hxxp://youtube[.]com

Analysis

user interaction
yes
max time kernel
290s
max time network
296s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/07/2026, 00:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://youtube.com
Sample260701-bbjqsadv8x

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5292	DCRCVDrv.sys

Suspicious use of SetThreadContext 6 IoCs

description	pid	Process	procid_target
PID 4316 set thread context of 4196	4316	KiddonsModMenu.exe	180
PID 4084 set thread context of 6104	4084	KiddonsModMenu.exe	187
PID 2804 set thread context of 3524	2804	KiddonsModMenu.exe	192
PID 3936 set thread context of 1884	3936	KiddonsModMenu.exe	197
PID 2024 set thread context of 3864	2024	KiddonsModMenu.exe	202
PID 704 set thread context of 3104	704	KiddonsModMenu.exe	207

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1404	msedge.exe
4500	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134273411178344832"	msedge.exe

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{DBC536FA-C0A2-4538-B829-750A37510EA2}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{97FE9A2F-72D2-4B86-8074-59A81543EF07}	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2272	chrome.exe
2272	chrome.exe
5748	msedge.exe
5748	msedge.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 26 IoCs

pid	Process
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
2272	chrome.exe
2272	chrome.exe
2272	chrome.exe
2272	chrome.exe
1212	msedge.exe
2272	chrome.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2272	chrome.exe
Token: SeCreatePagefilePrivilege	2272	chrome.exe
Token: SeShutdownPrivilege	2272	chrome.exe
Token: SeCreatePagefilePrivilege	2272	chrome.exe
Token: SeShutdownPrivilege	2272	chrome.exe
Token: SeCreatePagefilePrivilege	2272	chrome.exe
Token: SeShutdownPrivilege	2272	chrome.exe
Token: SeCreatePagefilePrivilege	2272	chrome.exe
Token: SeShutdownPrivilege	2272	chrome.exe
Token: SeCreatePagefilePrivilege	2272	chrome.exe
Token: SeShutdownPrivilege	2272	chrome.exe
Token: SeCreatePagefilePrivilege	2272	chrome.exe
Token: SeShutdownPrivilege	2272	chrome.exe
Token: SeCreatePagefilePrivilege	2272	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
2272	chrome.exe
2272	chrome.exe
2272	chrome.exe
2272	chrome.exe
2272	chrome.exe
2272	chrome.exe
2272	chrome.exe
2272	chrome.exe
2272	chrome.exe
2272	chrome.exe
2272	chrome.exe
2272	chrome.exe
2272	chrome.exe
2272	chrome.exe
2272	chrome.exe
2272	chrome.exe
2272	chrome.exe
2272	chrome.exe
2272	chrome.exe
2272	chrome.exe
2272	chrome.exe
2272	chrome.exe
2272	chrome.exe
2272	chrome.exe
2272	chrome.exe
2272	chrome.exe
2272	chrome.exe
2272	chrome.exe
2272	chrome.exe
2272	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
2272	chrome.exe
2272	chrome.exe
2272	chrome.exe
2272	chrome.exe
2272	chrome.exe
2272	chrome.exe
2272	chrome.exe
2272	chrome.exe
2272	chrome.exe
2272	chrome.exe
2272	chrome.exe
2272	chrome.exe
2272	chrome.exe
2272	chrome.exe
2272	chrome.exe
2272	chrome.exe
2272	chrome.exe
2272	chrome.exe
2272	chrome.exe
2272	chrome.exe
2272	chrome.exe
2272	chrome.exe
2272	chrome.exe
2272	chrome.exe
2272	chrome.exe
2272	chrome.exe
2272	chrome.exe
2272	chrome.exe
2272	chrome.exe
2272	chrome.exe
2272	chrome.exe
2272	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1212 wrote to memory of 3612	1212	msedge.exe	85
PID 1212 wrote to memory of 1404	1212	msedge.exe	86
PID 1212 wrote to memory of 4716	1212	msedge.exe	87
PID 1212 wrote to memory of 4716	1212	msedge.exe	87
PID 1212 wrote to memory of 4716	1212	msedge.exe	87
PID 1212 wrote to memory of 2144	1212	msedge.exe	88
PID 1212 wrote to memory of 2144	1212	msedge.exe	88
PID 1212 wrote to memory of 2536	1212	msedge.exe	90
PID 1212 wrote to memory of 2536	1212	msedge.exe	90
PID 1212 wrote to memory of 2536	1212	msedge.exe	90
PID 1212 wrote to memory of 1068	1212	msedge.exe	91
PID 1212 wrote to memory of 1068	1212	msedge.exe	91
PID 1212 wrote to memory of 1068	1212	msedge.exe	91
PID 1212 wrote to memory of 3468	1212	msedge.exe	92
PID 1212 wrote to memory of 3468	1212	msedge.exe	92
PID 1212 wrote to memory of 3468	1212	msedge.exe	92
PID 1212 wrote to memory of 1604	1212	msedge.exe	93
PID 1212 wrote to memory of 1604	1212	msedge.exe	93
PID 1212 wrote to memory of 1604	1212	msedge.exe	93
PID 2272 wrote to memory of 1636	2272	chrome.exe	96
PID 2272 wrote to memory of 1856	2272	chrome.exe	100
PID 2272 wrote to memory of 1856	2272	chrome.exe	100
PID 2272 wrote to memory of 4500	2272	chrome.exe	101
PID 2272 wrote to memory of 4964	2272	chrome.exe	102
PID 2272 wrote to memory of 4964	2272	chrome.exe	102
PID 2272 wrote to memory of 3388	2272	chrome.exe	104
PID 2272 wrote to memory of 3388	2272	chrome.exe	104
PID 2272 wrote to memory of 4484	2272	chrome.exe	105
PID 2272 wrote to memory of 4484	2272	chrome.exe	105
PID 2272 wrote to memory of 3912	2272	chrome.exe	106
PID 2272 wrote to memory of 3912	2272	chrome.exe	106
PID 2272 wrote to memory of 4752	2272	chrome.exe	107
PID 2272 wrote to memory of 4752	2272	chrome.exe	107
PID 2272 wrote to memory of 4396	2272	chrome.exe	108
PID 2272 wrote to memory of 4396	2272	chrome.exe	108
PID 2272 wrote to memory of 4084	2272	chrome.exe	109
PID 2272 wrote to memory of 4084	2272	chrome.exe	109
PID 1212 wrote to memory of 204	1212	msedge.exe	110
PID 1212 wrote to memory of 1972	1212	msedge.exe	111
PID 1212 wrote to memory of 204	1212	msedge.exe	110
PID 1212 wrote to memory of 1972	1212	msedge.exe	111
PID 1212 wrote to memory of 4080	1212	msedge.exe	112
PID 1212 wrote to memory of 4080	1212	msedge.exe	112
PID 1212 wrote to memory of 4080	1212	msedge.exe	112
PID 2272 wrote to memory of 1740	2272	chrome.exe	113
PID 2272 wrote to memory of 1740	2272	chrome.exe	113
PID 1212 wrote to memory of 5492	1212	msedge.exe	115
PID 1212 wrote to memory of 5492	1212	msedge.exe	115
PID 1212 wrote to memory of 5492	1212	msedge.exe	115
PID 1212 wrote to memory of 5636	1212	msedge.exe	117
PID 1212 wrote to memory of 6012	1212	msedge.exe	118
PID 1212 wrote to memory of 6012	1212	msedge.exe	118
PID 1212 wrote to memory of 5296	1212	msedge.exe	119
PID 1212 wrote to memory of 5296	1212	msedge.exe	119
PID 1212 wrote to memory of 5336	1212	msedge.exe	120
PID 1212 wrote to memory of 5172	1212	msedge.exe	140
PID 1212 wrote to memory of 1444	1212	msedge.exe	141
PID 1212 wrote to memory of 4932	1212	msedge.exe	142
PID 1212 wrote to memory of 1140	1212	msedge.exe	144
PID 1212 wrote to memory of 1140	1212	msedge.exe	144
PID 1212 wrote to memory of 1140	1212	msedge.exe	144
PID 1212 wrote to memory of 1880	1212	msedge.exe	145
PID 1212 wrote to memory of 1880	1212	msedge.exe	145
PID 1212 wrote to memory of 1880	1212	msedge.exe	145

