hxxps://isend[.]corporatecertifications[.]com/campaigns/oy240ckvg23a9/track-url/oa7988q69aaca/be40e9344e05d43b6de13ef0c6013a636b588c0c

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/06/2026, 01:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://isend.corporatecertifications.com/campaigns/oy240ckvg23a9/track-url/oa7988q69aaca/be40e9344e05d43b6de13ef0c6013a636b588c0c
Sample260627-bd2pdagy8m

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3084	msedge.exe
5508	chrome.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134269957608299403"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{56CE1E4B-CCCD-4F5D-8ECB-5EDA11941958}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
3804	msedge.exe
3804	msedge.exe
4432	chrome.exe
4432	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
2596	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe

Suspicious use of SetWindowsHookEx 13 IoCs

pid	Process
1676	OpenWith.exe
1676	OpenWith.exe
1676	OpenWith.exe
1676	OpenWith.exe
1676	OpenWith.exe
1676	OpenWith.exe
1676	OpenWith.exe
1676	OpenWith.exe
1676	OpenWith.exe
1676	OpenWith.exe
1676	OpenWith.exe
1676	OpenWith.exe
1676	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2596 wrote to memory of 4012	2596	msedge.exe	84
PID 2596 wrote to memory of 3084	2596	msedge.exe	85
PID 2596 wrote to memory of 3652	2596	msedge.exe	86
PID 2596 wrote to memory of 3652	2596	msedge.exe	86
PID 2596 wrote to memory of 3652	2596	msedge.exe	86
PID 2596 wrote to memory of 3168	2596	msedge.exe	87
PID 2596 wrote to memory of 3168	2596	msedge.exe	87
PID 2596 wrote to memory of 4444	2596	msedge.exe	88
PID 2596 wrote to memory of 4444	2596	msedge.exe	88
PID 2596 wrote to memory of 4444	2596	msedge.exe	88
PID 2596 wrote to memory of 928	2596	msedge.exe	89
PID 2596 wrote to memory of 928	2596	msedge.exe	89
PID 2596 wrote to memory of 928	2596	msedge.exe	89
PID 2596 wrote to memory of 2956	2596	msedge.exe	91
PID 2596 wrote to memory of 2956	2596	msedge.exe	91
PID 2596 wrote to memory of 2956	2596	msedge.exe	91
PID 2596 wrote to memory of 3048	2596	msedge.exe	92
PID 2596 wrote to memory of 3048	2596	msedge.exe	92
PID 2596 wrote to memory of 3048	2596	msedge.exe	92
PID 2596 wrote to memory of 4188	2596	msedge.exe	96
PID 2596 wrote to memory of 4188	2596	msedge.exe	96
PID 2596 wrote to memory of 4152	2596	msedge.exe	97
PID 2596 wrote to memory of 4152	2596	msedge.exe	97
PID 2596 wrote to memory of 4596	2596	msedge.exe	100
PID 1676 wrote to memory of 5012	1676	OpenWith.exe	110
PID 5012 wrote to memory of 5168	5012	chrome.exe	112
PID 5012 wrote to memory of 5480	5012	chrome.exe	114
PID 5012 wrote to memory of 5480	5012	chrome.exe	114
PID 5012 wrote to memory of 5508	5012	chrome.exe	115
PID 5012 wrote to memory of 5576	5012	chrome.exe	116
PID 5012 wrote to memory of 5576	5012	chrome.exe	116
PID 5012 wrote to memory of 5772	5012	chrome.exe	119
PID 5012 wrote to memory of 5772	5012	chrome.exe	119
PID 5012 wrote to memory of 5780	5012	chrome.exe	120
PID 5012 wrote to memory of 5780	5012	chrome.exe	120
PID 5012 wrote to memory of 5960	5012	chrome.exe	122
PID 5012 wrote to memory of 5960	5012	chrome.exe	122
PID 5012 wrote to memory of 6064	5012	chrome.exe	123
PID 5012 wrote to memory of 6064	5012	chrome.exe	123
PID 5012 wrote to memory of 5384	5012	chrome.exe	124
PID 5012 wrote to memory of 5384	5012	chrome.exe	124
PID 5012 wrote to memory of 5528	5012	chrome.exe	125
PID 5012 wrote to memory of 5528	5012	chrome.exe	125
PID 5012 wrote to memory of 5356	5012	chrome.exe	126
PID 5012 wrote to memory of 5360	5012	chrome.exe	127
