vidar | 158304a51c4012d9337af5ba6de8b494d11b6457f65ff195c1ccb7c324c9014e

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
21/04/2026, 00:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
158304a51c4012d9337af5ba6de8b494d11b6457f65ff195c1ccb7c324c9014e.exe
Size 2.0MB
Sample260421-a7hypaat9y
SHA256 158304a51c4012d9337af5ba6de8b494d11b6457f65ff195c1ccb7c324c9014e
MD5 ab8115ca7da3e2d77407e5640e19f42d
SHA1 bf6c4835a4e22b6cfc1280b7ee136e024a2d003a
SHA512 fa1c3a3f30b2b7d6f31defdb35cc2cb84e2e436e9897977dce54d6085cd574dee1e736ae4e0027d90cbe4d80fa91fae98ab5e3a640b5f9b53a846a1306a73726
SSDEEP 24576:jRH70VrGRXk61fNCJLTYzMQf9WUTrW6Jg4NwhZNjROzp+7SgqkerVXXX+3kEXIdM:jRbirGC61V6YzEUTS6eDOz0Ak3kFhcxJ
TLSH
T123A58D5BBC9104F6D46AA33788B72192BBB0B8480B3233D72E50A6783FB67D49C75754
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery vidar spyware stealer

Malware Config

Signatures

Family: Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Detects Vidar Stealer 2 IoCs

stealer

resource	yara_rule
behavioral1/memory/2944-1-0x0000000140000000-0x00000001400FE000-memory.dmp	family_vidar_v15
behavioral1/memory/2944-17-0x0000000140000000-0x00000001400FE000-memory.dmp	family_vidar_v15

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3272	chrome.exe
1628	msedge.exe
4076	msedge.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	158304a51c4012d9337af5ba6de8b494d11b6457f65ff195c1ccb7c324c9014e.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	158304a51c4012d9337af5ba6de8b494d11b6457f65ff195c1ccb7c324c9014e.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134212063574829068"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-312252282-3884318443-358092420-1000\{79EDCBA5-D181-4999-857A-E9E20DEE3BE4}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2944	158304a51c4012d9337af5ba6de8b494d11b6457f65ff195c1ccb7c324c9014e.exe
2944	158304a51c4012d9337af5ba6de8b494d11b6457f65ff195c1ccb7c324c9014e.exe
2944	158304a51c4012d9337af5ba6de8b494d11b6457f65ff195c1ccb7c324c9014e.exe
2944	158304a51c4012d9337af5ba6de8b494d11b6457f65ff195c1ccb7c324c9014e.exe
2944	158304a51c4012d9337af5ba6de8b494d11b6457f65ff195c1ccb7c324c9014e.exe
2944	158304a51c4012d9337af5ba6de8b494d11b6457f65ff195c1ccb7c324c9014e.exe
2944	158304a51c4012d9337af5ba6de8b494d11b6457f65ff195c1ccb7c324c9014e.exe
2944	158304a51c4012d9337af5ba6de8b494d11b6457f65ff195c1ccb7c324c9014e.exe
2944	158304a51c4012d9337af5ba6de8b494d11b6457f65ff195c1ccb7c324c9014e.exe
2944	158304a51c4012d9337af5ba6de8b494d11b6457f65ff195c1ccb7c324c9014e.exe
2944	158304a51c4012d9337af5ba6de8b494d11b6457f65ff195c1ccb7c324c9014e.exe
2944	158304a51c4012d9337af5ba6de8b494d11b6457f65ff195c1ccb7c324c9014e.exe
2944	158304a51c4012d9337af5ba6de8b494d11b6457f65ff195c1ccb7c324c9014e.exe
2944	158304a51c4012d9337af5ba6de8b494d11b6457f65ff195c1ccb7c324c9014e.exe
2944	158304a51c4012d9337af5ba6de8b494d11b6457f65ff195c1ccb7c324c9014e.exe
2944	158304a51c4012d9337af5ba6de8b494d11b6457f65ff195c1ccb7c324c9014e.exe
2944	158304a51c4012d9337af5ba6de8b494d11b6457f65ff195c1ccb7c324c9014e.exe
2944	158304a51c4012d9337af5ba6de8b494d11b6457f65ff195c1ccb7c324c9014e.exe
2944	158304a51c4012d9337af5ba6de8b494d11b6457f65ff195c1ccb7c324c9014e.exe
2944	158304a51c4012d9337af5ba6de8b494d11b6457f65ff195c1ccb7c324c9014e.exe
2944	158304a51c4012d9337af5ba6de8b494d11b6457f65ff195c1ccb7c324c9014e.exe
2944	158304a51c4012d9337af5ba6de8b494d11b6457f65ff195c1ccb7c324c9014e.exe
2944	158304a51c4012d9337af5ba6de8b494d11b6457f65ff195c1ccb7c324c9014e.exe
2944	158304a51c4012d9337af5ba6de8b494d11b6457f65ff195c1ccb7c324c9014e.exe
2944	158304a51c4012d9337af5ba6de8b494d11b6457f65ff195c1ccb7c324c9014e.exe
2944	158304a51c4012d9337af5ba6de8b494d11b6457f65ff195c1ccb7c324c9014e.exe
2944	158304a51c4012d9337af5ba6de8b494d11b6457f65ff195c1ccb7c324c9014e.exe
2944	158304a51c4012d9337af5ba6de8b494d11b6457f65ff195c1ccb7c324c9014e.exe
2944	158304a51c4012d9337af5ba6de8b494d11b6457f65ff195c1ccb7c324c9014e.exe
2944	158304a51c4012d9337af5ba6de8b494d11b6457f65ff195c1ccb7c324c9014e.exe
2944	158304a51c4012d9337af5ba6de8b494d11b6457f65ff195c1ccb7c324c9014e.exe
2924	chrome.exe
2924	chrome.exe
2944	158304a51c4012d9337af5ba6de8b494d11b6457f65ff195c1ccb7c324c9014e.exe
2944	158304a51c4012d9337af5ba6de8b494d11b6457f65ff195c1ccb7c324c9014e.exe
2944	158304a51c4012d9337af5ba6de8b494d11b6457f65ff195c1ccb7c324c9014e.exe
2944	158304a51c4012d9337af5ba6de8b494d11b6457f65ff195c1ccb7c324c9014e.exe
2944	158304a51c4012d9337af5ba6de8b494d11b6457f65ff195c1ccb7c324c9014e.exe
2944	158304a51c4012d9337af5ba6de8b494d11b6457f65ff195c1ccb7c324c9014e.exe
2944	158304a51c4012d9337af5ba6de8b494d11b6457f65ff195c1ccb7c324c9014e.exe
2944	158304a51c4012d9337af5ba6de8b494d11b6457f65ff195c1ccb7c324c9014e.exe
2944	158304a51c4012d9337af5ba6de8b494d11b6457f65ff195c1ccb7c324c9014e.exe
2944	158304a51c4012d9337af5ba6de8b494d11b6457f65ff195c1ccb7c324c9014e.exe
2944	158304a51c4012d9337af5ba6de8b494d11b6457f65ff195c1ccb7c324c9014e.exe
2944	158304a51c4012d9337af5ba6de8b494d11b6457f65ff195c1ccb7c324c9014e.exe
2944	158304a51c4012d9337af5ba6de8b494d11b6457f65ff195c1ccb7c324c9014e.exe
2944	158304a51c4012d9337af5ba6de8b494d11b6457f65ff195c1ccb7c324c9014e.exe
2944	158304a51c4012d9337af5ba6de8b494d11b6457f65ff195c1ccb7c324c9014e.exe
2944	158304a51c4012d9337af5ba6de8b494d11b6457f65ff195c1ccb7c324c9014e.exe
2944	158304a51c4012d9337af5ba6de8b494d11b6457f65ff195c1ccb7c324c9014e.exe
2944	158304a51c4012d9337af5ba6de8b494d11b6457f65ff195c1ccb7c324c9014e.exe
2944	158304a51c4012d9337af5ba6de8b494d11b6457f65ff195c1ccb7c324c9014e.exe
2944	158304a51c4012d9337af5ba6de8b494d11b6457f65ff195c1ccb7c324c9014e.exe
2944	158304a51c4012d9337af5ba6de8b494d11b6457f65ff195c1ccb7c324c9014e.exe
2944	158304a51c4012d9337af5ba6de8b494d11b6457f65ff195c1ccb7c324c9014e.exe
2944	158304a51c4012d9337af5ba6de8b494d11b6457f65ff195c1ccb7c324c9014e.exe
2944	158304a51c4012d9337af5ba6de8b494d11b6457f65ff195c1ccb7c324c9014e.exe
2944	158304a51c4012d9337af5ba6de8b494d11b6457f65ff195c1ccb7c324c9014e.exe
2944	158304a51c4012d9337af5ba6de8b494d11b6457f65ff195c1ccb7c324c9014e.exe
2944	158304a51c4012d9337af5ba6de8b494d11b6457f65ff195c1ccb7c324c9014e.exe
2944	158304a51c4012d9337af5ba6de8b494d11b6457f65ff195c1ccb7c324c9014e.exe
2944	158304a51c4012d9337af5ba6de8b494d11b6457f65ff195c1ccb7c324c9014e.exe
2944	158304a51c4012d9337af5ba6de8b494d11b6457f65ff195c1ccb7c324c9014e.exe
2944	158304a51c4012d9337af5ba6de8b494d11b6457f65ff195c1ccb7c324c9014e.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
420	msedge.exe
420	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2924	chrome.exe
Token: SeCreatePagefilePrivilege	2924	chrome.exe