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://youtube.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffbf4cec188,0x7ffbf4cec194,0x7ffbf4cec1a0
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1836,i,13042946200998791537,17643812141820274110,524288 --field-trial-handle=2352,i,17236851240121906816,16987551535626776095,262144 --variations-seed-version --mojo-platform-channel-handle=2380 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1668,i,4895864184368535127,12637583488610830511,262144 --field-trial-handle=2352,i,17236851240121906816,16987551535626776095,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:2
  2⤵
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2500,i,5147822410943707480,12455197772260417868,524288 --field-trial-handle=2352,i,17236851240121906816,16987551535626776095,262144 --variations-seed-version --mojo-platform-channel-handle=2512 /prefetch:8
  2⤵
  PID:2144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,13505223382361724442,18341609489826106229,2097152 --field-trial-handle=2352,i,17236851240121906816,16987551535626776095,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:2536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,8687031894729562725,4918001421699110015,2097152 --field-trial-handle=2352,i,17236851240121906816,16987551535626776095,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:1068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4188,i,9442999183621681213,16328773535592382813,2097152 --field-trial-handle=2352,i,17236851240121906816,16987551535626776095,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:1
  2⤵
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4196,i,3222238952348896447,7539451190113297275,2097152 --field-trial-handle=2352,i,17236851240121906816,16987551535626776095,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:2
  2⤵
  PID:1604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5072,i,13952923350255398771,13905366625089063985,524288 --field-trial-handle=2352,i,17236851240121906816,16987551535626776095,262144 --variations-seed-version --mojo-platform-channel-handle=5088 /prefetch:8
  2⤵
  PID:204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,15760122494704892421,17287798118382247217,524288 --field-trial-handle=2352,i,17236851240121906816,16987551535626776095,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5628,i,5073008475430508504,7126195108670333706,2097152 --field-trial-handle=2352,i,17236851240121906816,16987551535626776095,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:1
  2⤵
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5916,i,2981604132495112328,17746531660879763281,2097152 --field-trial-handle=2352,i,17236851240121906816,16987551535626776095,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:1
  2⤵
  PID:5492
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6116,i,6221062726216344552,6075329229511965579,524288 --field-trial-handle=2352,i,17236851240121906816,16987551535626776095,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:8
  2⤵
  PID:5620
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6116,i,6221062726216344552,6075329229511965579,524288 --field-trial-handle=2352,i,17236851240121906816,16987551535626776095,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:8
  2⤵
  PID:5636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6360,i,18332590406783240440,10060952630070688951,524288 --field-trial-handle=2352,i,17236851240121906816,16987551535626776095,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:8
  2⤵
  PID:6012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6520,i,9744909945837961045,13192285689198880238,524288 --field-trial-handle=2352,i,17236851240121906816,16987551535626776095,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:8
  2⤵
  PID:5296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3572,i,17519847921223502138,15560577293783388309,524288 --field-trial-handle=2352,i,17236851240121906816,16987551535626776095,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:8
  2⤵
  - Modifies registry class
  PID:5336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6204,i,14241543685593114398,16875826084637170050,524288 --field-trial-handle=2352,i,17236851240121906816,16987551535626776095,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:8
  2⤵
  PID:5172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6196,i,4970160923766458005,5703177760815388761,524288 --field-trial-handle=2352,i,17236851240121906816,16987551535626776095,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:8
  2⤵
  PID:1444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6212,i,3852604265779177442,1831231814709047763,524288 --field-trial-handle=2352,i,17236851240121906816,16987551535626776095,262144 --variations-seed-version --mojo-platform-channel-handle=7152 /prefetch:8
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=5300,i,9009781945201621954,2156807216307395463,2097152 --field-trial-handle=2352,i,17236851240121906816,16987551535626776095,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:1
  2⤵
  PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7080,i,314327950142122603,12851491083481055123,2097152 --field-trial-handle=2352,i,17236851240121906816,16987551535626776095,262144 --variations-seed-version --mojo-platform-channel-handle=6640 /prefetch:1
  2⤵
  PID:1880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=5124,i,1615844830242788992,12873857023843296506,2097152 --field-trial-handle=2352,i,17236851240121906816,16987551535626776095,262144 --variations-seed-version --mojo-platform-channel-handle=7016 /prefetch:1
  2⤵
  PID:1248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=5096,i,12589063074374467845,14140764096378740535,2097152 --field-trial-handle=2352,i,17236851240121906816,16987551535626776095,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:1
  2⤵
  PID:6116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=4900,i,11674977979850623384,15693186140326515367,2097152 --field-trial-handle=2352,i,17236851240121906816,16987551535626776095,262144 --variations-seed-version --mojo-platform-channel-handle=4976 /prefetch:1
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7016,i,3521864258941462117,9371678247775414328,524288 --field-trial-handle=2352,i,17236851240121906816,16987551535626776095,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:8
  2⤵
  PID:5624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5480,i,15488391950294131463,4095201302802931598,262144 --field-trial-handle=2352,i,17236851240121906816,16987551535626776095,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5548,i,8065552035822095370,15235118224747872355,524288 --field-trial-handle=2352,i,17236851240121906816,16987551535626776095,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:8
  2⤵
  PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5464,i,3909752782959463794,18146024261622642051,524288 --field-trial-handle=2352,i,17236851240121906816,16987551535626776095,262144 --variations-seed-version --mojo-platform-channel-handle=4956 /prefetch:8
  2⤵
  PID:772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5380,i,7860285223810608948,16151118358884430621,524288 --field-trial-handle=2352,i,17236851240121906816,16987551535626776095,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:8
  2⤵
  PID:2532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=7288,i,5636379225309422846,10585559352455313863,2097152 --field-trial-handle=2352,i,17236851240121906816,16987551535626776095,262144 --variations-seed-version --mojo-platform-channel-handle=7268 /prefetch:1
  2⤵
  PID:5480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=7408,i,6353766199409763595,14569704829405418279,2097152 --field-trial-handle=2352,i,17236851240121906816,16987551535626776095,262144 --variations-seed-version --mojo-platform-channel-handle=7184 /prefetch:1
  2⤵
  PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=4936,i,8819065263994788924,13218839534124268917,2097152 --field-trial-handle=2352,i,17236851240121906816,16987551535626776095,262144 --variations-seed-version --mojo-platform-channel-handle=3948 /prefetch:1
  2⤵
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=7708,i,11396054633949811027,14331120299726031874,2097152 --field-trial-handle=2352,i,17236851240121906816,16987551535626776095,262144 --variations-seed-version --mojo-platform-channel-handle=7684 /prefetch:1
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=7928,i,17707839989495901925,2679510925624520163,2097152 --field-trial-handle=2352,i,17236851240121906816,16987551535626776095,262144 --variations-seed-version --mojo-platform-channel-handle=7884 /prefetch:1
  2⤵
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=8052,i,4280686023343512626,6494292614416803676,2097152 --field-trial-handle=2352,i,17236851240121906816,16987551535626776095,262144 --variations-seed-version --mojo-platform-channel-handle=8060 /prefetch:1
  2⤵
  PID:5832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8284,i,7770930867272333286,3419385565657485122,524288 --field-trial-handle=2352,i,17236851240121906816,16987551535626776095,262144 --variations-seed-version --mojo-platform-channel-handle=7336 /prefetch:8
  2⤵
  PID:6132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=8288,i,12832079167053233684,15946626247947336860,2097152 --field-trial-handle=2352,i,17236851240121906816,16987551535626776095,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:1
  2⤵
  PID:6124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=8528,i,11780250522944763624,2438572849413737957,2097152 --field-trial-handle=2352,i,17236851240121906816,16987551535626776095,262144 --variations-seed-version --mojo-platform-channel-handle=8496 /prefetch:1
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8480,i,12521284037125773764,11069690965065507277,524288 --field-trial-handle=2352,i,17236851240121906816,16987551535626776095,262144 --variations-seed-version --mojo-platform-channel-handle=8364 /prefetch:8
  2⤵
  PID:5248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=8128,i,11627466636071960016,14725871584899881649,2097152 --field-trial-handle=2352,i,17236851240121906816,16987551535626776095,262144 --variations-seed-version --mojo-platform-channel-handle=7532 /prefetch:1
  2⤵
  PID:2100

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1516

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x124,0x128,0x12c,0xf4,0x130,0x7ffbf2dbc728,0x7ffbf2dbc734,0x7ffbf2dbc740
  2⤵
  PID:1636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1692,i,14623019565477337086,458688471439353464,262144 --field-trial-handle=1984,i,18257500584716894715,11370785649581964974,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1980 /prefetch:2
  2⤵
  PID:1856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1588,i,6331107781801022092,536616591277342910,524288 --field-trial-handle=1984,i,18257500584716894715,11370785649581964974,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2024 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2328,i,4257122874434902595,9941223933783307241,524288 --field-trial-handle=1984,i,18257500584716894715,11370785649581964974,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2496 /prefetch:8
  2⤵
  PID:4964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3208,i,11433272954455411462,6506052890924987539,2097152 --field-trial-handle=1984,i,18257500584716894715,11370785649581964974,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:3388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3244,i,12998769173762589522,7184319916885232261,2097152 --field-trial-handle=1984,i,18257500584716894715,11370785649581964974,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:4484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4488,i,10749184747822988081,17594177985508749093,2097152 --field-trial-handle=1984,i,18257500584716894715,11370785649581964974,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4496 /prefetch:2
  2⤵
  PID:3912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4716,i,15218149304668354859,14690301047372481243,2097152 --field-trial-handle=1984,i,18257500584716894715,11370785649581964974,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4756 /prefetch:1
  2⤵
  PID:4752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3920,i,12172083924419996716,3340646902905383037,524288 --field-trial-handle=1984,i,18257500584716894715,11370785649581964974,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4704 /prefetch:8
  2⤵
  PID:4396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4896,i,5772034973086796795,11852127494031973597,524288 --field-trial-handle=1984,i,18257500584716894715,11370785649581964974,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5020 /prefetch:8
  2⤵
  PID:4084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5200,i,494250573631392466,8486083271681831640,2097152 --field-trial-handle=1984,i,18257500584716894715,11370785649581964974,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5228 /prefetch:1
  2⤵
  PID:1740

