vidar | 605096b9729bd8eedab460dbd4baf702029fb59842020a27fc0f99fd2ef63040

Analysis

max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/05/2026, 04:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
virtnetwork.exe
Size 2.0MB
Sample260502-e3cckacz5k
SHA256 605096b9729bd8eedab460dbd4baf702029fb59842020a27fc0f99fd2ef63040
MD5 814d37f89ce49383a2022b9dcca637aa
SHA1 eb44914a6a8e2b603d4c73ca7855da52cb8fc93c
SHA512 54f25578c294668b4e35311219343217d7856d0a6b61ed16f622c5341798cc156445b941bd3189050c5fa9a12fe6b2f420f894cd80ca40b0e7d9cd57d60f5967
SSDEEP 24576:jqimp6QNXqsD2xTYvmrC8/InJgS8nJgtKlR7dxEpk:jqimv9qS2dY+rC/snJ6src
TLSH
T1CC957D3AB71482F2E64B81346A05A78383BB7C7A371170FAA17E12D41E5597A137E7F0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection defense_evasion discovery vidar spyware stealer trojan

Malware Config

Signatures

Family: Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Detects Vidar Stealer 2 IoCs

stealer

resource	yara_rule
behavioral1/memory/1556-5-0x0000000140000000-0x0000000140104000-memory.dmp	family_vidar_v15
behavioral1/memory/1556-1475-0x0000000140000000-0x0000000140104000-memory.dmp	family_vidar_v15

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 4 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	virtnetwork.exe
Key opened	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	virtnetwork.exe
Key opened	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	virtnetwork.exe
Key opened	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	virtnetwork.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1984	chrome.exe
4904	msedge.exe
2340	msedge.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	virtnetwork.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	virtnetwork.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134221697560128394"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-312252282-3884318443-358092420-1000\{88EBCC73-6479-487D-9791-D7B7CF662120}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Modifies system certificate store 2 TTPs 2 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\47BEABC922EAE80E78783462A79F45C254FDE68B	virtnetwork.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\47BEABC922EAE80E78783462A79F45C254FDE68B\Blob = 5c0000000100000004000000000800000f00000001000000200000003560e45b41e46b8f36537025d1d5bc02d9652a10645b0eff69e8b6a52191f335090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080b000000010000005200000047006f00200044006100640064007900200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790020001320200047003200000053000000010000002500000030233021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c062000000010000002000000045140b3247eb9cc8c5b4f0d7b53091f73292089e6e5a63e2749dd3aca9198eda1400000001000000140000003a9a8507106728b6eff6bd05416e20c194da0fde1d000000010000001000000070253fbcbde32a014d38c1993098ad997f000000010000000c000000300a06082b060105050703037e00000001000000080000000000e4add325dc0103000000010000001400000047beabc922eae80e78783462a79f45c254fde68b19000000010000001000000021d008b47b7a2a81c8435903ded424c92000000001000000c9030000308203c5308202ada003020102020100300d06092a864886f70d01010b0500308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bf716208f1fa5934f71bc918a3f7804958e9228313a6c52043013b84f1e685499f27eaf6841b4ea0b4db7098c73201b1053e074eeef4fa4f2f593022e7ab19566be28007fcf316758039517be5f935b6744ea98d8213e4b63fa90383faa2be8a156a7fde0bc3b6191405caeac3a804943b467c320df3006622c88d696d368c1118b7d3b21c60b438fa028cced3dd4607de0a3eeb5d7cc87cfbb02b53a4926269512505611a44818c2ca9439623dfac3a819a0e29c51ca9e95d1eb69e9e300a39cef18880fb4b5dcc32ec85624325340256270191b43b702a3f6eb1e89c88017d9fd4f9db536d609dbf2ce758abb85f46fccec41b033c09eb49315c6946b3e0470203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604143a9a8507106728b6eff6bd05416e20c194da0fde300d06092a864886f70d01010b0500038201010099db5d79d5f99759670361f17e3b0631752da1208e4f6587b4f7a69cbcd8e92fd0db5aeecf748c73b43842da057bf80275b8fda5b1d7aef6d7de13cb53107e8a46d197fab72e2b11ab90b02780f9e89f5ae9379fabe4df6cb385179d3dd9244f799135d65f04eb8083ab9a022db510f4d890c7047340ed7225a0a99fec9eab68129957c68f123a09a4bd44fd061537c19be432a3ed38e8d864f32c7e14fc02ea9fcdff076817db2290382d7a8dd154f169e35f33ca7a3d7b0ae3ca7f5f39e5e275bac5761833ce2cf02f4cadf7b1e7ce4fa8c49b4a5406c57f7dd5080fe21cfe7e17b8ac5ef6d416b243090c4df6a76bb4998465ca7a88e2e244be5cf7ea1cf5	virtnetwork.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1556	virtnetwork.exe
1556	virtnetwork.exe
1556	virtnetwork.exe
1556	virtnetwork.exe
1556	virtnetwork.exe
1556	virtnetwork.exe
1556	virtnetwork.exe
1556	virtnetwork.exe
1556	virtnetwork.exe
1556	virtnetwork.exe
1556	virtnetwork.exe
1556	virtnetwork.exe
1556	virtnetwork.exe
1556	virtnetwork.exe
1556	virtnetwork.exe
1556	virtnetwork.exe
1556	virtnetwork.exe
1556	virtnetwork.exe
1556	virtnetwork.exe
1556	virtnetwork.exe
1556	virtnetwork.exe
1556	virtnetwork.exe
1556	virtnetwork.exe
1556	virtnetwork.exe
1556	virtnetwork.exe
1556	virtnetwork.exe
1556	virtnetwork.exe
1556	virtnetwork.exe
1556	virtnetwork.exe
1556	virtnetwork.exe
1556	virtnetwork.exe
1300	chrome.exe
1300	chrome.exe
1556	virtnetwork.exe
1556	virtnetwork.exe
1556	virtnetwork.exe
1556	virtnetwork.exe
1556	virtnetwork.exe
1556	virtnetwork.exe
1556	virtnetwork.exe
1556	virtnetwork.exe
1556	virtnetwork.exe
1556	virtnetwork.exe
1556	virtnetwork.exe
1556	virtnetwork.exe
1556	virtnetwork.exe
1556	virtnetwork.exe
1556	virtnetwork.exe
1556	virtnetwork.exe
1556	virtnetwork.exe
1556	virtnetwork.exe
1556	virtnetwork.exe
1556	virtnetwork.exe
1556	virtnetwork.exe
1556	virtnetwork.exe
1556	virtnetwork.exe
1556	virtnetwork.exe
1556	virtnetwork.exe
1556	virtnetwork.exe
1556	virtnetwork.exe
1556	virtnetwork.exe
1556	virtnetwork.exe
1556	virtnetwork.exe
1556	virtnetwork.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4780	msedge.exe
4780	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1300	chrome.exe
Token: SeCreatePagefilePrivilege	1300	chrome.exe

