0808ecbe49323d7bb321045422ec0e1a92e67bcffe2b9bbfaa877453f216556d

Analysis

geolocation tags

cacanadananorth-americatoronto
user interaction
yes
max time kernel
57s
max time network
61s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/07/2026, 10:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
NinjaCS_v1.8.exe
Size 1.9MB
Sample260701-mflaysdy5v
SHA256 0808ecbe49323d7bb321045422ec0e1a92e67bcffe2b9bbfaa877453f216556d
MD5 d7cf18648d826f0025cb40e26fa7d525
SHA1 30faff52c4fff0ad6886e66f871deda41527eb1b
SHA512 d1c3ef46d8a1c9f0b6937ba347546f9976ff82ac23dad6e218a8c18e246465b6a3f99ea5bb1e7aa00fd9c5a887c979aa38cca8ee120e6fa00a7c4355590cdcc6
SSDEEP 49152:FcbzJITWJDISmKgNtSruba5/D0c98W2nwylSb6ilkVjVv+:Fcb9D/mKSMSba5wcKZnwylNilkdVm
TLSH
T12E952334B1C6C432DAA26D356AE1D7316B7879212B798ACB97840B6E8F311C0DF35B53
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	NinjaCS_v1.8.exe

Executes dropped EXE 1 IoCs

pid	Process
676	NinjaCS.exe

Contacts third-party web service commonly abused for C2 1 TTPs 11 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
7	raw.githubusercontent.com
73	discord.com
78	discord.com
112	discord.com
135	discord.com
136	discord.com
74	discord.com
80	discord.com
103	discord.com
140	discord.com
6	raw.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NinjaCS_v1.8.exe

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4640	msedge.exe
5244	msedge.exe
2476	msedge.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134273751006960110"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{B550C9B9-4590-4F41-B258-89440B6AA725}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{F68D6142-75FF-4CC3-9138-B277A9D33A98}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{A47EF0AB-FAD6-4EBF-9D99-05C3EDA60EB7}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
676	NinjaCS.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
5900	msedge.exe
5900	msedge.exe
5900	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	676	NinjaCS.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
5900	msedge.exe
676	NinjaCS.exe
5900	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4924 wrote to memory of 676	4924	NinjaCS_v1.8.exe	85
PID 676 wrote to memory of 4604	676	NinjaCS.exe	102
PID 4604 wrote to memory of 1868	4604	msedge.exe	103
PID 676 wrote to memory of 4572	676	NinjaCS.exe	104
PID 4572 wrote to memory of 3940	4572	msedge.exe	105
PID 1868 wrote to memory of 4964	1868	msedge.exe	106
PID 1868 wrote to memory of 4640	1868	msedge.exe	107
PID 1868 wrote to memory of 3884	1868	msedge.exe	108
PID 1868 wrote to memory of 3884	1868	msedge.exe	108
PID 1868 wrote to memory of 3884	1868	msedge.exe	108
PID 1868 wrote to memory of 3888	1868	msedge.exe	110
PID 1868 wrote to memory of 3888	1868	msedge.exe	110
PID 1868 wrote to memory of 4896	1868	msedge.exe	111
PID 1868 wrote to memory of 4840	1868	msedge.exe	112
PID 1868 wrote to memory of 4896	1868	msedge.exe	111
PID 1868 wrote to memory of 4896	1868	msedge.exe	111
PID 1868 wrote to memory of 4840	1868	msedge.exe	112
PID 1868 wrote to memory of 4840	1868	msedge.exe	112
PID 1868 wrote to memory of 1748	1868	msedge.exe	113
PID 1868 wrote to memory of 1748	1868	msedge.exe	113
PID 1868 wrote to memory of 1748	1868	msedge.exe	113
PID 1868 wrote to memory of 1560	1868	msedge.exe	114
PID 1868 wrote to memory of 1560	1868	msedge.exe	114
PID 1868 wrote to memory of 1560	1868	msedge.exe	114
PID 1868 wrote to memory of 3100	1868	msedge.exe	115
PID 1868 wrote to memory of 3100	1868	msedge.exe	115
PID 1868 wrote to memory of 3100	1868	msedge.exe	115
PID 1868 wrote to memory of 4944	1868	msedge.exe	117
PID 1868 wrote to memory of 4944	1868	msedge.exe	117
PID 1868 wrote to memory of 4944	1868	msedge.exe	117
PID 1868 wrote to memory of 908	1868	msedge.exe	118
PID 1868 wrote to memory of 908	1868	msedge.exe	118
PID 1868 wrote to memory of 3316	1868	msedge.exe	119
PID 1868 wrote to memory of 3316	1868	msedge.exe	119
PID 1868 wrote to memory of 1688	1868	msedge.exe	120
PID 1868 wrote to memory of 1688	1868	msedge.exe	120
PID 1868 wrote to memory of 1688	1868	msedge.exe	120
PID 1868 wrote to memory of 4928	1868	msedge.exe	121
PID 1868 wrote to memory of 4928	1868	msedge.exe	121
PID 1868 wrote to memory of 4928	1868	msedge.exe	121
PID 1868 wrote to memory of 2488	1868	msedge.exe	122
PID 1868 wrote to memory of 2488	1868	msedge.exe	122
PID 1868 wrote to memory of 3720	1868	msedge.exe	123
PID 1868 wrote to memory of 3720	1868	msedge.exe	123
PID 1868 wrote to memory of 5156	1868	msedge.exe	125
PID 1868 wrote to memory of 5520	1868	msedge.exe	126
PID 1868 wrote to memory of 5520	1868	msedge.exe	126
PID 1868 wrote to memory of 5668	1868	msedge.exe	127
PID 1868 wrote to memory of 5668	1868	msedge.exe	127
PID 1868 wrote to memory of 5708	1868	msedge.exe	128
PID 1868 wrote to memory of 5708	1868	msedge.exe	128
PID 1868 wrote to memory of 6116	1868	msedge.exe	129
PID 1868 wrote to memory of 6116	1868	msedge.exe	129
PID 1868 wrote to memory of 5140	1868	msedge.exe	130
PID 1868 wrote to memory of 5140	1868	msedge.exe	130
PID 676 wrote to memory of 5888	676	NinjaCS.exe	134
PID 5888 wrote to memory of 5900	5888	msedge.exe	135
PID 5900 wrote to memory of 5932	5900	msedge.exe	136
PID 5900 wrote to memory of 5244	5900	msedge.exe	137
PID 5900 wrote to memory of 1672	5900	msedge.exe	139
PID 5900 wrote to memory of 1672	5900	msedge.exe	139
PID 5900 wrote to memory of 1672	5900	msedge.exe	139
PID 5900 wrote to memory of 5308	5900	msedge.exe	140
PID 5900 wrote to memory of 5308	5900	msedge.exe	140

C:\Users\Admin\AppData\Local\Temp\NinjaCS_v1.8.exe
"C:\Users\Admin\AppData\Local\Temp\NinjaCS_v1.8.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4924
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\NinjaCS.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\NinjaCS.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/NKugeVU4zU
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4604
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://discord.gg/NKugeVU4zU
      4⤵
      Checks processor information in registry
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:1868
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x2a8,0x7ffbf9b4c188,0x7ffbf9b4c194,0x7ffbf9b4c1a0
        5⤵
        
        PID:4964
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1780,i,1716838244659099521,18414454414165200685,524288 --field-trial-handle=2252,i,15599500920559709147,15412312291553922465,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:3
        5⤵
        System Time Discovery
        
        PID:4640
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,8286357486928251311,4505607620752533638,262144 --field-trial-handle=2252,i,15599500920559709147,15412312291553922465,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:2
        5⤵
        
        PID:3884
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2576,i,15264780919188565383,7659473389446360924,524288 --field-trial-handle=2252,i,15599500920559709147,15412312291553922465,262144 --variations-seed-version --mojo-platform-channel-handle=2752 /prefetch:8
        5⤵
        
        PID:3888
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,4051631244071285879,9767309040503661538,2097152 --field-trial-handle=2252,i,15599500920559709147,15412312291553922465,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
        5⤵
        
        PID:4896
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,10363001054996119107,12018784420193636158,2097152 --field-trial-handle=2252,i,15599500920559709147,15412312291553922465,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
        5⤵
        
        PID:4840
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4232,i,9903481945313194839,986389130156431516,2097152 --field-trial-handle=2252,i,15599500920559709147,15412312291553922465,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:1
        5⤵
        
        PID:1748
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4244,i,11535463014783995451,4243668390199935738,2097152 --field-trial-handle=2252,i,15599500920559709147,15412312291553922465,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:2
        5⤵
        
        PID:1560
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4616,i,5779901846331137906,18258870495151241707,2097152 --field-trial-handle=2252,i,15599500920559709147,15412312291553922465,262144 --variations-seed-version --mojo-platform-channel-handle=4660 /prefetch:1
        5⤵
        
        PID:3100
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5396,i,305607122192072795,5497317933040475563,2097152 --field-trial-handle=2252,i,15599500920559709147,15412312291553922465,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:1
        5⤵
        
        PID:4944
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3604,i,11748425708852055250,10780630875689399978,524288 --field-trial-handle=2252,i,15599500920559709147,15412312291553922465,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:8
        5⤵
        
        PID:908
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5568,i,11290192787194185448,4871207366289687598,524288 --field-trial-handle=2252,i,15599500920559709147,15412312291553922465,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:8
        5⤵
        
        PID:3316
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=4220,i,10415397086196931233,14621348396777608271,2097152 --field-trial-handle=2252,i,15599500920559709147,15412312291553922465,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:1
        5⤵
        