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4916

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2604

C:\Users\Admin\AppData\Local\Temp\Temp1_KiddonsModMenu.zip\KiddonsModMenu\KiddonsModMenu.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_KiddonsModMenu.zip\KiddonsModMenu\KiddonsModMenu.exe"
1⤵
PID:3620

C:\Users\Admin\Downloads\KiddonsModMenu\KiddonsModMenu\KiddonsModMenu.exe
"C:\Users\Admin\Downloads\KiddonsModMenu\KiddonsModMenu\KiddonsModMenu.exe"
1⤵
- Suspicious use of SetThreadContext
PID:4316
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regsvcs.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regsvcs.exe"
  2⤵
  PID:4196

C:\Windows\Temp\DCRCVDrv.sys
C:\Windows\Temp\DCRCVDrv.sys
1⤵
- Executes dropped EXE
PID:5292

C:\Users\Admin\Downloads\KiddonsModMenu\KiddonsModMenu\KiddonsModMenu.exe
"C:\Users\Admin\Downloads\KiddonsModMenu\KiddonsModMenu\KiddonsModMenu.exe"
1⤵
- Suspicious use of SetThreadContext
PID:4084
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regsvcs.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regsvcs.exe"
  2⤵
  PID:6104

C:\Users\Admin\Downloads\KiddonsModMenu\KiddonsModMenu\KiddonsModMenu.exe
"C:\Users\Admin\Downloads\KiddonsModMenu\KiddonsModMenu\KiddonsModMenu.exe"
1⤵
- Suspicious use of SetThreadContext
PID:2804
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regsvcs.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regsvcs.exe"
  2⤵
  PID:3524

C:\Users\Admin\Downloads\KiddonsModMenu\KiddonsModMenu\KiddonsModMenu.exe
"C:\Users\Admin\Downloads\KiddonsModMenu\KiddonsModMenu\KiddonsModMenu.exe"
1⤵
- Suspicious use of SetThreadContext
PID:3936
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regsvcs.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regsvcs.exe"
  2⤵
  PID:1884

C:\Users\Admin\Downloads\KiddonsModMenu\KiddonsModMenu\KiddonsModMenu.exe
"C:\Users\Admin\Downloads\KiddonsModMenu\KiddonsModMenu\KiddonsModMenu.exe"
1⤵
- Suspicious use of SetThreadContext
PID:2024
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regsvcs.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regsvcs.exe"
  2⤵
  PID:3864

C:\Users\Admin\Downloads\KiddonsModMenu\KiddonsModMenu\KiddonsModMenu.exe
"C:\Users\Admin\Downloads\KiddonsModMenu\KiddonsModMenu\KiddonsModMenu.exe"
1⤵
- Suspicious use of SetThreadContext
PID:704
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regsvcs.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regsvcs.exe"
  2⤵
  PID:3104

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 0189d56a202dcf23c35c4d8068936776f13fe28ccf7572b3d03fa639187b6db3
MD5 0792dd4c94c4060dd845e6997b200155
SHA1 3cf945dbba5a54a04bf1507e97aabb4b12dd32b1
SHA512 5975bb5282a755755905662ccfe0e07974389cc967bbf37cffd4e35ddbdeb4272364ebc87e76c88a08fca933e467ebb6c7c063c4a2e4935423a5f76db13fbd15
TLSH
T1BCB02208E8802C03F380C3B00CAB2A88EC200EEC8202832282C220B080B02F0F00B02C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 e27bf6af6384a4663c8414ef12c10d54db97d7884ef81214223ed64c8cb4e17d
MD5 8db078f0f656f2829b4aab46346bd2bd
SHA1 3cf4d05bdd9900d1b550fcd751addf7ba77e991c
SHA512 c2aeb770aa7ede7877f2e4ea7ddb8e75ce19d09b8b61b7de7c29ba63a0e4acdc9eb8336454e21b508c64afc42e41a55912c3107569a004918c232f3dc0a6f10e
TLSH
T1CC41ACF783F4897D860096E4AA156F1FEE690924131C7CA2C9D4AE0B57F28B2D20078F
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 691B
SHA256 8b5b1d7beda353f4f80378cfded78db57c04a56353a9398d6df56153e28df51a
MD5 b5bc3444f18b31f32e65eb637e040065
SHA1 cd354a807d32a975f129cc5d051c87d0c24d271a
SHA512 f7ce5bac2cdb9225a53894bc7eea5d9f60356692a89a8ebb4ebc1ed4d17bdbfe2a0d3290592c8ac527cc1c083bde2b07ffc1c68b989026b4a902ef206e525ec0
TLSH
T149017B9BABBE3467107904B71D0CBC45AA7A7834038164EDCA67936CF1D64F32B06063
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 ec49e54e04265335272834f3a9c9fedc6da49361d0a0e0e2a5d09a2a8fb8c3cc
MD5 b1fbf674aa0d4c2de89309cd7a9eebfb
SHA1 0f370d72f698074948febf948be9fcc5673f36f0
SHA512 d551b8d91689c6c1c91ecd89b371ea85df1261160af5424151cb9ddcbdea764f3ae26b92b0e9b9fba5f2a4729e4c2e3909ba5ef7a6b8197a2c116873b25d2f26
SSDEEP 192:30RVT3YI7NDgdRtqFxwWDxv7cpAPRp2qg9BHsb+WNnVoG00PlvFpwPyIsnAUge:ER9lgyrwUXlgrwb0W+e
TLSH
T14832A61EAD54657B4CDBD32AF9267B57E3F5102235902E80E6FC8A2C16EB5CC221B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 16KB
SHA256 ac883f50a13b9c80e544411f1331af4575f3b2f3b141437197c53fd0c7fb76c5
MD5 c7f34f00c10d737e29facf4108b856ec
SHA1 854e6f24a8ef76e979b88fbaf215ce935e962602
SHA512 6b3e5cb7239a0e10410633aa2ba4ab624df781b361ce103b11579e1a01cc4352eaf43c44b134fc1010285409b9833f4586dca2ec7a0d1baa3bea79691452dfa1
SSDEEP 384:dXjRs7KxkXqKf/pUZNCgVLH2HfgslKR7pLuLcMzOXODR0+ErU3DTHGENEAYd:dzRs7KxkXqKf/pUZNCgVLH2Hfgs8R7pT
TLSH
T13272E9676C4C9A770F94C6CCD8267F4FADB5014B66E9886483FA582503D5BCF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 582aeb4ce2a6643ca0b4a349d9d9c53527eacd8cf978d99d75e09b05dbc1083b
MD5 2bcde01117fdaa029dcfa6215b301148
SHA1 ad629d6e0c062054ed81b4d80d47a91e914ad3f3
SHA512 572a4bdf55304ea9974b718bae0daf773b5bd614af08ff83513e83257b568b316df9e66627bcd3b0908c672d71afa393e39d213d55be49c698027750ae82e71d
TLSH
T1A4B00295C1026B52D0C303B0269994DCB1A0DF25CB43161692E01A66FB25AF5A939261
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe586cee.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe586cee.TMP
Size 96B
SHA256 344f474005847306ebd70d7ae4123c30707375b9d3c0dc7a2d9f1638f5434e16
MD5 3bf8a668b3fb9902608f07c2e3f2cb00
SHA1 c19fc7b846b4d53e9e133ca76a91b67cefd2de14
SHA512 08d3b7527d5f0a2c946e087819bb1be875d718e81a4529a98bebe3e57108953423f552d83942ad74af7207d6215acbd3d81c33b89223fd106b7b6f73f8f5655a
TLSH
T124B0025AC6026623D1520BF02995B9DAB170DF36C7031216D2F12A76EE2766186355A1
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 d7f86089e782577e02567f7c03c4c061860a4c1c7d27ffe5b85c424d183d4e90
MD5 d0f04c239be107af1881eec681d8bbec
SHA1 04b006537accb0ccec1054c35449e3e725e8b095
SHA512 f00d673605269139f76f014415bc5e04b591f7bc10891d0e5212e2cc0256a7c1ab9c589aae1b9eace122830a248b9f56d927632744a0b845e221f6e7ead09469
SSDEEP 3072:SPFUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ/:2FmUi21rSm8uUVNSlzY/
TLSH
T1C6C31300BAE3E8F2EE5930447BEE2A145D6C0D819291C54152739D419DEF3C71FAAB39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 835b05ce94d4cc57f4575f82239310ef4c0e61b5662eecb9deecd41086e19308
MD5 19a43c79db43e15c47d17ddfb98f2afe
SHA1 c26d6b33a6c97f4e7b67ce93ce23ec4ea4db047c
SHA512 4b755acbfa725c427da28ed96be269e3d39ebaeb9db687d9d105d65fe1be7e210ca54930390a13e5a0d614a8ee62670287bf843b18439d9f49f1d4d9f416a03b
SSDEEP 3072:ShFUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ6:+FmUi21rSm8uUVNSlzY6
TLSH
T1F5C31200BAE7F8B2EE99304476EE3A159D680D818291C54157739E419DEF3C71FAEB38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 994380ffd288a5f1a9acc9eb76a487a55b12cc1daec839d811240f6cbdc4da3a
MD5 f5ed4946834be586ac6410ed88740a7c
SHA1 6108ce368e8b3bb8012956bb25606c3b16835c7b
SHA512 76bf60b37c50422ab125edd3da70629e685408a106655a9b7e5cb6aa7b6a9000c76d8ac2f5dc85e58e893b61bef9b539b9488ac894f1fc1338a58944dc9f4711
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P77:fwUQC5VwBIiElEd2K57P77
TLSH
T1E5B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 758df8d3fcc8153add0884f31eebee2a2577adda6817b51a21944c2f22794229
MD5 dfe64ea383e58df01fbdd8c6865b3a83
SHA1 64d0ff086bd183d34c0b6b57979d47d1fe496dd7
SHA512 524a90cba89216a298c0432d24ac36c2e9c4be3586290c83a8e424408da052cee2b563929aeda73dc89ea7e7dbb596e97fee811e69b8a48e16ebaa5a39d7063e
TLSH
T1BFD0A73076696C96D538147194314701BEA58556219A96066144840D5C796C2B68A5A2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6de34b260036ecaa4ce5839bc4a7ff7495e50b7b94349b12d9f840ca0e76da3b
MD5 56d82099872fb501c566d072ae897035
SHA1 2c96501551fc13c09496780960d8e7ccb4957b77
SHA512 c4b4017256caf25e88f146e6104134cddfd15089203e8e74c5196627fc92897f9fe7e3fc5c8305032be88e9409cdbc5dfe1e81017fcd5e38b3579b3d823b4a41
TLSH
T160D0C073378C7C00EA090170D013C3031FA7855824C39F03B100C01C54B43D9738B093
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f5dece638cd89af82b06bd2fcb3d1738eef64d2275be237184ea8bff7af3fdfa
MD5 f19ec2293392af872f10929c41627e26
SHA1 0576f5277c470f5bb8c3f4d3786ca8d967d0a33e
SHA512 4cc85dc71d34bb516f8fe45b565a6a9b4cda255a931f33289247ed84150baf0e2df40fc87109df41771553b92545ed858197cdd3d673694c83458cf9812aa9dd
TLSH
T16CD02272268C6C00EA090170D01383021EA6855824839B03A100C01C44A52D9728A093
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000087

