vidar | 2200d1f9ee35726e51abec037deff7962ae4d525186bd634b3ac45db29946aff

Analysis

max time kernel
149s
max time network
132s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
20/04/2026, 06:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Bootstrappert.exe
Size 2.2MB
Sample260420-hadxgaft51
SHA256 2200d1f9ee35726e51abec037deff7962ae4d525186bd634b3ac45db29946aff
MD5 498e8e039e78a791a521223ef9a7eb36
SHA1 7e62ac04e2e86425c2233619b4fc4cec73821e5d
SHA512 3804031133d6c7c516a67c0e0654961a6a6934aa352245519ab5c2890ac1868537c21f115fd1808d6055a2df54a3f55dfae252792948b8f86006563d6770fe37
SSDEEP 24576:1tKE3A5+uKThdpHButUpc3WnsxswN2ZVbZtnRBv3COtPCptRRB:1tKKA5+uKThhuqpk4sxsnrd/Cj5
TLSH
T155B57C0BACD518F6D46A97328EBA26817B31BC0C0B3263D32E517A782FB6BD05D75714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection discovery vidar spyware stealer

Malware Config

Signatures

Family: Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Detects Vidar Stealer 4 IoCs

stealer

resource	yara_rule
behavioral2/memory/3052-1-0x0000000140000000-0x00000001400FE000-memory.dmp	family_vidar_v15
behavioral2/memory/3052-14-0x0000000140000000-0x00000001400FE000-memory.dmp	family_vidar_v15
behavioral2/memory/3052-1355-0x0000000140000000-0x00000001400FE000-memory.dmp	family_vidar_v15
behavioral2/memory/3052-1368-0x0000000140000000-0x00000001400FE000-memory.dmp	family_vidar_v15

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 4 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Bootstrappert.exe
Key opened	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Bootstrappert.exe
Key opened	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000\Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Bootstrappert.exe
Key opened	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Bootstrappert.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4692	chrome.exe
1352	msedge.exe
4456	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Bootstrappert.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Bootstrappert.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134211403743368177"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2122505878-652277452-2375749442-1000\{7CF1917C-4A86-42E7-98EA-796AE840FB44}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3052	Bootstrappert.exe
3052	Bootstrappert.exe
3052	Bootstrappert.exe
3052	Bootstrappert.exe
3052	Bootstrappert.exe
3052	Bootstrappert.exe
3052	Bootstrappert.exe
3052	Bootstrappert.exe
3052	Bootstrappert.exe
3052	Bootstrappert.exe
3052	Bootstrappert.exe
3052	Bootstrappert.exe
3052	Bootstrappert.exe
3052	Bootstrappert.exe
3052	Bootstrappert.exe
3052	Bootstrappert.exe
3052	Bootstrappert.exe
3052	Bootstrappert.exe
3052	Bootstrappert.exe
3052	Bootstrappert.exe
3052	Bootstrappert.exe
3052	Bootstrappert.exe
3052	Bootstrappert.exe
3052	Bootstrappert.exe
3052	Bootstrappert.exe
4552	chrome.exe
4552	chrome.exe
3052	Bootstrappert.exe
3052	Bootstrappert.exe
3052	Bootstrappert.exe
3052	Bootstrappert.exe
3052	Bootstrappert.exe
3052	Bootstrappert.exe
3052	Bootstrappert.exe
3052	Bootstrappert.exe
3052	Bootstrappert.exe
3052	Bootstrappert.exe
3052	Bootstrappert.exe
3052	Bootstrappert.exe
3052	Bootstrappert.exe
3052	Bootstrappert.exe
3052	Bootstrappert.exe
3052	Bootstrappert.exe
3052	Bootstrappert.exe
3052	Bootstrappert.exe
3052	Bootstrappert.exe
3052	Bootstrappert.exe
3052	Bootstrappert.exe
3052	Bootstrappert.exe
3052	Bootstrappert.exe
3052	Bootstrappert.exe
3052	Bootstrappert.exe
3052	Bootstrappert.exe
3052	Bootstrappert.exe
3052	Bootstrappert.exe
3052	Bootstrappert.exe
3052	Bootstrappert.exe
3052	Bootstrappert.exe
3052	Bootstrappert.exe
3052	Bootstrappert.exe
3052	Bootstrappert.exe
3052	Bootstrappert.exe
3052	Bootstrappert.exe
3052	Bootstrappert.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
4552	chrome.exe
4552	chrome.exe
4552	chrome.exe
4552	chrome.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
1268	msedge.exe
1268	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4552	chrome.exe
Token: SeCreatePagefilePrivilege	4552	chrome.exe