        PID:1688
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=4336,i,15305927173094804427,2933378122912607630,2097152 --field-trial-handle=2252,i,15599500920559709147,15412312291553922465,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:1
        5⤵
        
        PID:4928
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3556,i,17953764979295216722,16964221320662836269,524288 --field-trial-handle=2252,i,15599500920559709147,15412312291553922465,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:8
        5⤵
        
        PID:2488
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3580,i,1176744871460299216,1212465538059536745,524288 --field-trial-handle=2252,i,15599500920559709147,15412312291553922465,262144 --variations-seed-version --mojo-platform-channel-handle=3412 /prefetch:8
        5⤵
        
        PID:3720
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6260,i,7920422277293287786,16465777584026152131,524288 --field-trial-handle=2252,i,15599500920559709147,15412312291553922465,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:8
        5⤵
        
        PID:4044
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6260,i,7920422277293287786,16465777584026152131,524288 --field-trial-handle=2252,i,15599500920559709147,15412312291553922465,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:8
        5⤵
        
        PID:5156
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6232,i,8429613186659133912,6268223913165556975,524288 --field-trial-handle=2252,i,15599500920559709147,15412312291553922465,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:8
        5⤵
        
        PID:5520
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6468,i,17474446730492921764,13478446510141182284,524288 --field-trial-handle=2252,i,15599500920559709147,15412312291553922465,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:8
        5⤵
        
        PID:5668
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6728,i,1718619200234872964,17941229150788610715,524288 --field-trial-handle=2252,i,15599500920559709147,15412312291553922465,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:8
        5⤵
        
        PID:5708
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6704,i,12216498169656695751,6071130416365130424,524288 --field-trial-handle=2252,i,15599500920559709147,15412312291553922465,262144 --variations-seed-version --mojo-platform-channel-handle=6716 /prefetch:8
        5⤵
        
        PID:6116
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7024,i,9726007287298862129,5577936843877979945,524288 --field-trial-handle=2252,i,15599500920559709147,15412312291553922465,262144 --variations-seed-version --mojo-platform-channel-handle=7028 /prefetch:8
        5⤵
        
        PID:5140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://gamereaper.net/
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4572
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://gamereaper.net/
      4⤵
      PID:3940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/NKugeVU4zU
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://discord.gg/NKugeVU4zU
      4⤵
      Checks processor information in registry
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:5900
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x244,0x7ffbf9b4c188,0x7ffbf9b4c194,0x7ffbf9b4c1a0
        5⤵
        
        PID:5932
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1920,i,11454888635509815343,865933571419803560,524288 --field-trial-handle=2276,i,5232183734257608529,10250029752006446937,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:3
        5⤵
        System Time Discovery
        
        PID:5244
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1712,i,5259712510483074169,16988759664260615325,262144 --field-trial-handle=2276,i,5232183734257608529,10250029752006446937,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:2
        5⤵
        
        PID:1672
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2024,i,12351082334535331366,8840681684047084991,524288 --field-trial-handle=2276,i,5232183734257608529,10250029752006446937,262144 --variations-seed-version --mojo-platform-channel-handle=2700 /prefetch:8
        5⤵
        
        PID:5308
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3404,i,17140590230220788566,8846271457330807097,2097152 --field-trial-handle=2276,i,5232183734257608529,10250029752006446937,262144 --variations-seed-version --mojo-platform-channel-handle=3416 /prefetch:1
        5⤵
        
        PID:4236
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3408,i,4176133473285520085,14387947328597040850,2097152 --field-trial-handle=2276,i,5232183734257608529,10250029752006446937,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
        5⤵
        
        PID:5744
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4784,i,5325464756719036557,884688856870741992,2097152 --field-trial-handle=2276,i,5232183734257608529,10250029752006446937,262144 --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:1
        5⤵
        
        PID:3448
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5284,i,6955078700225873996,647839819862787406,524288 --field-trial-handle=2276,i,5232183734257608529,10250029752006446937,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:8
        5⤵
        
        PID:5204
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5100,i,3536350798079609951,7615462096203058651,524288 --field-trial-handle=2276,i,5232183734257608529,10250029752006446937,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:8
        5⤵
        Modifies registry class
        
        PID:1516
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,17714904046329838286,4634746118246948278,524288 --field-trial-handle=2276,i,5232183734257608529,10250029752006446937,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:8
        5⤵
        
        PID:2044
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3656,i,12855069285861421342,4597114766781894353,524288 --field-trial-handle=2276,i,5232183734257608529,10250029752006446937,262144 --variations-seed-version --mojo-platform-channel-handle=5636 /prefetch:8
        5⤵
        
        PID:5484
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5176,i,1178500317618703584,16948062916710860361,524288 --field-trial-handle=2276,i,5232183734257608529,10250029752006446937,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:8
        5⤵
        
        PID:1860
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6044,i,16064905688544839700,633654342849495222,524288 --field-trial-handle=2276,i,5232183734257608529,10250029752006446937,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:8
        5⤵
        
        PID:5616
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6044,i,16064905688544839700,633654342849495222,524288 --field-trial-handle=2276,i,5232183734257608529,10250029752006446937,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:8
        5⤵
        
        PID:5624
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3472,i,14549150348265903784,12502058719697757212,524288 --field-trial-handle=2276,i,5232183734257608529,10250029752006446937,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:8
        5⤵
        
        PID:5516
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6508,i,12831712599154943465,13269497721509381500,524288 --field-trial-handle=2276,i,5232183734257608529,10250029752006446937,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:8
        5⤵
        
        PID:736
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3496,i,16020989528927720927,13360153964918139916,524288 --field-trial-handle=2276,i,5232183734257608529,10250029752006446937,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:8
        5⤵
        
        PID:976
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
        5⤵
        Enumerates system info in registry
        
        PID:2004
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffbf9b4c188,0x7ffbf9b4c194,0x7ffbf9b4c1a0
        6⤵
        
        PID:3792
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1928,i,10139082272064873801,231385142183075721,524288 --field-trial-handle=2328,i,6492608820418795790,18092717784566004115,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:3
        6⤵
        System Time Discovery
        
        PID:2476
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1724,i,13622586103793507430,12911507422458461428,262144 --field-trial-handle=2328,i,6492608820418795790,18092717784566004115,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:2
        6⤵
        
        PID:5016
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2344,i,13488772962799432995,7580626114594121573,524288 --field-trial-handle=2328,i,6492608820418795790,18092717784566004115,262144 --variations-seed-version --mojo-platform-channel-handle=2596 /prefetch:8
        6⤵
        
        PID:2548
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4452,i,14261469766461486303,10015538344518809889,524288 --field-trial-handle=2328,i,6492608820418795790,18092717784566004115,262144 --variations-seed-version --mojo-platform-channel-handle=4528 /prefetch:8
        6⤵
        
        PID:5536
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4452,i,14261469766461486303,10015538344518809889,524288 --field-trial-handle=2328,i,6492608820418795790,18092717784566004115,262144 --variations-seed-version --mojo-platform-channel-handle=4528 /prefetch:8
        6⤵
        
        PID:4860
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4380,i,7686820132356708987,17498590713332168282,524288 --field-trial-handle=2328,i,6492608820418795790,18092717784566004115,262144 --variations-seed-version --mojo-platform-channel-handle=4704 /prefetch:8
        6⤵
        
        PID:5368
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4696,i,3019835830912855811,7936918725194987112,524288 --field-trial-handle=2328,i,6492608820418795790,18092717784566004115,262144 --variations-seed-version --mojo-platform-channel-handle=4704 /prefetch:8
        6⤵
        
        PID:1980
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4760,i,204705375587394830,17267938308834407535,524288 --field-trial-handle=2328,i,6492608820418795790,18092717784566004115,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:8
        6⤵
        