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000087
Size 57KB
SHA256 6303475cdd19a7c08d011c6c6862e3789b39f95797602963a78cac17ff73d1e5
MD5 73fe08c0771b0b44243114c8ea8b86bf
SHA1 03015c3d3ea5bb634dd29a50623a6147d206dc0c
SHA512 f4fe1b7b7562c4f1187ca0621ff4006be0fad055e41d772a1ff4a421eb0d18794e3c21dad72cc469b889c6ed9642616ab9c8b5bd27d87d8fb5b8f228c96407d6
SSDEEP 1536:5HBwP9e8JdgrDq3W2leMPq1AOFgHDU3kQj2W:5hc7grO47C9Du
TLSH
T1284302CFF0D8C6FE215052556E6E7628C261891FEB118DB2443F2FB2999D04172FBAE1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000088

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000088
Size 650KB
SHA256 305d7aa82b006dcc8437bf54a6aa003621574824a9fe0bc9b05a124bcbc70c00
MD5 feed2410cf7d6ff7c9f22d51e6d9aacd
SHA1 91d23d3a9b5f555296c28e692217c04722697d26
SHA512 a919c344a4024ec5459c63a30437982a883cbb9f35fbd14c39aaec84cdb7236502c2a91d351009c5194e0a8005b719ea096ec29d6ff0bb175d5c677e1142ffab
SSDEEP 12288:K4D4DWDKDHtk2Ah2pXoDGPi5kDLSdOPqSIOmz79OUDneqTDrbhEbTdTGW1+:K4D+WDck2AsBPi6KdOSSchOUrxXSPAW4
TLSH
T145E423A8A06A13494D9E636593B3F17DA0743FB828A926BC3D742F41DFD640B85D313E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000089