PID 5012 wrote to memory of 5360	5012	chrome.exe	127
PID 5012 wrote to memory of 3360	5012	chrome.exe	129
PID 5012 wrote to memory of 3360	5012	chrome.exe	129
PID 5012 wrote to memory of 224	5012	chrome.exe	130
PID 5012 wrote to memory of 224	5012	chrome.exe	130
PID 5012 wrote to memory of 5496	5012	chrome.exe	131
PID 5012 wrote to memory of 4616	5012	chrome.exe	132
PID 5012 wrote to memory of 5496	5012	chrome.exe	131
PID 5012 wrote to memory of 4616	5012	chrome.exe	132
PID 2596 wrote to memory of 2308	2596	msedge.exe	138
PID 2596 wrote to memory of 820	2596	msedge.exe	139
PID 2596 wrote to memory of 4144	2596	msedge.exe	140
PID 5012 wrote to memory of 5096	5012	chrome.exe	142
PID 5012 wrote to memory of 5964	5012	chrome.exe	143
PID 5012 wrote to memory of 5308	5012	chrome.exe	144
PID 2596 wrote to memory of 1268	2596	msedge.exe	146
PID 2596 wrote to memory of 1268	2596	msedge.exe	146
PID 2596 wrote to memory of 3804	2596	msedge.exe	149
PID 5012 wrote to memory of 4432	5012	chrome.exe	151

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://isend.corporatecertifications.com/campaigns/oy240ckvg23a9/track-url/oa7988q69aaca/be40e9344e05d43b6de13ef0c6013a636b588c0c
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ffc4c01c188,0x7ffc4c01c194,0x7ffc4c01c1a0
  2⤵
  PID:4012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1836,i,9016732547703001890,9132501237154113078,524288 --field-trial-handle=2100,i,1484404207306915885,16839196720413847600,262144 --variations-seed-version --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1692,i,8761945405582796936,146399977704935526,262144 --field-trial-handle=2100,i,1484404207306915885,16839196720413847600,262144 --variations-seed-version --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:3652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2580,i,17782434518726078361,10426953967073502266,524288 --field-trial-handle=2100,i,1484404207306915885,16839196720413847600,262144 --variations-seed-version --mojo-platform-channel-handle=2588 /prefetch:8
  2⤵
  PID:3168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,12939497534751739362,9065010072917366580,2097152 --field-trial-handle=2100,i,1484404207306915885,16839196720413847600,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,13506663708941902290,11568192267688870440,2097152 --field-trial-handle=2100,i,1484404207306915885,16839196720413847600,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4208,i,6343767755330622186,17357641671515576059,2097152 --field-trial-handle=2100,i,1484404207306915885,16839196720413847600,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:1
  2⤵
  PID:2956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4244,i,8052713760508707900,190476314809728961,2097152 --field-trial-handle=2100,i,1484404207306915885,16839196720413847600,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:2
  2⤵
  PID:3048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3500,i,14763365549849867053,5119705015338124131,524288 --field-trial-handle=2100,i,1484404207306915885,16839196720413847600,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:8
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5080,i,2568912265798842738,6145691594508154168,524288 --field-trial-handle=2100,i,1484404207306915885,16839196720413847600,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:8
  2⤵
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6052,i,7663568829056987832,6501260983027854026,524288 --field-trial-handle=2100,i,1484404207306915885,16839196720413847600,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:8