Suspicious use of FindShellTrayWindow 37 IoCs

pid	Process
4552	chrome.exe
4552	chrome.exe
4552	chrome.exe
4552	chrome.exe
4552	chrome.exe
4552	chrome.exe
4552	chrome.exe
4552	chrome.exe
4552	chrome.exe
4552	chrome.exe
4552	chrome.exe
4552	chrome.exe
4552	chrome.exe
4552	chrome.exe
4552	chrome.exe
4552	chrome.exe
4552	chrome.exe
4552	chrome.exe
4552	chrome.exe
4552	chrome.exe
4552	chrome.exe
4552	chrome.exe
4552	chrome.exe
4552	chrome.exe
4552	chrome.exe
4552	chrome.exe
4552	chrome.exe
4552	chrome.exe
4552	chrome.exe
4552	chrome.exe
4552	chrome.exe
4552	chrome.exe
4552	chrome.exe
4552	chrome.exe
4516	msedge.exe
4516	msedge.exe
1268	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3052 wrote to memory of 4552	3052	Bootstrappert.exe	80
PID 4552 wrote to memory of 4164	4552	chrome.exe	81
PID 3052 wrote to memory of 4552	3052	Bootstrappert.exe	80
PID 4552 wrote to memory of 4692	4552	chrome.exe	83
PID 4552 wrote to memory of 4324	4552	chrome.exe	84
PID 4552 wrote to memory of 4324	4552	chrome.exe	84
PID 4552 wrote to memory of 3172	4552	chrome.exe	85
PID 4552 wrote to memory of 3172	4552	chrome.exe	85
PID 4552 wrote to memory of 4216	4552	chrome.exe	86
PID 4552 wrote to memory of 4216	4552	chrome.exe	86
PID 4552 wrote to memory of 456	4552	chrome.exe	87
PID 4552 wrote to memory of 456	4552	chrome.exe	87
PID 4552 wrote to memory of 4804	4552	chrome.exe	88
PID 4552 wrote to memory of 4804	4552	chrome.exe	88
PID 4552 wrote to memory of 1080	4552	chrome.exe	91
PID 4552 wrote to memory of 1080	4552	chrome.exe	91
PID 3052 wrote to memory of 4516	3052	Bootstrappert.exe	92
PID 4516 wrote to memory of 4780	4516	msedge.exe	93
PID 3052 wrote to memory of 4516	3052	Bootstrappert.exe	92
PID 4516 wrote to memory of 1352	4516	msedge.exe	94
PID 4516 wrote to memory of 2456	4516	msedge.exe	95
PID 4516 wrote to memory of 2456	4516	msedge.exe	95
PID 4516 wrote to memory of 2456	4516	msedge.exe	95
PID 4516 wrote to memory of 2608	4516	msedge.exe	96
PID 4516 wrote to memory of 2608	4516	msedge.exe	96
PID 4516 wrote to memory of 4600	4516	msedge.exe	98
PID 4516 wrote to memory of 4600	4516	msedge.exe	98
PID 4516 wrote to memory of 4600	4516	msedge.exe	98
PID 4516 wrote to memory of 4476	4516	msedge.exe	99
PID 4516 wrote to memory of 4476	4516	msedge.exe	99
PID 4516 wrote to memory of 4476	4516	msedge.exe	99
PID 4516 wrote to memory of 1728	4516	msedge.exe	100
PID 4516 wrote to memory of 1728	4516	msedge.exe	100
PID 4516 wrote to memory of 1728	4516	msedge.exe	100
PID 4516 wrote to memory of 4756	4516	msedge.exe	101
PID 4516 wrote to memory of 4756	4516	msedge.exe	101
PID 4516 wrote to memory of 4756	4516	msedge.exe	101
PID 4516 wrote to memory of 3500	4516	msedge.exe	102
PID 4516 wrote to memory of 3500	4516	msedge.exe	102
PID 4516 wrote to memory of 3500	4516	msedge.exe	102
PID 4516 wrote to memory of 3432	4516	msedge.exe	103
PID 4516 wrote to memory of 3432	4516	msedge.exe	103
PID 4516 wrote to memory of 3432	4516	msedge.exe	103
PID 4516 wrote to memory of 4860	4516	msedge.exe	104
PID 4516 wrote to memory of 4860	4516	msedge.exe	104
PID 4516 wrote to memory of 2252	4516	msedge.exe	105
PID 4516 wrote to memory of 2252	4516	msedge.exe	105
PID 4516 wrote to memory of 2204	4516	msedge.exe	106
PID 4516 wrote to memory of 3532	4516	msedge.exe	107
PID 4516 wrote to memory of 2204	4516	msedge.exe	106
PID 4516 wrote to memory of 3532	4516	msedge.exe	107
PID 4516 wrote to memory of 4952	4516	msedge.exe	108
PID 4952 wrote to memory of 2968	4952	msedge.exe	109
PID 4516 wrote to memory of 1008	4516	msedge.exe	110
PID 1008 wrote to memory of 680	1008	msedge.exe	111
PID 4516 wrote to memory of 5076	4516	msedge.exe	113
PID 4516 wrote to memory of 3120	4516	msedge.exe	114
PID 4516 wrote to memory of 3120	4516	msedge.exe	114
PID 4516 wrote to memory of 4304	4516	msedge.exe	115
PID 4516 wrote to memory of 4304	4516	msedge.exe	115
PID 4516 wrote to memory of 1680	4516	msedge.exe	116
PID 4516 wrote to memory of 1680	4516	msedge.exe	116
PID 4516 wrote to memory of 4388	4516	msedge.exe	117
PID 4516 wrote to memory of 4388	4516	msedge.exe	117

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000\Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Bootstrappert.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Bootstrappert.exe