Suspicious use of FindShellTrayWindow 37 IoCs

pid	Process
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
4812	msedge.exe
4812	msedge.exe
4780	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1556 wrote to memory of 1300	1556	virtnetwork.exe	93
PID 1300 wrote to memory of 332	1300	chrome.exe	94
PID 1556 wrote to memory of 1300	1556	virtnetwork.exe	93
PID 1300 wrote to memory of 1984	1300	chrome.exe	95
PID 1300 wrote to memory of 4036	1300	chrome.exe	96
PID 1300 wrote to memory of 4036	1300	chrome.exe	96
PID 1300 wrote to memory of 2692	1300	chrome.exe	98
PID 1300 wrote to memory of 2692	1300	chrome.exe	98
PID 1300 wrote to memory of 4212	1300	chrome.exe	100
PID 1300 wrote to memory of 4212	1300	chrome.exe	100
PID 1300 wrote to memory of 2428	1300	chrome.exe	99
PID 1300 wrote to memory of 2428	1300	chrome.exe	99
PID 1300 wrote to memory of 3000	1300	chrome.exe	101
PID 1300 wrote to memory of 3000	1300	chrome.exe	101
PID 1300 wrote to memory of 3112	1300	chrome.exe	102
PID 1300 wrote to memory of 3112	1300	chrome.exe	102
PID 1556 wrote to memory of 4812	1556	virtnetwork.exe	104
PID 4812 wrote to memory of 3380	4812	msedge.exe	105
PID 1556 wrote to memory of 4812	1556	virtnetwork.exe	104
PID 4812 wrote to memory of 3768	4812	msedge.exe	106
PID 4812 wrote to memory of 4904	4812	msedge.exe	107
PID 4812 wrote to memory of 3768	4812	msedge.exe	106
PID 4812 wrote to memory of 3768	4812	msedge.exe	106
PID 4812 wrote to memory of 1812	4812	msedge.exe	109
PID 4812 wrote to memory of 1812	4812	msedge.exe	109
PID 4812 wrote to memory of 2320	4812	msedge.exe	110
PID 4812 wrote to memory of 4876	4812	msedge.exe	111
PID 4812 wrote to memory of 2320	4812	msedge.exe	110
PID 4812 wrote to memory of 2320	4812	msedge.exe	110
PID 4812 wrote to memory of 4876	4812	msedge.exe	111
PID 4812 wrote to memory of 4876	4812	msedge.exe	111
PID 4812 wrote to memory of 4940	4812	msedge.exe	112
PID 4812 wrote to memory of 1104	4812	msedge.exe	113
PID 4812 wrote to memory of 4940	4812	msedge.exe	112
PID 4812 wrote to memory of 4940	4812	msedge.exe	112
PID 4812 wrote to memory of 1104	4812	msedge.exe	113
PID 4812 wrote to memory of 1104	4812	msedge.exe	113
PID 4812 wrote to memory of 2188	4812	msedge.exe	116
PID 4812 wrote to memory of 2188	4812	msedge.exe	116
PID 4812 wrote to memory of 4408	4812	msedge.exe	117
PID 4812 wrote to memory of 4408	4812	msedge.exe	117
PID 4812 wrote to memory of 4008	4812	msedge.exe	118
PID 4812 wrote to memory of 3596	4812	msedge.exe	119
PID 4812 wrote to memory of 4008	4812	msedge.exe	118
PID 4812 wrote to memory of 3596	4812	msedge.exe	119
PID 4812 wrote to memory of 4624	4812	msedge.exe	121
PID 4812 wrote to memory of 4156	4812	msedge.exe	122
PID 4812 wrote to memory of 4156	4812	msedge.exe	122
PID 4812 wrote to memory of 4544	4812	msedge.exe	123
PID 4812 wrote to memory of 4544	4812	msedge.exe	123
PID 4812 wrote to memory of 3528	4812	msedge.exe	124
PID 4812 wrote to memory of 3528	4812	msedge.exe	124
PID 4812 wrote to memory of 1756	4812	msedge.exe	125
PID 4812 wrote to memory of 1756	4812	msedge.exe	125
PID 4812 wrote to memory of 3496	4812	msedge.exe	126
PID 4812 wrote to memory of 3496	4812	msedge.exe	126
PID 1556 wrote to memory of 4780	1556	virtnetwork.exe	128
PID 4780 wrote to memory of 3404	4780	msedge.exe	129
PID 1556 wrote to memory of 4780	1556	virtnetwork.exe	128
PID 4780 wrote to memory of 2340	4780	msedge.exe	131
PID 4780 wrote to memory of 1380	4780	msedge.exe	132
PID 4780 wrote to memory of 1380	4780	msedge.exe	132
PID 4780 wrote to memory of 1380	4780	msedge.exe	132
PID 4780 wrote to memory of 4708	4780	msedge.exe	133

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	virtnetwork.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	virtnetwork.exe