  2⤵
  PID:1112
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6052,i,7663568829056987832,6501260983027854026,524288 --field-trial-handle=2100,i,1484404207306915885,16839196720413847600,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:8
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3632,i,6187538772981914141,18401750448968513948,524288 --field-trial-handle=2100,i,1484404207306915885,16839196720413847600,262144 --variations-seed-version --mojo-platform-channel-handle=3992 /prefetch:8
  2⤵
  PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=560,i,3408404912972937139,9104415997393147346,524288 --field-trial-handle=2100,i,1484404207306915885,16839196720413847600,262144 --variations-seed-version --mojo-platform-channel-handle=120 /prefetch:8
  2⤵
  PID:820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4396,i,2397200364578315540,5827523345682177723,524288 --field-trial-handle=2100,i,1484404207306915885,16839196720413847600,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:8
  2⤵
  PID:4144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5292,i,12924378543980580819,6014324351444670454,524288 --field-trial-handle=2100,i,1484404207306915885,16839196720413847600,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:8
  2⤵
  PID:1268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6404,i,13153312646588121989,10867196881971168209,262144 --field-trial-handle=2100,i,1484404207306915885,16839196720413847600,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3804

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3856

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --single-argument mailto:[email protected]
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:5012
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x124,0x128,0x12c,0xf4,0x130,0x7ffc4988c728,0x7ffc4988c734,0x7ffc4988c740
    3⤵
    PID:5168
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1760,i,15930223184100657835,6706219515762389003,262144 --field-trial-handle=2076,i,7171670448074635706,9131889507001784037,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2072 /prefetch:2
    3⤵
    PID:5480
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1656,i,1244262504385499205,12473003297447752090,524288 --field-trial-handle=2076,i,7171670448074635706,9131889507001784037,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2344 /prefetch:3
    3⤵
    - System Time Discovery
    PID:5508
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2444,i,5666423237219366073,14401379662933968729,524288 --field-trial-handle=2076,i,7171670448074635706,9131889507001784037,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2636 /prefetch:8
    3⤵
    PID:5576
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3280,i,4141873815247915262,7283737782814226525,2097152 --field-trial-handle=2076,i,7171670448074635706,9131889507001784037,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3292 /prefetch:1
    3⤵
    PID:5772
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3304,i,12045739265208587506,12878580091846227358,2097152 --field-trial-handle=2076,i,7171670448074635706,9131889507001784037,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3328 /prefetch:1
    3⤵
    PID:5780
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4568,i,102152843016921111,5067225659459496474,2097152 --field-trial-handle=2076,i,7171670448074635706,9131889507001784037,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4576 /prefetch:1
    3⤵
    PID:5960