        PID:4512

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3000

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5696

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5320

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5744

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 0181141062da123c48165df0d093a0e55afca3eea8ad027fb9481928caca78a0
MD5 7f70ecf3403463cf7c2454474fd1c5d7
SHA1 685610646b0cc829a4afa1a27aeea2d7570f020b
SHA512 463f9dce8208a06625744baca2901f95c2cc5b3660de1e9403e02c31d9dfd4907be356493577fa99579f2df1107603dca61930833d91b8dec3af77fdbf2b29c9
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7r:fwUQC5VwBIiElEd2K57P7r
TLSH
T167B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 bfc7cc693f211098f1b8e9b1b3877ba9d631f2914342be51301339c02d1eb286
MD5 75b4f1a2b55e168f5af89d6859810db7
SHA1 a6fd5bea79162f80185d5363d7e8543fac947de9
SHA512 b29fefb32e05f0d6e4c36328a6e719f1c95d69ef0d79ff7ad4a614d25daa82889dec8f71208b66fc3e06674761a3f3c58356872e2b05364bdae9970a8cdedf58
TLSH
T1F3D0A73127C1B106E11521B9B41043966F4946542797C117C825C81DED2909557DE2D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 98eae6fcc56d922689f3a45ab65635857e6510c437555d4eae3a6cd68dff3acb
MD5 338a3c92e96cad1510815c958fc76de7
SHA1 e1234ace09aad728f9bde0798e2fb22ee82583de
SHA512 e29c9087bb4c9c94c8525a95c307117f14827336de29aa01f837bd02b05b3aecd1c1771970519a60972a1495e05b4f68ab34cf5e4ec9d7060f6383ac019c2ed7
TLSH
T17DD0803337C9A500F6567375F412C7412F2705741586C713A168C45CDC794C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 39ade3b855bc1276fe827d1c6e3670f6cb85898f1fab0bcce81ed55289cdfdf2
MD5 193deaeb7f389c6ac3a22c0ea13307ec
SHA1 8fe165b3ec44ef117d735026e29d3a3603bf8dde
SHA512 4dca254dea1810e4dc049e742951a54e8de0e9d4996cfbf1c03b2fe26e1bd1f851418731544ca7a99b37a41d29c120bbabc64300c1a21aff88cda8ed744b18a0
TLSH
T194D0A7316784E001D515617DB01486567E4982682287C1175576C89CEC2509867DF397
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4b399aed5a9803c56d9879b3fadd43d6604501cb2c9235a5051c251106aebeb2
MD5 1303d32d7f8aec9cb2a21bf741127595
SHA1 45e8db9074a2ab5fe452afd34b5956467cb2b7db
SHA512 9f3cad3dc21018c34d8a74ab0f3470fdc471f54246a389f16bbc0fa3914a5bb34bb8a940183ef98a5b8cf07f339d759208a0648c7955429cad7944b8943e3206
TLSH
T160D0A7316784E001D515617DB42486567E49826C2287C1175576C89CEC2509867DF397
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85da5d101c008762046da9670ca95944217bbb1829e60a748f367ee4f9926b13
MD5 ef105d8d3e87a813544857290c28833d
SHA1 bfe7010cf80fb8cbcb9eeb5e0d0b551ece0b3134
SHA512 ae71c302652e2de890fca25723381f403f4f9ee51e2da6583977318de3e7ff00defb73b202e17a287def3ff618de86c0af96c0fca7729ef3efe0a4ba3cfdfc63
TLSH
T16FD0803377C9A100F6567375F413C7412F27057415868613A168C45CDC784C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 4b087950e5869a861ff10a4aa554c4a9abbfbdfffe6b52a380a233256c8c0175
MD5 13365b0bcf94f5ce49b13d8061f37728
SHA1 04d963a5ed21ae0206f7c15217168cb37047984a
SHA512 343646a9fc0bde12d7da4f0800f783cd12781cd222965e9ca44a5f73321478ddfae082713196caf83436b7a25d1a101d2623202b27d4cd366f30bf7a7074df9d
TLSH
T15E81A32842A234E2EBFC1AF0D4C21205B5BD47CF971F8D49085C9EBD6E88368B17178B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 bf8667722338d3c5a6fb6a5cc55f2df03c6b02928eb2eb003e6919c7e219e996
MD5 aec65ea863479e4107f379ce8588dbd7
SHA1 cb9f77d8460940b5cb4ce6023f0df4e6ec73fe01
SHA512 7d68b2c98d4aae1a1e1de42d4c804ff734efd89561bd7a47452dcc761cecb906a436ef102f480916bdf7b439e01db571f8ba69cbcc259823b7af060b64628cf3
SSDEEP 96:7kJbUbRGvGl31kjZgNN0AwpGYWhFVlWLc9THmKCADY+4+iq/42CPa:7ybU1GvGxbz0/6Fac0K2+4PmF
TLSH
T11CE1E8FA03E364D1D7EC19BCD4C71210BA79869E770B8C4F0B5A8B7C1F483586A21A87
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58d637.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58d637.TMP
Size 3KB
SHA256 a7340e67a90c72540b9d1f4b914965fd347cce60660a2ca10a547f0d5026f4ca
MD5 3399abf7f2ba2e1f9c0c4a8f2e0ed178
SHA1 fa58fdbab3b31913017c9470e41eabdc75df3737
SHA512 20823c0feea8b576f208c9071c58eb3c8309179ac81224b9920347695f3fec78eeee5292afef9997686540c1bcfc064a8bcc7e1e404816f1a67a585e3c7efdef
TLSH
T1A5718F2842A23461EBF41AF0E4C31206B47E47DF0B0F0D4518AC9FBDAE89364B67178B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

computed_hashes.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_1\_metadata\computed_hashes.json
Size 429B
SHA256 b829b0df7e3f2391bfba70090eb4ce2ba6a978ccd665eebf1073849bdd4b8fb9
MD5 5d1d9020ccefd76ca661902e0c229087
SHA1 dcf2aa4a1c626ec7ffd9abd284d29b269d78fcb6
SHA512 5f6e72720e64a7ac19f191f0179992745d5136d41dcdc13c5c3c2e35a71eb227570bd47c7b376658ef670b75929abeebd8ef470d1e24b595a11d320ec1479e3c
TLSH
T10AE055170A1A50B79BB8DB90EE525CA2E8A0A6B1C50438D63E608234B68A11F738347D
MD5 SHA1 SHA512 TLSH

Submit Download

verified_contents.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_1\_metadata\verified_contents.json
Size 1KB
SHA256 d23b2ba94ba22bbb681e6362ae5870acd8a3280fa9e7241b86a9e12982968947
MD5 738e757b92939b24cdbbd0efc2601315
SHA1 77058cbafa625aafbea867052136c11ad3332143
SHA512 dca3e12dd5a9f1802db6d11b009fce2b787e79b9f730094367c9f26d1d87af1ea072ff5b10888648fb1231dd83475cf45594bb0c9915b655ee363a3127a5ffc2
TLSH
T12B317466C8683D56267A63348E2D0602EB57C2BB0050640EB5AC558D4F7115FE242FAF
MD5 SHA1 SHA512 TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_1\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_1\manifest.json
Size 962B
SHA256 5694c91f7d165c6f25daf0825c18b373b0a81ea122c89da60438cd487455fd6a
MD5 e805e9e69fd6ecdca65136957b1fb3be
SHA1 2356f60884130c86a45d4b232a26062c7830e622
SHA512 049662ef470d2b9e030a06006894041ae6f787449e4ab1fbf4959adcb88c6bb87a957490212697815bb3627763c01b7b243cf4e3c4620173a95795884d998a75
TLSH
T1661121366E2FC4260AE00698DC51308AF92453ADD380850E35BCE42E5B744FA430631E
MD5 SHA1 SHA512 TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 20KB
SHA256 5120443ebedce154c61f8b8c19adf88656ff1c704ba16ba520c9961c3e780538
MD5 a2ed3f359d1b93b8b5270303b70441b1
SHA1 1222e846bffd9c491c4cc5dca72153898f6bae62
SHA512 d15442b37ab58e052c52d9e7e7ee4d9f5d6814095c00d70be0dd2e6f5dea67f9e4e90ebe17a8a30b9c4d0dc471b676492596b281ef964517c86e65cd0073ec7a
SSDEEP 48:uzBmw6QU1Pz3wJOrZjrte3FJu4yeRvXKGg12AxyUA:6BCx3wAr5M3FJu4yYvXKz1Xxs
TLSH
T1C592B4574D387853FB052B7A262B4879C93BE19CAFA5CC89312550781DF8652A03A8FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 204KB
SHA256 cabc0bfb257af39065c616bb2dc040fd22fe20ff9dd7cc975917a1a5db767e40
MD5 783bce9402f164df3723e1038a72ff85
SHA1 d58b4c28774df9c709db4f6d791e27ef9c98fdd7
SHA512 503067d6069f9bf873b447b2a074723ed6acd373e59b82245de14d6974e8cfb1bd5ab16ae32c5117462d4387385d71649acda8d8f45db4a252e0e818198b4f91
SSDEEP 96:7xIU+bGz83uy3+u4tgp4DLjGQLBze9z3vbjBHMsDEuspU0wbtqrOQpPfR4J+MCXJ:7xf+G83uy3Ct7XBBKjJH7DXspU3iD
TLSH
T1A414121E5F343721CDBD917629E744B35D7CF03F8B1266CA686114B5CEE2652A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 357B
SHA256 d4897a0ddb14c26947dff7851007ff905a6e83d1381aa712c2efc1272e5994cc
MD5 8876715458d3789b716e17164fbd92c3
SHA1 65ee15a3cac6786a2e745a200220c073a75d2136
SHA512 bd1d6495496c08767de306766fae5ea4e66c2630389ed66ac7cb0c72bfdb54bb3a33336232ad9aa108e4cb54f8f18f2701698d6bcdcf0c683000d209a658d8fd
TLSH
T1E8E0DFF7C62C8C78679812F41163321CDEAA10AC19BFDAE6E142390848C86362114ED6
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 6500e43ea8ebe54fa3ad271b03974c03b7d738619b3bd436cece3aeadf109f57
MD5 5177ef04b62338f55fc4a01bbf82f87e
SHA1 feb7ea08725df9323c06ad1b95367204e7ac6aa0
SHA512 7f742e9c1aa655fd11da171f1a3dd2a9773c7ca4145de8a4b55ebc26a790bbd502055809268ecc2a0c8e75ba29cb64987cdd3c798362ce26dc0fdf0831a7ea45
TLSH
T158E020A479DEC26F51686087C215AB8CC7F03417D6CC3E45FF0598C5B441004FBD51D9
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 4e313e7f21a4e8d45a7d72a0393a8fdce3453192aad7ab5ccb64137a48c03c88
MD5 75cba15d9d8bd513c5397bfebba7ad46
SHA1 0a0c1877a059b6a663b5c97e64c8704d875b94ef
SHA512 bd0dd1c35e4d037aa9a63c0633e06f05fc60fb673cef9169b62b34168bd57ca21dff1915eea7ce56f1fa7bf3d909047d005aed13ba99cb7443089fefc0d44b7c
TLSH
T1FB41BCF3C3E48A2D8A0196F4AB186E1BCE1D0914432C3D5BC8E4AF1B93E2475E14194F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 5ab970b1891f07c490a040bef4e02f1d58e9e204fc97ad605ac018df626c5dca
MD5 86c1a6f4c40093a55c672163fe385893
SHA1 4a28791eef872a5405dc4f46cd3dde312ed428e3
SHA512 087141e30b7b86da1d3a612339dfb1c894274eb15efe6515d18cca9bad635343f2d31b237cfac438322de2bf8031cf83777bec1e865ead51ea0dd8fe821e4f8a
TLSH
T1D95189F7C7E8862DC91156F4AA146E1BCE2D0954832C3C2AC8E4AF1B93E2571F181A5F
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 522B
SHA256 0d6ff300cc584c94663a8352c2eef68958c6ea0923a9fb8e28d7d99b9ef86a38
MD5 e19061045a12f320bdc8767d6bbd21ec
SHA1 8f4dc79135ca540d2e0534dfe93a89c01f9a1f11
SHA512 78381f0cfc8460afd2f6d3332cc041cbc39f1888b9a1731579d58cd32edc67d4f916505f232784a3e5af45bbf0fea07d244c05d3fe9a40c83362e7ae6255269e
TLSH
T1FFF059938AB9F8771028853F0DC038456ABAB438020694F9D96AC73CB1954F36B13427
MD5 SHA1 SHA512 TLSH