C:\Users\Admin\AppData\Local\Temp\virtnetwork.exe
"C:\Users\Admin\AppData\Local\Temp\virtnetwork.exe"
1⤵
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:1556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --profile-directory="Default"
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1300
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffef70ac728,0x7ffef70ac734,0x7ffef70ac740
    3⤵
    PID:332
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1912,i,5567458501595302740,532826102810079872,524288 --field-trial-handle=1976,i,9931959935850710024,1865352287580902986,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2088 /prefetch:3
    3⤵
    - System Time Discovery
    PID:1984
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1752,i,5855960667416476396,8892142111046430203,262144 --field-trial-handle=1976,i,9931959935850710024,1865352287580902986,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=1972 /prefetch:2
    3⤵
    PID:4036
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2392,i,13942178871090366965,6565377467244549807,524288 --field-trial-handle=1976,i,9931959935850710024,1865352287580902986,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2556 /prefetch:8
    3⤵
    PID:2692
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3160,i,9262801756318225396,12100178882124687155,2097152 --field-trial-handle=1976,i,9931959935850710024,1865352287580902986,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3184 /prefetch:1
    3⤵
    PID:2428
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3176,i,7118871157444967626,8685339197431054225,2097152 --field-trial-handle=1976,i,9931959935850710024,1865352287580902986,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3200 /prefetch:1
    3⤵
    PID:4212
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4248,i,15172073409562953854,16441773727519453170,2097152 --field-trial-handle=1976,i,9931959935850710024,1865352287580902986,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4272 /prefetch:2
    3⤵
    PID:3000
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4452,i,1851228379786669794,5389473699402624023,2097152 --field-trial-handle=1976,i,9931959935850710024,1865352287580902986,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4632 /prefetch:1
    3⤵
    PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory="Default"
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4812
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c8,0x2cc,0x2d0,0x2c4,0x29c,0x7ffef708c188,0x7ffef708c194,0x7ffef708c1a0
    3⤵
    PID:3380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1668,i,9558628313711351808,9272411137643005456,262144 --field-trial-handle=2288,i,4306102734129854068,5544954743969283557,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:2
    3⤵
    PID:3768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1868,i,10642041316354022862,7328786120297738678,524288 --field-trial-handle=2288,i,4306102734129854068,5544954743969283557,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:3
    3⤵
    - System Time Discovery
    PID:4904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2624,i,13858512350511573860,7520626258901790948,524288 --field-trial-handle=2288,i,4306102734129854068,5544954743969283557,262144 --variations-seed-version --mojo-platform-channel-handle=2660 /prefetch:8
    3⤵
    PID:1812
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,8570863288156411473,8591439882300083629,2097152 --field-trial-handle=2288,i,4306102734129854068,5544954743969283557,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
    3⤵
    PID:2320
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,4428753943904089855,2039079858518853931,2097152 --field-trial-handle=2288,i,4306102734129854068,5544954743969283557,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
    3⤵
    PID:4876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4144,i,17100822833971597720,4599530105546009568,2097152 --field-trial-handle=2288,i,4306102734129854068,5544954743969283557,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:1
    3⤵
    PID:4940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4164,i,858434957234145970,11585610618668353088,2097152 --field-trial-handle=2288,i,4306102734129854068,5544954743969283557,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:2
    3⤵
    PID:1104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5024,i,15648048231749132253,17751957677357780368,524288 --field-trial-handle=2288,i,4306102734129854068,5544954743969283557,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:8
    3⤵
    PID:2188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5044,i,10584263308094948153,9886109618130667077,524288 --field-trial-handle=2288,i,4306102734129854068,5544954743969283557,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
    3⤵
    PID:4408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5076,i,13014128974027543202,7180927830070019196,524288 --field-trial-handle=2288,i,4306102734129854068,5544954743969283557,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:8
    3⤵
    PID:4008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5088,i,7597888056871078019,2373067951521003273,524288 --field-trial-handle=2288,i,4306102734129854068,5544954743969283557,262144 --variations-seed-version --mojo-platform-channel-handle=1596 /prefetch:8
    3⤵
    PID:3596
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,11236773032421964782,16956911770657526182,524288 --field-trial-handle=2288,i,4306102734129854068,5544954743969283557,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:8
    3⤵
    PID:1656
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,11236773032421964782,16956911770657526182,524288 --field-trial-handle=2288,i,4306102734129854068,5544954743969283557,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:8
    3⤵
    PID:4624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6292,i,17028964160698056137,14478659178249295143,524288 --field-trial-handle=2288,i,4306102734129854068,5544954743969283557,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:8
    3⤵
    PID:4156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6264,i,15356463961650501118,3205302881753834559,524288 --field-trial-handle=2288,i,4306102734129854068,5544954743969283557,262144 --variations-seed-version --mojo-platform-channel-handle=6456 /prefetch:8
    3⤵
    PID:4544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6404,i,16475809538894424900,2723079401527016043,524288 --field-trial-handle=2288,i,4306102734129854068,5544954743969283557,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:8
    3⤵
    PID:3528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6600,i,17567020847533614603,15710979068280186867,524288 --field-trial-handle=2288,i,4306102734129854068,5544954743969283557,262144 --variations-seed-version --mojo-platform-channel-handle=6592 /prefetch:8
    3⤵
    PID:1756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6940,i,18134627655748682117,13413749889290057408,524288 --field-trial-handle=2288,i,4306102734129854068,5544954743969283557,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:8
    3⤵
    PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory="Default"
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x340,0x7ffef831c188,0x7ffef831c194,0x7ffef831c1a0
    3⤵
    PID:3404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1976,i,8004464198239710325,5579883989575718821,524288 --field-trial-handle=2408,i,13027403055950196526,14025513841542286735,262144 --variations-seed-version --mojo-platform-channel-handle=2460 /prefetch:3
    3⤵
    - System Time Discovery
    PID:2340
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1764,i,18258101077498572520,8679891590977785194,262144 --field-trial-handle=2408,i,13027403055950196526,14025513841542286735,262144 --variations-seed-version --mojo-platform-channel-handle=2404 /prefetch:2
    3⤵
    PID:1380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2612,i,3238227597304480292,12874985572828480683,524288 --field-trial-handle=2408,i,13027403055950196526,14025513841542286735,262144 --variations-seed-version --mojo-platform-channel-handle=2772 /prefetch:8
    3⤵
    PID:4708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,9179696359234956654,7800408892597158258,2097152 --field-trial-handle=2408,i,13027403055950196526,14025513841542286735,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
    3⤵
    PID:3848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,1557692479335203448,11300222464686500416,2097152 --field-trial-handle=2408,i,13027403055950196526,14025513841542286735,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
    3⤵
    PID:4228

