vidar | 9bc02728947900c39ace25e0f9d669e10b283b7ce014728aaa3d34fa91333548

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
23/04/2026, 14:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Set.Up.exe
Size 801.9MB
Sample260423-rc1cxset9k
SHA256 9bc02728947900c39ace25e0f9d669e10b283b7ce014728aaa3d34fa91333548
MD5 18a06eea09b6db4e9c9710076127dd9c
SHA1 f4d5b34ba91fed45a8ad62b667ab3718a9a3b42f
SHA512 1f5a9353f91e8a258530dafb42a0214ac40f4bc252b3f7fb99343f69e299d07ae7b1ca9bce1763d2ec132c1a36bef66e258fe7f500b5fcc932f3abb02c198907
SSDEEP 24576:kskZpRrcVXW98ywSB/XUigyDj634OTBoziO7n1I3cqA2hZQAjmGFWPH5:kskRrb98uBrTbHPS3cB28SuZ
TLSH
T11E998C07BCD108BAD4A6A3328DF661927B72F8190B3233D72E50A6783F7A7D05979744
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection discovery vidar spyware stealer

Malware Config

Signatures

Family: Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Detects Vidar Stealer 4 IoCs

stealer

resource	yara_rule
behavioral2/memory/2512-1-0x0000000140000000-0x00000001400FE000-memory.dmp	family_vidar_v15
behavioral2/memory/2512-15-0x0000000140000000-0x00000001400FE000-memory.dmp	family_vidar_v15
behavioral2/memory/2512-1389-0x0000000140000000-0x00000001400FE000-memory.dmp	family_vidar_v15
behavioral2/memory/2512-1403-0x0000000140000000-0x00000001400FE000-memory.dmp	family_vidar_v15

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 4 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Set.Up.exe
Key opened	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Set.Up.exe
Key opened	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000\Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Set.Up.exe
Key opened	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Set.Up.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2672	chrome.exe
3316	msedge.exe
1792	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Set.Up.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Set.Up.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134214267803803537"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2122505878-652277452-2375749442-1000\{6D43B868-6775-4D31-8F8E-04EC2A5F738D}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2512	Set.Up.exe
2512	Set.Up.exe
2512	Set.Up.exe
2512	Set.Up.exe
2512	Set.Up.exe
2512	Set.Up.exe
2512	Set.Up.exe
2512	Set.Up.exe
2512	Set.Up.exe
2512	Set.Up.exe
2512	Set.Up.exe
2512	Set.Up.exe
2512	Set.Up.exe
2512	Set.Up.exe
2512	Set.Up.exe
2512	Set.Up.exe
2512	Set.Up.exe
2512	Set.Up.exe
2512	Set.Up.exe
2512	Set.Up.exe
2512	Set.Up.exe
2512	Set.Up.exe
2512	Set.Up.exe
2512	Set.Up.exe
2512	Set.Up.exe
2512	Set.Up.exe
2512	Set.Up.exe
2512	Set.Up.exe
2512	Set.Up.exe
2512	Set.Up.exe
2512	Set.Up.exe
2512	Set.Up.exe
2512	Set.Up.exe
2512	Set.Up.exe
2512	Set.Up.exe
3924	chrome.exe
3924	chrome.exe
2512	Set.Up.exe
2512	Set.Up.exe
2512	Set.Up.exe
2512	Set.Up.exe
2512	Set.Up.exe
2512	Set.Up.exe
2512	Set.Up.exe
2512	Set.Up.exe
2512	Set.Up.exe
2512	Set.Up.exe
2512	Set.Up.exe
2512	Set.Up.exe
2512	Set.Up.exe
2512	Set.Up.exe
2512	Set.Up.exe
2512	Set.Up.exe
2512	Set.Up.exe
2512	Set.Up.exe
2512	Set.Up.exe
2512	Set.Up.exe
2512	Set.Up.exe
2512	Set.Up.exe
2512	Set.Up.exe
2512	Set.Up.exe
2512	Set.Up.exe
2512	Set.Up.exe
2512	Set.Up.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
932	msedge.exe
932	msedge.exe
932	msedge.exe
932	msedge.exe
932	msedge.exe
932	msedge.exe
1596	msedge.exe
1596	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe

Suspicious use of FindShellTrayWindow 37 IoCs

pid	Process
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
932	msedge.exe
932	msedge.exe
1596	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 3924	2512	Set.Up.exe	80
PID 3924 wrote to memory of 5620	3924	chrome.exe	81
PID 2512 wrote to memory of 3924	2512	Set.Up.exe	80
PID 3924 wrote to memory of 1904	3924	chrome.exe	83
PID 3924 wrote to memory of 2672	3924	chrome.exe	84
PID 3924 wrote to memory of 1904	3924	chrome.exe	83
PID 3924 wrote to memory of 5908	3924	chrome.exe	85
PID 3924 wrote to memory of 5908	3924	chrome.exe	85
PID 3924 wrote to memory of 5916	3924	chrome.exe	86
PID 3924 wrote to memory of 5916	3924	chrome.exe	86
PID 3924 wrote to memory of 5880	3924	chrome.exe	87
PID 3924 wrote to memory of 5880	3924	chrome.exe	87
PID 3924 wrote to memory of 5696	3924	chrome.exe	89
PID 3924 wrote to memory of 5696	3924	chrome.exe	89
PID 3924 wrote to memory of 2572	3924	chrome.exe	90
PID 3924 wrote to memory of 2572	3924	chrome.exe	90
PID 3924 wrote to memory of 4424	3924	chrome.exe	91
PID 3924 wrote to memory of 4424	3924	chrome.exe	91
PID 3924 wrote to memory of 4488	3924	chrome.exe	92
PID 3924 wrote to memory of 4488	3924	chrome.exe	92
PID 2512 wrote to memory of 932	2512	Set.Up.exe	94
PID 932 wrote to memory of 3836	932	msedge.exe	95
PID 2512 wrote to memory of 932	2512	Set.Up.exe	94
PID 932 wrote to memory of 3008	932	msedge.exe	96
PID 932 wrote to memory of 3316	932	msedge.exe	97
PID 932 wrote to memory of 3008	932	msedge.exe	96
PID 932 wrote to memory of 3008	932	msedge.exe	96
PID 932 wrote to memory of 5020	932	msedge.exe	99
PID 932 wrote to memory of 5020	932	msedge.exe	99
PID 932 wrote to memory of 3908	932	msedge.exe	100
PID 932 wrote to memory of 2036	932	msedge.exe	101
PID 932 wrote to memory of 3908	932	msedge.exe	100
PID 932 wrote to memory of 3908	932	msedge.exe	100
PID 932 wrote to memory of 2036	932	msedge.exe	101
PID 932 wrote to memory of 2036	932	msedge.exe	101
PID 932 wrote to memory of 1784	932	msedge.exe	102
PID 932 wrote to memory of 1784	932	msedge.exe	102
PID 932 wrote to memory of 1784	932	msedge.exe	102
PID 932 wrote to memory of 4276	932	msedge.exe	103
PID 932 wrote to memory of 4276	932	msedge.exe	103
PID 932 wrote to memory of 4276	932	msedge.exe	103
PID 932 wrote to memory of 1960	932	msedge.exe	104
PID 932 wrote to memory of 1960	932	msedge.exe	104
PID 932 wrote to memory of 1960	932	msedge.exe	104
PID 932 wrote to memory of 5676	932	msedge.exe	105
PID 932 wrote to memory of 5676	932	msedge.exe	105
PID 932 wrote to memory of 5676	932	msedge.exe	105
PID 932 wrote to memory of 2496	932	msedge.exe	106
PID 932 wrote to memory of 2496	932	msedge.exe	106
PID 932 wrote to memory of 4396	932	msedge.exe	107
PID 932 wrote to memory of 4396	932	msedge.exe	107
PID 932 wrote to memory of 1376	932	msedge.exe	108
PID 932 wrote to memory of 1376	932	msedge.exe	108
PID 932 wrote to memory of 1208	932	msedge.exe	109
PID 932 wrote to memory of 1208	932	msedge.exe	109
PID 932 wrote to memory of 5900	932	msedge.exe	110
PID 932 wrote to memory of 1280	932	msedge.exe	112
PID 5900 wrote to memory of 3080	5900	msedge.exe	113
PID 932 wrote to memory of 6108	932	msedge.exe	114
PID 6108 wrote to memory of 5980	6108	msedge.exe	115
PID 932 wrote to memory of 4288	932	msedge.exe	116
PID 932 wrote to memory of 4288	932	msedge.exe	116
PID 932 wrote to memory of 2208	932	msedge.exe	117
PID 932 wrote to memory of 2208	932	msedge.exe	117

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000\Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Set.Up.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Set.Up.exe