Submit Download

f6a6981a-46ed-48e7-9b0f-f7af733569c1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\f6a6981a-46ed-48e7-9b0f-f7af733569c1.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 24013282f9570f7d19f7e2675f3ee379fc8d0e434b5c13ee5be50fe61b1e1feb
MD5 07a11a9c31e315259277f4baa052bfeb
SHA1 389ab70dd0175201cffa9a6e1cb6e8ff283e986e
SHA512 b9e99ae834997d282307437ec9f08cbe3cb6d8df8b7a469f4981b5527e6e7af425cfccf0b9ecb48944b37352b40b2081a558c9d41426ff9b75ecde27d341e4af
SSDEEP 192:sxZVHIRI+yM/jK1Ml8ROjYC/f4Ks+nWpV8zJFVBHIdpDVBHW6+WNYVpVzC/YQZxq:sxZy7F1/ffs+nWv8TojHb9/lO
TLSH
T1EB52C616AA346977CCDBD309FA55BF53D6F81462A2900D48A9FCCA1C05E7AED2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 22112c4b8befed68eb0c9714dd9b9c5a71e78675d3c5eca4969b974c35f56e55
MD5 27cc3a68ddeb8f3e2992fd520d4d5212
SHA1 6477934c2fbfd5ca78d1d19c6dbcfee9b88638ad
SHA512 9edbc3e1347a6da793f9b5993e63aeb0854fc5efc8c5c2e2ffa47e5aa5d4dfc4e697c727ba279c37091947edaf8eb4708b9b4990887d7215520c44625ba9d65e
SSDEEP 192:sxZVHIRI+yM/jK1hl8R/jYC/f4KsoWpVmzJzOWzRBHzodpEVHVBHW6+WNrV9VTS9:sxZyyM1/ffsoWvmdOtIHb0fevfs
TLSH
T17162E607AA3459778CDBD309FA55BB53D6F9156293800D48A9FCCA0C05EBAED2207C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 224a05c20124f21c5d02ddef218be6fdddae88959c613ccd79f1167bd661cecd
MD5 e6500876107318db7a17f67f43a3b394
SHA1 d140d402dff752087c54aa6d2c8d04e8a918df83
SHA512 614ab72e17a91eb6d09dbd94954a2fd3e690dfb214322e36774180d68cd8044106d8c3d43973a8f234d701daa251473a397bdaa71f0517eed5bd8784e12af095
SSDEEP 768:LT8iJANWvx78r8F1+UoAYDCx9Tuqh0VfUC9xbog/OVS3QALl6opdIromkOUn+:LT8iJANWvx78ru1jaT3QALocdzIU+
TLSH
T15DE20A3B680CCB7E4F844E9CEC2AAF966DE801CB5B94895447FA884C03C76EE511759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 32e101010e3a8e8489fdc612afa2f8c7abd9a44b600d140ba594666683ac1824
MD5 50f9633b8211a819023c7cc0bd601984
SHA1 b2fb752d1279e8c728d3f346312c3dce5d695bb8
SHA512 079a6eed2da3255ac7583155a22cce75994e94e801e88dcf72a3758764737a71d91c1a02b0b4b789a70e9b05565e4c8fdd8ba55794d84d48c91b4b27b4c0c04f
SSDEEP 768:LtoiJENWvx7gr8F1+UoAYDCx9Tuqh0VfUC9xbog/OVM30ALl6opnIro6tUnf:LtoiJENWvx7gru1jaB30ALocnzgUf
TLSH
T1FDE2FA3B680CCB7E4F804E9DEC2A6F962DE801CB5A988D5447FA484C02D77EF511B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 233B
SHA256 e331893a81dd8b89a6902c2d94ddcd61e440fb64fc0692f19ae85445aa7cd4b8
MD5 00ce2c0943ca1af23796afdb4fab2003
SHA1 1f7cf201d4ea14ad6e8750c915155a4c489c32c8
SHA512 3cecd5f14ab39a6b0915d16953f50e1923848baa5b6405e9ee14b2ec25f514d92089ccec620205a7572cd2c9354e443aa0287aefa687c6af91937bf9c0b3b70a
TLSH
T133D0976BE24224D1D7EBCA822A62A4AAD3913CC418D2808C9C223429443268BA112EE2
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 226B
SHA256 76ecbc2bb3fb13a30144c3fc5ae4c4e0c6d5ea72c4fa0011fbe0b63e0a1111f1
MD5 232696ba8e551974edf7bb0d601a29e7
SHA1 564b02994017fcb8a1e6fdb432c80410f9c48adb
SHA512 8499eb8568c157da1a02930dcfa9c8e8a79c131aede7c640861741c94a6e3e671f8b45a80a47e6f42965da9b064a000236b36c4234d95937439916e0697bca91
TLSH
T13AD0976BA14524D1D7EBCB822A53A46AD3413C8408E2808CAC210525886269B6043EE2
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe59456c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt~RFe59456c.TMP
Size 138B
SHA256 7eac62ccad9b3da80f56501db97c842c31c109fa4f6ed0d318cc0cdd84ba1842
MD5 d933229a54c08558857a0c06afc5b651
SHA1 e8ce6d7abffb53b32a2532b0d0273032d896687f
SHA512 c9fbac60c0a19524d45da939848c2206669e576a72b8fef7f30441ee8f051811d6fb0db4764836dacbf9bfc21cb598d8ce96a56e1bc0754281dbc8a4516ef438
TLSH
T155C08CA7A288105287A68280022291ACC3093CC94CC2804C682230151030A232142FE1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 6b3375da26e9b9f2f3322aa4a7d76261a45f5d62af223358742a7247de769cd4
MD5 80f757a0728af2c5908e89afb5502eaa
SHA1 27a4e9d501731edbf4144528eb247db2d80ffc69
SHA512 4839f42d8b053024f2dd06867b52be74339cec70f2ee3db3cdc1f0f58e3550a0b323406c47b8e4fb7cffa2f1612310940f3f326dc7f5930edfa5dccf402a6d23
TLSH
T132E026D026CEC27E607A62C3C235C789E2E87427D2CC3D42BF09C8C8A242504FBD61D8
MD5 SHA1 SHA512 TLSH

Submit Download

Tabs_13427375102811645

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13427375102811645
Size 2KB
SHA256 4369f5adb50a7856ae14cbe7153007ce66bbe36a2aa47a85cd97777fec0f8952
MD5 041a2de02749bb73e0b7033faa6bb4c3
SHA1 d55922b6c119cc7c5ab43c23fe3b156b0839c050
SHA512 6f5504304720398d504e0066d9fba70057d6b8dd8034f5fd7b700b834a90e15099fe8bfd437cfc0f077c7e2d9f3211737142e742243766f46da46a5d9f201113
TLSH
T1AF5147265A99483EE27F427D81FE01EA6675F94A35D1CF1F42A451480D623437EB0D86
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 3779e14b93df0da3099b6fcaef8c8379a5476f6f9047f48bdb299b5dd4e62df8
MD5 5c66780412428ef978c37366c173dd13
SHA1 2ffd1bec6381304792eb713b18c60b8de376d00f
SHA512 0b6a948857692b1182260fbe7dcac8897f64a00c463764bc7c8b721f3ecebd41340ee3f91672d4b936ea831719750a40224ee3d761ff66433fe712073e0debd5
TLSH
T1B9B01258BB08D66AC0C50DB512E34B496340F4030404CA478CF85F109E0B675EE419D4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 9bc967e29aeb8014cf688f5858ff7b9bcc7fdf2ddec0c048d1b6816050c9722b
MD5 aefa1404fe9c04e00ad34edceac65f48
SHA1 32a0f741681d68962dd1978d3b442ef824762494
SHA512 933696689f8b8c0a3b0b8c2a0baaf566a931c930220ff37f4ca297b6f29fa8d25089d8541028bb6a2fd4f485619c5231e9d2d9291c7360c14029777dd804f2f8
TLSH
T199E0D82037CECB3B61BA20C7C225E788C5E27413D6CC29657F0998846207180778B294
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 aefe20fa0b6945bec68b2b30c0336a3d70c057bd8abcfec82743cb18ce1d9e10
MD5 5de177484cf30a4e03a7e26b05b7afc1
SHA1 4cc784c43313911d1ef7e0c61520d0d565b7da92
SHA512 7c8a202ea07f0a78c7adba4d9cc3f9967149d742afb96581b74f80ec09f02c20829ae0436c28f552e4bffa32d3abd3afe7d22d5a3052749953d545166699f8f5
TLSH
T18EE0867067DEC73A506D60C3C265DBCCC6F4782BA7CD3B9AAB0848D4A111144B7EA6D8
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 7cbffa1df39741b93c667d33834299e3475210a5d3dc0fb7499b43dee01250ba
MD5 2f01361964a1e95276a3318dfdbbd827
SHA1 2d10864fce33093cb3ee5c0c1e66223d1f5706a5
SHA512 8bcd3311eebcf2a67aeb339720cd142aa091777ac82cb4617e5a40ffbfd9375bb29481e1c51f123d0585b45310b5afa2306ef967dc58c0d3e015bac58b364c25
SSDEEP 48:KgpIVKKwovyhiIvKLC87yNRIRKCsETdqjXNn8:KgpiKKwySioKLCCWRyKCsmdqjXNn8
TLSH
T1B591030231BF06022D7D7919A2B087574B81B1B3712CA42B7FA955714E2AE344EFDCED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b01d6a8a-5ca9-43aa-8601-ea9f516b301e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b01d6a8a-5ca9-43aa-8601-ea9f516b301e.tmp
Size 414B
SHA256 3f970ab625557dc3f81249bfa088fc15ecb6ebc0dbbb1ab2c810e4b0be353ef2
MD5 9e69211055ab5e94231ad227ead3bc73
SHA1 dec5159f8287048830c007f184ed82a70c5e4c37
SHA512 34ddf3c95d2a0d44f277f6ce1a38cd5b6a50a8cd69f0c3a429b3ae6a2f21cd95729fec9c27dae9953a56810e4e447b283a930704d8582f14af9e563d07e5db4e
TLSH
T100E02B9ACD51AC2728FD071D60504706E74513972751991F3B3CC20D8FB152B059AC7C
MD5 SHA1 SHA512 TLSH