Suspicious use of FindShellTrayWindow 37 IoCs

pid	Process
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
4448	msedge.exe
4448	msedge.exe
420	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2944 wrote to memory of 2924	2944	158304a51c4012d9337af5ba6de8b494d11b6457f65ff195c1ccb7c324c9014e.exe	94
PID 2924 wrote to memory of 320	2924	chrome.exe	95
PID 2944 wrote to memory of 2924	2944	158304a51c4012d9337af5ba6de8b494d11b6457f65ff195c1ccb7c324c9014e.exe	94
PID 2924 wrote to memory of 3272	2924	chrome.exe	96
PID 2924 wrote to memory of 3092	2924	chrome.exe	97
PID 2924 wrote to memory of 3092	2924	chrome.exe	97
PID 2924 wrote to memory of 4288	2924	chrome.exe	98
PID 2924 wrote to memory of 4288	2924	chrome.exe	98
PID 2924 wrote to memory of 1116	2924	chrome.exe	99
PID 2924 wrote to memory of 1084	2924	chrome.exe	100
PID 2924 wrote to memory of 1116	2924	chrome.exe	99
PID 2924 wrote to memory of 1084	2924	chrome.exe	100
PID 2924 wrote to memory of 2064	2924	chrome.exe	102
PID 2924 wrote to memory of 2064	2924	chrome.exe	102
PID 2924 wrote to memory of 632	2924	chrome.exe	103
PID 2924 wrote to memory of 632	2924	chrome.exe	103
PID 2944 wrote to memory of 4448	2944	158304a51c4012d9337af5ba6de8b494d11b6457f65ff195c1ccb7c324c9014e.exe	105
PID 4448 wrote to memory of 4388	4448	msedge.exe	106
PID 2944 wrote to memory of 4448	2944	158304a51c4012d9337af5ba6de8b494d11b6457f65ff195c1ccb7c324c9014e.exe	105
PID 4448 wrote to memory of 1628	4448	msedge.exe	108
PID 4448 wrote to memory of 3276	4448	msedge.exe	109
PID 4448 wrote to memory of 3276	4448	msedge.exe	109
PID 4448 wrote to memory of 3276	4448	msedge.exe	109
PID 4448 wrote to memory of 2492	4448	msedge.exe	110
PID 4448 wrote to memory of 2492	4448	msedge.exe	110
PID 4448 wrote to memory of 4988	4448	msedge.exe	111
PID 4448 wrote to memory of 4988	4448	msedge.exe	111
PID 4448 wrote to memory of 4988	4448	msedge.exe	111
PID 4448 wrote to memory of 2240	4448	msedge.exe	112
PID 4448 wrote to memory of 2240	4448	msedge.exe	112
PID 4448 wrote to memory of 2240	4448	msedge.exe	112
PID 4448 wrote to memory of 368	4448	msedge.exe	113
PID 4448 wrote to memory of 1688	4448	msedge.exe	114
PID 4448 wrote to memory of 368	4448	msedge.exe	113
PID 4448 wrote to memory of 368	4448	msedge.exe	113
PID 4448 wrote to memory of 1688	4448	msedge.exe	114
PID 4448 wrote to memory of 1688	4448	msedge.exe	114
PID 4448 wrote to memory of 2016	4448	msedge.exe	117
PID 4448 wrote to memory of 2016	4448	msedge.exe	117
PID 4448 wrote to memory of 1600	4448	msedge.exe	118
PID 4448 wrote to memory of 1600	4448	msedge.exe	118
PID 4448 wrote to memory of 3804	4448	msedge.exe	119
PID 4448 wrote to memory of 3804	4448	msedge.exe	119
PID 4448 wrote to memory of 3456	4448	msedge.exe	120
PID 4448 wrote to memory of 3456	4448	msedge.exe	120
PID 4448 wrote to memory of 4404	4448	msedge.exe	122
PID 4448 wrote to memory of 4944	4448	msedge.exe	123
PID 4448 wrote to memory of 4944	4448	msedge.exe	123
PID 4448 wrote to memory of 4888	4448	msedge.exe	124
PID 4448 wrote to memory of 4888	4448	msedge.exe	124
PID 4448 wrote to memory of 1768	4448	msedge.exe	125
PID 4448 wrote to memory of 1768	4448	msedge.exe	125
PID 4448 wrote to memory of 312	4448	msedge.exe	126
PID 4448 wrote to memory of 312	4448	msedge.exe	126
PID 4448 wrote to memory of 4836	4448	msedge.exe	127
PID 4448 wrote to memory of 4836	4448	msedge.exe	127
PID 4448 wrote to memory of 5088	4448	msedge.exe	130
PID 2944 wrote to memory of 420	2944	158304a51c4012d9337af5ba6de8b494d11b6457f65ff195c1ccb7c324c9014e.exe	131
PID 420 wrote to memory of 1624	420	msedge.exe	132
PID 2944 wrote to memory of 420	2944	158304a51c4012d9337af5ba6de8b494d11b6457f65ff195c1ccb7c324c9014e.exe	131
PID 420 wrote to memory of 4076	420	msedge.exe	134
PID 420 wrote to memory of 4344	420	msedge.exe	135
PID 420 wrote to memory of 3384	420	msedge.exe	136
PID 420 wrote to memory of 4344	420	msedge.exe	135