C:\Users\Admin\AppData\Local\Temp\Set.Up.exe
"C:\Users\Admin\AppData\Local\Temp\Set.Up.exe"
1⤵
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:2512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --profile-directory="Default"
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3924
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd031ec728,0x7ffd031ec734,0x7ffd031ec740
    3⤵
    PID:5620
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1684,i,1581066617667174622,2745893880452193444,262144 --field-trial-handle=2008,i,6349860950994954207,13567011863050235296,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2004 /prefetch:2
    3⤵
    PID:1904
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2188,i,5563199773631593729,2972342467179373445,524288 --field-trial-handle=2008,i,6349860950994954207,13567011863050235296,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2184 /prefetch:11
    3⤵
    - System Time Discovery
    PID:2672
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2456,i,9655835837517265352,5747114110657517996,524288 --field-trial-handle=2008,i,6349860950994954207,13567011863050235296,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2448 /prefetch:13
    3⤵
    PID:5908
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3088,i,569507144053114275,16619799025268016787,2097152 --field-trial-handle=2008,i,6349860950994954207,13567011863050235296,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3156 /prefetch:1
    3⤵
    PID:5916
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3084,i,8953614695386520808,6001937059527504669,2097152 --field-trial-handle=2008,i,6349860950994954207,13567011863050235296,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3136 /prefetch:1
    3⤵
    PID:5880
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4136,i,2322357368919169535,5412292455262302349,2097152 --field-trial-handle=2008,i,6349860950994954207,13567011863050235296,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4156 /prefetch:9
    3⤵
    PID:5696
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4588,i,16981367665477173126,16486205515779655423,2097152 --field-trial-handle=2008,i,6349860950994954207,13567011863050235296,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4648 /prefetch:1
    3⤵
    PID:2572
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4612,i,5218978280002155642,17854060978431474687,524288 --field-trial-handle=2008,i,6349860950994954207,13567011863050235296,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4780 /prefetch:14
    3⤵
    PID:4424
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4944,i,499504317894073143,11632666092078842210,524288 --field-trial-handle=2008,i,6349860950994954207,13567011863050235296,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4952 /prefetch:14
    3⤵
    PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory="Default"
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x308,0x7ffcf436c188,0x7ffcf436c194,0x7ffcf436c1a0
    3⤵
    PID:3836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1604,i,12862199674393251276,2444835584202885482,262144 --field-trial-handle=2176,i,16952693592670346942,7432673822970983345,262144 --variations-seed-version --mojo-platform-channel-handle=2172 /prefetch:2
    3⤵
    PID:3008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1848,i,15846457181606684152,8713749806969772371,524288 --field-trial-handle=2176,i,16952693592670346942,7432673822970983345,262144 --variations-seed-version --mojo-platform-channel-handle=2212 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2464,i,10581795355400857405,382074450835617833,524288 --field-trial-handle=2176,i,16952693592670346942,7432673822970983345,262144 --variations-seed-version --mojo-platform-channel-handle=3184 /prefetch:13
    3⤵
    PID:5020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3492,i,478704728298767120,18216172193894546442,2097152 --field-trial-handle=2176,i,16952693592670346942,7432673822970983345,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
    3⤵
    PID:3908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3496,i,567129286064181883,10861412463970486260,2097152 --field-trial-handle=2176,i,16952693592670346942,7432673822970983345,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
    3⤵
    PID:2036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4092,i,16472676193379941981,4758066207265155924,2097152 --field-trial-handle=2176,i,16952693592670346942,7432673822970983345,262144 --variations-seed-version --mojo-platform-channel-handle=4128 /prefetch:1
    3⤵
    PID:1784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4104,i,12119291975991778882,6538294650489351697,2097152 --field-trial-handle=2176,i,16952693592670346942,7432673822970983345,262144 --variations-seed-version --mojo-platform-channel-handle=2496 /prefetch:9
    3⤵
    PID:4276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4144,i,5854918140220342328,2933914896166847355,2097152 --field-trial-handle=2176,i,16952693592670346942,7432673822970983345,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:1
    3⤵
    PID:1960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4156,i,13450082663367143591,8345554407471896703,2097152 --field-trial-handle=2176,i,16952693592670346942,7432673822970983345,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:9
    3⤵
    PID:5676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5172,i,7046073931194223708,8051362324627046598,524288 --field-trial-handle=2176,i,16952693592670346942,7432673822970983345,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:14
    3⤵
    PID:2496
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5160,i,11810134599734238394,8813400658365923981,524288 --field-trial-handle=2176,i,16952693592670346942,7432673822970983345,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:14
    3⤵
    PID:4396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5244,i,9344202816514117824,13775680236799880774,524288 --field-trial-handle=2176,i,16952693592670346942,7432673822970983345,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:14
    3⤵
    PID:1376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5240,i,7845811459463951542,1519961896033799049,524288 --field-trial-handle=2176,i,16952693592670346942,7432673822970983345,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:14
    3⤵
    PID:1208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6260,i,1903919924101295910,17587730537819793732,524288 --field-trial-handle=2176,i,16952693592670346942,7432673822970983345,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:14
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1128
      4⤵
      PID:3080
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6324,i,6753531283397856768,2928960655903973885,524288 --field-trial-handle=2176,i,16952693592670346942,7432673822970983345,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:14
    3⤵
    PID:5884
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6324,i,6753531283397856768,2928960655903973885,524288 --field-trial-handle=2176,i,16952693592670346942,7432673822970983345,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:14
    3⤵
    PID:1280
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6480,i,6909677138556011090,16283462204626810516,524288 --field-trial-handle=2176,i,16952693592670346942,7432673822970983345,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:14
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=592
      4⤵
      PID:5980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6696,i,15691572478075380473,2975425669573889113,524288 --field-trial-handle=2176,i,16952693592670346942,7432673822970983345,262144 --variations-seed-version --mojo-platform-channel-handle=6724 /prefetch:14
    3⤵
    PID:4288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6860,i,12932959113795546219,4577103696606729906,524288 --field-trial-handle=2176,i,16952693592670346942,7432673822970983345,262144 --variations-seed-version --mojo-platform-channel-handle=6864 /prefetch:14
    3⤵
    PID:2208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6964,i,13793867380798511933,13809586049920839562,524288 --field-trial-handle=2176,i,16952693592670346942,7432673822970983345,262144 --variations-seed-version --mojo-platform-channel-handle=6948 /prefetch:14
    3⤵
    PID:4568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6928,i,15459035450737734133,16270003377000718394,524288 --field-trial-handle=2176,i,16952693592670346942,7432673822970983345,262144 --variations-seed-version --mojo-platform-channel-handle=6912 /prefetch:14
    3⤵
    PID:4400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6876,i,9285216418061324497,16497296785437701595,524288 --field-trial-handle=2176,i,16952693592670346942,7432673822970983345,262144 --variations-seed-version --mojo-platform-channel-handle=7140 /prefetch:14
    3⤵
    PID:1896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory="Default"
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  PID:1596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x34c,0x7ffcf436c188,0x7ffcf436c194,0x7ffcf436c1a0
    3⤵
    PID:5180
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1604,i,3200004408448610654,16174035364560337966,262144 --field-trial-handle=2160,i,2457470011619584559,9860305226812935272,262144 --variations-seed-version --mojo-platform-channel-handle=2156 /prefetch:2
    3⤵
    PID:2760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1888,i,6920465578228230684,5708386759317039106,524288 --field-trial-handle=2160,i,2457470011619584559,9860305226812935272,262144 --variations-seed-version --mojo-platform-channel-handle=2196 /prefetch:11
    3⤵
    - System Time Discovery
    PID:1792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2404,i,9050016746296464573,2669126288133413119,524288 --field-trial-handle=2160,i,2457470011619584559,9860305226812935272,262144 --variations-seed-version --mojo-platform-channel-handle=2984 /prefetch:13
    3⤵
    PID:2392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,7381120817209665157,4919840035118284323,2097152 --field-trial-handle=2160,i,2457470011619584559,9860305226812935272,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
    3⤵
    PID:2252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3484,i,15509115381007601154,7525096142614545891,2097152 --field-trial-handle=2160,i,2457470011619584559,9860305226812935272,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
    3⤵
    PID:1920

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:848

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1608

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3492

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4904

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5752

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 8b9eb4eb075c23b003685416d25b9ef6f1b5a40bb64b42ab6318c23fb9e8e1c3
MD5 1d502d93968858bfbca36c31a0904566
SHA1 6bd4e4a4074b158bc88632a7c264bc9b7f01bb77
SHA512 18c56ec2ba795c39f8c21b3d68b9d95222ebfcf2004057de0ccc283f848ec765a4b07a2d317d66a7c73884470183c06f610f3dcd21289db685945ad2b8d84ceb
SSDEEP 1536:wS5P++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNA:D++J3qUQm08KMWF0bFTcVHr6zf
TLSH
T1A99312B9991E7D39236FC396A0179CAC88D3DCDE151410BC30C65F1E14BB392A31B8E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 cf0266ac99d59d8e7bf7d06daaae58886aa69f3d629c74fbbf7794adfd2219a7
MD5 855c93f4f21d237e49deeb0724f94d4d
SHA1 9ddc8ddc10d3e5b48f893c6a47c2caefbff1140f
SHA512 0ffe3618dda92cf0c32f53b88d8586e4100a7bf6ff98a8c85877c4ffa8b392b45a5f3092f9ce911a0b58f4fa82e09244626a391f4deb58dc0c7adc95b0ed3fe9
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P71:fwUQC5VwBIiElEd2K57P71
TLSH
T151B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 eacd218daf22fcefbc23ae70ce919d8ac95b89c3f7d038f647296c47a218fc46
MD5 35b0754e7f5b0bef0f59e6474c3c9e30
SHA1 a5dbcd61883043544b184e46e47beb3bf5d259a8
SHA512 0a14f00d3bf385bd104004e3adb021fc5b135483b30669a0f446d235f67bf00d734e76a56ac18adc3d6765163a992c78b2c6833f0e764506a9c06ff2ad8fc90e
TLSH
T1ECD0801452F17C64C2E65975484677153D1DD4E346C3537225A3267C4C461881C953C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8648dbe7c6ccfd26bf551adf1fc6e3265815ce5ea5942267fdb3d8494e49ccaf
MD5 0d69a24f0c5199062814f3276a0e0425
SHA1 1689f8b116072314ed6419bdbf045ff11d1d2f1c
SHA512 1609905f1cd06a7538f4d74fe58e56421156a96ae16f40de19041369554941dd25cf283bb0eab1972345de9fc7fa8406d01b16d3ec09b21fe116537aaa21605f
TLSH
T1CDD0A73076D5F009C3751137865191602B5E844225D34090B255815DD45C6BD6BD9686
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0ae60b0b7ee21b60718be49570cae5f45e2d052ce76022466d2b5fabf1e6b2a9
MD5 9e62ca00b1c65888d414cc7154644957
SHA1 42adc17d3751253e873631da4c2eb6dae92c57b2
SHA512 2909bb2cc15b5bade4619539c285ca7278beccd4904438aa659a85a4fe755381856bd549fdcd1681722e5eb96df0b633b892bd98355d3bdd90bea31623c77af0
TLSH
T157D012307699A045C36615378590D2506B5A9492169341913191852DE4187AD66D9686
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4963460798fd1c68c8dee9c6246649bbdc513bd3ac847a574ae2e11d61d3e567
MD5 97f0d93cafafd07725e1ee6cd425e97d
SHA1 c485a5a492d514c80e90fc5f757a18df0d7a57fb
SHA512 b5335994e6f51604b45602a0cf376ca840a2dce8063fd253c07505726c0d62029f7bd9417e2ec3e32ea212f4ff8a569d2494d7a261d574fe95acf681f9aecffa
TLSH
T139D022307A98E004C3621037C890D2502B4A8082128301813190812DD4083AC26C9282
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7173f2853e3b591f142ed047bb6a2ea62d5d817f9016fdd31efbebd88f820e91
MD5 9093390d9e798f9a4ccc25251c10fea5
SHA1 96837bd82509feb4ca69a53466162950148f0394
SHA512 4db01b0d83eba59662ef7f147a96bb0034c92f2c5d5ac83ceeae12ddc800fe8dbce64d41320c2a3031796e981edc605460e3a1da207a6a9d39812740085a86ef
TLSH
T1A7D0801412F17C64C6E65975484577153D1DD4E346C3537325A3267C4C471C81C953C7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.104.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

