353bb67c33d
SHA512 2c4a84047e7e4988a4475632c45c8fb1ef31063b5f0957ad1a577c2c47834da111a6f86acc8ae1e6ec2dd67996805b6c3e7cb7a189bee0c7bbf3b5dfc73f8bac
SSDEEP 48:T/OA65g7LV6CM5znpgBlizb5pxVgnO9zxV+LU7mY2wzY5QcEVdyEVYF:D16S6CKnqlizbxV+2xVeU7X2B0+F
MD5 SHA1 SHA512 SSDEEP

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 184KB
SHA256 61c22934bcca9275d3aa4a9548828b028aaa84a0c1d977d50daeb889e02dbfd3
MD5 8eff070195653e2a131a916680cd18c2
SHA1 7f5dc88fc5d5969b25d5e75cccabd37362b31a94
SHA512 18ed6beca1a23e74571ee365b3c5e1b92686188178fa5481d41dd4c991286d5b3599613a870a8d371eb886f82b1b5e35be10ae82b0a95452a53f9cffed73f507
SSDEEP 3072:fMcHDPRuFP+3y3gE396O6uacMKeHex7Nq:fMcHDPR023y3ga6uacMKeHCq
MD5 SHA1 SHA512 SSDEEP

Submit Download