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4720,i,10325536577458953787,13614974233754642909,524288 --field-trial-handle=2076,i,7171670448074635706,9131889507001784037,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4756 /prefetch:8
    3⤵
    PID:6064
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4884,i,5511616512723881086,11085177502887419908,524288 --field-trial-handle=2076,i,7171670448074635706,9131889507001784037,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4752 /prefetch:8
    3⤵
    PID:5384
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4828,i,14856531060385925058,11127704633261571600,524288 --field-trial-handle=2076,i,7171670448074635706,9131889507001784037,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4992 /prefetch:8
    3⤵
    PID:5528
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5328,i,16451652751455088774,403540176002881511,524288 --field-trial-handle=2076,i,7171670448074635706,9131889507001784037,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5332 /prefetch:8
    3⤵
    PID:5356
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5416,i,5925712835306156160,12091375894295933972,524288 --field-trial-handle=2076,i,7171670448074635706,9131889507001784037,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5448 /prefetch:8
    3⤵
    PID:5360
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5328,i,514094175954897412,6666476304579636118,524288 --field-trial-handle=2076,i,7171670448074635706,9131889507001784037,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5384 /prefetch:8
    3⤵
    PID:3360
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5336,i,17457220741559243715,5882920271636199297,524288 --field-trial-handle=2076,i,7171670448074635706,9131889507001784037,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5380 /prefetch:8
    3⤵
    PID:224
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5456,i,7009776866097096518,6178377052959551546,2097152 --field-trial-handle=2076,i,7171670448074635706,9131889507001784037,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5604 /prefetch:2
    3⤵
    PID:5496
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5608,i,10186724503141301551,7370269467123321335,2097152 --field-trial-handle=2076,i,7171670448074635706,9131889507001784037,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5548 /prefetch:1
    3⤵
    PID:4616
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6104,i,3532972336634720778,579444525425663173,524288 --field-trial-handle=2076,i,7171670448074635706,9131889507001784037,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5384 /prefetch:8
    3⤵
    PID:5096
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5604,i,11909235800442548332,10910646925666561201,524288 --field-trial-handle=2076,i,7171670448074635706,9131889507001784037,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4716 /prefetch:8
    3⤵
    PID:5964
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5640,i,4162136746417500267,6126890885608728111,524288 --field-trial-handle=2076,i,7171670448074635706,9131889507001784037,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4728 /prefetch:8
    3⤵
    PID:5308
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5512,i,1324833172674412829,12935579015747784844,262144 --field-trial-handle=2076,i,7171670448074635706,9131889507001784037,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5032 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4432

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5668