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000089
Size 22KB
SHA256 e3fcc455108440bfa42d081546994bf6971253c5e45db97711fa45fb0805abdf
MD5 90e3c1ba3b93dcb12053821f461e5555
SHA1 f9bd3e9147ad19511f7724f3530e917c6222c1ae
SHA512 ec7785950920770b29e20a53d491b8a49cdae3fe8378739590730318f08b3aeaa15d5946badfa3740cde355532edb3ff5266ec7aeb01a79494150805e6562818
SSDEEP 384:ln+Sj9RmPBNVfnbHeo5LYJPuyUPoAgVDHU+SrkbeA8dEzPrmhmwD+c6+9xZfRtvS:V/R2hLrsJP8gJn8dEzG6+tvS
TLSH
T14AB2E0D4D8ABD17FB8D4D0CA6D66D9BF4E8483347DC62161AA9E8442E4084335B8D986
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008a
Size 34KB
SHA256 490c4f216a57a6b84816e50b36decbd570a7076bcfdf88b5e6139a0bc596e0c6
MD5 4aacb00449a95c6170091a70db5e6caf
SHA1 fbc34f1e05e1659b49e2c716689375d5b8e3f95f
SHA512 964d1661dd91ff1f03fe27e93b1903b1d0cd2d92f33200acdb19a6b4c5d75c67807a66bdec35d3dc7e7f4d46425611eca40e7253110135cafa5ad583c4e444f2
SSDEEP 768:RRlQTbZe+G/584fessoRfKX3B7U9tWnMd0y8rbHGvjZv788ok:GTbZI584WIRt9YnM+y8rz+D
TLSH
T15FF2E13838FEEFA0E5A04C645C812EF7B6F388417A7C783F97E81545667918508F92E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008c
Size 274KB
SHA256 c2c2ecbb3b138ca3dd06c8b7c8697be9dfe8fab8f6b7d3760fb4cade00f039b9
MD5 f62f2ab06511a995bf1b081c0a7281a3
SHA1 ca2c9bfd08704257ab2e87117697048011ce7563
SHA512 bd5626b76c1d823d8e7e69f95544f53e6faadcd65061b562745629c6c0a1ddada106eadf7f9b314468ddcb0358d44f7bb906504a5750e4461fe9ecdcf1f164b9
SSDEEP 6144:io6lmb7i7yulCCjUChUafh1LHcNhoW9p7n2MqKIcF49EOAo0OM:io6c3CRUqDfh1H2hoW9pr2FdcFSEO/q
TLSH
T1815423B9074EF207D889271E0F74C8E0ABFCD9570C31A66685E257BCDB40FB2945A366
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 58383c3c1118bf7c5c1ca30b294254e7e5b7594345f81afedaa34dcf22cf5d53
MD5 b4175579a80a5ce9f8fa29543f70a4d8
SHA1 2ea00c991da055f6b42f486cbecee2fb67cdb409
SHA512 9047fcba2999708977a6a2593b2e2e1201f03b5b62ebf0061a6cbc5a6ede74d9163fee94dddd9fdc6800dd9be324db4b7494d8f527ff2b42d81205a889612fde
SSDEEP 96:t4lBg4gobj1IfLaF78UL32C9waml44jiBbyzUSeY:t4lB9t/AWl8UL32C9wamaciBA
TLSH
T1C2B1F72FCE9219C3FF540131D1EA1A03BB39AE885A037E926305507D751ABA2F1EBC74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 16f62999e0b831f5bd218920c2d428face024b253f7198ffa4de35771cf2320e
MD5 02444613e7f3519b1215a11f72dd5838
SHA1 faff9fa1ed7e1784a1f6034c05d4be5421aed358
SHA512 6a3119defeeb08c0fba5d7217e4127d7bc80239b495abf38fa9faa822e234f014c488812e98db075dd9c3748eb1e8a70b11a74d395b5f8478b61c0f9b88c81c9
SSDEEP 96:b4lRg4LgobS1IfzyaF78ULbGhH9sxvmluF++BbyzR31I:b4lR9ZmAzFl8ULbGhH9sBm8M+BZ
TLSH
T1A4C1FA2ECB9219D3EF540230D1EA1B03B73AAE4496137E925B04507C699A792F1EBCA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5980cf.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5980cf.TMP
Size 3KB
SHA256 49df2f68a6e876017e0793291bcc464ac46859540b692e85ea05a5818b36d2b2
MD5 b1ca56ce772b39f930379ba044a5b1ab
SHA1 09ba585ecf5b360fd3811d918618cd6852a9a01d
SHA512 80ceacc5ea6e44e9eebacfca16f022365a45f23307f16316d47957da61c9916957b574fb99d10c5fa082a508b7c8f3f375a924d4453d4a95e5daab73b6606d65
TLSH
T1A071816F8D4201D3EF211131D5DA1A03373E8DA94903BED2115898BDB91EB67F0D9D78
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000017.ldb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\000017.ldb
Size 17KB
SHA256 60ef4f0d65b31422c3775126e5226e1fd97a38df2571ddb65a7882cff6f8edf8
MD5 0d0d5693ebb7f59900de7279090b8818
SHA1 901a21e8bcb979dda78b3c6d810f84c3be33c8b9
SHA512 662c8060d85af48b617d8f58c87e5627c8de7e50649a4b31946dcbd449efe48eb828bf9c376ed2ac99f75a0c7dd515279e12aae7e43db1ce352a56b87409e335
SSDEEP 384:kjrusqocnUzTFPztepXxSWWafDwAFEJeqeIbev7VU:6rBPoHSW5DFEJehRJU
TLSH
T1C882B0675EE9C4DBC03AE3B7E4FD028D6E21680F319590DC9683311C19666F722ADE27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000018.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\000018.log
Size 156KB
SHA256 f93aba26670c422f96a48e45abff728baeb239db25893770d48105ee67818640
MD5 a2af90ef0e12163e95cb3b4f23ae1a2e
SHA1 9941729dc434e46922dd7f53ac98f56367658c9f
SHA512 f7e448a2dd956297fb29421fc0958ca2c0b6ea842c9cbbf488b96610edc573e86c0abac5626ced225ad46e3951d89f79b2d098d1ddbc211ca6c447ad65708b62
SSDEEP 3072:f/+EFJ3j3/TjdvbW2PZ6LqSHiKUA92eQzZ6LqS3:U
TLSH
T127F3B524A35282C5F03E836702561C1BE7399AD8DA2B34B5B9627E0D37E67403F2577E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000020.ldb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\000020.ldb
Size 12KB
SHA256 36cbf13ccc25ca92a1814b2c8e54d01d1dd8a86a9288f6a027d069da17d47800
MD5 f629077e336ef169d8335fe6b2a50b3c
SHA1 b8398cc660e53a8f92083c483be5076e0f7108c7
SHA512 f07b2af680c184132cb2acb2d7c6ade1b493731eb2a95666e5afbe44c6f878432dded4399e111c33d5bdf9feba92b0fdb4fdebed0c5dbf4c94b49900c548f24f
SSDEEP 192:b2jVY2/2zjqPXe6yxcHp8ngr4SnxAkXVC2cspYvdFXCas2raDy489mvkQNNkTpJ/:ijC0e6yepXxSWWafBwAFEJeqeIbeviD
TLSH
T11642BF4AADE8C8DBC5B2B23AE4F715852D21740E3250C09E9B83011C0976EAF15BEF57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\LOG
Size 6KB
SHA256 c0a1797456083283b76ffbe5571c1b3b1ec3e75dafaf588d599fa3f51d3ba09d
MD5 194c415f65649fb51170d4dc0bb231a3
SHA1 4bc37b968d95654b532bcb8649b4724b080f025c
SHA512 f6fc7c265129ffce28ed3cd90e7fc596157cf7c727560a00caa9e9d1e715ced75d22c6b383cb219a9db8d5ef2cf141ee3e32b6002461b7c835e7e88a210a0971
SSDEEP 96:FmKMmKC3bnlgYa7D0NiVtWKaFIXrkkZOjcJVgxXC5hJYrV4oAhOQQxy:nrlgh0+W91kZOsSCiAhOnxy
TLSH
T1CEE1D8C717064CAC11C3E2A2C928F085C99CB427664CAF54798CBADF27A641F9B5F1F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\MANIFEST-000001
Size 1KB
SHA256 d626519f25d7cc8be723d9e8723a0c8328f952a4176f54a8848e60c7ede9637b
MD5 434fb2c731734a486b7943a94510be9f
SHA1 2a49e0cfd8ef1f0c1e2596ff807ed6ef5f0c6f16
SHA512 e4a7041506ae03b4d413c6e5e5819f9d8631e1832b77518b9944c41c3953dc0731fbda69b2bb3fd2dd45cff67b18cfb4394126710bfbca02450e37eab4cef1bd
TLSH
T1E6210641EBE88482FABA0EB0053F7049BA56788D1C27DA1F5355616F81E3FC5DD70A2E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 22KB
SHA256 cc77dc21598ab727a202cabf29b60f861d1f4574d6050b85f285db8ef3bdcca1
MD5 67c8dd6a80d5676c7f184f6d778e477f
SHA1 42986a5154f674dbe13eaafffdfe1d80fd9a6185
SHA512 badfeb8c8f382aa83adf73f6f70873db95adbc8d8e54073f6eaeb07ac6c3deba38d9618f9e6ccfc975436a281e40201fbea319f61f1ef2d6d0d30d50d9d3a9fe
SSDEEP 384:DtLC1ncFncEz504qt99QeIoMxdezLD6w1kLtUTYGSuzh4X8d5CqEqehOeyG8NDEg:STW+g1K5jKs/R
TLSH
T17CA269F787D5C62ED8115BF496147E1BDE1D0A24832C3C2989D6EF4BA3E2032E25964F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 066a14b644dbc2b17bd665d0d23c1548f1846eff45bf5e30fdacb6b71173eecb
MD5 f7fe99c9317a1d80315de5015a3a16e2
SHA1 12cdb01143e1daa6fc86e64ab855bbe4e32ec1a4
SHA512 5f6c765c9ad860ff1e3fba9c54d634734493335a75ff8aa8b9535bbfeff01d085bac34ce799a573539ff602a988c9991670e5e4a806a453aa7a60c12e57c070f
SSDEEP 192:sxZV4a4/yM/jK1Ml8MkYo/f42sokXwVfVIdp0VZpVjVfVgSH+VC6+WNnVc//YwMs:sxZG7MX/f7so8wQ/SH0A/L9
TLSH
T1EB52E812AA34597B8CCBD219F951BB57E7F55472A2900E44AAFCCA0C05E7BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 4d3729a2bc7513e883fc29989c31779776903514ceced6551911a95c07e5c051
MD5 f1154cb8b202035c7ff9c9d58971ec2e
SHA1 9d0ef617c8ad052071cdff96698420cc64105293
SHA512 208f0bfd92f78d3dcdb5b3a0a36884a37100c0bd3e400a411cab7103a44cf658d9e5fa789606b60b476e2dce39a44cdbc09178294ff2463d0a208a1f2d8e3e59
SSDEEP 192:sxZVGQUnu3M4/yM/jK1MlnUQYfkYo/f42sYAkzCwVEVIdpHV5FVZpVEVuVQDVqHa:sxZinc7bFX/f7s/1wVftH0FNZLZ
TLSH
T13472E852AE34597BCCDBD219F961FB57E6F5546292800E44AAFCCB0C01E7BED220781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 4a94f55d65a4a711c091bbfc00a8022c306db6ac43a829860dd980e509210a32
MD5 49378fba6341e9ee7adf1ea2650f95d4
SHA1 1aa5d317fa01a526fd0e1e1f683e5fb30f5dd56d