C:\Users\Admin\AppData\Local\Temp\Bootstrappert.exe
"C:\Users\Admin\AppData\Local\Temp\Bootstrappert.exe"
1⤵
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:3052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --profile-directory="Default"
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4552
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0x78,0x108,0x7ffe3bafc728,0x7ffe3bafc734,0x7ffe3bafc740
    3⤵
    PID:4164
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1540,i,2034264561024380234,15947285741496833197,524288 --field-trial-handle=2100,i,14923632558948176339,13121494280302508259,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2196 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4692
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1640,i,1414023795518686472,9958035844192691510,262144 --field-trial-handle=2100,i,14923632558948176339,13121494280302508259,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2084 /prefetch:2
    3⤵
    PID:4324
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2408,i,7228167262800656104,8553033292275921457,524288 --field-trial-handle=2100,i,14923632558948176339,13121494280302508259,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2560 /prefetch:13
    3⤵
    PID:3172
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3136,i,16994919082307061280,18006194979523890828,2097152 --field-trial-handle=2100,i,14923632558948176339,13121494280302508259,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3228 /prefetch:1
    3⤵
    PID:4216
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3252,i,7880982971421040013,6415220747230645110,2097152 --field-trial-handle=2100,i,14923632558948176339,13121494280302508259,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3268 /prefetch:1
    3⤵
    PID:456
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4240,i,11353780915867838884,321881469243419196,2097152 --field-trial-handle=2100,i,14923632558948176339,13121494280302508259,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4248 /prefetch:9
    3⤵
    PID:4804
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4656,i,14062965620935564977,1425847504912297347,2097152 --field-trial-handle=2100,i,14923632558948176339,13121494280302508259,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4676 /prefetch:1
    3⤵
    PID:1080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory="Default"
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x30c,0x7ffe3badc188,0x7ffe3badc194,0x7ffe3badc1a0
    3⤵
    PID:4780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1768,i,1886605142714669951,2474039507315227892,524288 --field-trial-handle=2152,i,8049700333263623982,4509650981797987149,262144 --variations-seed-version --mojo-platform-channel-handle=2196 /prefetch:11
    3⤵
    - System Time Discovery
    PID:1352
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1556,i,13724806143406174678,9253373445208489511,262144 --field-trial-handle=2152,i,8049700333263623982,4509650981797987149,262144 --variations-seed-version --mojo-platform-channel-handle=2148 /prefetch:2
    3⤵
    PID:2456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2576,i,13010558758664105637,7001688396121509756,524288 --field-trial-handle=2152,i,8049700333263623982,4509650981797987149,262144 --variations-seed-version --mojo-platform-channel-handle=2464 /prefetch:13
    3⤵
    PID:2608
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3480,i,12362090011599552664,10875379924052188888,2097152 --field-trial-handle=2152,i,8049700333263623982,4509650981797987149,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
    3⤵
    PID:4600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3484,i,8370267784013849521,17871592890295354047,2097152 --field-trial-handle=2152,i,8049700333263623982,4509650981797987149,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
    3⤵
    PID:4476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4112,i,18009182203411303470,2501341969522927697,2097152 --field-trial-handle=2152,i,8049700333263623982,4509650981797987149,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:1
    3⤵
    PID:1728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4136,i,10762021276167396858,5299176832303487653,2097152 --field-trial-handle=2152,i,8049700333263623982,4509650981797987149,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:9
    3⤵
    PID:4756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4176,i,8957796184475733700,11564464220193808064,2097152 --field-trial-handle=2152,i,8049700333263623982,4509650981797987149,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:1
    3⤵
    PID:3500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4192,i,7247081803196484522,15476820181373204304,2097152 --field-trial-handle=2152,i,8049700333263623982,4509650981797987149,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:9
    3⤵
    PID:3432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5228,i,16252334259340674528,3181039701456461733,524288 --field-trial-handle=2152,i,8049700333263623982,4509650981797987149,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:14
    3⤵
    PID:4860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4904,i,16110174831252401018,10482368659436424613,524288 --field-trial-handle=2152,i,8049700333263623982,4509650981797987149,262144 --variations-seed-version --mojo-platform-channel-handle=4872 /prefetch:14
    3⤵
    PID:2252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4936,i,987201805674448512,4193410234296101408,524288 --field-trial-handle=2152,i,8049700333263623982,4509650981797987149,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:14
    3⤵
    PID:2204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5172,i,2812922897458677673,1774293227817986403,524288 --field-trial-handle=2152,i,8049700333263623982,4509650981797987149,262144 --variations-seed-version --mojo-platform-channel-handle=1196 /prefetch:14
    3⤵
    PID:3532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6140,i,2739535576035451215,18183540767290425424,524288 --field-trial-handle=2152,i,8049700333263623982,4509650981797987149,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:14
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1128
      4⤵
      PID:2968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6248,i,17531606591245374036,13915058971993635003,524288 --field-trial-handle=2152,i,8049700333263623982,4509650981797987149,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:14
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=596
      4⤵
      PID:680
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6408,i,6108396844969662100,11832047340528824752,524288 --field-trial-handle=2152,i,8049700333263623982,4509650981797987149,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:14
    3⤵
    PID:1704
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6408,i,6108396844969662100,11832047340528824752,524288 --field-trial-handle=2152,i,8049700333263623982,4509650981797987149,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:14
    3⤵
    PID:5076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6248,i,11150295831417642283,14481930587234031197,524288 --field-trial-handle=2152,i,8049700333263623982,4509650981797987149,262144 --variations-seed-version --mojo-platform-channel-handle=6720 /prefetch:14
    3⤵
    PID:3120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6180,i,8992680134154328397,10148591856868683759,524288 --field-trial-handle=2152,i,8049700333263623982,4509650981797987149,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:14
    3⤵
    PID:4304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6532,i,16419533464680277441,15390314457328875242,524288 --field-trial-handle=2152,i,8049700333263623982,4509650981797987149,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:14
    3⤵
    PID:1680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7092,i,3250627865707597146,2411377050168607909,524288 --field-trial-handle=2152,i,8049700333263623982,4509650981797987149,262144 --variations-seed-version --mojo-platform-channel-handle=7088 /prefetch:14
    3⤵
    PID:4388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7112,i,5346967215270623742,5057519475409295411,524288 --field-trial-handle=2152,i,8049700333263623982,4509650981797987149,262144 --variations-seed-version --mojo-platform-channel-handle=6808 /prefetch:14
    3⤵
    PID:836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7132,i,7786318025264118898,17832587964016255704,524288 --field-trial-handle=2152,i,8049700333263623982,4509650981797987149,262144 --variations-seed-version --mojo-platform-channel-handle=6948 /prefetch:14
    3⤵
    PID:884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7072,i,10223689070338303231,12676066673078970315,524288 --field-trial-handle=2152,i,8049700333263623982,4509650981797987149,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:14
    3⤵
    PID:4104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6732,i,9815762372950442084,937266191070791096,524288 --field-trial-handle=2152,i,8049700333263623982,4509650981797987149,262144 --variations-seed-version --mojo-platform-channel-handle=7120 /prefetch:14
    3⤵
    PID:1520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory="Default"
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  PID:1268
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x2f4,0x7ffe3badc188,0x7ffe3badc194,0x7ffe3badc1a0
    3⤵
    PID:2544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1816,i,5584749075517315664,5841239006253228246,524288 --field-trial-handle=2836,i,15120811340878202440,9960226692709187223,262144 --variations-seed-version --mojo-platform-channel-handle=2952 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,9314369182593579505,17992519188727683528,262144 --field-trial-handle=2836,i,15120811340878202440,9960226692709187223,262144 --variations-seed-version --mojo-platform-channel-handle=2840 /prefetch:2
    3⤵
    PID:880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2280,i,16509939166856478157,158860346213991361,524288 --field-trial-handle=2836,i,15120811340878202440,9960226692709187223,262144 --variations-seed-version --mojo-platform-channel-handle=2420 /prefetch:13
    3⤵
    PID:4716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3376,i,15219489503800708652,16697999345281230025,2097152 --field-trial-handle=2836,i,15120811340878202440,9960226692709187223,262144 --variations-seed-version --mojo-platform-channel-handle=3436 /prefetch:1
    3⤵
    PID:1636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3396,i,865383177426285924,13022993103840313359,2097152 --field-trial-handle=2836,i,15120811340878202440,9960226692709187223,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:1
    3⤵
    PID:5080