C:\Users\Admin\AppData\Local\Temp\158304a51c4012d9337af5ba6de8b494d11b6457f65ff195c1ccb7c324c9014e.exe
"C:\Users\Admin\AppData\Local\Temp\158304a51c4012d9337af5ba6de8b494d11b6457f65ff195c1ccb7c324c9014e.exe"
1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --profile-directory="Default"
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2924
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffebff4c728,0x7ffebff4c734,0x7ffebff4c740
    3⤵
    PID:320
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=2008,i,9258094741426154824,2840343332309880658,524288 --field-trial-handle=2100,i,4690633201250116437,6699092540451763869,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2164 /prefetch:3
    3⤵
    - System Time Discovery
    PID:3272
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1720,i,7815908137385665976,12655195123752841305,262144 --field-trial-handle=2100,i,4690633201250116437,6699092540451763869,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2104 /prefetch:2
    3⤵
    PID:3092
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2392,i,13509622789490255004,1937311600152209945,524288 --field-trial-handle=2100,i,4690633201250116437,6699092540451763869,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2564 /prefetch:8
    3⤵
    PID:4288
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3196,i,8522185378755705281,12847480477635787296,2097152 --field-trial-handle=2100,i,4690633201250116437,6699092540451763869,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3204 /prefetch:1
    3⤵
    PID:1116
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3220,i,11109274040386199077,1975471466188597389,2097152 --field-trial-handle=2100,i,4690633201250116437,6699092540451763869,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3444 /prefetch:1
    3⤵
    PID:1084
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4232,i,13531543221889286869,13483065783825362735,2097152 --field-trial-handle=2100,i,4690633201250116437,6699092540451763869,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4240 /prefetch:2
    3⤵
    PID:2064
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4592,i,1120505599729086881,7723883606796363836,2097152 --field-trial-handle=2100,i,4690633201250116437,6699092540451763869,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4616 /prefetch:1
    3⤵
    PID:632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory="Default"
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2ec,0x7ffebff2c188,0x7ffebff2c194,0x7ffebff2c1a0
    3⤵
    PID:4388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1976,i,2239355226137255294,2331831644266510129,524288 --field-trial-handle=2348,i,14901489804201216178,11712899086569191276,262144 --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:3
    3⤵
    - System Time Discovery
    PID:1628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1756,i,16866455659576260768,17609946699183333752,262144 --field-trial-handle=2348,i,14901489804201216178,11712899086569191276,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:2
    3⤵
    PID:3276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2628,i,9778377271943712758,2793337280986746192,524288 --field-trial-handle=2348,i,14901489804201216178,11712899086569191276,262144 --variations-seed-version --mojo-platform-channel-handle=2632 /prefetch:8
    3⤵
    PID:2492
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,16823996796194026125,14143094625570250857,2097152 --field-trial-handle=2348,i,14901489804201216178,11712899086569191276,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
    3⤵
    PID:4988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,10163566549305558358,1066859213379924699,2097152 --field-trial-handle=2348,i,14901489804201216178,11712899086569191276,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
    3⤵
    PID:2240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4136,i,7386487962018197445,18422632389889179461,2097152 --field-trial-handle=2348,i,14901489804201216178,11712899086569191276,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:1
    3⤵
    PID:368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4160,i,8654430274737126553,8613802169099146620,2097152 --field-trial-handle=2348,i,14901489804201216178,11712899086569191276,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:2
    3⤵
    PID:1688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5072,i,2234913637648811925,2184674080454252868,524288 --field-trial-handle=2348,i,14901489804201216178,11712899086569191276,262144 --variations-seed-version --mojo-platform-channel-handle=4156 /prefetch:8
    3⤵
    PID:2016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,3135400205938298036,2981141979426081527,524288 --field-trial-handle=2348,i,14901489804201216178,11712899086569191276,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:8
    3⤵
    PID:1600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5076,i,10684740415685659370,18305023021769212685,524288 --field-trial-handle=2348,i,14901489804201216178,11712899086569191276,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:8
    3⤵
    PID:3804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5036,i,10741153334217086296,9167282195788801883,524288 --field-trial-handle=2348,i,14901489804201216178,11712899086569191276,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:8
    3⤵
    PID:3456
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5964,i,10613744993011678634,11786964092290827235,524288 --field-trial-handle=2348,i,14901489804201216178,11712899086569191276,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:8
    3⤵
    PID:1116
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5964,i,10613744993011678634,11786964092290827235,524288 --field-trial-handle=2348,i,14901489804201216178,11712899086569191276,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:8
    3⤵
    PID:4404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,16168564600525047104,11872425768564304749,524288 --field-trial-handle=2348,i,14901489804201216178,11712899086569191276,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:8
    3⤵
    PID:4944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6436,i,10282085169643121366,1098164203364809761,524288 --field-trial-handle=2348,i,14901489804201216178,11712899086569191276,262144 --variations-seed-version --mojo-platform-channel-handle=6440 /prefetch:8
    3⤵
    PID:4888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6292,i,8888342515238990157,10018089910861554435,524288 --field-trial-handle=2348,i,14901489804201216178,11712899086569191276,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:8
    3⤵
    PID:1768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6464,i,13240608546313277295,3762295341594645096,524288 --field-trial-handle=2348,i,14901489804201216178,11712899086569191276,262144 --variations-seed-version --mojo-platform-channel-handle=6440 /prefetch:8
    3⤵
    PID:312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6776,i,3047380508625293832,12250048297014227410,524288 --field-trial-handle=2348,i,14901489804201216178,11712899086569191276,262144 --variations-seed-version --mojo-platform-channel-handle=6760 /prefetch:8
    3⤵
    PID:4836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7148,i,17748783488085822937,15255227586673159357,524288 --field-trial-handle=2348,i,14901489804201216178,11712899086569191276,262144 --variations-seed-version --mojo-platform-channel-handle=4160 /prefetch:8
    3⤵
    PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory="Default"
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2d4,0x7ffec12ac188,0x7ffec12ac194,0x7ffec12ac1a0
    3⤵
    PID:1624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1996,i,7061746448365949824,13601187406390919489,524288 --field-trial-handle=2420,i,15573545771383605026,10812017616059263884,262144 --variations-seed-version --mojo-platform-channel-handle=2448 /prefetch:3
    3⤵
    - System Time Discovery
    PID:4076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1788,i,11681113115057733335,1943501306878817546,262144 --field-trial-handle=2420,i,15573545771383605026,10812017616059263884,262144 --variations-seed-version --mojo-platform-channel-handle=2416 /prefetch:2
    3⤵
    PID:4344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2480,i,5872727963944521050,353965401657762906,524288 --field-trial-handle=2420,i,15573545771383605026,10812017616059263884,262144 --variations-seed-version --mojo-platform-channel-handle=2488 /prefetch:8
    3⤵
    PID:3384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3524,i,9275528584569719575,7779225112998639533,2097152 --field-trial-handle=2420,i,15573545771383605026,10812017616059263884,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
    3⤵
    PID:4444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3528,i,1422243457232199759,7497152121276365319,2097152 --field-trial-handle=2420,i,15573545771383605026,10812017616059263884,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
    3⤵
    PID:2016