Submit Download

load_statistics.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db
Size 116KB
SHA256 85f7b5bdd9c7b6b462511365e99a5135f1eb40009f2c01bd8e43bef2512c8923
MD5 cbe91224e417274775d6e09fe76e33ed
SHA1 6cee48cc7d9cf8afde48f45e9e81ada11672b53c
SHA512 f39f3d5d915e71dacda474ba75de3c2a861fb37d1303a715775f52305983a9cb12ead2afdd4a992635436bd5e8d5fbf35894e02a2583917de308d180d96e3da0
SSDEEP 768:rcA1FfqSVavr0VH4px6cocIYL7osF6g5Phrcp3zZgOUp3r09TBoEeb4dRMUfWaBN:FgLto3zZG0NoEepnLklRPkJzL1ON
TLSH
T1B5C310F76D0A81A6CACD91B8D41BFF44447717218620D8E5AE3C08C33B79A2BBE765C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 12KB
SHA256 d8498c22e72216edc787875b7447bd737cb8240fed13354be4430500d575583b
MD5 c0d70a538e558e170200f4acd2064866
SHA1 7cc7630fa3c012a7a82aa3a048d5ea39d638b757
SHA512 3398050871cc8ba34552383055b03d0deed089a031c57f881d65101c03d9fc76b0bc6c161a65dce8fcb0bebd25b40c11eb4a1e556a45dc2ac06ad8cce6141b0d
SSDEEP 192:qQXIIImbGMIMslYcY/+O+WAsBlu0Nus+X:qQXIIImbGMIMuBc+fsDIs
TLSH
T18842B52E2A15AFBBC1AE5F7A2252C2845BD988814970252D71916C4F8DF3F9793C13F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 322B
SHA256 c32305e0bfb4743d5e73ee0515617941c67a4d44f66287dd6151ea209a9c25da
MD5 3544d7dc9f74e984ad3300d8a171895a
SHA1 6f06618e8d4a6b5b41a7ece9f16caa97344e7723
SHA512 a5ab86e693420b0d7c0a3a0d2def1d8ea8438ade264ceb44539e30d7a40a92b49a30a20bb0866d7116aadf5d60ebe3c0a51f600b6426808f0acfef553c42b7b8
TLSH
T1C9E0D82466CDC25F60BD20C7922587C8C2C4351BFBC92A556F0584C860011047799295
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 0c0d68a3d73e65d4f1e007e7a74f7abcb3712de27ce64e12df0b7c6aaaca3c40
MD5 2003b3322dcf4ed597ed3476cea685a9
SHA1 0a5aae9c07e35498c02e33d0097b84807814fba0
SHA512 dcc500639e16979dadc2b62dd5b58c3eb5f192b83177e3c26723ccc02c87b61022adc44b1bdcfad05c56d7ad2f4dc69d6eff0f83f5a52dda21308224fd6bbe99
TLSH
T136214C91F734C019C6898276147E6F261334E8028FF8EC1F55BA20647F72F441E4B6E6
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 340B
SHA256 3565440ed4863b6aa07ef6b69ce0a05d662bac0cfdf15d7caed5c92a10369d4e
MD5 6f583f819891dbcc18d3c1373260d9a5
SHA1 8bc2aa7ac3814ad3066a5d4f7cb1f1e69bd3e839
SHA512 28e17c226c9a8f2fc840db6e984b07060d7c6c8e6203590bf8e784a4fb9c254d347c7e7d873311cea748261abfdfb25aff6cfc69bb27afc6418c44d83aeef8ad
TLSH
T141E0D82475CDC25F60B920C38175C7C8C2D5396BEBC82F516F0588C85101145779A295
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 24d0c9ee4ce5b9bcd1900d28f1216bfc3b253a7d88d17dce36bb3cf0d7861081
MD5 4f642a36b336330bdace648135a3c0ac
SHA1 de884bd97969efcccf79a2d46a1c468175973908
SHA512 ffde46b29a18320a2130407d033e80a8c57192282986586c7c25314b70e7f78794625393f54d9a29f51103fe56860d6735655936f0ecf4547cea0bf436b9e7d1
SSDEEP 384:neurQXjZxh6VVsNjLWocV2k/rqq7yAStgMli0FxKBTMLoi3Swdw:eur0h6/RVKqxS6SKBoEiCR
TLSH
T119C26BB2D4B42CF749A2D9C9A547F6272EB8013BC6881E1CD6F9763931DF5F8230A415
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 c765fe4d761b45990dcda5da56bb21e22e165450bd550c3f569ab0af13b3c6c2
MD5 6aa0a6017d816792038a0db7c798bf4c
SHA1 2405896d8328cd3e198fd29de4e62387e50726d0
SHA512 757182c3d0bb806c9aba7dddc74169e6acbe904cd782b97b294e986f302088ac9cd9fd6145ce178b3a92d74aa3f0f35d213688361b0a6e8551402c7b4070d2f4
SSDEEP 192:zoWEONP76kmL06aQmiU1VEVDgUfDZk036r1EYTcIi4q0U9:zYONj6Z+/Ulk/rqmJU9
TLSH
T15522193668687C7B5CA3A545F48B36135FA59027DBC82F95D5EC1B1C06EB288530F827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 663989a8a574964ed3b3f7e56bb99d1c891c6cedd891bbfffb4569668afdeb51
MD5 5c4a5576d2481e84ac218e0b283f4cf1
SHA1 90d331823576ba776e102a91caa70ef5a7b5305d
SHA512 328fb725c881c75708fbf7bce245c4070121ad5e455d72960488f4c4b37e84750b0166cb475a9a780ec65176d9761d58f97b6fd1512feb19ca79fe9c6f337536
SSDEEP 192:8EONrK6k1+QmiUyV7VIf89036r1EYTcRi4q0U6:/ONO6Jrk9/rqzJU6
TLSH
T142123A3268B8BC7B5D93A941F48736135FA59127EBC86F85C5EC271C06EB288130F827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 73fcfbb03ece0c200981058c90af7e16d65a1d85864628aa145271ee27fc2b31
MD5 d42359c4b328abd30ad56def741b23f8
SHA1 20b635366a3c45878da8f44e40888f46ba790683
SHA512 39f2a307167779e295d22cbf9e3b7901c03773f26bad25a852ae349705a297c9c0f9c5c85b6cb7287dad079378f697689c778942bae31d4122fdedaa243afb18
SSDEEP 384:neurQXjZxh6VVsNjLWolV2k/rqq7yAStgMli0FxKBTMLoi3Swdw:eur0h6/gVKqxS6SKBoEiCR
TLSH
T140C26BB2D4B42CF749A2D9C9A507F6272EB8013BC6881E1CD6F9763931DF5F8230A415
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 98718a3cfc9e46fb1fe0b26b7db91f7ad75ca7ca309d1d7e6d4c52d73ffe7594
MD5 515544358bfc79243ea02c89c2d82f07
SHA1 0f272f8d28ae4440ed878bcf81e568c31bd54008
SHA512 0380e01a4fb43074d55d8343b292157737e64f8804960f1f2bf22416c1f2e2d3fe644b763d7ae21d1d4727feaaeb5b38ba677cf724339934cfdd164112f37d19
SSDEEP 384:neurQXjZxh6VVsNTLWoMV2k/rqA1i3Swdc1oRIzZ:eur0h6/1VKA1iCF
TLSH
T1BD929D7668747CB31EA3A14AF29B3B576FF8007BCA841E68D5D88B0D15C7688370F916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 a08ce09e907d98503fe9ae46a1567124794092582f64f1cff6a0dc1fb50c467a
MD5 d3e0ae3e0a2794f6bb6328721056c769
SHA1 55f391b1722a112fe8885e1214ac29d59a715d45
SHA512 0b4a13c3c1d19bc95a245006496a3060a7d0cf44f3915f981471dc5d9ab838004c13406bcb02a6ee6fbd73988f2f8e644af149c807e5a4b7b83f4c312f51865a
SSDEEP 384:nCurQXjZxh6VpsNTVWhSV2k/rqK1i3Swdc1oRIzZ:Cur0h6TuVKK1iCF
TLSH
T1BC928C7664747CB31E93A14AF25B3B576FF800BBCA841E68D5D88B0D15C7698370F81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 a07e191a11dd63f17da23e5510c151163f0c2d83e0b613554c45ccc23ecb4cc9
MD5 99d490ec29f01cad3acc98b06f65b3fe
SHA1 3de4eed95c73ff14b9724ff047dfd50fdf434ef4
SHA512 0ffb1d27eaf78a342041feea7a653a2c72ea87ddfc14001eb479e345049e032a25a180bddf46c27c092ab99d902de226dffc46f6682482335ad84dfa9212f1c2
SSDEEP 384:n4urQXjZxh6Vy3sNTVWrrV2k/rq7OGASQpOgkmqDrPwi3Swdc1oRIzZ:4ur0h6Y3BVK7OS9OqvPwiCF
TLSH
T11AC26CB2E4A42CF70992D9C9A206FA173EF80137CA885D1CD6F8763A308F5F9631B555
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 fa9c440721fefdcceb60f8234feda2b2ec7dc4a9100603237242b8a396b16807
MD5 b4ad49f211f419abf891ed16d32e61c2
SHA1 f8f340429d38776594e9a6f3b4169dbcbd5ea714
SHA512 94abcfb76394286b3fb4a03f3114d6d715f19ff8349cfc2359c54a7fd9b28eda5abea141c8db3349e61a55bd3071dd98cf38ac368d3fbda723bb87d53ac18321
SSDEEP 96:ZqONk3QsjpfmUTmDK5ih/cIPURHl8h4otop5VF5DVkBhPwivh50xy0SFYKQAxsYL:gONz6kDfQmiUyVXVIZ9036TQiiE5U6
TLSH
T10B02EA3568786CBB8EA3AE46B44777275FA5213BEA852F85D9E81B1C04D724C2306837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