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2568

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2472

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4068

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:224

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4924

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2872

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1F911D71

Path C:\ProgramData\1F911D71
Size 90KB
SHA256 582bb51eb25944c03990ef362b103c8c1ac532b883df1a93f959e27858146c7a
MD5 6b6519be1c9422a65936352ab166c7bd
SHA1 373cdc991bb423c74fdf60851bd28e24117dc639
SHA512 4f0a26905c4e76033128b4fb08889da4fee86a031522cb6fbd38d5df26283dd2c5450cd85e1ec6b4279d7d673ed02d4e33c88a4e40d9b03ea80cfc3ab76545d8
SSDEEP 1536:NSIP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNr:n++J3qUQm08KMWF0bFTcVHr6z0
TLSH
T1B89312B99A1E7D39236FC39A90179CAC89D3DCDE151411BC30C75F1E14BB392A31B8A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 49704b69573c2ea29b44913637e25f3691afdf9bdf47a765c3790959a3c31698
MD5 51baa31e085d9ca62f6abda9687afec7
SHA1 095379704e0ed91bdd3c4d4146edd606ace2105b
SHA512 c72e43b5348c34271131bc2b7fe74e766753b121f0f041ba6c142c42f5ca4e5d585e88408d13e79e94be76a219e5388c9a5df77b474bb80858aafe70197f3967
SSDEEP 1536:wSNP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNA:v++J3qUQm08KMWF0bFTcVHr6zf
TLSH
T18F9312B9991E7D39236EC396A0179CAC88D3DCDE151410BC30C69F1E14BB392A31B8A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 3181581ff9a1d358cbc13c4b5b51ac0d60650b41933ed6f6b59bddd8d0e5ebcd
MD5 e7877ff8212ffab65a63d728bb0a4a95
SHA1 732a295e598c9c2eff559eae0b202b2b90c22e97
SHA512 59e3fef7e209202f0bce60bcaea0d1784e307f0ecdb58c9425fd2c2b21ab46234c614607e21af11add2b5ce8855fa0d25771d55233fb0d43b2c774455b99e2a0
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7h:fwUQC5VwBIiElEd2K57P7h
TLSH
T11CB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 eacd218daf22fcefbc23ae70ce919d8ac95b89c3f7d038f647296c47a218fc46
MD5 35b0754e7f5b0bef0f59e6474c3c9e30
SHA1 a5dbcd61883043544b184e46e47beb3bf5d259a8
SHA512 0a14f00d3bf385bd104004e3adb021fc5b135483b30669a0f446d235f67bf00d734e76a56ac18adc3d6765163a992c78b2c6833f0e764506a9c06ff2ad8fc90e
TLSH
T1ECD0801452F17C64C2E65975484677153D1DD4E346C3537225A3267C4C461881C953C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8648dbe7c6ccfd26bf551adf1fc6e3265815ce5ea5942267fdb3d8494e49ccaf
MD5 0d69a24f0c5199062814f3276a0e0425
SHA1 1689f8b116072314ed6419bdbf045ff11d1d2f1c
SHA512 1609905f1cd06a7538f4d74fe58e56421156a96ae16f40de19041369554941dd25cf283bb0eab1972345de9fc7fa8406d01b16d3ec09b21fe116537aaa21605f
TLSH
T1CDD0A73076D5F009C3751137865191602B5E844225D34090B255815DD45C6BD6BD9686
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0ae60b0b7ee21b60718be49570cae5f45e2d052ce76022466d2b5fabf1e6b2a9
MD5 9e62ca00b1c65888d414cc7154644957
SHA1 42adc17d3751253e873631da4c2eb6dae92c57b2
SHA512 2909bb2cc15b5bade4619539c285ca7278beccd4904438aa659a85a4fe755381856bd549fdcd1681722e5eb96df0b633b892bd98355d3bdd90bea31623c77af0
TLSH
T157D012307699A045C36615378590D2506B5A9492169341913191852DE4187AD66D9686
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4963460798fd1c68c8dee9c6246649bbdc513bd3ac847a574ae2e11d61d3e567
MD5 97f0d93cafafd07725e1ee6cd425e97d
SHA1 c485a5a492d514c80e90fc5f757a18df0d7a57fb
SHA512 b5335994e6f51604b45602a0cf376ca840a2dce8063fd253c07505726c0d62029f7bd9417e2ec3e32ea212f4ff8a569d2494d7a261d574fe95acf681f9aecffa
TLSH
T139D022307A98E004C3621037C890D2502B4A8082128301813190812DD4083AC26C9282
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 969B
SHA256 df453142d0f1759d7c78cfb66714ae38810d07ab357650c43e52e2674545212f
MD5 96c202fb7b1285b53659f73bfb5a4f9f
SHA1 e095f8e71170dc3a72436a7ab1024991e5521155
SHA512 4217d1419622fc20a1183fb235594b83414e81a8d651f31265eeab8bd6f25715c7c2d586cb9355d44933862f52572f12baeb6908ce2375b381de007a2ae06ef3
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 319B
SHA256 c6df3cadff1669118d65c0218fbadb84fe4beb348a655630fd712034edfcec13
MD5 dbab8ead00cee5af9e3c99540366d1db
SHA1 1fedfdcc8e2cbf57a54cc5c596e04f19cdf2c289
SHA512 761e056dac5f1b6a40648cc661e027a278467289651105188fb4472a81c7f581aedb860b95446b0270c49c6c59d87ecce900eef7ebae6c16354d794ddff5caf7
TLSH
T165E0866444C9C179E46C68938B6CA308C7E23647B6987E12172A8CCD6105645EB96794
MD5 SHA1 SHA512 TLSH