computed_hashes.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_2\_metadata\computed_hashes.json
Size 429B
SHA256 b829b0df7e3f2391bfba70090eb4ce2ba6a978ccd665eebf1073849bdd4b8fb9
MD5 5d1d9020ccefd76ca661902e0c229087
SHA1 dcf2aa4a1c626ec7ffd9abd284d29b269d78fcb6
SHA512 5f6e72720e64a7ac19f191f0179992745d5136d41dcdc13c5c3c2e35a71eb227570bd47c7b376658ef670b75929abeebd8ef470d1e24b595a11d320ec1479e3c
TLSH
T10AE055170A1A50B79BB8DB90EE525CA2E8A0A6B1C50438D63E608234B68A11F738347D
MD5 SHA1 SHA512 TLSH

Submit Download

verified_contents.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_2\_metadata\verified_contents.json
Size 1KB
SHA256 d23b2ba94ba22bbb681e6362ae5870acd8a3280fa9e7241b86a9e12982968947
MD5 738e757b92939b24cdbbd0efc2601315
SHA1 77058cbafa625aafbea867052136c11ad3332143
SHA512 dca3e12dd5a9f1802db6d11b009fce2b787e79b9f730094367c9f26d1d87af1ea072ff5b10888648fb1231dd83475cf45594bb0c9915b655ee363a3127a5ffc2
TLSH
T12B317466C8683D56267A63348E2D0602EB57C2BB0050640EB5AC558D4F7115FE242FAF
MD5 SHA1 SHA512 TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_2\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 204KB
SHA256 229aaad83499c4b39d5453f09989f0ab1e327502b3adcfe69482759a47445848
MD5 2fd7a2e4ee6664a5a809eaf6439b291e
SHA1 f46da90570c1bb62999801c29f05afcf424dd191
SHA512 1b7e70f3bbb6699d8dee6b77cde8b842916acf589242831c233662e27ba2ab7bebc337d130de6a72e3a78abab27ae5ad93b0e49d5c8c689379a44d149f8bd680
SSDEEP 192:x6WION0+G83uxXBBK31GkSJSGd8EJH7DNspUM:x6WIONa83uFBBQ1GkSjdh7DNspUM
TLSH
T1DF14525F5F353212CD6C803629E644A35DBDF43F8B52768AB8601461CEE3B62646C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 093d9ad2abffc0370b21ba0df7dbf667721934088cb060623c1b4526fde4d324
MD5 64a4c0dc6ce28580e1d0003bee6e28f2
SHA1 0463b5fd0416774f6a3f822b9d1fd5493b53d760
SHA512 e1ef248f08391c2e0af8d2f5d2beb284850e06af05fe5035e2853b440dbd2b9bf590bca326d414b918e7f4899cf005ddca59084d1188cbb89eea43be553c35b2
SSDEEP 192:sxZdQUnTR5yM//K1Ml8M4p/f/sEh+MokmGbzRdpjS/W6+WNBfQ/Y0XBAOdIAIg5R:sxZ1nTbgp/f/sEh+MXmkl+/b6/5T28z
TLSH
T1E872F9066A34597B9CDBD219F9057B53D6F81462D6944E48E9FCCA0C08FA7ED2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 7cbcc8c518e804859643bcafeb3cc0c2bb262dbce235cf245f0f07ecee249b1d
MD5 9459bd8febd70e7311560807b7733562
SHA1 005069fec90c451e698bbcf15de4a698d03585b3
SHA512 bc81cd43b79178be4d98a0bae212ab8c05df3f7382ea6a8ac0b03b1674aa4d87405abf0aca5af5a889193bfadb403d45272d9c84e6dcf3fad975d2d9b98a9dbd
SSDEEP 192:sxZdQUnTR5yM//K1Ml8M4p/f/slh+MokmGbzRdpjS/W6+WNBfQ/Y0XBAOdIAIg4J:sxZ1nTbgp/f/slh+MXmkl+/b6/5T28c
TLSH
T17672F8066A34597B9CDBD219F9057B53D6F81462D6944E48E9FCCA0C08FA7ED2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 0ada1cdd4524b6073487d7100aca066166b109b05638f2b2838749f514cbf3bf
MD5 6e747187d3fc097fbb19a35cca88b9fc
SHA1 e563a4bfb0210eb261bd11eb0e793777ab7b138f
SHA512 536beabac14d42bef8d70e383cdbaf8251873afdb881d4b969364563d07e4d910bdb23aebd1394021fb8428cb2d39b81449c842f3ab5fad82cd68e0c04ea7ad0
SSDEEP 768:7OTTF8J52gF7pLuLnYwWRmY4QPU8F1+UoAYDCx9Tuqh0VfUC9xbog/OV36EmfLlX:7OTTF8J52gTEnYwWRmY4QPUu1jaK6EmV
TLSH
T1F8030D3B2C0CCB7E4F804E9CEC26BE9A6DE8018B9698C99447F9844C03D66EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\10de054d-3f36-44fc-b626-b151e99d30f8\index-dir\the-real-index
Size 72B
SHA256 243c4f69783dd5cf6cea5973414f130aedada49ec632066b1e3331626a3d47e0
MD5 c9c9dd43e5c9aa10e93b9b4ff6309a9b
SHA1 abfda65e4c014d7a8a9a2a81f192c5bad88427f9
SHA512 fb43a8fbbd9866012148d4e3268235563d5ea8f9fadb4fbe6bf3ed21aadfdf3cf12b0472508aa3f847c0ebe39604747f9c704ebaa0d9904ce5869f2c323f4d9f
TLSH
T147A0021B12C56172F1855771607B03407359C830520D431D82B0B97DD8E51A09223468
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe594de7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\10de054d-3f36-44fc-b626-b151e99d30f8\index-dir\the-real-index~RFe594de7.TMP
Size 48B
SHA256 fc4205fb7dfd7f2c17b8290decee746f5d529587206eec8fc1357adb2b36d38b
MD5 da5b743fe849d2d738eb301e4aa9bce1
SHA1 8333dc862080867e96af588d6d3e03c3f84912c5
SHA512 231c9cbfcd4ad714f50c65d745f971cb12c3d4dc0dca73785c5d107be1f05c1579897629ba98108c2774ab1ae5b1a88fb484d3eb46366708b0cb676412d9ef99
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\29f82bdf-5137-47fc-84db-12b63379496e\index-dir\the-real-index
Size 72B
