hxxps://transparencyreport[.]google[.]com/safe-%20browsing/search

Analysis

geolocation tags

asiadelhiinindia
user interaction
yes
max time kernel
82s
max time network
84s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 12:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://transparencyreport.google.com/safe-%20browsing/search
Sample260709-pc33psay7z

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2408	msedge.exe
4840	msedge.exe
4548	chrome.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 11 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134280727814224259"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2049790993-2338060321-149346055-1000\{22893FF7-A038-4A50-A430-DEFD43752014}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2049790993-2338060321-149346055-1000\{83A1B703-8C7E-4AAB-BC24-25B38270B986}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5788	chrome.exe
5788	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 29 IoCs

pid	Process
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe

Suspicious use of AdjustPrivilegeToken 52 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5788	chrome.exe
Token: SeCreatePagefilePrivilege	5788	chrome.exe
Token: SeShutdownPrivilege	5788	chrome.exe
Token: SeCreatePagefilePrivilege	5788	chrome.exe
Token: SeShutdownPrivilege	5788	chrome.exe
Token: SeCreatePagefilePrivilege	5788	chrome.exe
Token: SeShutdownPrivilege	5788	chrome.exe
Token: SeCreatePagefilePrivilege	5788	chrome.exe
Token: SeShutdownPrivilege	5788	chrome.exe
Token: SeCreatePagefilePrivilege	5788	chrome.exe
Token: SeShutdownPrivilege	5788	chrome.exe
Token: SeCreatePagefilePrivilege	5788	chrome.exe
Token: SeShutdownPrivilege	5788	chrome.exe
Token: SeCreatePagefilePrivilege	5788	chrome.exe
Token: SeShutdownPrivilege	5788	chrome.exe
Token: SeCreatePagefilePrivilege	5788	chrome.exe
Token: SeShutdownPrivilege	5788	chrome.exe
Token: SeCreatePagefilePrivilege	5788	chrome.exe
Token: SeShutdownPrivilege	5788	chrome.exe
Token: SeCreatePagefilePrivilege	5788	chrome.exe
Token: SeShutdownPrivilege	5788	chrome.exe
Token: SeCreatePagefilePrivilege	5788	chrome.exe
Token: SeShutdownPrivilege	5788	chrome.exe
Token: SeCreatePagefilePrivilege	5788	chrome.exe
Token: SeShutdownPrivilege	5788	chrome.exe
Token: SeCreatePagefilePrivilege	5788	chrome.exe
Token: SeShutdownPrivilege	5788	chrome.exe
Token: SeCreatePagefilePrivilege	5788	chrome.exe
Token: SeShutdownPrivilege	5788	chrome.exe
Token: SeCreatePagefilePrivilege	5788	chrome.exe
Token: SeShutdownPrivilege	5788	chrome.exe
Token: SeCreatePagefilePrivilege	5788	chrome.exe
Token: SeShutdownPrivilege	5788	chrome.exe
Token: SeCreatePagefilePrivilege	5788	chrome.exe
Token: SeShutdownPrivilege	5788	chrome.exe
Token: SeCreatePagefilePrivilege	5788	chrome.exe
Token: SeShutdownPrivilege	5788	chrome.exe
Token: SeCreatePagefilePrivilege	5788	chrome.exe
Token: SeShutdownPrivilege	5788	chrome.exe
Token: SeCreatePagefilePrivilege	5788	chrome.exe
Token: SeShutdownPrivilege	5788	chrome.exe
Token: SeCreatePagefilePrivilege	5788	chrome.exe
Token: SeShutdownPrivilege	5788	chrome.exe
Token: SeCreatePagefilePrivilege	5788	chrome.exe
Token: SeShutdownPrivilege	5788	chrome.exe
Token: SeCreatePagefilePrivilege	5788	chrome.exe
Token: SeShutdownPrivilege	5788	chrome.exe
Token: SeCreatePagefilePrivilege	5788	chrome.exe
Token: SeShutdownPrivilege	5788	chrome.exe
Token: SeCreatePagefilePrivilege	5788	chrome.exe
Token: SeShutdownPrivilege	5788	chrome.exe