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5500

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

285277d6-5d77-4593-b1ed-673b3ab5cf7d.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\285277d6-5d77-4593-b1ed-673b3ab5cf7d.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 f5a7def1021c97ac613eb0502fd63b5653747136f0a91f828f5481e47e1e3380
MD5 0e3114dd2cbd2338f24df8f84a0987f1
SHA1 673b54a1c2429237ad4dedc505f4621ecd44dacb
SHA512 bf3c9ebd66fbb9adaeedaa8db619ea2a2326b55e5b6bdbdec1e68ea5c0218254398e3d5d43ff853e774ad670d55dfe38e480ecf1e53226872b1bd8748831fb5a
TLSH
T156E02BBAC961EC2B18FE0B2870554746E650137B2B40494F7A3C8A0C8FF0B3B9745C1C
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 5140cef8646e76f9b8854ff023c4470cc46b8bcc47f1699767a1548e14b06301
MD5 3dcd6dcb5f7abbb32bf470fbedf2e355
SHA1 095f82bfb7e14d453de1cd502c05d116493cb398
SHA512 3027852cca1c90e9d42ca7e36e2ed59e440cf3f66fb972e921eaae8f40cf10bde17175268481cca5eabe99825acf48b7eb752975c7c6fbe4265fda62404f3fb6
TLSH
T1ED518BF7D7E4896D891152E4AB216E1FCD2E0A14531C3C6688D8AF4F53E2972E20539E
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 b010051bc82362970c0bbf87bb6cf5542c75da430a307b7490ad34722c9a0ec2
MD5 d586a8258cf681a684f0aef4ddeb0d68
SHA1 aaf5ac1241be76f20d3b664a97f062dbe6557f7c
SHA512 c1cff8650451c8af5d412e34c3805b134eb1e961f3cc63f2a34c364f1ba5b0d3f564ed5f45d66ec965869c4476a86069c5f714bb23a857b68d0ff80f6527197a
SSDEEP 192:DQRiUHWLAv72vbPRpf99THsb+WNna50x+ND2aakw0VyIsnAUgE:0RiU2LcCbXlFwc0x+N2aaQE
TLSH
T15C42B42FA920653B5CDAD61AF9227B27E7F5103136D42E84E6FC8A2C14E79CC312741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 b1ffa5675a0d1263c814e9ecb43a4df61d86f4a270511ff95fd5d8ee90660068
MD5 d0471eec9744d47f2957ca5f289ca011
SHA1 be3159f2ff363e7094cbe44eaef8a6ecf9d496cd
SHA512 33bbdfda4191e20ea0b0a7328e24d7dcf2fbaf16b62ed760fd97db6a5fac988640c24c68e02d6d9e131fb61c7fb615e146e1795ef4fe22ce75e8d03a2f050ec9
SSDEEP 192:DQRiUSWEv72vbPRpf99THsb+WNna50x+ND2aakw0VyIsnAUgE:0RiU/gCbXlFwc0x+N2aaQE
TLSH
T19E42B42FA920653B5CDAD61AF9227B27E7F5103136D42E84E6FC8A2C14E79CC312741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 843fc99c1c440d4f6df29c7efb8fb5983a57b79e7266d7a0c5eefa7ee6da45b5
MD5 1cf3e2b195b567ccda1a270e368b4b29
SHA1 dd3e5b12fa9b4eb6f653e005f4867eb1301e7188
SHA512 e8f936a268aff1179edd89d4bcf8c436a98fa7110f6e9340c2574eb68e6234eb671cdcf18d5a23ad54dc679d7bd36ca71c3909d3ba8b7a46a83f684561124dce
SSDEEP 192:DQRiUHWLAv72vAPRp299THsb+WNna50u2D2aakwYVyIsnAUgE:0RiU2LcC6XuFwc0uI2aacE
TLSH
T18142A46FAA20653B5CDAD61AF9227727E7F5102136D42E84E6FC8A2C14E79CC312741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 e27e827a6ee20d7f636ff0eff27db4fbc66159997f8cb0394ad7c8215832b309
MD5 b8148d7d3d29ac9982accedad0458cee
SHA1 a550581ffa09db6bde1108dfd32d2f1e47eb3c24
SHA512 b62c7ada419144db9475fe607f480c8aa8787aefc1e5b32475341395674a9065e14ab9a1731fc761aa958c92b6277c20bfa40c48d0ce116ff0194a66c555e384
SSDEEP 192:DQRiUHWav72vAPRp299THsb+WNna50TD2aakwsVyIsnAUge:0RiU22C6XuFwc0v2aaoe
TLSH
T1FA32936EAA20653B5CDBD21AF9227767E7F5103136D42E84EAFC892C14E79CC312740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 89e98be3ca1385557a2b413acb30c0071b3930be9afeec93be16ec8869e7aea3
MD5 322c10e6596dc3e31c8d58fd00906b88
SHA1 d3e27ee57c7377f4c24852fbc3b5bd0fea4149a5
SHA512 a4903b7c4e21f30151ace43a8fc93aec646d99e1cd834ec5a308c0b6d56517afe3509a2937586f290456dad065fca40eebd519fac44b924e0a7f235cc739209c
SSDEEP 384:/1jbW7KxkXqKf/pUZNCgVLH2HfgslqcXODby+ErU3khHGNIB3WhmNKoUT:/lbW7KxkXqKf/pUZNCgVLH2HfgsMOOHR
TLSH