SHA256 8ef4a385611c6d2a5b2293deb4cda55c851e887914ff13172731ce4b6adef3cb
MD5 8a5307d5e9723b679f83eab84cd6e193
SHA1 8e1423ff31d5e3005be0c4fee48802df468a3fd3
SHA512 79e2bb64cccf97b2689258403be841df26b1bc2cc81e3695650e03cdfdb7b60981d87873b9752672eb1176dd58348f97e28fd4668b12c2127cf8259408d9147b
TLSH
T1E1A0023047554481D52107B0558287582719DC155629930F40900559CC591AD5E4E044
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\48166f30-78f6-4da5-98a5-a0ff368b9888\index-dir\the-real-index
Size 2KB
SHA256 035c4e5cf26bdc99eeb4563437ef7ee556bbbe732cde4ef80811008e3ddac3b6
MD5 a3f4e0bd1752b8cd04fe82bac86f6d34
SHA1 7682dfc6e3b8131fc9aedaadf3c6546667479b94
SHA512 3378ebba36bfe5b3156a5db6765da66fb974efb5acc60865ba6e7b70547b689604422f856006c0f4a01df9805276fde10de2f2c694f0b4063b1c35cd88bbe646
TLSH
T15051CA0E5D665F15C975107209771894377498CDBED80A37E8DC89B064472651F6EB11
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe596865.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\48166f30-78f6-4da5-98a5-a0ff368b9888\index-dir\the-real-index~RFe596865.TMP
Size 2KB
SHA256 fbbec08f0588823d2e89b8d05776d12438b4385cccd8254681693ee7ef553728
MD5 32d4784bdd39ac4f184939e3e398daa1
SHA1 11cc4ea63ac6522a1940ebb1771d14eec16b83ff
SHA512 df0789abba47745727246f76acae701234c2ecba443d907dc7ad29043e7bf614e5d676ad5ad2e093dc41e9c3da69ab8c7f6b7d1ad0e892b36e7b1364e9952c8c
TLSH
T1A751C99E9C430A32CDA095B345CA6465333D68555949BF0B35FCCA33ACC77AD3D56344
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\a0feea58-0528-4786-bcab-29a71cde3c37\index-dir\temp-index
Size 72B
SHA256 a2482e1b7510fcd31c67ff560307228ee89dfa78f8153e4b3ccdb4f1a39ddb2f
MD5 b27daa55cd063acb5aa1bdfbd955b5f6
SHA1 934c524854515f76481acc6485f378275ff1d136
SHA512 a1201bdb9ee3774cf65ff83028daac4c08d978756eb1bc50ac4560a7c5c50e829c5e2563eaaae7e9688bd261b1197f0072124097d0ecfb79d5ab70d2bba5cc5f
TLSH
T18AA002504B805443D9031EF425D74385A710D81043125B0F41D10284CC585C99E5204C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe594f01.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\a0feea58-0528-4786-bcab-29a71cde3c37\index-dir\the-real-index~RFe594f01.TMP
Size 72B
SHA256 62fec3a8ae44135719d6d2eed0c94928f198e367a0e4168c042d717686682cba
MD5 4bf65ab6a625fec851e61485d01b888d
SHA1 296865cd7791978fafd8f68ce0398193c3d421fb
SHA512 511074b5b24f9e6571a083ddf0212bb061cfea1360eae51c330cab46e8cd246cea0a37cf5fd73a27110da40bdf3f42858992536e62ddadb9d24d889a691a1445
TLSH
T136A002A423B61806E01315F1257242551340C8201136E2468691005ACD54C54698AD0C
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 476B
SHA256 dd08a303bb6faa4dab83c95bee329a4f1f914a5299a41f19b165754b7edc2f10
MD5 621608728ad4605e44be78449b6e8f43
SHA1 519efe561f9e2b3fcd0df5d83054c3131f47d7c0
SHA512 5d07cc14c971d943c1fa687a1b398012d709e6130ea993de1b32d1d645916834bc21e1612f37d871b8715782f3f25e52a4addf2fe8e7836dd8a6c45ce962c97a
TLSH
T177F027772EFB1924FCABD3D2107158F00565B95AC024EC1E5419738310B1316349ACA6
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 481B
SHA256 37e0c1197a2634ffa0135df60096335b0917c936238405978dc2803a928b97a0
MD5 76122d1151bcd7beb5908a59ba77138d
SHA1 51801e7b6474bf067de5a4c2ac472e807efc4144
SHA512 be1309e89377d7abba59df7f149aae2131acdcc6c14d6d79697eb94977870879794b520cca38a894a656e7c4f657538ea2e49c3c17f131f204f080535669453e
TLSH
T1A6F020773EFB2824FCABE3D2203088F00555BD6AC415ED0E146A738360B2316349ECAA
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log
Size 8KB
SHA256 fb5ac7451de42d96d69c737d0bedf21d3702f89efeb97f75d5ae609e0c6ce9a5
MD5 1720a72bc8ab075bdec288aad630cf43
SHA1 50f72ff7ff7c0207cab11e28ce95bd87d0eccdff
SHA512 2355b24623661eeb791548f99ed11e9ad95b957b8a61b025df3778f72aa1a4adcb05c6be85f5c244fa3c77ab951463bc4f2becd822b97a2490381b85c8222e6c
SSDEEP 96:F1m5HiJp6I2pkAp6Apkpf/vOappXpm+qmpSp2:F1YH6gfDGRH1HXlgg
TLSH
T1B9129BE3CA145053C9C9A6FB2039F5E9542DCA466FFF87A611BC8F6E52412D23328B0C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 03bd25fa71fc714c3028d7d3fc078e5712799fa0fed28eab507386a5569a8ed8
MD5 02d427baa8da4398b5e40a5a58285b43
SHA1 a6e6e6a18d64a2710c0027dedeab338623d75e50
SHA512 ad5703f5c2f3ce1c4ac6fbf6eb8c8f0a639f5795916460c727e8312bf849bc08d697c2f7ec399746e89620bccfe5c19af223dccb4bc40d4e5528a62adcda87c1
TLSH
T155E026910BC8C1FE6296205B132CA749B2F87847E2CB3D062F88D8806142985F1E2680
MD5 SHA1 SHA512 TLSH