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:748

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4956

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:176

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4740

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:808

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 89KB
SHA256 ebb497e23d65003fdcefdd76e02cf64389f2c3a411aa4026299e841af3a3fbf7
MD5 7545b1af841d652b964696902f4f5df1
SHA1 0d3d6a1e24714a9fcbc6ccad04886a9a9f218d73
SHA512 bb1c30edb3b385021ae74f51c74835c0db2ee6a3146885b5978f8337173e0ca3f7c771ba59288449c0972956a726b4611eb9a2d84dbc96fe35dc7836401fb3f9
SSDEEP 1536:ip/KXcRcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jH:a93Qw/xLANk0mUW5GmRntSFCjEENL
TLSH
T1389312BA4E2646E7997D4A8176AD7909CE12534D705FA9CC325CA38C61D02CC2F72F73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 44e9a43c63982734361d58f6dbb1502c3d740628b05ab5bec57406bde04add60
MD5 723a748e44caadd71195ffe4e217722d
SHA1 7c7f1c75f1efbe6ba044a556d11f863c98b2acda
SHA512 44b8b021f13d2c8587120e726b58a313a8c6936ade23d6930d74e692ecbb5ad90bf9aaefec94e7110419575515c29551e0ec9551d3e4937f1f999d88b062c3f8
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7L:fwUQC5VwBIiElEd2K57P7L
TLSH
T16BB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6b65e3f6d57bee85b90392c47f2236ea7ffcfe9cba07ca29930764c7dacc0ea2
MD5 726476576ad538c648305e214c389ece
SHA1 03960d925aa07a6736b28a431ddf422fa8bba04d
SHA512 7b99250e71a507574a7ea1c326ff4f687cffd7e1a0eb1ba5aa847f5b5e0c5d997dbef37ede7c2815a11e03b25f291a4f19173dd0aa9d22472d224e9b1d6349a5
TLSH
T11ED0808995F15C35D5D78CF1154B37067915C577DF42932374633C3C8C435D19546283
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d084fddc35d62ab10457432373865714cd0577ad9bebe9188135998b9f802bd3
MD5 ff587c8337b9997eb40f19fb41bffd1a
SHA1 75e9be1412e32cbe6e960e041e872bbb48ab464e
SHA512 d50cc729f4f047045aba003643fd356cb1ac85c1d90f9ed992f787f682a862005a91103e9e388ad5cbd4f884c2668a35a0e5a0d011d0684ef2d6bc59a10b1701
TLSH
T15ED08089D5B15C35D1D78CF1154B37067915C577DF42532274633C3C8C435919546283
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 90683947ca9dc7e152aac9078e0a08fa38c107818c74ba4adcfaf6a2722c26ac
MD5 a34d0db9a1369d24b467966bd8be94ba
SHA1 12b76879a9ec71944f4ccf1397b7443c26708635
SHA512 954405fb5277fbd9eb84f02236f6026a0dcd7a137428b38c606554278942dbb1efc4e8608581d9b7c3dcf4f2d7c340894ea99d0544c667129b703b8975514cf3
TLSH
T1C9D0A772E6999006D1960CF2115342912646819ABA8B8181F116840D8CA5A69A3D7242
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 411d0f87053c712a48c59e7655358ce1413482d81379e67903593ee7c0aff96e
MD5 b5ac1958a5d22a17691182592ff9da71
SHA1 0b5458f07be66f3432eb1377d7bb5cac091496b0
SHA512 07ab0c057412d8befeff73b53b4e42ccbfa037d0dadbaef05c3bc35b83cb860c92e8cb2f472d257d9ce7b458bdfd1d4bfc9ede392baaa034dcfa666185b3910f
TLSH
T131D08072F75D9002D2C70CF360524391558781DE7F8B9182E012540DDC929A5E3D7342
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2b3a8cee4b71b061b3f017ca1cf25f24558db1c527744083ef343648ff76be83
MD5 54e9704319a597cbfd3da850d7a9ee5c
SHA1 594d813deba55bae1f6e4f63ee8984307a73a909
SHA512 c805f9d26e9f523b5426828fce425429723f4e771768671306c3b62a099552ceee6ae00ea1fb64e1b7be61d31a31748e4ce2f700ca57b759c7dcdc4a47b9cc6a
TLSH
T1EDD08072FB5DD002D2C70CF364514391658781DE7F8B9182E012540DCC929A5E3D7342
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 93aaffbbe136e9e910cf316c2ef1d9db00555bcc299afa442a08b74511074dee
MD5 7315c8f7202ba25e85e703942775d5f4
SHA1 a1e4cf6d7e5eadfd1ea4f73f0f48f16b83e1e123
SHA512 4a22109d5c0f65002e9a244676a0f11b08596cd765efd2305d610589298892ad64cf643d96bf53abc0b833c00a0f9a20e83cabe981bb908141f4804d988a7d24
SSDEEP 96:ZMvvyZOGj3vGzZsnAuL+8Bki7kKQ4F3T60dy:ZMHQ1Gz2nCE7kuFu08
TLSH
T18EC16F44BB847284EBE48DB95F901A6DE173874820460B3F36F4D4EF2A37BAF41C05A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5a3fba.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a3fba.TMP
Size 3KB
SHA256 50b1adbb788aeb45d58f72ccf2c882a47ee1ba3dc17680fdd5fd6290ae49377a
MD5 cabeefc81def580d8675d54b74531be7
SHA1 1d10b3ed15a7c069d24b8f3cef146ce39217e5a8
SHA512 aad14aef5e22e957256b183ecf8d763095845fc9911ca4df70e016b8e2b92a54313be077fc61385e084621890c97f826528bf92766c1b813be87c31ce7edae10
TLSH
T18671B5447B418599EBE4C8F86B95125EF2658B58304B0E7F35F0C53FAA36B2F40846F6
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 741B
SHA256 9b997acc7c88838d57b0c2471326a74947d58166568e3b4aa7946a4f24bf7ff5
MD5 0b0a9c73fc7c9b071290f7f9ef3a2c56
SHA1 d9bd125eec41252658f662a2f320f37576b1f093
SHA512 d334bd714a0dc22be924e9d777f7a2b31fec6f98e009c4ef22049944c5ff16fde3428ea13a759f597d43736755732dbb10684bba533b7f69cd6587905db023c0
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 319B
SHA256 baf505d9fca6df32fe0d77dd16a972a969bdfa4236931ffc38ce57b212f67851
MD5 cb04c316a95d3fe0259634f3dcf2d910
SHA1 4fdcbe6d5b3cbb24bcbf75680dd2ef44f7a54c5e
SHA512 db3d9791b397220f690e098aaf8eb1c9d2c36f1ca84fbbc1b974a324ba8abfbfeb6f927a77cf077a069962634fcbe6a425874e67c5e96f53c4f6f694b079ed04
TLSH
T118E0262C1ACAC22DA05478DBC7BD4F49C2D33403AACC3A829708E8487101B42E2CE790
MD5 SHA1 SHA512 TLSH

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.104.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

computed_hashes.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_1\_metadata\computed_hashes.json
Size 429B
SHA256 b829b0df7e3f2391bfba70090eb4ce2ba6a978ccd665eebf1073849bdd4b8fb9
MD5 5d1d9020ccefd76ca661902e0c229087
SHA1 dcf2aa4a1c626ec7ffd9abd284d29b269d78fcb6
SHA512 5f6e72720e64a7ac19f191f0179992745d5136d41dcdc13c5c3c2e35a71eb227570bd47c7b376658ef670b75929abeebd8ef470d1e24b595a11d320ec1479e3c
TLSH
T10AE055170A1A50B79BB8DB90EE525CA2E8A0A6B1C50438D63E608234B68A11F738347D
MD5 SHA1 SHA512 TLSH