SHA512 990ea4bbcfbb968cb6d14b120d456b64cf26733cf24f5a99d7e270406391c5928910407f610f2a62df839c7335c310d717cf2f28ee783ba65d48e9c894290ef5
SSDEEP 192:sxZVGQUnu3M4/yM/jK1MlnMkYo/f42sYAkzCwVxVIdp0VZpVIVfVqH+VC6+WNnVN:sxZinc7JX/f7s/1wqqH0IXwhZ
TLSH
T14462D852AA34597BCDDBD219F651BB53E6F55062A6800E44EAFCCB0C01E7BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 894eaa454a950a06621a32203a9bc3e12dcf9a90ecb7670cd38ac71f1b201d76
MD5 80e75e0f9e3c667299ec59ceca3bfc8a
SHA1 8865a22424dd9bd4f899ab7bb6d8f4967b989ede
SHA512 804319c26090382ed9e9a63d1f11658807d87eb9728d7bf9f9dfcd45593fc8089b18986fa42142aebb06517b06011cdc14861a0ebd1b4aeec3afbafd6b965b5d
SSDEEP 768:wJ4jeXmWvmKLE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhPLlrZ+d9rohaDcIan:wJ4jeXmWvmKLEu1jacPLZQd2Zz
TLSH
T1EED20A3B284CCB7E4F844E5CEC26AF976ED801CB6A584D5447FA894C03C76EB512B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\622a90ad-84d2-43dc-bbf0-736b6738abc4\index-dir\the-real-index
Size 2KB
SHA256 0263326fe4b6120dda44c86a527f973d121241414097f3f3eab2a56f07f849ca
MD5 0e7840ac068342528895e4c3b7d757b5
SHA1 902e6d8cbf96bd99210a87e93699ed5a25721180
SHA512 5caf8835468d97d7f69ebd212d67ffce528c87e5876bbc0cbce1cebf08a3dfb862d1e575fe8abbb72f4d08750b0260759c6bb055c7fb7815e38041f9ee49409f
TLSH
T13F41448CCC84ABADDC7551BE2D9815F687752D39FC58C2A24564B2B234036B41B4B9FC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5880f3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\622a90ad-84d2-43dc-bbf0-736b6738abc4\index-dir\the-real-index~RFe5880f3.TMP
Size 48B
SHA256 f5e8eb012b29b344e1812be939185c430f5e4a596eb729d4ebd8e78497bec8a9
MD5 449a059e0e3c306e65efd04149c1438b
SHA1 2d81d13b7013e3c18f2a433ef105078b7e70229f
SHA512 86c9ee8eb02fa9e89e7caaf8b9daf169c0e2b5a13cc48ee7a1260183038612612b9f72e544c2239b492ba282f4ec77333d4c04d2500b9b8c247d28569b93eb58
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\a5b8b695-6a33-4c23-8b71-d2399cd100ae\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\a5b8b695-6a33-4c23-8b71-d2399cd100ae\index-dir\the-real-index
Size 2KB
SHA256 8f5cce67b33c5521cc6210327c83b197cd52576f104850e5ae4f0818cb53110c
MD5 644ba3b0ac5f89383c9e0b4efa780ffb
SHA1 62121856f1f721a04492bd11d361c955a0ffacbf
SHA512 272763a7423fd9da04e1b06fdf5a997fae68148c45e65d42b6869de483c42aaf262e3c02b9cfddc64ec8e5f168395c1cccb97b26989defd196d0bf4e3a3de493
TLSH
T11951624CCC80ABADDC7591FA2C9414F267722D39FCA9C39285A5B1B134932B41B579FC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5906dc.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\a5b8b695-6a33-4c23-8b71-d2399cd100ae\index-dir\the-real-index~RFe5906dc.TMP
Size 48B
SHA256 80b89c8c612305adad56f73a95b6b65df5ebafae6cf569fa612cad12fd5fdea4
MD5 49043a73dada083dd38da4d2e5bfc9b2
SHA1 2085fd3d515a2a4abe0714558b76fa1a5c514edf
SHA512 00546f4d334c81b559f4d6d06595337e67571bbf397f1636391f4611c88e5ce4d47f60d9f5d8b8e41b94236deb31cc50a0d023bba4b6e05de9887e1630587167
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\ce8f5508-fd45-4f66-94ba-9767aebc58b0\index-dir\the-real-index
Size 576B
SHA256 caf70e018f8dcfcb241574fd1cffcf6035ef80a9efa0cab09248759ca5e2818e
MD5 5a23c7b716a7ea6d5472bac5b2647b31
SHA1 ee7459425e6f6f30473aa96aec682ac25386ac80
SHA512 2d9316a53807f0f59017fb2a184460f6d54acd6d329de5af930500b09a33d4d7156af0dc9dadea1960352ce0732f91c9b2ea51ddc9fc41e5dc39413b920d362e
TLSH
T1FAF0AB6D25F21865EE1049B254A36F74A234D9E620923FA349A892B7041FB93EC80340
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58e0c6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\ce8f5508-fd45-4f66-94ba-9767aebc58b0\index-dir\the-real-index~RFe58e0c6.TMP
Size 48B
SHA256 91e241317271c605844fa56cc9cafa9f90981545d7b977e39b845f3f175b1d8e
MD5 96c51a8268b33db39da79101b9fa97cf
SHA1 e5e5ce41a1aa0e46c2adcb3499635abd6a0210a5
SHA512 4fd36bc8f2f21b94e7982c4c1f46b6903f2129ea5e01c4a637123304f341d9537f30850d6388560312c12936bbd153ab0e84e1e15c4269d2588b850ebe6d4800
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 390B
SHA256 5340d24e625b50f07339865d141bec0fc094a76e0c144ef8e11e4c52110e770c
MD5 f4f9b3024723421338e54bbd4b436cdb
SHA1 a089a9ca4d11c0965f0d036d3d937db53433cff7
SHA512 adcee5d46b91aacc03083393ded03a276186909aa00cf87fe11e089c502061c5ea3b29e32c68805c043a8339e202b6c1131e6e7ec6fcbc84523a80a5663df0ed
TLSH
T1DAE068C5E6B38999EA775FE52839706F823AD8189C82DCBC2585A01931B1F07E550D2A
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 130B
SHA256 526b6df81af558dba66538e90a4e40eed90d9c9c7c99ee185b03a81f67d1d1a5
MD5 5573c292bc40c927254fdb070fa43050
SHA1 e30aae86821c57209efb21c854b9bdcc812531e5
SHA512 f18b82d15d99a2b5a6d58e7c5fcc25851d9b7cccc4cd59fb730eedacab15d0325f439808b05844d64370fc52b4187052dae46fa0f4334f97662bacfa27e79193
TLSH
T16CC092E685E1C6CF5A70ABCC2038B71E951BC15CA8C2CCF8A588A0523138F13CD02A3A
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 214B
SHA256 a0964f04c1de77728a7db44cbd52dad68d4e89cf8206fb313c62ad1fac3effd9
MD5 d17cc5e63290aa3ec5f9e0fcf0806f22
SHA1 5a493fadef49b294cf4c03be009f31127b63e7a3
SHA512 f52ff3668427be832c786643e4f05ce8b0cb4992eae3387673ed66fe4449397897d37fd0f3b1d5a63a6f08425ed3ec8f11e8c6ac6f9be284a1fca72a58078227
TLSH
T1E2D023FF41354D5A66309FC4A43CB26DC4594D0AD4C5CCB8660470CA38FC913C4015B4
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 56B
SHA256 c58cb79fa4a9ade48ed821dd9f98957b0adfda7c2d267e3d07951c2d371aa968
MD5 94275bde03760c160b707ba8806ef545
SHA1 aad8d87b0796de7baca00ab000b2b12a26427859
SHA512 2aabd49bc9f0ed3a5c690773f48a92dbbbd60264090a0db2fe0f166f8c20c767a74d1e1d7cc6a46c34cfbd1587ddb565e791d494cd0d2ca375ab8cc11cd8f930
TLSH
T1069002F74800819A0E20A9C82038A35DE40F818CD8C0CCF0900890423028A234002851
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 383B
SHA256 c2e87fc3da4fa4c71f9ed3317c6b1ba44e91968617c746a47495d0f181cfbdb7
MD5 41fb15ec17fdaa3d387b1016d520f34e
SHA1 112a10bf2ab9d6a353fa3ba51b53da0bf6cc2ab9
SHA512 7fd2728839a70bd313f7df66af4d836ecf9f10010d4f00464440a6b46506b9e492ee390cb28c5edcf84ac53b5163d1e4c21a5faf805dd98cc3d4ec41405e0ee5
TLSH
T167E068C5A6F2899AE9BB5FE52835B03E823AD0189C46DCBC6585801931B1F06E551D2A
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 140B
SHA256 b806e1ae66fa8e37e51566f4525db5cfcaab3f93c6831d2eb7ae5745eb33ed89
MD5 434e40c5f1d022939587a2dca4a0a3e6
SHA1 152486d79443747b7c3700aa24965175d17cc862
SHA512 484ae9cdebc7ba2fd5d27ed06ebba2483d6439ce5c8cdfc551ba0c0c8b3e27086f53046a02352e6424f14099950ab369a8bacdd34098de9cc3cd479c92e53561
TLSH
T174C02BE6C53290162A90E4C0D538238DA4BACC4E99C0CCF0C809F081307CF2BC001411
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 130B
SHA256 1be33e44e111b5fcb64b4800334551a09d1de0dac437045272b38aa224667bff
MD5 0acaeba8184aacc2d52361ff1b420225
SHA1 ac39cae0da21ddb44d3516e23e809c84db6443c0
SHA512 7d0e3bcf2c1f6e6ffbb22e641388c73e548a705c2f5daed4ae16588ec8ddcbc68818b65b8e5f3c5c44de4f968abef062912a4d86dd9223d05c9261b185ed5cd1
TLSH
T1EBC09BD7141196DA1630AEC8643C973DD95B454D84D5CCF4630450453CBC9134541675
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 214B
SHA256 86e88943cb588c88359d90f7bccb205ac23150e28a52c23bfaddd3ae46e70ce9
MD5 3791549ebdbf3d1bd83d3415c123273e
SHA1 d973f7d7ec8fb279234047c755fdb179eb7b838d
SHA512 f20622f389b5ec717a761af759218df94efd613a662ccf6c7218071e1632445b272f08bb8dd4aff174dec544efca9b2e0f5584ef5a0d80c8a3b849bf13c4a1f9
TLSH
T182D023D5C1B2D5872670E7845038374E547BCC1D58C1DCB4D545B051307CF13C400436
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 242B
SHA256 ce84a65bf381667763bb06cb4c2e9250a2aba4ff5ae5d06871b0b8ad5fe0a9c5
MD5 7a58d2b93342215c0420a691ffe57630
SHA1 370a5be627d50850c45549db522c07441efc57ef
SHA512 27ff08b4bb686959b6fa95fca5646ae6e5d33e21f0f0df2b901551ce498086863182ac8cd710869733df849bfc652aeef2080b0ea1e6ff2986803372bc44bfb4