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4392

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1204

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3216

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4288

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:660

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 89KB
SHA256 59e457be6d1ec3d55ebb133b024ad3f4433a8d2ef5127e6122254dc84dcbfd0a
MD5 94ed25b8f46e10e6404ef033c0db47e9
SHA1 ab15d95a6c7ab1e87236db1c37a645b44b23be3c
SHA512 b963e7bb66e651ea6a7fe4ca56f3a04b96a626ecbbf9be49c97dfb19cdaf9cc84ac9ce56add5da87f61a0cf7bea2a4c4d93f5ad28ab552ae27574677b7273c32
SSDEEP 1536:ip/EcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YW:aE3Qw/xLANk0mUW5GmRntSFCjEENL
TLSH
T1F79312BA4E2646E7997D4A8176AE7909CE12530D705FA9CC325CA38C61D02C82F72F73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 d4b1f4021efe562889686ca23b343186755c4a3e384d48334452f0e3d84d3486
MD5 ee955f2c936c31e263773fe62d6a83cb
SHA1 47d2c335e07918d44d3d5d60208bd2e8ea91b3c5
SHA512 84d608e59364d37b614631245b5e20358df5bf985a2531a22dba8df4c53ad17ffd7989293c5a9242cbf1c9b5a7688cdb2e89f37edb3cf63a74a244c94c6da653
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7S:fwUQC5VwBIiElEd2K57P7S
TLSH
T154B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ecc103220659b15b56c51e9002281cb930975deca8db44af194bf80a64b234af
MD5 9fed310f4dbdc9a2461971b19f5052c0
SHA1 115846f0655f86ee9b0df9e6162b98f6759f0431
SHA512 fa56e883ae91402b4ea0c534c2613509a62d2b9143aa63ac21e6964c2160f26457b4535ce353ca6ca04a2cd6e78c64013c6198649d03713abde28dc1800ee193
TLSH
T19DD02375FDD9D006D33A04B3135353516746C6157F434011F055C40CDC557BEE3C5582
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9ff8d381f7139fb92b33cf5c547073b70b41d42ed1ddc6139099fb1e0be9de9c
MD5 10f818095f5e044c765f111723e046e9
SHA1 edf3939b7495098161b217e610c1deb5a0736c45
SHA512 1b2e33a236535b3c3c2da904dd1e83518dc65274330c4cc967e3b11053074f6bbb59b852d87ec3f72843dfee915911b69b1fcdfb10ee236815084dfac05b49b2
TLSH
T1CBD08075FD9DD005D35708F3619193515746C6656F524101B091981DEC017F9D3CA642
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 dd10f9085cecfffecfd5883131fbca23560ac08d660007d9ab5caeec6dcc906d
MD5 2015b6001ceb9bc2260f7fb63f4d8354
SHA1 ab906bfec4264085eb0ae180f9039048de14c9df
SHA512 4f0cfefa674cfa613518d89245c5012df2a00b5b3559185a25168614fcc79d65eb01780926edfd64b12e96489d21616a8c1adc059ec94e2baaeb0adca6eb95bb
TLSH
T124D08075FD9DD005D35708F3659193516746C6696F524101B095981DDC017F9D3CA642
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6b65e3f6d57bee85b90392c47f2236ea7ffcfe9cba07ca29930764c7dacc0ea2
MD5 726476576ad538c648305e214c389ece
SHA1 03960d925aa07a6736b28a431ddf422fa8bba04d
SHA512 7b99250e71a507574a7ea1c326ff4f687cffd7e1a0eb1ba5aa847f5b5e0c5d997dbef37ede7c2815a11e03b25f291a4f19173dd0aa9d22472d224e9b1d6349a5
TLSH
T11ED0808995F15C35D5D78CF1154B37067915C577DF42932374633C3C8C435D19546283
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d084fddc35d62ab10457432373865714cd0577ad9bebe9188135998b9f802bd3
MD5 ff587c8337b9997eb40f19fb41bffd1a
SHA1 75e9be1412e32cbe6e960e041e872bbb48ab464e
SHA512 d50cc729f4f047045aba003643fd356cb1ac85c1d90f9ed992f787f682a862005a91103e9e388ad5cbd4f884c2668a35a0e5a0d011d0684ef2d6bc59a10b1701
TLSH
T15ED08089D5B15C35D1D78CF1154B37067915C577DF42532274633C3C8C435919546283
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 4c356b2b87c2b8839af0c8b4af7a56235f51bebffad6603694cd530b57cd325d
MD5 b31df02586f54ecbdf23ea427ff4afea
SHA1 e1680ee46f21ecb2a01a3c9fe62d600d1f5173a4
SHA512 277a43bfdd0a67fade78058e6ba557bfbb0a7da816f558ca80e48d647a45a3041edea2261ab0c95b2f07f1677d4adc91c6449e5c2890069c5d01e52bb657955a
TLSH
T11B71F73C8D758C39F3E881F06EA130557238B798232B2EFE32F4712C4E1AB11930A594
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 855B
SHA256 933afc1fd66370964663fbb5972cd71d64dc9a4315b57dc8c6011dd232d511dc
MD5 fbe7019c87a334dddef9cbabc58ddd36
SHA1 cdb96fd472899e9631024633abfaba2b29057533
SHA512 d34d70f78fbd3238902369bb3104bd30ca0fbb6d96d8212900b985ec02a0f9f05deb96fe7902bc94db3843f2b75c6bac3410ac56511aa4ce4dab7a3d69a7a95b
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 322B
SHA256 e40cafaabcb1decf8169368e096fc966e32b9dc011b6e406cdd374b5ee01311a
MD5 e332de766edf3d55f28689a818b6b9f0
SHA1 b82882776f438886ab927fe34b35b5b88046fa41
SHA512 a4521fb08ccfb93c7def27d90602c9cb62e2b045c8c3a6683679839c136b32875b1cf365ef072ddb2deaac3f0ee1086e12baad187f803d653e1ecd9b8b05c1cc
TLSH
T10AE0485404D9D5EE631C68D78B6D630CC3D53657B69539022B098C986306545767E2D4
MD5 SHA1 SHA512 TLSH