Submit Download

verified_contents.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_1\_metadata\verified_contents.json
Size 1KB
SHA256 d23b2ba94ba22bbb681e6362ae5870acd8a3280fa9e7241b86a9e12982968947
MD5 738e757b92939b24cdbbd0efc2601315
SHA1 77058cbafa625aafbea867052136c11ad3332143
SHA512 dca3e12dd5a9f1802db6d11b009fce2b787e79b9f730094367c9f26d1d87af1ea072ff5b10888648fb1231dd83475cf45594bb0c9915b655ee363a3127a5ffc2
TLSH
T12B317466C8683D56267A63348E2D0602EB57C2BB0050640EB5AC558D4F7115FE242FAF
MD5 SHA1 SHA512 TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_1\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 5KB
SHA256 f4bdeeee5e6067f0f56da111f308fd535beaff8824e6bfec963ac80b9c9f0bd3
MD5 98ab985d73435c0012d8401f249e4fcf
SHA1 927f1e4c006786f2a59535558b20397951637686
SHA512 8258147c961b822f2e1aaea02a21fa2da386be13e3e2d001e1a2b14e3dfc810de9cc96761c2c3493ee0e601dab7a050b038a870b98bf172a394dbf4ee1746df2
SSDEEP 96:io+A2jJwRv2gJ0vBwL1JqgZGYB6Ov2YRtrZ+pN6XwFDANB:rl4JwRwJyJqg1xtbo34YDW
TLSH
T105B1B4F3252D942BC78A40D5C547FD6EC61308BC8FDCEE9CD1BC699B26A5134352A506
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 1d1ad22a5981bb92964df312b91159d448294199b297eaf439f7d8e509fc43b5
MD5 0c2b3268531c258aa9fd48285d6cfc65
SHA1 fd0305c489f9748adc39526578ba5ea3c399e7d9
SHA512 69baf446e91d6907a091d6acabcddec4f478d9e8fc05c01101f21ded4ecdbe76d940a1e0c7e318f69b0cf3b8e577156745bfe38d81754711ec2073c6ab0f9379
TLSH
T187E0DF744ACEC16E6288608BD3AD7B0EC3E13507E6CC2FC61B04E884B042408FACE7D2
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 41961be6d7e350ffe5814b622ca06726899209b75d673443bc9b9d3ac55274a1
MD5 ef0e21e76c026ecb93409d9afed605a3
SHA1 14dce456c995b5444c1574149d57b9722d180c11
SHA512 a9d3d22fa3f55da0647ba6b6f2950637a39eed5241c9ef6107f6e5a4b0c38686eaa50a293671b44aa65070d38d518db1e55dd8b85df701562ce2862ba1e7fd72
SSDEEP 384:sxZWnbgWScy/fdsh+Lu2HnIlqrfHb1/+c:sYbgWBy/fM+LtHIQbHbJF
TLSH
T1107209166A24997BDCDBD218F915BB53D6F81562D6800E88D9FCCE0C04E6BED2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 93ea2090db11c74a7ed017440972c72d71a7d1fa205e2c5c61cbca52e801a33f
MD5 79d32757226ba0dca591314d66e113d3
SHA1 de18498c9c0fd4998220b11d0155bbb8fbb3acbb
SHA512 c3bc5654cf145fec51e597a6612e81ffc71df9ca77744f255ca49c9116d5d52cbfa335c0de525c6cd6dd8b4b131a204af4b34e59c31cb743ca7224aaa30fdc3f
SSDEEP 384:sxZWnbgWScy/fdsT+Lu2HnIlqrfHb1/+N:sYbgWBy/f++LtHIQbHbJm
TLSH
T17A72FA166934597BDCDBD219F905BB53D6F81562D6900E8899FCCE0C04E6BED2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 df52733a5c0e9074dac4714e31ae0d09b2c0e231ea806254e821314d275f5ea4
MD5 a7d3052fb90635703a5c9502875374e7
SHA1 cb3bcde6d3c203c8ba1f5b5b8b10f5da3bd4e7f8
SHA512 128936ba5bcb265387c6b14ce5f9d401e256c78afd9a7034ec38f5b1cd86592004252522c8a26492887f7d470e39ca385fff4b12b36723b359277ac9efe24488
SSDEEP 768:D0Qv2w27pLuLneqWve+l+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVfwnFLllnWhAroA:D0Qv2wWEneqWve+l+u1jaWwnFLfWhLxe
TLSH
T15BF20B3B6C0CCB7E4FC04E9CEC2ABE8A6DE8018B9698895447FA445C03C66EF55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\32bd6690-22d7-4d50-901d-6f07e47d7f4c\index-dir\the-real-index
Size 72B
SHA256 7362adf41cb6279054e4dc8fdbd4d2e9db2765ec1f193c64dd626e2c04d4f530
MD5 d4d30a9c3a26d36a95450c46382a827c
SHA1 156d0c33bfa6fb5b860b2a9ef4129a0103daf30a
SHA512 3651454d3ff233901032633a613f1aef480ba446f136644c54b0e8e8d9c2aa641997cb169500d49dbdc849de7ae7bf7b57155872c8aa74acd4f6282cf413241c
TLSH
T13BA002D547E30C45F0A265B535520B911214C9181222934653910085DC94D90655100D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\32bd6690-22d7-4d50-901d-6f07e47d7f4c\index-dir\the-real-index
Size 72B
SHA256 a2b4bd2230597d77c1a0cb3d7eec291ccedc593a30a97049e89defc10fe8c641