T17C52E867688D963F0FD8DA8CDC16BF4FADB1029666740C2497FA9C0803997CB115A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 d036634d89dabd634da402de273514a64c7c5570d6e946ede6488d8491e7294b
MD5 c59f1423891b6a4dd18bd3bd2545ecc8
SHA1 757953ac3cadb591e4e710cdce070018c8c727b1
SHA512 86a898b867626418c76be9de5ba064fcaaaf53df538dabac47f01a442e6b19844db9dfdc602d5fbd12fc4234e3e9fcdbf118e24a9a72ed7f6f4576a202aa2f81
TLSH
T1FDA0021173C11821DD3056B561B25E7233924C5435615F0364A51D78DCDB3D54125609
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58df30.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe58df30.TMP
Size 48B
SHA256 2e5c2cec73f8dee902ba3c63265f87e6a24c952f7e88938880b64917d2d3f23f
MD5 77d5a81731f1e217add8bb0a62f83366
SHA1 99d192f22162ccba27dcd8fdad468a01d245bd4e
SHA512 6f5bc24bec913ad01cb81877ac91676665bad2a13176b925769112978f9a4d54f422e00005f01a6b46db999bc8286789f11dbd53ab98918579847908c0b0e828
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 5f8170cab47265aa9cbb73e41cf68e098769cfab5a9db69d348f27a81599fdc0
MD5 514d61593b0097a6acd316ae4aef7333
SHA1 fb175a04a450eeb216aa2d48c4435b8032a4ab24
SHA512 92fd03858819e8a38f41331f56df4f73c52edc2c012363db1eab871ea60aa3a7e7734c8bc82f0e4406df0900de27ce2636e43d2cac3e99ad6d9f86f9ff7506ec
SSDEEP 6144:3w/gwqv7Hx6QKyGwEUWm7Rkm1tYpBeh2BAoh:Eg2snh9oBGcAoh
TLSH
T19E3412369D75AE3A80695B1BB18A4F1C4EF25BF6D828E85289D82D0427DE74C7D94C30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 9d3aead777b835f3a1f4b73a8fda1a807e636565c51fd1a00a5289377980f132
MD5 d9be3004dab085fe80aa06e17faae0ff
SHA1 217013d1ad2d0cc1895ba0d70bce33267d4215a3
SHA512 3811a8f92c11e0380104ecd2fe41fde5a96b9a89d21fd6822b3a630d7aa8f0b99976a15fde61573e38a589da2974b4503eb94badc3f13c3a307133954627444c
SSDEEP 3072:UGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMm:Xm7Rkm1tYpBeh2BAom
TLSH
T14BC3123B5E70A9775979AB4EB08E0B1F1EF14AA2D930DA42C8D85A0437F97CC1A05D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 51a13baacbd40f4c40776dc11136f9d1c3b4f11f62f892bb5111e9b732680dfe
MD5 ce89c032fa225f8f809f76775aea1c7f
SHA1 20bfde9d897fcd68b01e9cc0171ad75e2e710311
SHA512 ec843535b521385eb86918c3c051ba082aa18eb8441a651530cb1983535fdc91147c6ae9cbca8d6da6280700ff974231ac8737f8c13fef0e4bf229a5b3d79ba7
SSDEEP 6144:38a7gwqv7Hx6QKyGwEUWm7Rkm1tYpBeh2BAoh:n7g2snh9oBGcAoh
TLSH
T151341217CD75BE3A80695A1BB18A8F1D0EF25BF4E828E86385D86D0427DEB5C3D94C34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 16f2f6a52d3bee71da9758c73d36453bf83e81823e83b7a743d89ee1173f6d15
MD5 15e4b8b3f1120535d464923055aa694c
SHA1 3491e3d2af24b97f7a43e2f1089fb75fcb1a8dcc
SHA512 a39853a67ca1ddc0831dc7dda3ecdb0965eed8d962cc00ac11238406f1426878539178c57651d9925fe734fdc792ef147e198abf320421efba989378638fc32d
SSDEEP 6144:W8a7gwqv7Hx6QKyGwEUWm7Rkm1tYpBeh2BAoh:a7g2snh9oBGcAoh
TLSH
T16C341217CD75BE3A80695A1BA18A8F1D0EF25BF4E828E86385D86D0427DEB5C3D94C34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
MD5 4751cf705a737c4226029624bf43b9a8
SHA1 fd8cf726ee3f8f75b97147829de5553530caa82c
SHA512 46e3fedbf7fa14bdc2b3aad129f2879a9d24252f5d7bd9b55766bc32a6b82ea77aaf193bcdbdf4423e3b67ef84955e589b6077609344091ef72204c1d50b0dab
TLSH
T17ED09B307A58A58BD14360F1A4114B4115375557205397757521508E9E98055B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 701082e4ac35f878dc5ff6eb27989aae9d20d9b5662643e20b3acd1720b367fc
MD5 2b3686986ce1fd99f079eb226e8b0a8b
SHA1 0d2cdee36351378b91ed7f6ecdb43457fe4d7b5d
SHA512 937da61c495fd21a02bb76a63556dec83ce132f1d1830ff8d9af6212d15f1844766dd4abadd15ea61b48f8ae03b52baca44c99117714c705da840dbff8f116dd
TLSH