Token: SeCreatePagefilePrivilege	5788	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 4064	2180	msedge.exe	88
PID 2180 wrote to memory of 1328	2180	msedge.exe	89
PID 2180 wrote to memory of 2408	2180	msedge.exe	90
PID 2180 wrote to memory of 4804	2180	msedge.exe	91
PID 2180 wrote to memory of 1328	2180	msedge.exe	89
PID 2180 wrote to memory of 1328	2180	msedge.exe	89
PID 2180 wrote to memory of 4804	2180	msedge.exe	91
PID 2180 wrote to memory of 3996	2180	msedge.exe	93
PID 2180 wrote to memory of 804	2180	msedge.exe	94
PID 2180 wrote to memory of 3996	2180	msedge.exe	93
PID 2180 wrote to memory of 3996	2180	msedge.exe	93
PID 2180 wrote to memory of 804	2180	msedge.exe	94
PID 2180 wrote to memory of 804	2180	msedge.exe	94
PID 2180 wrote to memory of 5484	2180	msedge.exe	95
PID 2180 wrote to memory of 5484	2180	msedge.exe	95
PID 2180 wrote to memory of 5484	2180	msedge.exe	95
PID 2180 wrote to memory of 2808	2180	msedge.exe	96
PID 2180 wrote to memory of 2808	2180	msedge.exe	96
PID 2180 wrote to memory of 2808	2180	msedge.exe	96
PID 2180 wrote to memory of 2436	2180	msedge.exe	98
PID 2180 wrote to memory of 2436	2180	msedge.exe	98
PID 2180 wrote to memory of 2436	2180	msedge.exe	98
PID 2180 wrote to memory of 1928	2180	msedge.exe	99
PID 2180 wrote to memory of 1928	2180	msedge.exe	99
PID 2180 wrote to memory of 1660	2180	msedge.exe	100
PID 2180 wrote to memory of 1660	2180	msedge.exe	100
PID 2180 wrote to memory of 636	2180	msedge.exe	102
PID 2180 wrote to memory of 3240	2180	msedge.exe	106
PID 2180 wrote to memory of 5816	2180	msedge.exe	107
PID 2180 wrote to memory of 3044	2180	msedge.exe	108
PID 2180 wrote to memory of 1384	2180	msedge.exe	109
PID 2180 wrote to memory of 1384	2180	msedge.exe	109
PID 2180 wrote to memory of 1384	2180	msedge.exe	109
PID 2180 wrote to memory of 5704	2180	msedge.exe	110
PID 2180 wrote to memory of 5704	2180	msedge.exe	110
PID 2180 wrote to memory of 5704	2180	msedge.exe	110
PID 2180 wrote to memory of 1924	2180	msedge.exe	111
PID 2180 wrote to memory of 1924	2180	msedge.exe	111
PID 2180 wrote to memory of 1924	2180	msedge.exe	111
PID 2180 wrote to memory of 5000	2180	msedge.exe	112
PID 2180 wrote to memory of 5000	2180	msedge.exe	112
PID 2180 wrote to memory of 5000	2180	msedge.exe	112
PID 2180 wrote to memory of 5500	2180	msedge.exe	113
PID 2180 wrote to memory of 5500	2180	msedge.exe	113
PID 2180 wrote to memory of 5500	2180	msedge.exe	113
PID 2180 wrote to memory of 1184	2180	msedge.exe	114
PID 2180 wrote to memory of 1184	2180	msedge.exe	114
PID 2180 wrote to memory of 1184	2180	msedge.exe	114
PID 2180 wrote to memory of 1420	2180	msedge.exe	115
PID 1420 wrote to memory of 2744	1420	msedge.exe	116
PID 1420 wrote to memory of 6124	1420	msedge.exe	117
PID 1420 wrote to memory of 4840	1420	msedge.exe	119
PID 1420 wrote to memory of 6124	1420	msedge.exe	117
PID 1420 wrote to memory of 6124	1420	msedge.exe	117
PID 1420 wrote to memory of 2488	1420	msedge.exe	120
PID 1420 wrote to memory of 2488	1420	msedge.exe	120
PID 1420 wrote to memory of 2028	1420	msedge.exe	122
PID 1420 wrote to memory of 2876	1420	msedge.exe	123
PID 1420 wrote to memory of 2876	1420	msedge.exe	123
PID 1420 wrote to memory of 5816	1420	msedge.exe	124
PID 1420 wrote to memory of 5816	1420	msedge.exe	124
PID 1420 wrote to memory of 4012	1420	msedge.exe	125
PID 1420 wrote to memory of 4012	1420	msedge.exe	125
PID 1420 wrote to memory of 2728	1420	msedge.exe	126