MD5 9a53bfd59b8bb48c8139b719da4a3759
SHA1 5e77a950c15ea0c661321518406485403a1ef6ad
SHA512 b3fa3e042ff5fa794b76fa451f53788ffdf688fa8fc199bc0e994a525a2cec57ee0b20c3aa76fb9b0ce88d07d0dddc56580c8fa123a6b64a3df2cdc282b2b203
TLSH
T1AAA0022D56842047C20E33B025EE01413311CD550A451307C2902084ED5054A4D9505D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\a8685028-8a71-4316-b2b9-e9c8eb46c656\index-dir\the-real-index
Size 2KB
SHA256 26a39e79356a46008f7686da0ea292dd6b71f38c9621f7849cb1d9b455205cac
MD5 b7967a55bd9a72376d18e12d624b2123
SHA1 b7194fda40ecca7c8b437e227af408f711b1c56c
SHA512 1cf0be3dc9e83fdbb9a12d137ce8c3c4f0fd2c172f27176ed016c5de5eeca6e5eccc88a2a21c8703d57b439ed951e84b0f64605938acd91603a6c86beac6b7e9
TLSH
T13451C54D9C8E8F17CE6912B158FA1029333898FE2A4807073CFD9A39AC873952DD7208
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\a8685028-8a71-4316-b2b9-e9c8eb46c656\index-dir\the-real-index
Size 3KB
SHA256 0c1a5c0d986f52255498d66d9f32ee4fe6efc93ddd2c57bd7b3abc30d1f72be2
MD5 c0e31bb9eb025bcd8586e37dce711e43
SHA1 c6ab1046d704d2b442c4a17e9d1026be6a2f08d0
SHA512 147a6468070f7cc396a9a95cc3691d639f8eaa5f75cab66b1a22ea99957d622a2edd9d38c85fe108276ceaf8fd4a3a8453b463c237f9536f37d0cd819b9231bc
TLSH
T15851D8CD5E4B5FA7CC7D59F318B1048133384ADC66A0A617ACAC6A7935CB32E0E5BA05
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59d1ae.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\a8685028-8a71-4316-b2b9-e9c8eb46c656\index-dir\the-real-index~RFe59d1ae.TMP
Size 2KB
SHA256 d324f9fd433aa39bc6396fadceddaeb360ddbaf7d062b5c0fd6006d5c7f93abb
MD5 3414816d9563b7d3419995db5cd280aa
SHA1 db84de1dd3da36fe12c35de57d2d85ab1c37bb34
SHA512 8bc844df3c05c691c8a6a052e75bc77c56cf97ae76f4d87677f851db48ded6151cf519636026e06c5a2926fe4c37205d9ab8e696f44fe31f5ac198874c0d1d71
TLSH
T1A151C85E5C824A22CD6044B359CA2468333D68A55944AF0734FCCA33ECC37AD3E57344
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 479B
SHA256 df45e47582b99e0822bfb5f34170c5c9664e6415f56ef0c8b7027e57b0060636
MD5 dc990b8b19e6c3ad8fab3dc1789cfd5f
SHA1 296a7ee6d287a995ffcc860911c82ba5a16019f7
SHA512 973d5bb4ed807e20ebf38ccd61a6e58add73787f9415ee9ec6b6b81ac69b7f366d7d83b0fd768a279c02fcfffb33ea025f8ac15fe4ff7f4ad71e9d5e4eddfb45
TLSH
T101F027BB2DE31821FCABD2D9283150A50108BC51C851DC4F04ABB6D794F2354244EC62
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 bc68409e15bf21869333fcbaa88766ae2b73ae2e767f953d4097253673e4901e
MD5 a330eb4efa1bba22d53b870835bf6ecd
SHA1 0eee22c8c8dab82825971e31d2a57792b9a10b8e
SHA512 66e77a7fde6282ecba3053f4cdbc081916047f3a91c8edf6cb2d5904ef421a3246ce75e3d40e042712b00d934815fcca901d49ee6ccb5a3c66e0d708ac9649d1
TLSH
T15EE0D8BB2CA31524ECAF93D5283154A50149F955C951EC4F50AAA1D754F2650244AC62
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log
Size 4KB
SHA256 d22287151880cb43dddb698a8f01a3aabb83a95b7f319e33b5658f6f8835ebb4
MD5 a67ee6203c1cac800891df8ddf89fb4f
SHA1 f8051c6ed5695e7633c9f5b9c2a6a111c68dcae5
SHA512 cbe6b146de932aee632dec1248fbc876dc1dd4a00285eaca2f4e3ded4b02823eb189150c5a0cc9d113c790777a16b70e2f627f34cda1a0c57e686e2908197798
SSDEEP 48:F2em5HdYlvSaJp6Fpgf58OHoXp1fwp6FpL58OiTpjpL58OV:F1m5HeRJp6FpgyXp1op6Fpipjpn
TLSH
T18291BDE3CA105043C9C966FB2039F6E4556DCA066FFF87A611BD8F6E52442D63328B4C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 aea4eb0ba0f9ff9dbf80454f844acfb8bd6fb891552368838dd8abe9ffe4eabc
MD5 f160b7dbfba161e1a87e5b4ef4d02b88
SHA1 ce2645e5f8b7478eef8ee106eb0f1e45568c93d9
SHA512 cd92f590eeaf150c9340787e3d230e5064b21d97ae7acb56cd32a1d244633ce778b4a427ee692a5167cd1e25dfb46330471a008fba3e750dfd902e1f4472f029
TLSH
T1F2E026380ECAC17D7125208383BDC389C2E6B447D2CC3FC27F01DA84E242A85B1D6690
MD5 SHA1 SHA512 TLSH