9dcb5b0a-44bc-4b9a-a3e4-34cf6039a08a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\9dcb5b0a-44bc-4b9a-a3e4-34cf6039a08a.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 9c2a2c145551ff03748fad5d2f8d962928b4ac0ae8fccacc5c7202bf6c2c13ad
MD5 26c287ac22f06c0d091bf56628d87546
SHA1 c20bc9e72b7161c0bf19d2d6f34f98cd32db61a1
SHA512 f1d5ea20fd0ad0dd189dcb2179f9e922b8f923ebfc4b264788393220151fb14271743d581d9416e2c29cc1c0b35adcd83855011444c96aa4baaf91f5f953ae1c
TLSH
T1C3412A58AAFA1148B3B76F16ABF6A9AE447B7C372F06D55D10010E4F0A63B40C871B37
MD5 SHA1 SHA512 TLSH

Submit Download

2dd6fd5c-3f63-4e9a-94b0-2f34bd449818.tmp

Path C:\Users\Admin\AppData\Local\Temp\2dd6fd5c-3f63-4e9a-94b0-2f34bd449818.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

59084ad6-d1fa-4dd8-810e-7861a6cd02bd.tmp

Path C:\Users\Admin\AppData\Local\Temp\59084ad6-d1fa-4dd8-810e-7861a6cd02bd.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

HandyControl.dll

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\HandyControl.dll
Size 1.7MB
SHA256 7ca80a01651cf83645c44f2d8dddc1df018c3c9984df977d5f9d5ee9a59f42cc
MD5 30ffd805ab4ff562040afc9cff4a89e9
SHA1 62ebf6a48e105eee60e02a7cdccba2d9a0129c2c
SHA512 7be8242559775dd1a8f9abee6521cd45a4f2b1425a4ccc7a8962c11ae23d15cf3ceae4c6ebff98e3b86f1344ef202a9d544cbac25d3033310b77726aa7bc1930
SSDEEP 24576:ZaHIzmBFOXuzNEXYz0m65xrJW5sdnEI7gIFailMNGAHUH4EtizpKfdKwK0KPKUKm:0keBEoz0m6fr8cnEIsgaUco4pw
TLSH
T1F9856A11B7B4AD36C57F0BBACA3216CC673C884667E0E78B61967EBD0CE534069052E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

strings.json

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\Languages\strings.json
Size 28KB
SHA256 5ddb5de75d40c9aeac2bf91cae8de79f09e89550fae0a8b3485948a890f6bc4b
MD5 46904db1b31a4a84e7c86da05a193613
SHA1 dde10ab88dbb141703a837b4d70954987685d5cb
SHA512 4978baf79c6f5fdf89ac26835ebff5743e73af6f5ff49289ab539049bf13efa7f3516ac02a2a993a032304cd94a1121de16a8c43cf7db3ec99bcd7f3336d0af0
SSDEEP 768:hY8+yFUO+45PZrw+Gy6QPZ2VmLMcrDD/KKWVSXzN:hLFZD5xrw+r6Zmga+OzN
TLSH
T1CFD28533C9655CA703F2B70AAD695947F89103BF23011E4B38BCD96C1FB2926915E72E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Newtonsoft.Json.dll