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://transparencyreport.google.com/safe-%20browsing/search
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2c0,0x7ff98955c188,0x7ff98955c194,0x7ff98955c1a0
  2⤵
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1564,i,11894802065816276568,7571120354029593856,262144 --field-trial-handle=3004,i,3706608376547875372,15863515235652292828,262144 --variations-seed-version --mojo-platform-channel-handle=3000 /prefetch:2
  2⤵
  PID:1328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1952,i,8920954428501543702,17566657395458668628,524288 --field-trial-handle=3004,i,3706608376547875372,15863515235652292828,262144 --variations-seed-version --mojo-platform-channel-handle=3040 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2248,i,8881371365431660059,17458077826401355137,524288 --field-trial-handle=3004,i,3706608376547875372,15863515235652292828,262144 --variations-seed-version --mojo-platform-channel-handle=3312 /prefetch:13
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3632,i,9779219727078050557,11353189374575520217,2097152 --field-trial-handle=3004,i,3706608376547875372,15863515235652292828,262144 --variations-seed-version --mojo-platform-channel-handle=3724 /prefetch:1
  2⤵
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3640,i,14368382990310110227,14919380612119332363,2097152 --field-trial-handle=3004,i,3706608376547875372,15863515235652292828,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
  2⤵
  PID:804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4284,i,5970569824333692573,8603534916244061907,2097152 --field-trial-handle=3004,i,3706608376547875372,15863515235652292828,262144 --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:1
  2⤵
  PID:5484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4300,i,3612866309398276986,9154835037694883252,2097152 --field-trial-handle=3004,i,3706608376547875372,15863515235652292828,262144 --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:9
  2⤵
  PID:2808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3848,i,3330718131522338246,15123192849261315439,2097152 --field-trial-handle=3004,i,3706608376547875372,15863515235652292828,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:1
  2⤵
  PID:2436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3772,i,4469271092579664092,3030611143576897434,524288 --field-trial-handle=3004,i,3706608376547875372,15863515235652292828,262144 --variations-seed-version --mojo-platform-channel-handle=3720 /prefetch:14
  2⤵
  PID:1928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3792,i,17075306379732061962,10916151082470220922,524288 --field-trial-handle=3004,i,3706608376547875372,15863515235652292828,262144 --variations-seed-version --mojo-platform-channel-handle=3940 /prefetch:14
  2⤵
  PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,17830756175327383828,621801049675900997,524288 --field-trial-handle=3004,i,3706608376547875372,15863515235652292828,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:14
  2⤵
  PID:5220
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,17830756175327383828,621801049675900997,524288 --field-trial-handle=3004,i,3706608376547875372,15863515235652292828,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:14
  2⤵
  PID:636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,14267797238277482356,362055032523792393,524288 --field-trial-handle=3004,i,3706608376547875372,15863515235652292828,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:14
  2⤵
  PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4848,i,2729071093879382413,4944373209150872148,524288 --field-trial-handle=3004,i,3706608376547875372,15863515235652292828,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:14
  2⤵
  PID:5816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,4964201169002997237,28782480413418489,524288 --field-trial-handle=3004,i,3706608376547875372,15863515235652292828,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:14
  2⤵
  PID:3044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6076,i,7562074139609413330,9529215962192169253,2097152 --field-trial-handle=3004,i,3706608376547875372,15863515235652292828,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:1
  2⤵
  PID:1384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6564,i,14591279157227390274,2110555723872618794,2097152 --field-trial-handle=3004,i,3706608376547875372,15863515235652292828,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:1
  2⤵