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.104.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

computed_hashes.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_2\_metadata\computed_hashes.json
Size 429B
SHA256 b829b0df7e3f2391bfba70090eb4ce2ba6a978ccd665eebf1073849bdd4b8fb9
MD5 5d1d9020ccefd76ca661902e0c229087
SHA1 dcf2aa4a1c626ec7ffd9abd284d29b269d78fcb6
SHA512 5f6e72720e64a7ac19f191f0179992745d5136d41dcdc13c5c3c2e35a71eb227570bd47c7b376658ef670b75929abeebd8ef470d1e24b595a11d320ec1479e3c
TLSH
T10AE055170A1A50B79BB8DB90EE525CA2E8A0A6B1C50438D63E608234B68A11F738347D
MD5 SHA1 SHA512 TLSH

Submit Download

verified_contents.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_2\_metadata\verified_contents.json
Size 1KB
SHA256 d23b2ba94ba22bbb681e6362ae5870acd8a3280fa9e7241b86a9e12982968947
MD5 738e757b92939b24cdbbd0efc2601315
SHA1 77058cbafa625aafbea867052136c11ad3332143
SHA512 dca3e12dd5a9f1802db6d11b009fce2b787e79b9f730094367c9f26d1d87af1ea072ff5b10888648fb1231dd83475cf45594bb0c9915b655ee363a3127a5ffc2
TLSH
T12B317466C8683D56267A63348E2D0602EB57C2BB0050640EB5AC558D4F7115FE242FAF
MD5 SHA1 SHA512 TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_2\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 5KB
SHA256 08f63dde96988dc96a524ef44ef57d94c88fa0fb29eb353b966ee923abb4af4f
MD5 0f2d5e3f06ea61cfcb02e3db1f204ea8
SHA1 4e8cf1a0c4255efb51eb850560ff090aacb5437e
SHA512 2fa4b8b0f9a8eb22e655f33a322cad51c0afe75283de6d230258a397cedffc79cb40fe98a78fa43c33e2688a76bb2f02bc7a6802672bd207816bcb40e6c2b052
SSDEEP 96:hi+m2jJwRv2gwkU1nMlpOv2YRtrZ+pN6XwFDUeWyONp:Yz4JwRBMnM2tbo34YDG
TLSH
T137B195F7242C9836C78A40D5C543FD9EC503087DCFECFD8DD2BCA9AA25A61243539256
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 0662e3295bd39df14dc73fdffa43abf9338f2e6c08ffefc48a5bdc380349831f
MD5 0aa0e1af4b8cfc80c21f65aa91f95fd8
SHA1 f43bf2ed91c15c882e6ff8f33288deeb8e1ac175
SHA512 eeea9951676bcb437401c2907b0fe4f2d1c335e33fb04e221e0db79dec5b02cacc145b14ee840de83517d47c23d892fb00ad221ed92880f2a08412998cbad9a8
TLSH
T1C1E0D87186CEC6AD660838CF97297708C3A4368BE79C2A811B04A8C8B10F448FA992D5
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 b6a3523a352edc592c8b71f49e1e7231853f2542f2ce782aaf87eba577934430
MD5 3c2963318bc0fc202a00eec03ff650e8
SHA1 44c4f30ed049b1ce30726cba2a10b245aac0fde6
SHA512 3f8b50afeaba810c981eabb3d85988c2cefa7e6e7c26743e8cb26d6cd9e1e7399e1023d56929e61cc84bc3ceadfc9643e8f1c85eff040230b54aa02f1db3be65
SSDEEP 192:sxZ1QUnYRNyM//K1Ml8MEw/f6sZb4Uf8lZAGYbZkdpmhHW6+WNB5X/YJbSb5Ig4J:sxZdnYfcw/f6sZb4U2/0EqHbT/Lc
TLSH
T1EE6208166A24593BCCD7D319F9067B53E6F80562D6900E48AAFCCA0C04F6BED2213C6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 71100aeed7bf7b2694ccc6cae8c8092c6c80857a4fabaeb326f90efcb0a0d809
MD5 54d52f85d92922e87d887a91d34007b6
SHA1 d200882728da6b99d964daa4d1ffa9da4135e849
SHA512 3a7f842edcbf09c5ed5939849b88699a4bc31e28407d63d137f42089beb20df01f12f38e9dda7b64798e80fe0b9ec529d8a506058d5ac8fa9d5777e4f20b9ad9
SSDEEP 192:sxZ1QUnYRNyM//K1Ml8MEw/f6sGb4Uf8lZAGYbZkdpmhHW6+WNB5X/YJbSb5Ig5J:sxZdnYfcw/f6sGb4U2/0EqHbT/Lr
TLSH
T1D3720816AA24597BCCD7D319F9057B53E6F80562D6900E48AAFCCB0C04F6BDD2213C6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 985412d355488ce9e0583f4666fdbcb5983428755ecf7235698159528e4c4bd7
MD5 1e3f6618001580437c0466c07f2fd4aa
SHA1 1b884c9131e589e9e04d5980d758d1ba41ca964c
SHA512 669b2e436774d2711aa176c82947948c54a5adcfb6032dcc341091fbe0a5e7438c3d8cd60cb5d9e62aad31d057d9aa6244d6f19daff48c502b59beb35ecfa01e
SSDEEP 768:3gQv2J47pLuLneqWve+l+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVn20FLllnWhsroV:3gQv2JkEneqWve+l+u1jai20FLfWh3xH
TLSH
T158F20B3B6C0CCB7E4F804E9CEC2A7E8A6DE8018B96D8895447FA841C03C66EF55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\32bd6690-22d7-4d50-901d-6f07e47d7f4c\index-dir\the-real-index