TLSH
T18CD0A7C656E2C2CA96396AE82038F16D851B9C5CDCC6CCBC5645B0553174E13C962D39
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe587347.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe587347.TMP
Size 137B
SHA256 7b3c788c10b0e31e55078a3f9da29e32c3cc5a222ecbe5d34298d83ade500e74
MD5 52bb72924cf490cff537653e176440f9
SHA1 45d4b3d4fc927d7dd76d39df8a60cc583c8048cb
SHA512 1a27cf77dfa4c3e1a8d20c1fabd52dac19fee5a03ff2beb929cb903166c71ad3d0b9da27b94258829754a2e73c3ebd7002e52de93173bf0efb1edd820d3065c7
TLSH
T13FC02BD7401046D6073059C4B03C931DD89B4C0D88C0CCF4630630013C7C9038640630
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 6151ae9ff643f9a34596f95b7e5df1862f4aa071c69929906650ffe56d0d7796
MD5 8e7179fcc03c4d00fd122c67b9608889
SHA1 0594c72b5b494a5993988ef3edf049c16aa50f2f
SHA512 d32abe224f78b3512e41a123f495db8246a47e24b581d72ffd641b831613e3cfc7cb2c5cf0150d6fd9849b32ef1eb23b33176c7ea1c9bf61844080db08da4f9b
TLSH
T1F6B012554B08B011CC2C037A38C251F2716409240A2511410050009D4422548A100082
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58d5c9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58d5c9.TMP
Size 48B
SHA256 b2ff9648c6d33caf7e395a878b9cde2521f771e7c4da4a84c28e8c531e4473ac
MD5 801dcac63a308afcc48df51d82cf4c73
SHA1 2a085b5754bc5a2eadca715127227034eff74961
SHA512 8b701649d0f192e0092055a2167439fb3cf870a807e95d99e783b4b0f250b0c17ef83e4843e1edf56aaf31483eac2bf504bd19f12281f5a548bed4b07887ddd7
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 b298c57473881de4896e7709757d4873b9b99de4624bf72405d59644bd874af3
MD5 1525c366f1b3aa1b8823d55d1f332990
SHA1 7654e83367b46dfccc0820293366c11d48cd708b
SHA512 2b37839aeecae8d9b06231d701eab4d0f58553fce6edb1fc5474b361df15a1d6726d4f960b6b1f1f996524b2f74e8a3de18c5c88fd7f9db4c54b085f177fbb13
TLSH
T1E6A0021277414459C49812B810ABD5883354BC501145560664F20857D8746519556806
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 2784e32d9e846f033fe251590765669ce16af36f0b120e83464b29f3e71134bb
MD5 30931c95ef4e65cb2d9bc83f79bc5e69
SHA1 e40bc37d0c8e1266f002c1c3bc18791f8ee60191
SHA512 b4c6b79c360f70ab26942df481eb26a7459aafe011638f6ffb60d27c868fa77b8c64433c3062a2b2b897721eef343842d5174e82d0dddcf2e9f8a050a040a132
SSDEEP 96:KMUAKJSayEQK1+zWLa2Q44eWIdFgWeK4rgEec+WjS49HVCbvlI:KHriWLa2Q445IdGWWrgEN+WjS49HVCbS
TLSH
T19F91A821367A06017E3E261C82E5A7579D92BA53310CB42B7BED81754E2BE118CFDCCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cbc591d1-f6ed-4ef9-9b44-41c14a085fbc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\cbc591d1-f6ed-4ef9-9b44-41c14a085fbc.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 617a1d30baffaa4f9b24c8324cc6762e371f3aded5a1ab8aa26b39185f25c1d2
MD5 4e7a0908e46e1500adfcc11613c6072a
SHA1 3e38276dab244693e9f4914ecc92f4197590d61e
SHA512 7037a414ce1824b3605f5b8709ceb2088747c66efe88e558ae10c766615a7e8a8384b91dd0e334c663d3645b506143784b08bf4bc705d2a33595535834af0d2c
SSDEEP 384:1tNn/s3n9SjsNRnhXT67xwf+68R+XGxJrEmFBX0IidKzv0u3:1j+9UfyZEhDB78KzD
TLSH
T145927D36AC699D774CD296C9F41B3A139FF84267A7C52F94D1EC6F0C01CA7AC231A912
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 566166c4876f6c8219251270812250b0c53f327ee1c34a1a1ef3df84874ad31b
MD5 5e76aaa04dc430cf1a579ec3f45546b0
SHA1 ff7a744d14eed0cdfc0328d8f5e3d8d52af46022
SHA512 314ffd2dac71eb5e2b7c67692792c1a11a0d2c753ae7d84b5464d45e69abfec138ec05b39238957c14e19d33f29c8527d07917efa0f0a31b65db86bfb155536d
SSDEEP 384:tiFKtNn/s3n9SW3sNj8TUNTUlIldhXTrJxcf+68R+XGxJrENFBX0IidKzv0u3:kFKj+9JOwgTeZEhaB78KzD
TLSH
T11CC22AF248D78D76D89E8787B73D2E139EBCC167B6816A50B3981A0CCC8617FD30A811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 bd59c14f193f81d562253de0eeccb794003028c41c1a363d327c799d977fba54
MD5 39ef849dc0bd5cde6b8549b7218abefb
SHA1 b143f7476d41c0aed0a126dfeae76b303cccb476
SHA512 fe65d39b9f7c3c4e30d1652b1040066782af83e83384d4c59393cab7a998c277c02af2137779a32aaa63a0fb110eecaa0ed760af0a12657df580c84986079df3
SSDEEP 384:9tNn/s3n9SDsNRdhXTr7xwf+68R+XGxJrEfFBX0IidKzv0u3:9j+9YWyZEhWB78KzD
TLSH
T1CC927C36AC699D764CD2A6C9F41B3A139FF84167A7C52F90D1EC6F0C01CB7AC231A912
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 2baa9d44ea5819980caec88a0b2f8da6e7219e231cda63e8bdb150634286c2d9
MD5 612cab064b24987a22a31d8f545fdcec
SHA1 306e5fa654bae86bc40061f0af341452e7edcdce
SHA512 74d72b88093a2d28809d250852dcc92c9aa5d4207a6fea1785a7bc8fd1edc759bcba889b764c2b1262c04f544befb489c04e1ec164a86a82b30c32f8f1bd8ef7
SSDEEP 192:EON86hZ0QmiUyVQVEpc/+jVIjzorRV5wOZiy3U6:EON86owpu+68R02XU6
TLSH
T1D602D935ACBC6C778EE2AE45F48727235FE5212BAA956F84D6E81B1D00C775C2307836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 be3137829712a4d2b2f52f345a63e37a49c1bc082acb497c46019e7fcbf6676c
MD5 198bf97fee2a1f5225e0cb3232d8f343
SHA1 130ce70ba47f8925aa08f31360bcc7d997858198
SHA512 fde481c80b1105fea55b2885df893e1851957a41de94b310f218a03e23dfdf5a45f6a96ca4947e296e5eb2eba96bee1d1462a1f3b28376a149d710b01efdae0f
SSDEEP 384:tiFatNn/s3n9SWGsNN8TUNTUlIRmKXTcsx+f+68R+XGxJrEOFBX0IidKzv0u3:kFaj+900wg14ZEh7B78KzD
TLSH
T100D21AF258D78C76D89E9787B73E2E139EBCC167B5816A50B3981A0CCC8617FD30A911
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6cfb3f98be29359592f4bb7fe27c5ebb1d5f049fa055fc80fc069d6e396a62ec
MD5 20d75914b5c768b2633e6c16bcbebc8c
SHA1 73061c9e7759a6a61daee1d1ae5d06f10b6bb0b3
SHA512 d734198de308164979ae27821fb7ed5839fdcffd03830810372ab0f0a77b0bbb65a551b8b60290a112b2f0ca34e935b6f9ef2b08d98b21019315a214fbbce518
SSDEEP 192:fQONr46hZ7VQmiUyV4VEf5wc/+jVIjzorR+XKFuSJrEb5cOqiWqOpU6:oONE6bKxwu+68R+XGxJrEG9BU6
TLSH
T1D812FB36A8ACAC775DD2A691F44732139FE51127EE857F94D2EC2F1C00DB66D130A822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 6cc5fdba39f284156edd27a042e876972c782dfff785166248f104c83466eb05
MD5 ee940c3cb86683a6208db6821f6942d0
SHA1 460dc1cac38c5b4fb581c1427ff515a974b2673d
SHA512 bf435c17be97fb684341641bed1ac991eeaa219633e906b1baeaa514d18ea637b4cb286d2d0f385ead196a58e901a1a4c705ddb5959bd3ec6cedb6f021af8766
TLSH
T14CE00943A35180FAC12C073000CB2B246AE3C03411A603064E2109681C233102E30B8A
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 f94e40fac0b60b568c8368923c6e7f92c510a4cdd22a46e029753d28746801d7
MD5 b7d7494c94f478ccd68b68cc0300164c
SHA1 af04264956f13b1d5670cbc2992a31baae2d25cd
SHA512 8c7c90fc9529d2bd42856a31d406b81003b2d306a8f98a0410743fee09fc342a0d3996cb2476395655606e97691302ded02cf4560d97ef4b7678cac3f0cccf06
TLSH
T1E2E00143A31040EEC12C073000CB2B206BE3C03411A603074E2105681C223102F30ACA
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 56ea7be3f6aaad36558a4946efa1dac508cc4d29dbff21389e40ae53a3a224a7
MD5 b6860030a07bf210fa63f0d0023dba9d
SHA1 2ebcf878fa8173b103754c85252594b4e9c66694
SHA512 f0e8d70211b01b73eae5f53adab42cda73cdfe8f853f756c4d988c87ff58ce602ba3da1e8288e47dadd6f5bb48407b2592bdc6ab8144a0b0457e16a5bcfd80c8
TLSH
T17BE00243931040FEC12C073000C72B202BD3C03411F503074E2105581C323102F30EC6
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 1144d8efc88530a33405c6230220871a46250b22fd096a46f00e7e14cbee7626
MD5 b61421a526c943f489e424dd2ae092a0
SHA1 042d66ab39ae2f6d43257ca6e186e86f79b9e0e5
SHA512 3ed7d944c580bc890cb486c85e6988f5167c17f9ed62edbb71cf7d470da0b3ff279191d3a2070231e839dc54a9d51ea01ec31a48e58500ab86ec0df7309f9e58
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe58c4d2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58c4d2.TMP
Size 392B
SHA256 fc70351cb5525c96b6169d4ed286979e80eea934de3429abc70cb560f9750247
MD5 2ee72172ed5d89fb67789237a816e55b
SHA1 86605600c9313bed98f65d9839b3b02bc69527c5
SHA512 54752d0dee4bc5857dc24f8c235a42831ad767dba11152479ef6518b21df55b249bcbdd74676ecc6e529b0ca345fe6725fb3dab55263eac3664bc03fa3e28346
MD5 SHA1 SHA512