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.104.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

computed_hashes.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_1\_metadata\computed_hashes.json
Size 429B
SHA256 b829b0df7e3f2391bfba70090eb4ce2ba6a978ccd665eebf1073849bdd4b8fb9
MD5 5d1d9020ccefd76ca661902e0c229087
SHA1 dcf2aa4a1c626ec7ffd9abd284d29b269d78fcb6
SHA512 5f6e72720e64a7ac19f191f0179992745d5136d41dcdc13c5c3c2e35a71eb227570bd47c7b376658ef670b75929abeebd8ef470d1e24b595a11d320ec1479e3c
TLSH
T10AE055170A1A50B79BB8DB90EE525CA2E8A0A6B1C50438D63E608234B68A11F738347D
MD5 SHA1 SHA512 TLSH

Submit Download

verified_contents.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_1\_metadata\verified_contents.json
Size 1KB
SHA256 d23b2ba94ba22bbb681e6362ae5870acd8a3280fa9e7241b86a9e12982968947
MD5 738e757b92939b24cdbbd0efc2601315
SHA1 77058cbafa625aafbea867052136c11ad3332143
SHA512 dca3e12dd5a9f1802db6d11b009fce2b787e79b9f730094367c9f26d1d87af1ea072ff5b10888648fb1231dd83475cf45594bb0c9915b655ee363a3127a5ffc2
TLSH
T12B317466C8683D56267A63348E2D0602EB57C2BB0050640EB5AC558D4F7115FE242FAF
MD5 SHA1 SHA512 TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_1\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 204KB
SHA256 df6d1a8c99e741451718dee8d3d2839157812eabc535a19352856c2b01f21ac4
MD5 9d8f66c582550e13c78164644ede1f97
SHA1 ecc05e07b992c2a0c9ac865ec04e89a8d25c8901
SHA512 3b22a9e1f469dfe89c755349ee06270d3609084d1cf60e22cc164dc8699187e475db7902b415b918e13341053798214ee2a77807bda1f4ad2a3c6a271b662cd5
SSDEEP 192:xAgNQ0+G83uxXBBK31GkSJpgEJH7DNspUC:xNNQa83uFBBQ1GkSr17DNspUC
TLSH
T11214531F5F752312CE7C803629EA44A35DBDF07F8B52669A78641470CEE3B52606C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 f11dada312a51d77225965ce246d95d4db0f40bb6e095a5a1ab709553c8341cd
MD5 05a8818d5b5652f6ccbe0f61b4923ac6
SHA1 83dd1b9ab9d30480c672fa023d6b39e7fc579317
SHA512 6755eddae998d180f48d1d76e7423d0480dbc918d0d83e816327590e53684b0eb9b69a7f019c0399ee08bf871ac87c680d4b827569ca435278d6a656a85bda51
SSDEEP 192:sxZqQUnORfyM//K1Ml8M4N/fJsVDxMah9OYbIVdpjI/W6+WNBE4/Y0XDn7hDhIgc:sxZcnOFgN/fJsVd5kxZs/bp/555c
TLSH
T11E72D906A634593B9CE7D219FA157B63D6F811A396940E48D9FCCA0C04E67ED2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 b82ef2a019cf01599f1de095730ae0c09c44dffc6d9da22d9b2ef3c8cb99eda1
MD5 ddd4b56ed1e15520cc73ae95dc61ec21
SHA1 5538694e6c5dbef88a9e0d1781027754e3fbefa8
SHA512 c170ac486fc977bc2d119a67323ec974e4a0cc7d2ddcaf61b4805ca285496456d5e8af1a033965dd4323b73e9446b9902fb1dd9fcc4551f67bd5766e56f6d937
SSDEEP 192:sxZqQUnORfyM//K1Ml8M4N/fJsdDxMah9OYbIVdpjI/W6+WNBE4/Y0XDn7hDhIgs:sxZcnOFgN/fJsdd5kxZs/bp/555s
TLSH
T1C872E916AA34593BDCE7D219FA157B63D6F811A3D6940E4899FCCA0C04E67ED2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 c7b0be9339be19908c59b59e4f91c82f79905339c2c80b706b1d25ed0f632099
MD5 92f296e058dc57a07d72f28233d43e23
SHA1 cfaf283393e075217ca2a952c0754688435c7dc7
SHA512 9a09d09f405ea73dc16362e80cae7f5ae629a42476b75e8a53563a5676e7abfca2ef205ebcfc05b4cf8167b86b00e61266b483a764ef7b4e9d3f4e97cb081793
SSDEEP 768:zuTTF8J520L7pLuLnYwWRmY4QPU8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3IUtfLlC:zuTTF8J520dEnYwWRmY4QPUu1jaKIUtw
TLSH
T11C03FB3B280CCB7E4F844E9CEC26BE9A6DE8018B9698C99447FA444C03C67EB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\48166f30-78f6-4da5-98a5-a0ff368b9888\index-dir\the-real-index
Size 1KB
SHA256 a449067f56bb458f855f8e132ed0b70c590c28d3ddaa98da8381d6283b0ac59d
MD5 d4ea4d021fd3f8437412528e78061871
SHA1 5e0a481b3ea410dd0273ebcf6ed778d8539c59b6
SHA512 704353f73fce4369ce6fa5b69d3f20e4730f5a9495bfb1beaaf2e7422085773e7280f1814cc17f76901951901f7b5bca271e693d2a5e9e7a6c356717e238a7b6
TLSH
T19831B75E9CD94D07CC7685B000F5263C33BC99ED1F48630BA5AC463AAD9F7A66DE3108
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe593985.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\48166f30-78f6-4da5-98a5-a0ff368b9888\index-dir\the-real-index~RFe593985.TMP
Size 1KB
SHA256 e8705994a537c80e73a78d2f63aecbf9f0ff4cac62a353fb72b0258bb8176229
MD5 0792b9b62b8b3367b64bbf1962614b53
SHA1 f6d499b3917ac2c79eb14422d000a633c92e1f6f
SHA512 29643e37659baa3077c1ba8454d3e0c9d740ecf239a22bc1a36530b546f3db6a90091bdbf3767f992894fbacffd86b5b8cf0843e1e755a92e9bc7992ba8b514d
TLSH
T16331B49A5C940E13CCA0807145CEA129337CE8951A00AB0B25EC8B33ECEBBB92D93114
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log
Size 4KB
SHA256 afec98f025cb1f5c0aecf9ed938e638c0e585467e676a9b89700a343c0a4121d
MD5 ee4a064ae5b28f1d56a8ed8843c9bb6c
SHA1 ee9d699ad1f95375cc4b1eec5adbb52cc0e518cf
SHA512 736389bd28c8c8bcc1a0d44c20eb5a2d5cddb3ef9a8ca4982faef61fea67aa442021c6d75bf64d8ac496d09bbb3f3d7fac9b5e016d8becc94e0b0842d778f6b1
SSDEEP 48:F2em5HdYlFJp6bRHtgf5lOep7Jp6bRHtL5lOpdpNRHtL5lOV:F1m5HQJp6bRNgXp7Jp6bRNMdpNRNu
TLSH
T12281CBE3CA105043C9C966FB2039F5E8592DCA066BFF87A651BD8F6E52412D63329B4C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 a755d4f59c95a458c6091d37d27820005be0e9f99eed79abb5d6fdeadb457b12
MD5 33d82ab4a77c03587536293d4115edfc
SHA1 3747099571551894abf598fedadf34c3e3a1572d
SHA512 d1b7e508d15553fba028842c7f919b2c4c939896df2e21a3b5a2393b7c3434cec358633531091d0bca88e2c9582057c51fd02a4acf976c81312853eada17bcdb
TLSH
T1DCE0262445C8C2FDB119224B0F3C9318C2F57647F6CC3D022F28CA446642504F2A26D2
MD5 SHA1 SHA512 TLSH