Size 72B
SHA256 99af275c0d1b94c844fbdc82d1f2a9a3a310f491246a9c4d657ccc30a8534269
MD5 eb1e6aeb9917934abbe61a46d2c32000
SHA1 9f0b46c6db0e87fcd9bff991f2b11e1460eec5d8
SHA512 139f299c0445dfb4cc8fd7078e18f7ad310ecd3a65391f4a0ec15fa016decb9f374d11177c173afb787c11caea90531651fd437abcbdf140276a61250317298f
TLSH
T148A0021C2B984051C10256F0259782D12311BE5412011305A1E0185ACDA154A559191C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\32bd6690-22d7-4d50-901d-6f07e47d7f4c\index-dir\the-real-index
Size 72B
SHA256 0f4131fd01ed071bc785a4034f883903208d3d3aa0c67ad05ee2591f158fc41a
MD5 57154f8fa3a4893bb72ece4cbfdb4a8a
SHA1 543ec58a54ccc34963ebd12c5d28c792ce73522c
SHA512 0a766e2698d50c196ab61aa01e91511255c1fe0384bdf1f2a503dd7c7ce436499041a2eee7305049f2073b87e65e416e6d8563b78edbe595f8e6813e3af167e6
TLSH
T175A002D113E30A15E23362F1195262411241C9101222A74B62A10584CC60C44678140C
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\a8685028-8a71-4316-b2b9-e9c8eb46c656\index-dir\temp-index
Size 2KB
SHA256 66f12d40d1fa22a2dc822db2b546b608a5ce339612b7273b033c28bf03e6abd0
MD5 7cd643b81f06c6efbe01335201fece44
SHA1 94caa73b51133b0c3607b9bed13b28c7d8d62f42
SHA512 3a9b33ee1dbcd93248db44d4a3dcc2233f3e74a879afd3bb44b3fa6f69119561629af36a649259615f08cff6bbeb772d5f2b21561518aa6f0a0a55bf0a9a7bda
TLSH
T14151945C9C8D8F63CA7E02B09AFA1029337848FE5A585B0728FC5539AC876962D8720C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\a8685028-8a71-4316-b2b9-e9c8eb46c656\index-dir\the-real-index
Size 2KB
SHA256 b60feca62caddaf7f56fa82b66c5220f80866b20f681c95e7d2f35fd37f55e67
MD5 a686c05e7d878adc40d20ae7c360c296
SHA1 6756d8e65b67117050f70a39098a548d0a0cebe8
SHA512 2d91eeb49ee23c8d0bf13701323977bf1ce041ba0a68f050c1d7fc2ff3a7da152ed53cda3296523b6417a363d9a68895d3500d541401ffde3c02f94fe16eb424
TLSH
T14251EA1D9C4D4B62CDB811B24DB604453378D8CD7FFC4E0B99AC99B5385331E1F4A516
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59933d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\a8685028-8a71-4316-b2b9-e9c8eb46c656\index-dir\the-real-index~RFe59933d.TMP
Size 2KB
SHA256 66d0ca0dcd3f09e9c9668e20a1722765cedc4940f60078e4b5361d3dd8725f93
MD5 b9c4113fe7cea3e9f46724bf04c30b80
SHA1 02b8911f9d2b1b743bff0b157d997a135f9d9626
SHA512 7e9de493df247f7653110380ad26b89334411c4b041a5dda068ae62a521bbc2d47526d92b87558792f37ca2d192d0107639a10068ee4865ff71f562cad8cfe87
TLSH
T1FB51A85E9C424A21CD6081B349CA246D333E689549459F0B34FCCA32ECC769D3D57345
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 6bed000344d93a5f8dcb426f49df2633fd8e4e81718b26285d6dddb1e9e601f2
MD5 c9ce6e73d4cab298a539e21b2b127c1f
SHA1 0833bcb937b37d6ba4632c63d3c0d7532792095e
SHA512 9c6be98a4be65428a621b80130c6dbd407402d4c28a945c77f4c388ad9c51c23b570bd9296668bcc0583d7c77320494d52e4d47e6046737c86557f68e29c4e8f
TLSH
T17DE0D8BB2CA71514EC9F93E12832A4B60149B8559951EC4E54ABA2D714F2240245AC26
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log
Size 4KB
SHA256 e2dafecd7ae02d454611d2d0fbc34f64e53e59c7a4490515e372467faa22082b
MD5 bfa8002e3e884eedc079005f10b86155
SHA1 66e87af604b33ab9816f0111c2b9e737644c7e28
SHA512 3a5dd0139b94d1a0edce8215081ae4769f4d671358d85539147dfff22253e555ea68bddaf00edd613a93def97db4b82f9ca5512ff0472b961a46dc7c8e7e5670
SSDEEP 48:F2em5HdYlvSfJp66Htgf5JOHoXpZIzfgwp66HtL5JOepMHtL5JOV:F1m5HeMJp66NgTXpZIzfjp66NnpMNm
TLSH
T1F891DDE3CB145043C9C966FB2039F5D9592ECA066BFF87A611BD8F6E52442C63329B0C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 338B
SHA256 19e9d79ebf42d4e997a3b7dc3fa682e6496004a725144b5b50172cbb2ff2a02b
MD5 6da96f31ce46f3c7925da86cb4abe8d7
SHA1 2b3af48e1fdc177b08cbba227e66a649ca7d770f
SHA512 0bbc50b989abf49fa621179bde3b9d8275174a34a3cf23df9ae85b8728533b9b32e522ff76cf00fb8336acb57123bea1bc079ea88e0e075f830aca4959facade
TLSH
T101E0262105CADDFD715924C78B29A70CC3E9762BF2C83D022F00C8C8614B508B2AB2D0
MD5 SHA1 SHA512 TLSH