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\Newtonsoft.Json.dll
Size 695KB
SHA256 e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d
MD5 195ffb7167db3219b217c4fd439eedd6
SHA1 1e76e6099570ede620b76ed47cf8d03a936d49f8
SHA512 56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac
SSDEEP 12288:GBja5bBvR8Q0TE2HB0WLmvXbsVG1Gw03RzxNHgKhwFBkjSHXP36RMGy1NqTUO:GBjk38WuBcAbwoA/BkjSHXP36RMG/
TLSH
T166E4394123F98F2BE1AF6B75B4704E1543F9F917A6B5E78F9A04D9A91C43B408E403A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NinjaCS.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\NinjaCS.exe
Size 489KB
SHA256 d8edf72441f234139624f9be86f9292e6feb7dc25b35b7d2b2e9c638f75ff1e7
MD5 f9b0cc5089ae944589d75cc43e3582c0
SHA1 42fbe528c0b68b1ea0fca65dbca2826a167181ae
SHA512 fc1ab2d66885f0aa0ee0b8aaba944a8331939c1068280b4003bf0a97f2464bdd5136dca13e59510ce55ed8f780e8bc2653863b01dcfb03ab06ce3af77bf7e61b
SSDEEP 6144:nqhUpQQ8fapjheSvJg5vk8Hb0x1R59/BS6HhfXPy56sIIh/1tuJGs3HOUi8Hb0x3:BOfsjPvuYtD/XPyssIEhs3NYt
TLSH
T1FAB41209F7BC5523DAFBDF3C18F596208AB165832752CFDCA88A461FA8D27940653723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1868_777032358\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5d602184-03b7-4f67-a560-1056838e040c.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1868_798316795\5d602184-03b7-4f67-a560-1056838e040c.tmp
Size 152KB
SHA256 f83832c37a0969ce89f77b16eaa07457b03f43029abaec00eaedce2674adbaf5
MD5 d2e80cd29c43ea745d16284dc1f58ea6
SHA1 53fe0165f9f303b333be9284865c8a74f3553c0b
SHA512 375fd3e65b12f80b92a63c1cf6f0ace9fe878c1a0cb5179d869c99aad0cfde14715fd1499eab22a04f353e5f292c19d6a5aeccb43ec2ff5cd6878a5226b005ca
SSDEEP 3072:bHVqfst2F+fBXzSKmg3n0OIH1iCylcLMLgaK9enj59Ah8MuBX8Yk17CF:b1qkfBXG801idlcLMLgaOeV9A2XdBkda
TLSH
T1DBE3E13C3EDACD26C21B20F97F287587C54D8F17A10BA50BE14A84015A76B5E17E2DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2004_1937598991\CRX_INSTALL\_locales\am\messages.json
Size 1KB
SHA256 64e01bc292ba2ea1699576fcc445367047520ee895e290ccee20c24c9336d8ef
MD5 83e0e58d0752ff7c3f888e6406413b84
SHA1 14a8981e4355301bb3073db6d7ffb337ef8482e3
SHA512 fc772bd3d6ac64110562aaca7d320f49ffba4e1f9ac2e10456fcb75e172d086d3ce8996cfc64b33b2ecdf4f6b96e38905e671c1e6ba5205fede9af4a183812c4
TLSH
T13F41184CC989A599E7F7908FACB9A0F54CF70E90D580B8391DBDA20E526543DA04BCDF
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2004_1937598991\CRX_INSTALL\_locales\ar\messages.json
Size 2KB
SHA256 47652115cbb912907f405992fcfc64f987642158f0cb35c9d6e0d4742d833802
MD5 c825621044e4d5c504404dae9752285c
SHA1 68c1e29daf042487cb76629abcdc03f16fccc92a
SHA512 4aef3e7a747e290be8ba10e22e670c1c2dc653d4311020a4fd3060205fd88bb5d13d9edf388fc18919abe353c62d6841a4ef87e38064430299e52ca16c81941e
TLSH
T1CE511EE4BBB6695C051CEB0399BFEDDC18553DC188EB90321B7C13C882296097E5D3A3
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2004_1937598991\CRX_INSTALL\_locales\az\messages.json
Size 1KB
SHA256 614470da3c5034ace649f1786beaaad2c94f4475bcc8858390b721f06fb7bf64
MD5 c603747b8578c1324dd262565f643e06
SHA1 5cd18bb971af007d9a589377a662688daafe7519
SHA512 59a5b29459e6a10628ab95ed620ab159dacde2d98dc2c3dc7949d0e5e253f2be7a21cb13f0ee8ae0e2f85191a520c9daf797fd93b27c39f53b1faa8aef1b706a
TLSH
T13E216AA321F1FF5CCB064146FA74734E14609E5410A9A4E17CB2A9BF072E5DDF152A2D
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2004_1937598991\CRX_INSTALL\_locales\bg\messages.json
Size 3KB
SHA256 22bc37b47ce8a832f39701641dc358357676e9be187a93a4c5d4b016e29238ae
MD5 361b516edf253851044dae6bad6d9d6f
SHA1 d64c297cf1977cd8ad5c57d9b0a985a4de4fd54b
SHA512 b2614c53e93e705a93b82db9fcf5259ca44b10b5e5237967a34f68607ab2380ea0c8e5df4ffd941d914617fa3538fd40c18df7d3c9808c5f652852f01e214c77
TLSH
T1C351B2E2C0F7165C29C87996FB71BCED38987881E128E73FDC7E2287D21462566D131A
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2004_1937598991\CRX_INSTALL\_locales\bn\messages.json
Size 2KB
SHA256 3e3ceaa214d8079b02c9c941635f5d45e621236d9c3f82e06ac604f0772670e8
MD5 b1101fac65ce2faa3702e70fd88957d2
SHA1 06ebd889fad9ee2d5d5083b10abf7b2a4d0e1724
SHA512 398d03bd3b51e2789d0573f5e4792c13193c36539e8fa35261bc3b9a991a155635e6d44a9999b42d3dfa264e3fc329e11dd65d6e1408c4076a49576e7e5ef4ff
TLSH
T12D513D0AB0E5FA89060D3066DC3064FE5BAC599741301B3A8D8FDACA7E1E17DC16F9B1
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2004_1937598991\CRX_INSTALL\_locales\ca\messages.json
Size 843B
SHA256 de6d7b7c2427ec4e738407d7834b71941f69166b030355e00f325ff1391df5a1
MD5 fbb841a2982166239d68907361f41f61
SHA1 4a8d76a6fe1bb111fdbdfd42d1af0019a97fc540
SHA512 8db540b4c9e250d3781797238b1d16ad820c568edc563bfb912872ab99950def7e89ee432c696ba9876e3d7b24a4e4c26fa5b0fa9e76a54e11ae63996e02a561
TLSH
T1D201AF5E75807EAA4B0ED0A33E3BB20FD0B81AC12745E0D7A2A4421D124AD4DF3637B0
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2004_1937598991\CRX_INSTALL\_locales\cs\messages.json
Size 953B
SHA256 5a701d67910ba6c7ccedc26e02fa707cc86a1be57cd7d36290a3d268732a42c7
MD5 48663a88dcf0ef6c9fade9bee4935b91
SHA1 af7cad1498bb4b0f05c1468abe3563d0182a97b4
SHA512 3c3e5b9e56535efe1e20d6024b6fa46d3ea969c971d5ec8f5af1c933c1feb75d25e7f26c9e2bb8d200bca70ea1f1bd7e93e4e1c09dbc447340cdbeefa91cc33f
TLSH
T17311595B53F22C9E871ED0967C36B26542B046C1119CF46262BED18BB10ED2CB57B276
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2004_1937598991\CRX_INSTALL\_locales\da\messages.json
Size 764B
SHA256 94cddb998c2c5ab40b6f074c359a60e6eebaaa2d52a9649c22f4ea4c1b9936f2
MD5 0e451c9c8453577e513aabf630c275f2
SHA1 5912cc58aa82bc75691540c8aeaca7c68641539e
SHA512 a89dcc1ec8c79e7cf702692e20ebc952907b2fb1d76a3beef60d7415baee24e055e2988b55e12ce00bc112c115ddd9d46d63bf0a1c511fffb041da7054391f80
TLSH
T1A101D09292E27E8B4B2F9117BC217A15517C07CB51A6A013B0CAE95E594385DA16F370
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2004_1937598991\CRX_INSTALL\_locales\de\messages.json
Size 927B
SHA256 22e2828bfdbb9c340e7806894ae0442bd6c8934f85fbb964295edad79fd27528
MD5 5daf77ae7d2b7dbef44c5cf7e19805ee
SHA1 48c06099aee249dd05b268749836e3021e27cfb5
SHA512 b9fe759ba6a447ebf560e3ac6c79359e0ad25afca1c97da90f729dcd7af131f43c1f4bfcb2cd4fe379fff2108322cf0849a32995b50188b52258bfff9e5ca34d
TLSH
T1C611108373E20E1D578FD1637C3A7685D76442E6D284B113B8CCE51E618F42E1107630
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2004_1937598991\CRX_INSTALL\_locales\el\messages.json
Size 3KB
SHA256 728d8cbd71263680a4e41399db65b3f2b8175d50ca630afd30643ced9ffe831f
MD5 32886978ef4b5231f921eb54e683eb10
SHA1 9e2626e158cbd26a2a24a50e4e8cfd98a49984e9
SHA512 416832f007470bf4d9d915410b62bd8159029d5ddabed23d2bbc297e4bbae46f4346feb68c54163428a6932c537967ae9ef430b9fac111f15cfb001a480799b3
TLSH
T13F71612E3676BA790BE9D24BA5316CEB7E4E4FE0C1B015F2656AC2D8544CE19D07F02C
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2004_1937598991\CRX_INSTALL\_locales\en_GB\messages.json
Size 708B
SHA256 c7255e9b784c4b8df7df7b78f33a5737a9ab7382f73465351597b1da9b3d5fe7
MD5 c4e77421f3361277f7e3aa3472b5eb10
SHA1 f8ddd7cd0cce742e68443d173196471e8a23bd83
SHA512 6c11cccbfa6e841d90fa5b41f46de5489359335dd59ccb06d5148e7d2ce3af1422b93eb574360be4695e69d851befed8a2588dd411a7b0a553cb621238d474d4
TLSH
T168014C5363417F554717F05BB9023441A5B44AC52784E07775EC982C665ADAFB24B3B0
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2004_1937598991\CRX_INSTALL\_locales\fa\messages.json
Size 2KB
SHA256 e758273c25fbad804fe884584e2797caefbbd1c2877dfd6f87ab1340cd25252e
MD5 e578e08ee604158d674982ba060396fd
SHA1 fd601092203317fe9f576fbfd675e274001efa80
SHA512 131c75cdbc4a40068cf97d7becad08f49e77a9bda3fb1cc50501b0007273ee5c6eae2f84047d97f72b6fd9f28f65ae544eb807057a54a6e009b9bd8fb8ca4df1
TLSH
T1545158DCBF767A5C152CDA029D7DDACC04493CC088AF90799B7897C4C5A45847EA93A3
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2004_1937598991\CRX_INSTALL\_locales\fi\messages.json
Size 840B
SHA256 a822b0e66d04644d1cfbd2517736728438743162c3213f15d986e2db85bd0213
MD5 1d4778e02337674d7d0664b5e7dfcbbe
SHA1 fe1763ac0a903a47446a5896a2d12cce5d343522
SHA512 771c7ba7f93a6e9db94593897d495e190e58a9b9c490523cc410059e72538005e2de96864dbbed8bd1f01eaa4d1cd022443dddbf759a606e2903c9ddecac43fe
TLSH
T117018E6763763E9C970BE1127E32340BD1B52AD600C4D9A321DC4B6F25AE92DB277734
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2004_1937598991\CRX_INSTALL\_locales\fr\messages.json
Size 902B
SHA256 6713b69b6c9e80b03e0a9d4a7d158197b0c7ec8a853c64c0af0b1a05ce54d74c
MD5 85718fe4820c674c5305d33dfb5cbddc
SHA1 d4170743349f3e037718fde17bc63a369c2e218a
SHA512 678e934f8d4a1bf0b98844b796eaa2471a78911d4020bf755871650dd0adad6bf7b475d9e5bf68b6a911ed330308a08698706d9460df003648b612d97848e652
TLSH
T129118009A3343EAD5F279172BD3564878A7C45C5738071127189970F52AA86DF2F3770
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2004_1937598991\CRX_INSTALL\_locales\gl\messages.json
Size 927B
SHA256 9890710df0fbf1db41bce41fe2f62424a3bd39d755d29e829744ed3da0c2ce1d
MD5 cc31777e68b20f10a394162ee3cee03a
SHA1 969f7a9caf86ebaa82484fbf0837010ad3fd34d7
SHA512 8215a6e50c6acf8045d97c0d4d422c0caacb7f09d136e73e34dba48903bb4c85a25d6875b56e192993f48a428d3a85ba041e0e61e4277b7d3a70f38d01f68aab
TLSH
T11B117D9E6AF1BDF6470BE0627C3FB10BD62856C21E80E8DB28A9D1281108C5AF163765
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2004_1937598991\CRX_INSTALL\_locales\gu\messages.json
Size 2KB
SHA256 cc3e9077fcc9bd0dfc5dd3924c6c48b8345f32cee24fccc508c279f45b2abe61
MD5 86de754c2d6b550048c9d914e55b5ff0
SHA1 5b6654101b3596742be06b18ef2a5d81da569ee5
SHA512 3a8d326b91141b18cb569a93bcd295075e94a0488f2ffe5afb80a4cb36e4523e28c87d91a64ed255445470ad6c8a34948fe091e709e8097dcdd06eba1cc52887
TLSH
T18751C5CF51E0DA7A061E2435583CA0EA4BAE0C6A403C1335DE5FA6B9795C6BFC16F1A1
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2004_1937598991\CRX_INSTALL\_locales\hi\messages.json
Size 2KB
SHA256 14895bf43ce9b76c0ff4f9aef93dbe8bb6ca496894870cf0c007b189e0cef00e
MD5 4a9c9f947b479e5d89c38752af3c70ea
SHA1 799c5c0ba3e11ad535fa465ab87007c36b466c6a
SHA512 293d9fd5b207c14d1ffc7945f80d3c2dc2d5450bdf1e7b7962767b8d330c9255da16dfa677234198569f4ddfd00bce82d70086df974afe512769597039e21cf9
TLSH
T1165162D2F3F2F9C9810C7071D43A96ED5A849D920161E8AB5CEE9ACEC2872448253FE4
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2004_1937598991\CRX_INSTALL\_locales\hr\messages.json
Size 863B
SHA256 985976b776e729835e047c81d3d731a6c488a6459aa8918dbc8ec808c0bf73a1
MD5 eb6c5133c1fe7f9e8e4449a917d185d9
SHA1 9be42ac75487a77dfbbf01ea2098886e69956356
SHA512 1aba115b30c99e786845c137ecb8beec4b5162c59d10724dcc083ff6b91a47af45ca850fc0b3072d44be189b31abb67423c88369171b0c411ccf7ae884fd831e
TLSH
T1DF11C2A382667F4A830FC1967C38F31698F482C85BC5D47316FDB338424EE74A102224
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2004_1937598991\CRX_INSTALL\_locales\hu\messages.json
Size 1KB
SHA256 cf26310b073b0891996ecd761c6cb53f00193dee524213a9fb34225d636ec4b7
MD5 fb8d08676aa88683f27a2759c5837529
SHA1 80badd0de6a8d87a8e14232f71fbcbe231eee443
SHA512 5c4307b653cd841af14a4b57f225938be54d718c979fa4008513461fa6f8409bc82e050f0b32e587f8e52d5580aa7c6d667aa94b30a588cb87de585b015fe176
TLSH
T19F21CC8DA3F62E1DA30B9195BC317DCD877886D21044E05E62E5C6BF978A43E6137732
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2004_1937598991\CRX_INSTALL\_locales\id\messages.json
Size 718B
SHA256 35872a3343d4b4768fe4702a8dc18b749933e81210db13466ad172bd2880f6eb
MD5 3fefe403f5f537d9a2d28ab36b2c1a94
SHA1 dd674520092f333aff63138f660987fbd8fa51e0
SHA512 45182775ac13b1f9406bc9595e822f24a9d8b854254e0d71514e1d99625b12b9cd8bc3226f04b1dfc79248f786f925b9b88a70e0d57bdf9a8dc48d79175ec60d
TLSH
T19C01974326C03D6F530F908379A2320665A503C64B80B06B62ECCF782A6F46DB08B331
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2004_1937598991\CRX_INSTALL\_locales\it\messages.json
Size 756B
SHA256 3377a873db531113d79919e7a89369a79a602bac6ae09b9864b9378dc285f345
MD5 88a9acd41521d1d00b870e2da3044a88
SHA1 36716937ce047463dbfa5cf1f5ef4277fe354d9e
SHA512 a56ffa200c5f8b312d8ed77ea40df931b86074adf1577941726d184497531d1c89d77382983f01797604e6a5c34029fa88f3aae0d52c368e2046c0c6f21cd956
TLSH
T13901285285C37E555F1FA24375527006D9BA06D27AC171137BCE892C238F84DF417B28
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2004_1937598991\CRX_INSTALL\_locales\kn\messages.json
Size 3KB
SHA256 5fa00c465c1c5eed4bea860ceb78da9419ea115347ba543ddb0076e5c188feed
MD5 f55ce2e64a06806b43816ab17d8ee623
SHA1 27affcf13c15913761d0811b7ae1143e39f9eea4
SHA512 a0e7d0f7beeca175c67a783adf5ff614c8e3b731311f82bc24eb0f0798938d79f15a5cfa012b3cf06d7a138d88e6f78eb3d3d57a3edebb60116de2dc706e2b0f
TLSH
T11461119E7379DACC1B1D200A9830F89DD95CA48110F643BDD8EA928E350E52ED2FFD61
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2004_1937598991\CRX_INSTALL\_locales\ko\messages.json
Size 1KB
SHA256 57f81a5fcbd1fefd6ec3cdd525a85b707b4eead532c1b3092daafd88ee9268ec
MD5 e71a91fe65dd32cac3925ce639441675
SHA1 91c981f572497a540c0c2c1d5fb28156d7e49416
SHA512 2b89c97470bae1d55a40f7f1224930480d33c58968f67345ca26e188ff08cf8b2f1e5c5b38ecfdbf7ebfd9970be0327cbfc391cf5e95e7c311868a8a9689dfb6
TLSH
T18B31488FC3341AE54246984FBD5273FEB68217E2008CA972D2B9E9453F0E47DA023734
MD5 SHA1 SHA512 TLSH