T182D09B303A58A98BD54360F1A4104B41153755572053D7757521508E9E99095B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

528688d5-8cad-4c99-b795-2438a55312c3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\528688d5-8cad-4c99-b795-2438a55312c3.tmp
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 d93265d81171dc8134a9bd2cbe7023576071b88eab83705421c1b7a40c57739c
MD5 89e0036e3a3dacb0cd2097a85f3d6121
SHA1 82824672ffc1a5a70b6925c8f53d7a7d84277229
SHA512 cbe7969cc9422602007669d22c1caa025ba5eaaec1e709c8886cab37681c9fb3dce153750316d61798a9845375d523b2f0a1147136c782135fc7d7940f4c4e9e
TLSH
T12761E638092E0471E39A28B556D5320730B6BDEBF9565E74D2E09E37211FF25B93D508
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58a9f7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58a9f7.TMP
Size 3KB
SHA256 3acbfd7eaa2de2203723a4de96a15387f32ee17db1f973714f53121ab919ac9b
MD5 45bb252d3c2bfcd2f346f256b740d3f3
SHA1 9632dcc4e435a4d5f5ab7672cf5dc06ce7364e32
SHA512 49e3d60e6c3f7d5a06373c1fbe5414075608ba8ba4f843e98ac5fb3202d1c9416f829509f06bf5de3768a028dc577692c47b0552ecfc5b932b4fbac256e9274b
TLSH
T1FD61E5380A2E0871E39A28F156D5320720B6BDEBFA561E75C2E49E37211FF25B93D508
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 86a25374364e3a448f91703dd9825afcfd4a076ec52da08155888ac237ae44fc
MD5 4c36a0ecb32547a3fe859435060c88a2
SHA1 8a8b851e0249b5a80126b284dea20f8e10d6888a
SHA512 9df149bba55e6fdb5fb6fa577f7cc65f5cc303443e3a6e94a67da2d224b2b438c7f2bcb4e36d9872129a44bbd17bcf158e479b3f88519205d87f593e174d9b85
TLSH
T19831C0B3C3E4467EDE4142F06A287E2BCE1E0945436C3C0A94D4AF1B93E3474D10294F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 eeb9bffa8ee7d10e929f0da79c7ee04ecd0846422459866414f7ba9d6f119128
MD5 bc1ff2e12878e2d53c44a924b97f4ed9
SHA1 cb02784c15a2cedd6f4fdb0d9b1c4db038cc1808
SHA512 9bb70170ff5061a7a198e410d503b61255accaea12cf5be92590960b2d40197f72b7a1b7770be361fdbc61fff0f70936a2018dcda2a0cda0ee3e2a56424da571
SSDEEP 192:sxZvRmyM/jK1Ml8MkcW/fYsok67IdpJHW6+WNGY9Io6D4IgrJ:sxZvcMcW/fYsokrJHbGi9
TLSH
T19842D812AA345977CCDBD209FA55BF53D6F90472A2940E44A9FCCA0C05E6EED2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 71a655ab6cee5b5dc39d4105f3f80edd6f17d7c60a498f41dfa5c5c2600a4a35
MD5 34f9572933cdbe8091b4def5e7b5dbf6
SHA1 4b39a65159cd84b44bfc751f524b9b101169f383
SHA512 d60695b38f098851e42fc9b6399142d6ddcd0978df99248fe04c8e777473a23d107dc281e1ace46169aed5a179df4528deccc195c2c591a5e2c528bbfcb19728
SSDEEP 192:sxZvRmyM/jK1Ml8UQ3kcW/fYsQg67IdpLHW6+WNGY9Iy1gDD4Ig5mJ:sxZvcq0cW/fYsQgrLHbGq1ZE
TLSH
T1EE52F916AA345977CCDBD60DFA45BF53D6F94472A2900E44A9FCCA0C05E6EED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 1bb6ccc1c4dcf0e1f3e03bbcd3fdc50e8cbaa0a411f2a3e3d8f553929b6f05a4
MD5 dc57039892ac4a29d00a3a8ac55f856c
SHA1 3a3c8c1dab1a223e60efe4dab396f9f4ccc5686f
SHA512 542a51fd9179614771a2f41929ae73591b7d747b760482881e6c720139680b5f28b06fef33c7999bdbcdb99e14403af56d1b6d11ce9693bfe4c19b25b1bfc8a9
SSDEEP 768:Apcv21wWvu+Z+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjFLlwmWNHroag66:Apcv21wWvu+Z+u1jaeFLeRNUaq
TLSH
T1E5D21B2B280CCB7E4F841E9CED2A6F9A6DD801CB57988D5447FA884C03C77EB511B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 7e1fc2f4d0c2d1c08fcdc940050440491d9d117d228dd1524ef709f9631b8f47
MD5 2e7434e474385493088c10458a5a0efb
SHA1 1e23d75f947ee965c503ae45298d470aa04f909d
SHA512 29f77b1c208c0c2fa212d5ee1e8a4d6ca98779d4fcd18ae20c82fcae94f378d44af46fdeb25358e7d502d494b5d013394c4b671a0d1017a1b39a3e4045d495da
SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBDqAoKRef6KcKDyCP:mTLqHPP
TLSH