Submit Download

ba23d8ecda68de77_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\ba23d8ecda68de77_0
Size 114KB
SHA256 19c1ff915dd269ec90a2c606d38b0d7d90460780ce7ee8cefce05815c305b84e
MD5 2384f608f26b076a266ffbfaebfec59f
SHA1 c733a040718d4e35e7cd65aa57ef1b014330398c
SHA512 cc791363d5b2ef78395f3bfc6b1051ffb2f25c32ee2551e3497aae06432577359eed0a6dd2f6cbed93238744715c67bbd6106ee62c765eb4dac3c33f5ecddb11
SSDEEP 1536:AO49U3+xPCJWjtG8gEezKL/NuTXTapIH0zetDYybZ2xTLU1zsM:j49K+xPCJWjtG/EezKL/oTXTmrMvZH1P
TLSH
T1ECB3A932369C54AB0E8ABEA45156B50352BC7467B844E078F21467FC25DBFB013BBEB1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ba23d8ecda68de77_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\ba23d8ecda68de77_1
Size 202KB
SHA256 9ed17cf528e5e8f756dc5a2e6b761a0b09aa03d7dc40d66b0411e47d81d92454
MD5 0e540407e4c9bdd2fa03723c77ce7056
SHA1 8f5d89b8029ab8bb1dafaca87d3c7b234dacd394
SHA512 cdedd870e1c1754b332bdf1bb903805eb6732d9435d8077c03de5b4f3a4c04f5216d3de309191093240eb4d39b87e5ebf31b1b202c9a041386d3a12ed8694e80
SSDEEP 6144:DxOfhg8HhXxkD+4epjKLfxSw182ZCGL/yMEAaPrugT5bi45zxtpUsCGHc:b8BwVL/1UvUG8
TLSH
T12A140722234960ABCD1E93FA116B9E1377F44045BFC3E269854193342CAF7E35ADF926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 81827a9518c299d4b308c347465f2ecce21671e4ec69484effb250421e053977
MD5 12bad6a8951f0d08abe133078227892a
SHA1 2449f2a2f4e704ab08490075063dad0d837d5179
SHA512 4dafc0ec80dd58bf392bf98cb22b3773e7755cec1293bf8c705b0111190cfeb19f522a104b8f2106eb8b9272ab1a8db757b014ae29e4132252a62c885a0b2412
TLSH
T1B0A0023D8565905DD01A4F7490879294262598680607221648A442F8A950A55556600B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59e8d0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59e8d0.TMP
Size 48B
SHA256 526a78af5c3a5e19475137440c4a2b0d0b0dd65cc0f520f78ceed5e295c7cb45
MD5 88841b269c3532b4deba3e0e217bd1d7
SHA1 04cd996eba7959b895c6ea86a1742459a2129230
SHA512 ee332ddbf1decdbf482d5ee24f2cd158801045d52367a6055062a0adbce04a1e050488c61b1a5762991d41c837081f70ffd5f2244c32b5ede39ce6ccd3bed3b4
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log
Size 8KB
SHA256 cf96075fe8c0832d51b9fb789e214741e32f186401463c1ded63254be544b81c
MD5 dceac47f9357fd05be3daf0b216ffc9e
SHA1 4d86e701e50bfcb416f487767fd2d190d6c70448
SHA512 0b86714f09eb9d59da595c5b73a7019c9e60fb85aa5625b72b390e7ba8b61ef01bebb363b12212e6a22da2fc5fafe2887fd92ff60fd791c94e67965468658691
SSDEEP 192:9b/Ux7K2vuyEUCh+xa0DWPaOJZzTdZqDbXv:Cx2h+4PaOHzTdADbXv
TLSH
T1A802585AFBEB405DF7FF8E6118322499487EF9421C5CEC99119442CD0D3AE48E8B1E3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG
Size 319B
SHA256 f79f42818487519a0dd338ebd4ff16bb453793dcf625a85894b926e39adde173
MD5 61aa1f1ac9f12bbf9b104098b4d58fbf
SHA1 84e9d77c974cb4b7e685c8e58dca8512964a2c28
SHA512 fb74df64831aa6a2a5708b0579bdc57477e02f67628704dcb82d4cd7164234525f37d65f682e976c9301c387b95ae42c7e3a312cc431402d8ac4af57f3057313
TLSH
T16BE0207444C5C1FDA2146CDB8739730D83E4364BF7A82D015704C88C620A505FBB92D5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 6666d44ffcc746155d1f7a216926c4e8eeb4fcd64dccb5270d7f664395ab6ad3
MD5 c24d8acd3c8e3a9061b9709983e963da
SHA1 cee122173fc6f16b7d0afc95d531bfe46ab1489b
SHA512 3986ec435b2c374ef50d6f1b29c32220a28085ab1b767e55a8ab2c90e9b5da34b064ee610ea230c6b1b57a12e7960193ee2c25b2dc02de22cfc8579f1bd31235
TLSH
T1D0E0D13015CACBBA714924CF4719F70C82A5770BF7D815513F0498886207548B15B291
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 a5661ac215d35bdf0d195c13ad1c965e116f38acb065d2a847fed17eab7662f1
MD5 26f8753e11adeabaf79818d5b9e6deed
SHA1 44c4a72b19573d9e5a03802af911e9ce2bb600f7
SHA512 f65d4dcf8211196b702b9d6154a851d9dab1688f3a030351565ad9f9b4b661308df95f8340cd748965c97dd24f9f539571eb6a004a60ed8d022d57ac78ef7c75
TLSH
T141E048F045C5D6B9634864C7876DB70C83E87A1BB79539456708449C6207144777E6D4
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 7KB
SHA256 c29684e820932150ac1aaa0af5c67d36347de0039687753548c91c1485dcbf4d
MD5 7ce5532f9677e25511fb9faaac291274
SHA1 146e96e65708abaf0bd4b3eada6675d388b5ca4a
SHA512 a45362e70b02f578905061a3738e9d66dd286179f389628ca484890b2823d6f72dd7b21e9c4a0b6e844fa20ba4c7c318a6ce871526b9741f86c24845f78146b5
SSDEEP 96:KkE4Kh6Cub6KEMWO12KmUZIgK9eqSGkKD6UU:SnB5ptL/U
TLSH
T1BCE13320323A06913A7E259E85D0B95F96C175733598A42F3BFC44A68F67E20CDFC8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

QuotaManager-journal

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager-journal
Size 12KB
SHA256 fe615c49395be3221e95fe7e202f561ad03f855017a1fbd60d6d1c1c50c09108
MD5 150e2350b1f7fd45f0e278f007cd95c5
SHA1 8c57697dd546e7fc925017611ada1ad5c173f1da
SHA512 0bfd6dd4c3cc8ed583c342ce9a46ba96f6da644c6a76d3558eb91985560f16733db5b06eaa03df97d0a4ee9c9acbc379bb076ca4635eb8f2a487f74eb4f52295
SSDEEP 3:K9Nllv/etXlL3dvGl7o1qvTv4RRftD0td7jdtQfQq62dvGl2eXtXlL3Q:1lhyypR0tdnd2y2alU
TLSH
T1534280DBBEC4C021D63101BCCB728EAC37A3440C5E547EC0005D015F10169297C7CDC0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