Submit Download

f1cdccba37924bda_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\f1cdccba37924bda_0
Size 114KB
SHA256 25174248314396ae87b3717d6691d8c3de30f989e2e0d7921e8526790041fa11
MD5 a5721f8734b1eeae14b78ea732905c8d
SHA1 f112f98c8d90e30ada07f173b446f80eff6a5b20
SHA512 bbd0fd909f350ea2df7b85141a3cf3a90149f5ce2d4a435bcbeeedc0127f9299e01a5f964407f0c3a289aa4c54036704ac37cb81cf7abe13666cccc7a9345602
SSDEEP 3072:M49K+xPCJWjtG/EezKL/oTXTmYnbvZUdc:M2cdKL/ozTmgbv6+
TLSH
T190B39932769C50AB0E8ABEA45156B50392BC7467B844D078F21467FC25DBFB013BBEB1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f1cdccba37924bda_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\f1cdccba37924bda_1
Size 202KB
SHA256 856b0333d264d68ff8914aa503019979c72dfb4e521da2bb12c00e5fb483f5c0
MD5 370f862b20ca52014ee6ca56b49f1498
SHA1 50f4ab11b38b6fd7a14a1d91e2a6bb5c5f8b9ff8
SHA512 867f8089de9b5cc3cc6002ad6f4fe199668b18d98734776ef214cd6b3b1dc8828575d33de2d3bc092600748341a39a3cfc5f32b74a305d52c8d525b1cd315120
SSDEEP 6144:0xOKlg8jhbBoDSgepj+LfxSw1821WyL/yMEAaPrugT5bit5zkR+6suGHg:R8JkJL/1SQyGA
TLSH
T14F140722230960ABCD1E93FA116B9E1377F44045BFC3E269855193342CAF7E35ADF926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 48B
SHA256 5229831294d107f9d160e3b35af48751444656a369c4527c0b83e5e72370a0fe
MD5 ddc2c41e2152500d30c5863f2b81b97a
SHA1 dd9a2fd16dc60076d13a2b7fb8555467d7e75be6
SHA512 55b0aab111b5a6096a069fad487be238e7c000df5f73cf475422d75c14e782809db8b6b2a42380d7afa0698a6203e7bd7054b94ce72d3b2d1093170f21f2dd23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 952897384e117625264e531f1c92d105358a6da5d3fd0cc45fdffcd63b2b7745
MD5 743bcace0aa06d639c6c9d12a498b13b
SHA1 f7fb1c24b40bac20952681c2f2287a2993da065e
SHA512 00c5f9d849dd0a0518cda988e4d2818092542a3c1e6409729d23044bf117b0ec60dc3243a55263d13317bbd625475e619c5258d2968bd978cc6abc849aef49e3
TLSH
T12CE0487456CDC26BB149209B5F6CE30CC2F37546F7E869352B1CD544720A144B753655
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 962283f64e46947784e8a964c9c370d2bb51c2d89b0c5c795543efb1a7057dab
MD5 1a8d75c016583176384897f3d198abc7
SHA1 e70b8b770b1c4407832cb93e24b8df4a8fe2979b
SHA512 484bd57f15ae1d7286e5a60911c70e9a0f5ba52306ce03643e560cd3b6b2eb9543d23d6955fb2ca58946b8a6af407c410986ff77752715ea98b7ec4d031e50db
TLSH
T10AE0267496CCC2799008A0C74F78A70CC3F17946B3E8FA22671C5884A501110F7B6AD1
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 1de88a8dfa615f436e92c4e847de2c6733b4b7dfbd783a936140703a1170c55a
MD5 4996b35332cb3edf2cf6f7f2f51dcdfc
SHA1 96a2dfd0e082a8bcb5d69d52e610ad6dbf97a058
SHA512 0ffd74ed4cfab8bdc888aaf977647b79a8e5582492ab22abb27660ec70445b983f528f3dfc7d5f27c112264510cb85d8d3a4b19a6b57a28b7aa133681352e9a6
SSDEEP 96:KwzeKc4mWH2Kc8Cqq4Kz6YuoKD6umB2KqA6:YFBFPIjdz
TLSH
T1F3E11751727B17C03A7E298A85E4B9BF52C134773018A43B7BB812664F26E50EDFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