Submit Download

ba23d8ecda68de77_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\ba23d8ecda68de77_0
Size 114KB
SHA256 73c0fe06c203a79beb45f79b8201fc5a6c28d1a3a62d7c003e8897a897c04210
MD5 9fd5a4568957da1fee3ed8605a49dae6
SHA1 1d42dce05b89fa2e30494da6f29efb32f6ef0be7
SHA512 7d69e2e177a0d8b22ccf261024ce157a4962fee7912b6acf3860be1ddc72440b0d5326ada3189770008a8252989a733cf3b99cc8d5e66d703f21069232e67ea1
SSDEEP 1536:AO49U3+xPCJWjtG8gEezKL/NuTXTapIcNFxPueLZ2dTLuPzsM:j49K+xPCJWjtG/EezKL/oTXTm1tbZdPn
TLSH
T1BCB3AA32759C50AB0E8ABEA45156B50392BC7467B844E078F21467FC25DBFB013BBEB1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ba23d8ecda68de77_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\ba23d8ecda68de77_1
Size 202KB
SHA256 eaee93f234c9d5a45056f8af3632ff6524f79695953b134102eac8920e83b9d0
MD5 f9a500e0ded0bbcdd846c6fc57bc4dca
SHA1 b9b1110c94edf67454a03c5ac8d6d3df2ef61263
SHA512 e9066114678b82cfd3dc5d24373fc41a7847f7af2880a3bfafae5a5f1988b4535cd9a0d7b51c64808d8b38fa3e010bf7f984420a57788f7d3fe55cac612933ef
SSDEEP 6144:TxOKlg8jhbBoDSgepT+LfxSw1821WyL/yMEAaPrugT5bit5zwdFoa3/PL:c8J0JL/1mvz/j
TLSH
T19B140722230960ABCD1E93FA116B9E1377F44045BFC3E269855193342CAF7E35ADF926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 07a45df8375ea779185a8096ffafec55ddca85ca2630d55f513ddf5cf0eecbde
MD5 c41188a50b7865b95a7be10b581150e5
SHA1 9ed2cabd8eb0c4dc61f0e5811897fb3abb008165
SHA512 adac9d55ef2ae2289589498910abd8f371b36833a76d3092758c36d805a2de9d2b30337fa9281858e8786c5e21b5d6d86f992a4b35d1dc7eac96bf037a82fd2c
TLSH
T11DA002598795D18DC1010270D481029C632098984675261551F40058EA7418C5372104
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59643e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59643e.TMP
Size 72B
SHA256 e378c32db0a06408a8184c59825011efb5e155ce389f0e43d4f127d7881efb72
MD5 edbe26d3d052ef30329b0c34739f00f8
SHA1 18de6bf65263d394d902f1fa645aa363e04f8e95
SHA512 0d4f1dbb478e7bdfd2d2785a8b0b145144de0f26af8ba804640f15de6b2b055056ec60daab07ac633b4f728fd65cef54af89a8f19915fa7834d95b26e4fbb74e
TLSH
T1F7A00296925A9400D40845BDD00526445361986A00056202459090EDFC9D8D05DC2153
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 6077dee3a6e0fe3fdc2deaa930dec0bdf7daaa004821b29ff89e00a82feddaca
MD5 89e18ce5fbb09fdb160a2cd01f3e768b
SHA1 8354766f3d87c9427ea731eae2b56b49eb5f3b81
SHA512 986a7ce7ac7e8e272dbe31448a0bc4a9aebe71b44e6474d4c90374182038c2589a79259c12332beee6f6361dd752933b32e215e4fb1503c519543ce268d6f5a4
TLSH
T14BE0D8611BC9C2AB63C6209F631CF749A1B27842E6DB29152B0CA4806206580B293640
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 c34ea679dad2c8d7238562eb96cbceb8355a521425d0922124a782682b020e21
MD5 e385737f98b4b0e5bb0fbcb5c325da02
SHA1 cd09d4099fa0793d329a8379a355238a84d5af48
SHA512 053ba2636741e97be2cc87a248c2235e299a58f2088d1d83fc587ce671dd38cbc045b8e9bd6701002e383ff6faec5ea6f69688bba6f47913ff5ca2641dbc4754
TLSH
T119E07DF245C8C2FB50887097436CAB5E93F8BC07E3CB3A02970C5488B5017D1B2E65C0
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 8KB
SHA256 ffc445a96f9b95232126dd332f473ac19dfc17383aa7d5ab735113c8629aa77f
MD5 2c4b3699912a6016a218a1cfe4029924
SHA1 cf9afd92814c2124eb5f49b6fa992c1606bb4af7
SHA512 4f7eb65079a41aa3ab38462d06c4050d617cc6786dc4c467b290cef78db1dd3b71b1c7a63b2fac540fb8a059f1ef467aac810240116aa62dbdac7686cfdf711e
SSDEEP 96:KwzeKc4m6sQK5KSvYp8oamqgGurzQQgKo1QSgsgQby7KIKTCi+DaK4AHnCKw8u1:YFP3JXvddh1
TLSH
T177022F11317753803ABD2D8A95A5B4AB138270A33054B86B7BF850AE0F27E54DDFE9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