load_statistics.db-wal

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal
Size 3.9MB
SHA256 8d5ecc2bbd036afbf6a6eb88fb65560b352f140f73ded41cfa3cd719705c6eae
MD5 d21d656ee3c543cb2f349b9bc71f659f
SHA1 01c2df4f2b01a02b56c53e4f6e9cb332b823c3eb
SHA512 1b3ae78bc7fec29dfba228faa30561b8e4f4488ed779446b64fdbc80b4c5b0c761dffbfbf8888b29ac2a6c05b320fd049d2f40c20002b81dfd59c3cf057c74b8
SSDEEP 49152:VvGYnhjcDlZbA8lWI+YXogGhutOjdZqcIQXz/52Dc916F9XY3XNQ9rtJrTS4i7si:B
TLSH
T1EB1667F36E2941AEC9CD94B4C50BEE4848B346394F38D5E1A93D08CB7B78A123D759C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 12KB
SHA256 6bbc83ed7306c9f7a030c3945b09da5eb7ba00f32b9a30c599632b914f534eb1
MD5 98d158b51bf247acf8d55e572b33bdd0
SHA1 1724dd584fc8fb8688b5bba86d751786955f9f41
SHA512 f3ef6062ca87ba525e705fd407cca9d4e0a001c0fac345c44eed74fb2f43a4176659daa94f680a3b45af0f06b4c4248a99463258cd14ec2c5c7eea5deb494340
SSDEEP 192:HQvIIIebOMIMUbZYcY94OLJOAsmli0BCsJJFZl:HQvIIIebOMIMeBWLJ3sEksz
TLSH
T19942926A66151F77C24F5F761256C2921BDB88814870252D30A12C1F8DF7FA78BC92F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 319B
SHA256 05e9ebd0038a390059b572ad30766ad2068933c6cb18ce2b1b4ab119d022bb32
MD5 82b01af73548c33b42888ea46899bce4
SHA1 8c1ebc972870a7d7b5ad91e6b81fde83b1c473da
SHA512 c0927cdc70d3efd5d823faa74b14f76aaacfebe3cb30c87d485ea5fb3ff1961c0e6c66c42a6f2b8d3211ef7b303be2b2e29f92b591c98c2db6c7bac8a65a010b
TLSH
T1A9E0202054C5C2FE662864CB46397B0882847F47FAA42D051F00C88C64061047E7D6D1
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 995f6a2fc2d58af5cadae7b8e7ebd6b82ff6ab84401c0dbc9d55b5d5c0ff30db
MD5 bffcf85b432eacf0d403ada2b81a069e
SHA1 bc225c933b36189a60a4da8211f4cfe64f9c7c8e
SHA512 1e14560068706a23eddfb679e45eef439e4947483dab45cf6972669798b253f3d2298f73d31ea1132ee85e287e709483d2c799c6915e34f47bbefc86e6908f9f
TLSH
T1F32128A2F330C259D14A467A953E9B1A0338C8069FBCEC0F54B638646E76F050D872E5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 337B
SHA256 c79bd9e6bea5f655d8310123472fc1c5da7faac5a853c0d22af424fd0891842a
MD5 7cd0d7abde1968ccda1d5692026ef4d1
SHA1 53c2881302c2d7e4099c7c1e3e484ef0298219b1
SHA512 d9d64da08e195e0a22033c45fbda99ee2f6f2628d51404b375a615e5bccf5d68b94b6ce122f3cfae949ddd91f2acf709dd4e05c3cfabd6557dcb6cd33aa68190
TLSH
T1A4E0202064C5C2FF522464C74679BB4882957E47FAA42E011F00CC8C55061457E7E6D1
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 309efd136a6dcf3b73ab6521a32e81929fb55e0e4a0679b094725429e11b9daa
MD5 c247d0243c8169f8cf46f20ea7d57fe3
SHA1 8017a6effc74ed1ed6e5146e171e812f70c7a560
SHA512 b52616fbba3329d939427cdb79c69dc1f942362bd9418eec719d10b1c76cff5aa20775be003090cc9c1af45cd1012787bff26af3fb93f22a78b29aee99266a09
SSDEEP 384:nLjccCs+Bt0S3vsNX/MTCB2eougDJ6Vy5XU/AatId6FlZr5Vf3B:nccQPKBtKM05XabW6d3B
TLSH
T1DB826C7268B46C3F9AE3A525B1473A176EB482ABD7843F64EDDD4B1C00DB1EC130B562
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 4b34cc6743c40f4a1cc54de8a3fe3417c5551069c212482b2cd02c5ffcefd6fe
MD5 29b41e45a57678ec2c12e9c1f06e6165
SHA1 6e32b974ec29944e823dbe356c7185a595426d67
SHA512 1e83a3b7ee5941045ab8a7cf934dffb04a922c9a9be611d50b2602e75e38e2ce295263536d994c184b54aa13b482ca9fe9b9e2d38f57d961211d51cd08fdd084
SSDEEP 384:nLjccCs+Bt0S3vsNQ/MTCB2XougDJ6Vc/hwvXU/AatId6FlZrlVf31:nccQPjB+KMAhwvXabW6d71
TLSH
T166927C7268B46C3F9EE39625B1473A076EB082ABD3853F64E9ED4B1C00CB1EC1307562
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9a764d4ad6fc38b1c415b157435f5c7e11fe62d01d465ed7c576806ae98e582a
MD5 fd198eeecfb64beaa7691b30b02c2852
SHA1 40ead295ebd2ee4bfd7c5f78c2fc5a874c75b4a4
SHA512 3de18c0c84dd87b3faa721385ec799401b43c619c87bee1162148ba849e909c04de99140092c84140042a80d91036f71468867c9322c7d074e71cc124fdb26fc
SSDEEP 192:ZON+6IT0JZQmiUyQZOgibF/xogFuH5zU6:ZON+6B3XOgiJ6BZzU6
TLSH
T1E702D975686C6C6B8FE3AE49B48B3B275FA4112FDA953F94DAE41B1C00D719C1307922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 535cd597959c6759e83b187037a7f962477b737972731dba59d3c9b943df3058
MD5 25998a4e2767092c2faa5b8711d026ac
SHA1 6d423772e78a209970ea412a604026c8f817061e
SHA512 a74435efeac91429f10eec000a70ae6141154c4c0a04ff864f96f3f402b9bd892c8e63476d15c4a3df96fb5e85ceec1b430fded3b622587db0346e93792685dc
SSDEEP 192:bONy6IT0+QmiUztZjgibF/xoVneJBh1DoqTU6:bONy6yHjgiJ6VW5U6
TLSH
T169120B7668B86C3F9EE3AD55B0873A135EA5821BD7893F94DAEC171C00DB19C130B562
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

campaign_history

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history
Size 20KB
SHA256 f6a3e0548122f0ccfe7bbd54f3a26da140583bcbfb7b6e9c824b6e6fa3f3da5d
MD5 5c9f438b59a2f726064b7704dbe62c5a
SHA1 b3628a6878fac8e3c429368b7d99679c3840a2c1
SHA512 fd3943e07dcf10d476a4a55a5fa160f8c9fbd009ab68c22bce13af41bafb165e18cd02559ed1be427ce95053ce25065d035747d66d625662a177065423d8c398
SSDEEP 12:TLpOPFUxOUDaaWZXiDiIF8izX4fhhdWeci2oesJa/Si3isOmQQtudoKzQdo7zcQj:TL85UOl0afDdWec9sJMWc9+tGDB5fc
TLSH
T16C92F422BD312467E8DF0B76F9434CD00DFC126FCAA7B804D9D44D5109A2BC1A6941FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 3dc9043838386f5363ac96a01477cf3163b5118b80191576a11b32ce9894314c
MD5 cdddc745a8c954dc438c931889999bdb
SHA1 7908f975b6815460caa2bc3438efbd8fc8d36211
SHA512 3d2d4852aa2ac6cb0b9b6cbca9f04366afd48d362d869be877ef324c16d72ff119b5842891baa2b6b99df2de2db8d3be5c23f0f97f8943bd74195996bcb66a0a
TLSH
T159A02407C473C00FF4144051C45C034114F4C047011DD0115070D33714D40CF03F5C35
MD5 SHA1 SHA512 TLSH

Submit Download

e9d66968-d107-41b0-a58a-e560e1a3e356.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e9d66968-d107-41b0-a58a-e560e1a3e356.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 cdab05f6dcdabc3f1e9327f9a95ae6eb8e0b045e7426369e6f69dc7d48d56b95
MD5 aa0c90078e2999ead71aeba66937a2fc
SHA1 59a20634e38203e9924e62813dc7dfe900f7eed7
SHA512 9e21b4713ab06587ad42e4d78f1e5d49ef7c8c27529093fbcf594ea575efc5e8089399e62933125c2591fe50baa973501b3072c55ba40fed9bd4521464de36ff
TLSH
T13D41FA58B6F91149B3B76E5AAFF6A86E447FBD372E06D45E10110E4F0B62A00C861B37
MD5 SHA1 SHA512 TLSH

Submit Download

28142457-c919-4ff1-9886-7204045c1d01.tmp

Path C:\Users\Admin\AppData\Local\Temp\28142457-c919-4ff1-9886-7204045c1d01.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

442e8154-3eac-4595-8db2-058978f4619d.tmp

Path C:\Users\Admin\AppData\Local\Temp\442e8154-3eac-4595-8db2-058978f4619d.tmp
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aee588c9-eb37-408f-bbee-ba8bc436fa34.tmp

Path C:\Users\Admin\AppData\Local\Temp\aee588c9-eb37-408f-bbee-ba8bc436fa34.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4448_1234820090\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2944-0-0x0000000140000000-0x00000001400FE000-memory.dmp

Download

memory/2944-17-0x0000000140000000-0x00000001400FE000-memory.dmp

Download

memory/2944-1-0x0000000140000000-0x00000001400FE000-memory.dmp

Download