QuotaManager-journal

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager-journal
Size 12KB
SHA256 7f7f3aa2c6819cb0f543498351b2f89a2d3c21349dc72f012d5bee0067cf53c1
MD5 0adf1ac94380c2f342d459058beb6e4b
SHA1 cf8de3a083824e9d18b55bd67d145993b9a369aa
SHA512 00481d716af91686b8835ea41a7f75f8fd1062f11e15b9cd6e179ed7937ffed9dc85fe1f59073e3983fbbe41ad971e7bb0cfe5bb213189aa8045d0c93487dada
SSDEEP 3:zN9d9Nllv/etXlGzt+/7o1qvTv4RRftD0td7jdtQfQertbC+/2eXtXlGzt+Vn:h9SlG0/ypR0tdndG/2alGa
TLSH
T1D84280FF3EC8C0D1D42D007DCE46EDB433E7848D54447E000019014B1596D257834D41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

load_statistics.db-wal

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal
Size 3.9MB
SHA256 e94c248736fdcf8d8fb20b461ff26a55cda00ab5550afe3df2ba8577c96f55e8
MD5 44c095669ac5d28c5f1c6f09669776d6
SHA1 3db3297cde0d43790362e1ef2d06f3616ddd0ac0
SHA512 254239e91abd7b7e27d879fa3f6f0126c5b831475fcd2e05f88bad2eb2d37698b1c50acec79eba82748a2693607823065e9a79a347fabfc12c7f936cadb6fb23
SSDEEP 12288:A4zaIa8MwW+qrW+An1RFLDbhm2TtA7Xgsd6DcPkui2dSe2LghwQOCv/CoZWRa9Rd:A4Jg
TLSH
T1B716BBFB7C0941AAD9CDE474D50BEE4950B3466A8E24CDD2A93C48C33B78F027C759A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 322B
SHA256 f46dea688cb42fcdfe17bbc9d4e6ee86b73a215d0241796c3a035e2275e1b725
MD5 4d2e677d6299bf301801f535ec2f5012
SHA1 2e2ac38c7c6a9686d9de759e9168bf32fd2e8d71
SHA512 d65c25d0e9263a22390cca0de024f8858fa52baa67231fd99e972dc3594cf6e4d3e8985fc3226e0acb9a13acf0cf8f4ccdf482f2f8935ebb2613a6ecdc94d6cd
TLSH
T18CE02071D4C4C19EE45964871E3C5708D2D73593FA9439055F24C44C6042100FB59655
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 de3ecde0bed975f8a7a192b888d63710d1d8525a6a63bc123b38240fae6e2064
MD5 d87d7c0e84008127bf8e54d19c34786c
SHA1 f77e7ecdb68573cad5f70bec957be54609c09f5b
SHA512 cde8f1f46e9d88ad1e7624923f959429b7e4b5c77c451d2414906848fd9e1389ce7bb027a587557030edf436f0d9b04623935fa49afed760c5e33996dfb93a54
TLSH
T13A212D96F330C145D149463A643E7B291338D5468FF8EE0F447520642F73B440D4B6E9
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 340B
SHA256 a5c2c650420248c244ea478cea64ff13102c95f1c59a7158e3e441e66aa181e7
MD5 657eca7f31520e9930abcb08933cb0cc
SHA1 e50fdc8daf568b6a4ebfb5b89d47786eadfe1d0e
SHA512 a520d8d51f923d4c91c2e217cec2892a7180489c71e88af067f727d4437c0996dda3bed0a1384e8cc9d74e29c968efe2019fdaf598626c0febd31f39fb418058
TLSH
T1F0E02071E4C4C1DFD05564870E7C9748D2E739D3FA943E015F24CD4C5142141FB5E655
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 9dfba23693fd5bf2ee9c69bed09b2455bf1c5ed3387238fe18338476bbdd8c59
MD5 0cb282dd2792b5df9f8aabb3456988b6
SHA1 45ec5c1b3a8b60ec6002bf3a953fbf55a8943053
SHA512 964169146c6d020fb8e886abe573fbdcca38acf5ffdaf5634116d382a2dd0b397bf69609cede6bec5b23a4c637bbd63b7375640c9c21d0c00a6cc002f45dcd7b
SSDEEP 384:zzjccCs+Bt0S3v8N3FTclpvRAkc/Tvw+px8M6SgVLBf3V:TccQPv17c/rweeM61VBV
TLSH
T1CC827C3268B55C7B9AE7A915F04B37239FB440BBA7842FA59CDD9B1C05CF2AC1307812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 50c2c7fe9af9fc168e6e34afcff1c4bdad8eaca5d57b0c1c0035caf7315cda1b
MD5 5c527c42c55670e98bd408e7a3ab9cfe
SHA1 bcebbd91e07e9aa69ca2c14bd2c071bb33814bf9
SHA512 08fae2cb1e2d3227ee1bfef6b194e471f25324f186f3afec82dffef8306643bc4cd901d01525214dc3129ae564744de28b24e0892e159f9bd53fd6b81ed27094
SSDEEP 384:zzjccCs+Bt0S3v8NtFTclpvDAkc/Tvw+pxzh+16SgVLlf3x:TccQPJn7c/rweZh+161VNx
TLSH
T19A927C3668B15C7B9EA7E915F04B37239FB050BB97852EA58CDD9B1C05CF2AC1307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f0b1a1778495ed57272831bc4ffb7f2387618f8dd93aa298eb3024ad8c559a97
MD5 6cd7efa902ede8b3894f24b9bb7751cc
SHA1 52de59d19753785b8e1004043bc02a7fda070ee9
SHA512 e6659335a69cd2d64ec0bd9980bda5bbe99cd3644b1bdbafac3f94fa47784a403d3d71d09a30d35eb69faa734782d36c1c64c0d7f3977e11f57c8ebd8e4438f9
SSDEEP 192:fGNa6IMGiQmiUzuDgxc/Tvw+pxmhAHS66HqfU6:fGNa6GeOgxc/Tvw+px0MU6
TLSH
T168121B317868AC7B5DE3A951F04736239E90516BDB896FE5C5EC2B1C05EF79C130B812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7e1138d64564e86f03dcda220e0337b51956ed7a2df243506233a5fb78b8b93c
MD5 89cb19cfc0330e182d2415c704f621c8
SHA1 074b09bd1177288036ab5cfcf809da242883933a
SHA512 e4000e07e29b98cd418c1db2ffde2be9b8097ea0f5ab6a614c80ceabf7e2c89da0d4879420d1c3955e1764ff14fd87e872a95011a19e0954cbdd7978472c13c9
SSDEEP 192:lGNmB6IMGEQmiUyATD6xc/Tvw+phSepGluU6:lGNmB6GUHn6xc/Tvw+pfDU6
TLSH
T13902D8357C686CBB9EE3AE55B44737339F94206BAA941F98C9E81B1D01DB65C1307822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