Submit Download

ba23d8ecda68de77_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\ba23d8ecda68de77_0
Size 119KB
SHA256 f0d43176d355fcf84d378efff0b2ec5fdaf8640a12599c1e856003988d7e1795
MD5 846e7fb64e0c4638ca160c74b1313ad3
SHA1 02af805a50df18febcc78e78a1c8d5360a9e940d
SHA512 b4872da331467c06b5b80bf557dba73c3a7b6b29267199976210f25fede00e39f671e3dbe869fcaa2d6f414af3f34168883ddf5c46be569d1e3c16f3e91cbee0
SSDEEP 3072:T49K+xPCJWjtG/EezKL/oTXTmaZekewL/EL/6hL/TL/dL/a4slfEN3:T2cdKL/ozTmaZekewL/EL/6hL/TL/dLv
TLSH
T11AC3AA32769C50AB0E89BEA45116B50352BC7467B844E178F21467FC25DBFB013BBEB1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ba23d8ecda68de77_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\ba23d8ecda68de77_1
Size 207KB
SHA256 afc19c6f7722aa0fdff1115f358743ae22cf998e0d5c990d8afbd66565e74399
MD5 7bedf5469fc4e160d07ea0d51ae32592
SHA1 4026b363b6620d728533545e1c8b8b116d099ea5
SHA512 61ed6c764977af3cc12678f3542947f3b34d4928d0edcefcb15175d3b4af635f5b4d3d7f1ce243880e28e16e0d96becb3d320e96b7721869363f04525d73b3df
SSDEEP 6144:XyGguI8LZ2lzOeoOJUJoGVHcBVmuVpL/yCEJr1VYgz57185KD1QG0XL/OL/6SL/H:K8e/3L/HO1QG0XL/OL/zL/JL/UL/ud0I
TLSH
T1CD240822231560AFCD1A53FE11679E1367F84046BFC3E269854193342CAFBE35ADF926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 bf8116a55a3a7301e42606ab22697c9a4eb96ad055d7ddbd468be7cb48eacb90
MD5 7fd8afb08ee2f1864bd13c4d85de5f33
SHA1 c6b63360b99badea07bc22efe4439ea6376e0f86
SHA512 afc9e2783fb83b4035c3a78826ad858aa73ef78e2d9f217799eb24b831f140a657c9b2a75575bbb2ae12f5d3a39cf6614d8fda2d9cf574b0c25348ae7e98b154
TLSH
T174A002D79B7A84C1C344027AB57152842221C8A8064A2A2552AC14A588641494592806
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a26d3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5a26d3.TMP
Size 48B
SHA256 7350eb95f10a93d29736607ac769b8c0c281bc7e92f43863a2c766cd446926f3
MD5 1e65653a38e7c139b0559f604909de6a
SHA1 970d07f63a2edd36592376fb247e6a0be001f0f8
SHA512 bb2a1cec85e6748830538b2b683fcaeed5c5e62bf845b30934eb9df6740906596def83b0b9fb1fc697abd683cebe3a07a4c409c7c5d072b1cccda9f76c4d95a0
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 35499319bba8066465125e133ed22b5a7eab3457c0c08687e8f2bac1a2c3fda6
MD5 282a91b20c4bc58f5da7f0828556d9ab
SHA1 6f1a1c31ea1041b8ed2440b309b4cdebcaffae82
SHA512 415a79d08bf2d502002e0f01e7877a2cf0c87d7e503ca6b57ae4ac36943f77c260648723205044225918536973b067a7a9dd7c538aadc8557e70eb45287eb8f1
TLSH
T1F4E0D8381ECAC22E715520C7C37DD389C1E3B443D6CC2BE17F09E584E3066807287650
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 93cf61c86aa2e1d4bba91109a1d1378a26da23e5c7f84d24ba896555a06e91b7
MD5 8ba822a9b938627cd004aca3ab29a5cb
SHA1 e3b355cc79a146cb99ddd30ea3826b660e4962bc
SHA512 a3478e88fb8c0d75d10a4f98cca9cd0b14861fc8a577c5e7931ad61121d650e26c4bd4dd506c8a24bed08f9ba7a21d3ccc4a06f3a8160ba70b1528568f2e94de
TLSH
T191E04FB84EDAC23D605560C3C3A9978AC2E3F857D7C93E86AF08D484E105255B6BAA90
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 4d875d4768ac3097571d8656f6a57e489bbf6bd339b36a56e7b7fcc231bd47a5
MD5 7cfa182a7c017dffd28b8aa92b08d67d
SHA1 07b53cfb8add99de8f359ebdc6aba502963e9eed
SHA512 599274d335c51ae5802ab0420f34a40144be4a06b1607b1ccec645394a72cf4647d47bfbc7d0de3259d8d9b3ddfe81f3983639b94f25c7ddc4f440279b3b9842
SSDEEP 96:KkE4Kh6Cy4QK1mq+nGKg4/MgKla2eJuKC4W:SnzLFXrFP
TLSH
T153E17351323B12433A7E359EAD94B41E16C630633554B42B3BB900A64FA7E25CDFDCE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

QuotaManager-journal

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager-journal
Size 12KB
SHA256 3581e0d99f9d7b124d98a12db50c3fb20d460da0419b3c9b29a1b3a746808062
MD5 c8049b384b34a1ac3d30e05b7b03bffc
SHA1 1454ab5fa81e7ed14a6c7fab781995b4f93e814c
SHA512 0f258b2c862926ed92c81d72668e1dafdf3d830f4484a1f282f9d1355b72b2018c55a535c289ebbffb2643b6c338c265da445c8e3ab1f48f8d55648f8c1d02de
SSDEEP 3:GxvHNllv/etXlL32J/s/1qvTv4RRftD0td7jdtQfQq622J/IlsXtXlL3Y:GolCJktpR0tdndzJwCls
TLSH
T1DB4212D3BACD8010DF1144BCCB678AAD36AAC51954586E80101901471817F22783CD80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

load_statistics.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db
Size 124KB
SHA256 fe524159e81906660c062ba50e1126aa2f4064a57622caf8e6a585836a0e58cd
MD5 3b5669bf1321124b06364594058aaf03
SHA1 bee85d3236a62872f4334e93d9de65f7337bf60e
SHA512 f2e1800c367633b3d87be71ea887b116832042af922b9b53dc145435e70321092d44ea6d5777831ef068e91e92c651d201faddb1d0652a7474e078c8c5154c0f
SSDEEP 768:fC6aMYUnmH0u+dA39IANlsiA7VqFXh2Bv43A/PuLZ/Y3bfKbCK05dzDr4I4LB94q:fMF3A/2nLPCKblW4Bxxg7EH
TLSH
T1E0C321F7AC1690A6CDCD92B4D50BFE0884B346668A24DDE5B93C04C3777D6023E7A9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