QuotaManager-journal

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager-journal
Size 12KB
SHA256 f65c5541778afdfe7021cefa81d6bb69813cddcec7049233aa4eb8a1b2c88810
MD5 68b01602862afa3f8035feec6c54a166
SHA1 5213f15d1f21a68e704d0b1d1e7d616f697d2cd0
SHA512 62faf7708bd6c5083b6d938e5f9330e23aab99e5d6ebda227f00ea41b231e36ed2c4560deb3132ca9ce3630ec78d9b5d1ad5493e174fe4faff2f905ae56cf05e
SSDEEP 3:9lllNllv/etXlGzth8lpoll1qvTv4RRftD0td7jdtQfQertbCh8lkvWXtXlGzt+n:9MlG/8TolrpR0tdndZ8wClGsn
TLSH
T1A74280FF7EC4C0D0C471047C864AEBB412E7440D55447F480019114B1457B21F934D41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

load_statistics.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db
Size 116KB
SHA256 464b1856b860f7aa704bbb099d0742979488be457cd7e0442c8ddda6888ded6e
MD5 3b7b2f516285043340f591aaf6b8a1ef
SHA1 85d66641660f63bfe0ddae8c92229b60cd5c4954
SHA512 b1e24f997a2faba4239d1cd950d2ae08b0c2c99b47e1e831e8fb1d2aa7fb9d282137252138a8ece980664894239b411412a344570e084f63bd26a2b11e89e720
SSDEEP 1536:dvnlW4iZ8u6L/4heSQDooT3tuBp9uwMbqzu8Ln811gdezMJqvIFG4cW:d/c47jEeSQDHq2aD
TLSH
T193C325FB6D0990A7CECE95B4D90BEE0441B346268A24DCE5A93C48C3777DB023D769C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

load_statistics.db-wal

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal
Size 3.9MB
SHA256 d65c416e8b60426889f50e943ba70f14cee8098c7ab217b2b00d79834442a8ce
MD5 0303a3c69dc764e059176095eee54a35
SHA1 38bb5b5b87fadc44c0c91462d5262aab338e19a3
SHA512 ae2e989abdf2d0aae847449ff5ce5697840977bc7839d76c491d92518500b2e9ea1ff5b844fafe4214b89b44d2ef337c3239fe4b1ee46814c72fb1200d969779
SSDEEP 24576:IRDnciepobiNMeRDnciepobiNMwRDnciepobiNMjRDnciepobiNM9RDnciepobiQ:edTXj+HsDSO
TLSH
T1B41679FB7D1941AECACF85B4CA0BEE1881B346294D34C9E5693D44C37778B023E76989
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 12KB
SHA256 14df24897fe727fc3eac345b125afe157b23288f8d1dc1efb24f82d5e0002e1e
MD5 f783413cc910b5b6c1acf6fb2378feb7
SHA1 1fa6ad64648d2553aeafb47299e2238d9c897384
SHA512 c8a5e4e311c8f54362e414d40de0dafe77b515a7c8d2482010f0bd5c8ad350957a8467981cd7b7c094e8613923de9f19b4ffed8aa14b28d430cb6421c9fcbfb9
SSDEEP 192:6dQvIIIebOMIMUbZYcYMO+zAsYlrqDQ2snQ:YQvIIIebOMIMeBK+Msav2s
TLSH
T109425E6E2B592F37C24F5F769656C6901BD898824C70362D31212C1F8DF3AA787C22F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 319B
SHA256 e2fc99bd5879ebf71859c195088f282bc6cb4199b3c4ced3ba0a6bc427b2517a
MD5 bc2f6a19c8370e52761908c5e2e1b9a8
SHA1 fddd5e3d5dbfbc94caa34764b653e1ff0fcf9cfc
SHA512 7bae9e5fca3ece5c0d609194ae382e396b648a22c36478c3c7daf496b12dad49bfa70af21aa2158c869c099dc83dd2c73fa5a56854264740227633ecee6541f6
TLSH
T1B5E026D4E8C9C1AFA05AA09F022D578EE3A03C03FAFA3D061F08E494A101981F3C6181
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 1c48c53004c076e3a4a3bcc7568129496140fd196870a61db51633a66fd123f7
MD5 912e0c62bb3a7e96c44190ca25d3f975
SHA1 e70bfed8daa303278c18f4a81b7390e10b0205c8
SHA512 d4a038672ad930af0a20f8375a3d09367f983d8a63c41903ecb9dc2fb651279c6ef68e934c26922c9955a25fc76d7a28e3a634ab5435bb459983edbfc360d9a7
TLSH
T149214C51F330C15DD2094B3A653EBB2A1334C5579FB8FD1F44B560246EB3A051D8B2E9
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 337B
SHA256 603586c5a36a82b6f0919bd8bf91adda804a6277bbe4accf7fd2242bdff199b5
MD5 7d6d1f7fbac9f8ffe3e760685954bc07
SHA1 f95b5a9cddb0e3dc78a2528bbfbb22d8b20d5937
SHA512 e015a0e8f38e804e0ed18d073456f1af8350f4f5ec6f83d0762767123db525a7081ed868178bae2c0013757a468d1f581c07984d58b2c780ede52e785094392d
TLSH
T1F2E02694ECCAC1EF905160AB027DA7C9E2A13C03FBFA3E021F08CD84A101582F3CA5C1
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 73d6003f35d0cf0afd5845561c3ef1fc100f0c3c639947e3f7bb1cd244f7d47d
MD5 0e3676589763d14dfc0e598dac8dcc2e
SHA1 76be62fb56427d5945de473711ac3bb16ae5f5e6
SHA512 6d809c40e583ff1e28a7add1822e515ee7a58e4537da3add06780d63cf3d8db8c96bdb88066631431bd565c07a7f95c2b19f238a34dbd8eaf3a6569c55366ad7
SSDEEP 192:zGNg6IMGZQmiUz+Rbxc/TtTbH7S663q9U6:zGNg6G3obxc/TtT6CU6
TLSH
T192122B3278786C6B5EE3A950F48336279E644167E7C92F94D5DC2B1C05EF2AC130F952
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 fde0b088c78058b4761118c8080b3d09317fef4eaee8aa70426b6d8a31ac30cd
MD5 e72b16dca79adc2f8a14cd9459cae83a
SHA1 6a3ad6104e853071da089f70ac81f826c83a2988
SHA512 fe30a6722bc146fbe97583c053b79da473ff2ff30d8203436e10efbb287321766c8436e9e9d07df168542a12c4f6d8594d101663bf88de9616d63b0608f7e309
SSDEEP 192:lGNt6IMGEQmiUyYTR6xc/TtgSepKFRAU6:lGNt6GUL16xc/Tt4bU6
TLSH
T12502F93578787CBB9EF36E45B08737276F94116BE6A52F88C9E81B1D00DB69C1307822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 67c2ad5d3a3fe5d7624d51b4bd38dd304353836af1171dd53538bb0a876e8b92
MD5 503fa08df9403ca63cedab6fa07ad7b7
SHA1 2b94b307e5056f68636d9255c4569ec2d7f64d77
SHA512 decc24240177146fdd6f753f570a55b328c71f16b54b62050c1e1d215cda339f3882060e834c8b5129c88dfcdbe4624b2313f14a67d498af15012750a5d2b6e0
SSDEEP 384:nbjccCs+Bt0S3v8Nt5TmlFCZkc/TtTWClnxf3W:3ccQP/eKc/cClntW
TLSH
T127826C3268B55C6BA9E39558F0873713AF7085A767C42FA988DD9B0C01EF2EC070B956
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 cacf3723fdc0ca15695637f264633101c06d0d05d3f739082ecf7d34d9d0394f
MD5 5273ee9e4848ab0e5eb143ff409309b2
SHA1 95b233e1e454d55bd35c8a2bd7fa81d8eedfdbad
SHA512 6f85f374f682a18854d1af64f0107ae5c0cd4eb5b0e17ca5983cf2c8031e923f48b04cc88bf1704659b0b8d6072ee0befb095c4522d4f0fc7ab62b9ffd6d0dd7
SSDEEP 384:nbjccCs+Bt0S3v8NCU5TmlFYZkc/TtTq5jlnNf3+:3ccQPPUKc/+jln5+
TLSH
T12B926B3268B06C6BA9E39558F4873313AF70816767C42FA988CD9B1D01EF2EC130B566
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