campaign_history

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history
Size 20KB
SHA256 e5b96c1c4938d5e1bd86d356aeeff52840a52ec6747da15f4e10c83a824ab2f1
MD5 0a84b054bbc3d7b1b3808bc931c356df
SHA1 c2ce7f0c06cee76b3d97bff872da4b5c81b16751
SHA512 ac097cec2b50bfbfae105922fadcec77061bbcbea4b0f5192d123f26c1e5c8a9028f3079c71db8661aa97e4d7ec4e3a8596e14392d35db4bb1d9f15fb7e48183
SSDEEP 12:TLpOPFUxOUDaaWZXiDiIF8izX4fhhdWeci2oesJa/Si3isOmQQtudoAzQdopzcQY:TL85UOl0afDdWec9sJMkC9zfGDB5fc
TLSH
T17192FE22B9352023E8DF1B76F94348D00DFC16AFC9A7B804DED44D6149A2FC2A6940FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 3dc9043838386f5363ac96a01477cf3163b5118b80191576a11b32ce9894314c
MD5 cdddc745a8c954dc438c931889999bdb
SHA1 7908f975b6815460caa2bc3438efbd8fc8d36211
SHA512 3d2d4852aa2ac6cb0b9b6cbca9f04366afd48d362d869be877ef324c16d72ff119b5842891baa2b6b99df2de2db8d3be5c23f0f97f8943bd74195996bcb66a0a
TLSH
T159A02407C473C00FF4144051C45C034114F4C047011DD0115070D33714D40CF03F5C35
MD5 SHA1 SHA512 TLSH

Submit Download

7c3da031-7f2d-4ff0-943f-379cfc8098c8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\7c3da031-7f2d-4ff0-943f-379cfc8098c8.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

19f0e7be-bb6d-4302-9e12-1e5b886eb4b8.tmp

Path C:\Users\Admin\AppData\Local\Temp\19f0e7be-bb6d-4302-9e12-1e5b886eb4b8.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

6c875ba0-bfab-4347-933a-ce41cd4dc1c5.tmp

Path C:\Users\Admin\AppData\Local\Temp\6c875ba0-bfab-4347-933a-ce41cd4dc1c5.tmp
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e87203eb-13ab-4671-b63b-ee32d0879399.tmp

Path C:\Users\Admin\AppData\Local\Temp\e87203eb-13ab-4671-b63b-ee32d0879399.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4516_877530656\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/224-1217-0x0000025B190E0000-0x0000025B1918F000-memory.dmp

Download

memory/680-316-0x000001A98F830000-0x000001A98F8DF000-memory.dmp

Download

memory/2472-46-0x0000022028B50000-0x0000022028BFF000-memory.dmp

Download

memory/2568-32-0x0000020240D30000-0x0000020240DDF000-memory.dmp

Download

memory/2872-1294-0x000001E437860000-0x000001E43790F000-memory.dmp

Download

memory/2968-244-0x000002090F950000-0x000002090F9FF000-memory.dmp

Download

memory/3052-1-0x0000000140000000-0x00000001400FE000-memory.dmp

Download

memory/3052-14-0x0000000140000000-0x00000001400FE000-memory.dmp

Download

memory/3052-13-0x000001BAF67B0000-0x000001BAF685F000-memory.dmp

Download

memory/3052-0-0x0000000140000000-0x00000001400FE000-memory.dmp

Download

memory/3052-1355-0x0000000140000000-0x00000001400FE000-memory.dmp

Download

memory/3052-1367-0x000001BAF67B0000-0x000001BAF685F000-memory.dmp

Download

memory/3052-1368-0x0000000140000000-0x00000001400FE000-memory.dmp

Download

memory/4068-109-0x0000029287A60000-0x0000029287B0F000-memory.dmp

Download

memory/4924-1277-0x00000261318A0000-0x000002613194F000-memory.dmp

Download

memory/5076-860-0x0000024090600000-0x00000240906AF000-memory.dmp

Download