load_statistics.db-wal

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal
Size 3.9MB
SHA256 33ba0f3796f1a378ebf1a6e4535030a66223aba39d9a10117e690ad7c652d8d2
MD5 f0e63a12c9f1d011b745804cde6c1753
SHA1 dfbfc8c5feefa47a91a6699df3f05c9da6011bf4
SHA512 fae576d0ca369f30865aed748912499fb9c4711f35b8b1cbc914f429c77563f2b6aaf96582051dcd5c46774e8745a4d22b97d64e954d6460e492acf984d21d48
SSDEEP 49152:GnIzZ2ZM5rVMoa4q0uBBef4E9eui14h7UTu0Am3D7mBz+2De58Jhz6qyqywk:C
TLSH
T1BF1688F77D1640AEC9CD95B4C60BEE0844B386B94D28DDE2693D04CB7778A023DB99C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 6d4aaaab3a70bc20373f61333b7af6a2fda7ada272afbb9409d873db9a25d39c
MD5 59d6ccc86ac5f2f92c9f1cb99a5dfce5
SHA1 0fe632eb1025a96b6a6ff74cf5394122fa8b006c
SHA512 02bd56ba8da919e78974be6ce707a823a5dfb12f849ac8b6479a482109e7d65887471880194cc43a54bb5555c9ebdd315eb8f27a41db4b58d1dceb7bb6c4f757
TLSH
T14921D865F330C148D14A427A546E6B261734D4029FF8ED0F597A64B42EB6F041E4B6E6
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 340B
SHA256 b6de3c963b106098dfd362a5d2bd03c9b03c6c4878c8298c2763b0887e4a51ac
MD5 40bfd9165b9ee0387539fb9aabf712d2
SHA1 be2ca281ad1d193d74f9dc4fe1f606eb17b63f05
SHA512 575e6529a28750608d256f0d667b97adc1fa74e20870ebd7bf910e20895ec3ade1ab0bd780b4c7d2287aae898ff6c968da1613ed60a6acbcbff28dea9ed1e84a
TLSH
T13DE02624ADCEC1EFA09020C382A9834DC3D33803FACC3F821F09CC88A106142B7CE691
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 24d6271f04ffcb351c06c2deaedaf7f611590c8d7f4139270009c1a2da34c746
MD5 3a93aea8d49c4fe0792561434b8462ee
SHA1 a660e112b5366445fca3e787b36bf09295fc94c4
SHA512 9d1d8fca8ad633e682719de7c86f06229b3923e08f167ac3b76d5c13b0e9a34b388d4bebdaf71519c5f7018345acccb1ea53099cdf7f6d1ffb01933fbe2b2c8c
SSDEEP 384:ntcXqn6sNMjFTPhdKymkgDptfQ+2V15yBwAHW/+00p:R634ymp1mlV15ytiOp
TLSH
T161826C36A8B89C3B4AFB5945B04B37171EF4916797C92FD4D6D85B0C08DF29C2307926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c15a3f27d728fdacceeb00b04f8a0f70634dade86a76f3c4b7d4edd6ac1026bd
MD5 51208988f48b47a2b59d72e75578c595
SHA1 13974408ad3522a609496bad57dba476eeeb9828
SHA512 7b2387b20eb4311c35505279aae3744b7af2d577dfe214defe648347ce0ac5fedbbb44ba15b6dd3ba570d59fcef4de7271d6b2fa86f639dae8cdf996c7d1a3fa
SSDEEP 192:sONd6IT05QmiUzj7j6kgibFPuWXvQ+2hh1153qRU6:sONd6Pv/6kgiptfQ+2N15yU6
TLSH
T179121B31787C986B4EF3A851B08737135EA5822BDB897FD4D5DC1A0C05DF29C230B822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 071fac3c7a2538232529f3cf6958fc1473f57826d3357a1640fe63fbc5834ef9
MD5 d8a9360d102115298379d888c3dfdc49
SHA1 0e1db4bbc179d75e766de4d2b372457893a06d97
SHA512 783517293d6f1ee9ab3941b1ecefbefaabd3ca587340f764a811cfd9f30b7bb87a6285fa507a3a77ddee88ad2b00dd568e89c8292853493c2d592c01126013ea
SSDEEP 384:ntcXqn6sN0jFTPhdv+mkgDptfQ+2rjAd2GBwAHW/+001:R6vt+mp1mlPXGtiO1
TLSH
T16A926C36A878AC3B8AFB5945B44B33070FF5916797C92F94D9D85B0C08DF1AC6307926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f32d25312aebda9e58c4decb52853d3226a1985207133c330924687cc499174f
MD5 3b5f8d64638775e3f25002c8b9e10556
SHA1 e164eacbadd2b585cbd5eebc89ad81eae03c652d
SHA512 e7849b3df6fe4db18278389e05f1262f3a5d13546a5d9258d3a3de54c920c05b848420a54bcc0584ca603b50768ddfeb2b13725d21a43aa5170a6f26398936d0
SSDEEP 192:ZONw6IT0JZQmiUyjLj6OgibFPuWX8Fu15E8uU6:ZONw6B3kv6Ogiptd15/uU6
TLSH
T19002D735B87C686B9FF3AD45B04B7B175EA4116FEA957F98D6D41A1C00C728C2307922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

campaign_history

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history
Size 20KB
SHA256 18728f0b8077e577053e4676a2c7235a0cff67d39ca931882f35d091166a692c
MD5 d63abb632839c8516cdcf1b6d7729225
SHA1 66e50d5d5a2c9ecb222f726dc4c3a561329fe366
SHA512 5ac9a7b2df3382de2f126cd058e05e42fc9dc2eff219109f4e57cc609410672a5eba5f9428bfa69ca2a6e65ae29f49702f4eaa43f4ae0746221eba6ad1a88dce
SSDEEP 12:TLpOPFUxOUDaaWZXiDiIF8izX4fhhdWeci2oesJa/Si3isOmQQtudsCzQdsDzcQ2:TL85UOl0afDdWec9sJsnGDB5fc
TLSH
T1D192DF33B9212023E8DE4B76F94748D10DFC12AF89A7B804DAD04D6109A6AC2A6941FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 3dc9043838386f5363ac96a01477cf3163b5118b80191576a11b32ce9894314c
MD5 cdddc745a8c954dc438c931889999bdb
SHA1 7908f975b6815460caa2bc3438efbd8fc8d36211
SHA512 3d2d4852aa2ac6cb0b9b6cbca9f04366afd48d362d869be877ef324c16d72ff119b5842891baa2b6b99df2de2db8d3be5c23f0f97f8943bd74195996bcb66a0a
TLSH
T159A02407C473C00FF4144051C45C034114F4C047011DD0115070D33714D40CF03F5C35
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 26e635268325b7da49754cc6784899d762686343afbdba36538547cf14829a52
MD5 89352ab305da0008e79279e08616aef6
SHA1 d0f38d9e88cb27e6e3b9256e1aae78c030bcd97a
SHA512 02e0ffe07dc54ce5c33a2c76cc1dc3b51bec9c8dd60c33c3bb5aaade4ac5ffa75e3b76071935b02716a42accb81e13b42f4dd889ab2b7af80821c0f32d03a539
TLSH
T113411958A6E91148B3B76F5A9BF6646D487FBD333F07955D00110E8F0A22B40CC61737
MD5 SHA1 SHA512 TLSH

Submit Download

910e05c2-74d6-4f1a-a2b3-8ee2aa82d147.tmp

Path C:\Users\Admin\AppData\Local\Temp\910e05c2-74d6-4f1a-a2b3-8ee2aa82d147.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9a57c6c6-8c21-4de0-94ed-ef328ae5bc1d.tmp

Path C:\Users\Admin\AppData\Local\Temp\9a57c6c6-8c21-4de0-94ed-ef328ae5bc1d.tmp
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9d996a5b-41b2-432d-b183-f791c2106854.tmp

Path C:\Users\Admin\AppData\Local\Temp\9d996a5b-41b2-432d-b183-f791c2106854.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

XJzUtEBJvHn4

Path C:\Users\Admin\AppData\Local\Temp\XJzUtEBJvHn4
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4812_564675895\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/176-134-0x000002005C000000-0x000002005C1A1000-memory.dmp

Download

memory/808-1371-0x00000232BCE00000-0x00000232BCFA1000-memory.dmp

Download

memory/1556-17-0x000001C0740E0000-0x000001C0740EC000-memory.dmp

Download

memory/1556-0-0x0000000140000000-0x0000000140104000-memory.dmp

Download

memory/1556-5-0x0000000140000000-0x0000000140104000-memory.dmp

Download

memory/1556-1475-0x0000000140000000-0x0000000140104000-memory.dmp

Download

memory/1556-1487-0x000001C0740E0000-0x000001C0740EC000-memory.dmp

Download

memory/4740-1344-0x0000025F3E400000-0x0000025F3E5A1000-memory.dmp

Download