campaign_history

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history
Size 20KB
SHA256 1b11940c6d00651fda509d487bf2d77bc3e8b66f2f0fd91815d298d7a37204aa
MD5 4dfb24be628f74b8a9a592244f12cbee
SHA1 5d7be7ca89e4c015aa1f56364b2fd4bc7a8ab185
SHA512 0e14a5b6f7a9e7a532874bd7f9e010350e013173f886634a9844858f022c6581a907b3a5bf9fc173399a710c6a21fbabe438262d51f6a910cb4a3d73bff508a7
SSDEEP 12:TLpOPFUxOUDaaWZXiDiIF8izX4fhhdWeci2oesJa/Si3isOmQQtudT+3zQdTVzcs:TL85UOl0afDdWec9sJ3+O2EGDB5fc
TLSH
T13092A222B9352063D8DF1B76B95349E10DFD126F89A7B804DDD04D6109A2BC1A6551F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 3dc9043838386f5363ac96a01477cf3163b5118b80191576a11b32ce9894314c
MD5 cdddc745a8c954dc438c931889999bdb
SHA1 7908f975b6815460caa2bc3438efbd8fc8d36211
SHA512 3d2d4852aa2ac6cb0b9b6cbca9f04366afd48d362d869be877ef324c16d72ff119b5842891baa2b6b99df2de2db8d3be5c23f0f97f8943bd74195996bcb66a0a
TLSH
T159A02407C473C00FF4144051C45C034114F4C047011DD0115070D33714D40CF03F5C35
MD5 SHA1 SHA512 TLSH

Submit Download

b339ebcf-3b56-4873-934e-79da0c1a8ce6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\b339ebcf-3b56-4873-934e-79da0c1a8ce6.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

7394ad54-5d02-473b-8fe7-21356bb62ca1.tmp

Path C:\Users\Admin\AppData\Local\Temp\7394ad54-5d02-473b-8fe7-21356bb62ca1.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

8534c5b0-0346-49bd-a1f2-c2bf8bc1dfbb.tmp

Path C:\Users\Admin\AppData\Local\Temp\8534c5b0-0346-49bd-a1f2-c2bf8bc1dfbb.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f81a440c-2cb3-40f7-a8c0-a695b802a728.tmp

Path C:\Users\Admin\AppData\Local\Temp\f81a440c-2cb3-40f7-a8c0-a695b802a728.tmp
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir932_1924087301\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/848-44-0x000001E338240000-0x000001E33829D000-memory.dmp

Download

memory/1280-1159-0x0000016ED3C40000-0x0000016ED3C9D000-memory.dmp

Download

memory/1608-58-0x0000015DA9A70000-0x0000015DA9ACD000-memory.dmp

Download

memory/2512-15-0x0000000140000000-0x00000001400FE000-memory.dmp

Download

memory/2512-14-0x000001676D5D0000-0x000001676D5DC000-memory.dmp

Download

memory/2512-0-0x0000000140000000-0x00000001400FE000-memory.dmp

Download

memory/2512-13-0x000001676D4E0000-0x000001676D53D000-memory.dmp

Download

memory/2512-1-0x0000000140000000-0x00000001400FE000-memory.dmp

Download

memory/2512-1389-0x0000000140000000-0x00000001400FE000-memory.dmp

Download

memory/2512-1403-0x0000000140000000-0x00000001400FE000-memory.dmp

Download

memory/2512-1402-0x000001676D5D0000-0x000001676D5DC000-memory.dmp

Download

memory/2512-1401-0x000001676D4E0000-0x000001676D53D000-memory.dmp

Download

memory/3080-375-0x0000016CC0CE0000-0x0000016CC0D3D000-memory.dmp

Download

memory/5980-381-0x00000169DA190000-0x00000169DA1ED000-memory.dmp

Download