Submit Download

66a1b552-76db-41f5-abc4-527f19963e3e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\66a1b552-76db-41f5-abc4-527f19963e3e.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 a5725a98310ebd7728120472ee6a9494e9661afce20f91a798941b3a4b9abd97
MD5 e06d3933df2c5b6a67238493cb3b3c38
SHA1 8bdb23206ff578f4e495b42b702130e9bf0057d0
SHA512 7c59ed26506e02d7b291141fd3f965b73a0aeabacdd2695c07e686b3a7ee7c585f219281e7e5014565f950d6835947a6a1620924522fcb53b4d70e128b897706
TLSH
T18941E958BBE91159B3B36E56ABF6A86D487FBC772F07805E10010E4F0626E40C8B2737
MD5 SHA1 SHA512 TLSH

Submit Download

DCRCVDrv.sys

Path C:\Windows\Temp\DCRCVDrv.sys
Size 137KB
SHA256 87e8d39db624f37d3e77aedf487a2dfd197f71a4730ea74f4e7a4341deaec2ff
MD5 567c158ee0858f8e941d4ab7a6c18dbc
SHA1 47d922b0fd5d704025d14ef98ded46e74830a423
SHA512 f976cb8e9a2f0fc769e2e4345d18e1e9f01fdb1c4303eb20d94b625467e60ce20dd120e77a96d9ba498361dd6dc0066535404cb22cf99fc49607d1f35eaed2ab
SSDEEP 3072:6pEFTp46B6ETbeP/ItLK9Di8/4BQaeJzP:Y8Tp46B6EOLgBQX
TLSH
T10CD33A12A36550A4E977E2B8C6B65263EFF37861133547CF03608A654F23BE4B93A3D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/704-1646-0x00007FF71FB90000-0x00007FF71FE24000-memory.dmp

Download

memory/704-1648-0x00007FFBF2050000-0x00007FFBF2106000-memory.dmp

Download

memory/704-1649-0x00007FFC01C10000-0x00007FFC01C62000-memory.dmp

Download

memory/704-1650-0x00007FFC05D50000-0x00007FFC05D74000-memory.dmp

Download

memory/704-1647-0x00007FFBF2800000-0x00007FFBF291E000-memory.dmp

Download

memory/2024-1626-0x00007FFBF2800000-0x00007FFBF291E000-memory.dmp

Download

memory/2024-1627-0x00007FFBF20B0000-0x00007FFBF2102000-memory.dmp

Download

memory/2024-1628-0x00007FFBF1440000-0x00007FFBF14F6000-memory.dmp

Download

memory/2024-1629-0x00007FFC01460000-0x00007FFC01484000-memory.dmp

Download

memory/2024-1625-0x00007FF71FB90000-0x00007FF71FE24000-memory.dmp

Download

memory/2804-1611-0x00007FFC01C10000-0x00007FFC01C62000-memory.dmp

Download

memory/2804-1609-0x00007FF71FB90000-0x00007FF71FE24000-memory.dmp

Download

memory/2804-1610-0x00007FFBF2800000-0x00007FFBF291E000-memory.dmp

Download

memory/2804-1613-0x00007FFC05D50000-0x00007FFC05D74000-memory.dmp

Download

memory/2804-1612-0x00007FFBF2050000-0x00007FFBF2106000-memory.dmp

Download

memory/3936-1620-0x00007FFBF2050000-0x00007FFBF2106000-memory.dmp

Download

memory/3936-1619-0x00007FFC01340000-0x00007FFC01392000-memory.dmp

Download

memory/3936-1618-0x00007FFBF2800000-0x00007FFBF291E000-memory.dmp

Download

memory/3936-1621-0x00007FFC01460000-0x00007FFC01484000-memory.dmp

Download

memory/3936-1617-0x00007FF71FB90000-0x00007FF71FE24000-memory.dmp

Download

memory/4084-1605-0x00007FFC05D50000-0x00007FFC05D74000-memory.dmp

Download

memory/4084-1602-0x00007FFC01C10000-0x00007FFC01C62000-memory.dmp

Download

memory/4084-1603-0x00007FFBF2800000-0x00007FFBF291E000-memory.dmp

Download

memory/4084-1604-0x00007FFBF2050000-0x00007FFBF2106000-memory.dmp

Download

memory/4084-1601-0x00007FF71FB90000-0x00007FF71FE24000-memory.dmp

Download

memory/4196-1592-0x0000000140000000-0x000000014002A000-memory.dmp

Download

memory/4316-1595-0x00007FFC01340000-0x00007FFC01392000-memory.dmp

Download

memory/4316-1596-0x00007FFBF2B00000-0x00007FFBF2BB6000-memory.dmp

Download

memory/4316-1594-0x00007FFBEF540000-0x00007FFBEF65E000-memory.dmp

Download

memory/4316-1597-0x00007FFC05D50000-0x00007FFC05D74000-memory.dmp

Download

memory/4316-1593-0x00007FF71FB90000-0x00007FF71FE24000-memory.dmp

Download

memory/5292-1591-0x0000000000010000-0x000000000003D000-memory.dmp

Download