T1BE917316313B1692787E6848A3528A378E4636A3380CF56F7BB800B55F27E551DFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe594731.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe594731.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 edeb60e71907a8f6e3444d729c451af4ffdf409ce72cb05c6040b91cf88796e4
MD5 f429d777ff3c449d8096fa273eca055f
SHA1 334d3594f12889084c3e52fc23904abe72213280
SHA512 6bca02da52e3cba7756227d5269b0b6d6e7bfc08d8bfc7cf5ebc9bfe6674c46115475edeb603110ae17b3924fdfc0adffc877d11389abf6982d55e5d9e03ae53
SSDEEP 384:rotNn/s3n9SZsNHDMxBzijrnVCHe+CMOfqQ1Dmn15wbAjEc:kj+9u1/yC+kOfjDmn12bfc
TLSH
T185927C36A8781D671EE39949F54B322B5FB88077E7852E94D1DC6F0C02DB3C82316D2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 2b703494090729a1ac6a08de0112583abea90a641e2a64ecb0c06c2e200e0ef7
MD5 e9f77eb708683baf831129df27b917d3
SHA1 ba33c7b0dc769a02f4dcfae87b521551e3da3f97
SHA512 d421556610e203757014e2baf307e429703dadc7cbb003fda07cdcdd1a9fb4d519a9d68f87770e47f347445f14ca953238bae93b2bf91b6add554c4c58f22c35
SSDEEP 384:9iF4otNn/s3n9S6IdsNZ8TUNTUlIlqMxBzijrnVCHe+CMOfq15Dmn15wbAjEc:0FRj+98EwgF/yC+kOfsDmn12bfc
TLSH
T10AA26D339C688D7B6EE79E85F54A322B9FB940B7D6852E90D2DC5E0C01DB2CC2316D19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d8f169d868814480525e0968f34c773d3a56b826b2a91b5ad229e98e4433985f
MD5 240dd6e103af78852c37947df7f0ee92
SHA1 a57dcd0d94af448f3aaf1bccfe2bb36f2dfc5040
SHA512 20cbf7d145e0a7ec362a2903d3ce4df03cfa8c9ae7fa405607f5adfeefc0959a40f6c43cffc9ad456e0f540cd9ac8e6f7d6186b0653dfb11414ff046511fbd83
SSDEEP 192:JONVh6v+YLNQmiUy05Zh+CGlOdmuus3EU6:JON/6vz/7Zh+CMONUU6
TLSH
T10102FA35B9782CAB9FB2AE45F48737275FA8113BE6912F80D9D82F1C01D765C2306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 a674aa2f415d569eb25c6f38ec3ec8a77dc04007e19c21b72edabae624243cb6
MD5 4d824f2d718107cc9c8c07be5b1170a1
SHA1 345d6bb135ce5a68c163439191dcb0ab8d565cd9
SHA512 45250ea773ba410aeb3b56be18c382062a0196d359ac8cbf458172ba7113618a5b9b6d6e26bd874b6c5b414118545c43a9309013e3be3512551a6e7c4df30a8c
SSDEEP 384:IotNn/s3n9SZsNHqMxBzijrnVCHe+CMOfqQ1Dmn15wbAjEc:hj+9uQ/yC+kOfjDmn12bfc
TLSH
T107927C36A8781D671EE39949F54B322B5FB88077E7852E94D1DC6F0C02DB7C82316D2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b2852fbf80ccca06644b987290d6af99e9ec0d130c2830b8fa27dcd6ce42f14a
MD5 7f60720aae3dac140c579f71e7097690
SHA1 7f7b4c237dd33ecdf5cbb48ab9be71561c2fbe27
SHA512 a537cea01c1fc02d8df5ce24cdd2078dc39bf3382d35a2b749ca0686fc99af8cc85966f30d6c8b3dc28accdc364652e3e51c811bf8bc27272ad72d1eb724ce4b
SSDEEP 192:yONy6v+YL/QmiUyBVr51h+CGlOdmcheNYCHlqeU6:yONy6vzdsVV1h+CMOfq5DU6
TLSH
T18A123932B8786C6B5EA3A945F48731275EA84137EB863F80D5DC3F1C01DF69C230A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ab986f49-e32c-45a7-a37d-46921ada202b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ab986f49-e32c-45a7-a37d-46921ada202b.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 14476a24f3f4f4b36b24db23298ff04151c38843da399c932797923091088a91
MD5 06341a7ab634cadfe32b1fbce99054d0
SHA1 b8788831b737e4042c9b6be370d96b456b1f5c37
SHA512 41b4dbafc51477e50e8ed8f9858a5cce004ea0a61443ea2e218eb32e0fc26cb727248a79f62f1b3c715589aa3b032ace1316f9e72c0dde7b08b7702175ddec31
TLSH
T11F412C58BAE91118B3B76E569BFAA86E487FBD362F07D05E10010D4F0A22B04CDA1737
MD5 SHA1 SHA512 TLSH

Submit Download

2ea1fff8-5f92-4614-8ec9-fba67fcab62f.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5012_510864727\2ea1fff8-5f92-4614-8ec9-fba67fcab62f.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
TLSH
T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5012_510864727\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download