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5900_1498694188\CRX_INSTALL\128.png
Size 4KB
SHA256 ff702ca753a7e3b75f9d9850cc9343e28e8d60f8005a2c955c8ac2105532b2c9
MD5 d056cec3b05d6a863ddfa7ee4c1c9f0c
SHA1 dcd15b46dea9d234f13d7f04c739a2c516c973f1
SHA512 751274949b04c7cdc5e8f5f20fd062bfe130f1415eee524d9d83bcf1a448fbfb4b82dff8bbf7495250a852779c3d11ac87e33275508a4064f9d52417f4ca230f
SSDEEP 96:YpjISYK9mvKBG4+43tmidWQX3DJQoWQpzYKL:Yp7nG4j3tRWQX314QpzzL
TLSH
T1EDA16DDEF15935355323E89B282AC458C69F5302D282D6AF940DD4C572C3DBE68B2DC7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5900_1498694188\CRX_INSTALL\_locales\en\messages.json
Size 711B
SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
MD5 558659936250e03cc14b60ebf648aa09
SHA1 32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA512 1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
TLSH
T1460197136240AF18470BF05BB9023442A0B44AC62384E0B775EC982C6656DAFB20B3B0
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5900_1498694188\CRX_INSTALL\_locales\en_US\messages.json
Size 1KB
SHA256 4f70eca8e28541855a11ec7a4e6b3bc6dd16c672ff9b596ecfb7715bb3b5898c
MD5 64eaeb92cb15bf128429c2354ef22977
SHA1 45ec549acaa1fda7c664d3906835ced6295ee752
SHA512 f63ee02159812146eee84c4eb2034edfc2858a287119cc34a8b38c309c1b98953e14ca1ca6304d6b32b715754b15ba1b3aa4b46976631b5944d50581b2f49def
TLSH
T153213806EA14BB37825F6036BC657585A3300ADB2600FC3D7EDC941C1B059AA91BB3D4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5900_1498694188\CRX_INSTALL\manifest.json
Size 1KB
SHA256 507f5fce0acbb9dddf006205127035b2f474fba4c9cc513a524bb19b86bf0599
MD5 53fefc4e02295749ada8487202118bf3
SHA1 bf67ddfc5dd251059286dbaafde0638ccefebd0b
SHA512 3e02a34e4b1741fc0007f123e0a5d684735a49e92678ea79cb2e71d21400f6c2e8fccd6359d642b3bf4459d66f4d9a69fc87557e92592a3171bc0a58fad9f45c
TLSH
T1F54169F7BC00AD634BA49898AA1E710EFB29B24D55CFD4DB8298107302CCDAE1D601E5
MD5 SHA1 SHA512 TLSH

Submit Download

memory/676-34-0x0000023DE0970000-0x0000023DE09EE000-memory.dmp

Download

memory/676-53-0x0000023DFC690000-0x0000023DFC6A0000-memory.dmp

Download

memory/676-45-0x0000023DFC750000-0x0000023DFC772000-memory.dmp

Download

memory/676-48-0x0000023DFC690000-0x0000023DFC6A0000-memory.dmp

Download

memory/676-50-0x0000023DFC690000-0x0000023DFC6A0000-memory.dmp

Download

memory/676-51-0x0000023DFC690000-0x0000023DFC6A0000-memory.dmp

Download

memory/676-41-0x0000023DFC710000-0x0000023DFC748000-memory.dmp

Download

memory/676-42-0x0000023DE2580000-0x0000023DE258E000-memory.dmp

Download

memory/676-40-0x0000023DE2570000-0x0000023DE2578000-memory.dmp

Download

memory/676-44-0x0000023DFCF30000-0x0000023DFCFE2000-memory.dmp

Download

memory/676-52-0x0000023DFCCA0000-0x0000023DFCE6E000-memory.dmp

Download

memory/676-908-0x0000023DFCCA0000-0x0000023DFCE6E000-memory.dmp

Download

memory/676-35-0x0000023DFC690000-0x0000023DFC6A0000-memory.dmp

Download

memory/676-37-0x0000023DFC8E0000-0x0000023DFCAA4000-memory.dmp

Download

memory/676-38-0x0000023DFC7D0000-0x0000023DFC88A000-memory.dmp

Download

memory/676-663-0x0000023DFCCA0000-0x0000023DFCE6E000-memory.dmp

Download

memory/676-662-0x0000023DFCCA0000-0x0000023DFCE6E000-memory.dmp

Download

memory/676-661-0x0000023DFCCA0000-0x0000023DFCE6E000-memory.dmp

Download

memory/676-39-0x0000023DFC690000-0x0000023DFC6A0000-memory.dmp

Download