  PID:5704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5220,i,13349511515245801435,1582216498858271246,2097152 --field-trial-handle=3004,i,3706608376547875372,15863515235652292828,262144 --variations-seed-version --mojo-platform-channel-handle=2936 /prefetch:1
  2⤵
  PID:1924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6800,i,11154742119331305667,539368825129507649,2097152 --field-trial-handle=3004,i,3706608376547875372,15863515235652292828,262144 --variations-seed-version --mojo-platform-channel-handle=6740 /prefetch:1
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5540,i,1205238700350916753,4801215620543934721,2097152 --field-trial-handle=3004,i,3706608376547875372,15863515235652292828,262144 --variations-seed-version --mojo-platform-channel-handle=4976 /prefetch:1
  2⤵
  PID:5500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=3668,i,6687514449285138424,16630776870775301312,2097152 --field-trial-handle=3004,i,3706608376547875372,15863515235652292828,262144 --variations-seed-version --mojo-platform-channel-handle=6940 /prefetch:1
  2⤵
  PID:1184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2e4,0x7ff98955c188,0x7ff98955c194,0x7ff98955c1a0
    3⤵
    PID:2744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1956,i,18065198746510894956,14275217670207309814,262144 --field-trial-handle=2528,i,12580231239372966673,16081168855773970643,262144 --variations-seed-version --mojo-platform-channel-handle=2452 /prefetch:2
    3⤵
    PID:6124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2128,i,3664462005915198293,5297287182480261560,524288 --field-trial-handle=2528,i,12580231239372966673,16081168855773970643,262144 --variations-seed-version --mojo-platform-channel-handle=2560 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2640,i,27825653273308928,1240816810447941155,524288 --field-trial-handle=2528,i,12580231239372966673,16081168855773970643,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:13
    3⤵
    PID:2488
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4400,i,11120083937421958615,9893310641224842205,524288 --field-trial-handle=2528,i,12580231239372966673,16081168855773970643,262144 --variations-seed-version --mojo-platform-channel-handle=4416 /prefetch:14
    3⤵
    PID:3160
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4400,i,11120083937421958615,9893310641224842205,524288 --field-trial-handle=2528,i,12580231239372966673,16081168855773970643,262144 --variations-seed-version --mojo-platform-channel-handle=4416 /prefetch:14
    3⤵
    PID:2028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4832,i,13725458514211868272,5471713601342023116,524288 --field-trial-handle=2528,i,12580231239372966673,16081168855773970643,262144 --variations-seed-version --mojo-platform-channel-handle=4804 /prefetch:14
    3⤵
    PID:2876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4920,i,10909041955083584877,3980715758139722356,524288 --field-trial-handle=2528,i,12580231239372966673,16081168855773970643,262144 --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:14
    3⤵
    PID:5816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4896,i,11420959418434125561,15419506444495314398,524288 --field-trial-handle=2528,i,12580231239372966673,16081168855773970643,262144 --variations-seed-version --mojo-platform-channel-handle=4924 /prefetch:14
    3⤵
    PID:4012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4828,i,10668604467753752919,11803518085800876922,524288 --field-trial-handle=2528,i,12580231239372966673,16081168855773970643,262144 --variations-seed-version --mojo-platform-channel-handle=4856 /prefetch:14
    3⤵
    PID:2728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4896,i,9145990221803301545,2716287033719091030,524288 --field-trial-handle=2528,i,12580231239372966673,16081168855773970643,262144 --variations-seed-version --mojo-platform-channel-handle=4892 /prefetch:14
    3⤵
    PID:3020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5172,i,13739971510867768026,6482930949732708596,524288 --field-trial-handle=2528,i,12580231239372966673,16081168855773970643,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:14
    3⤵
    PID:1188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5024,i,3783530018211687597,10428725489722775726,524288 --field-trial-handle=2528,i,12580231239372966673,16081168855773970643,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:14
    3⤵
    PID:2760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4444,i,15763607256514143085,1297169889055804044,524288 --field-trial-handle=2528,i,12580231239372966673,16081168855773970643,262144 --variations-seed-version --mojo-platform-channel-handle=1160 /prefetch:14
    3⤵
    PID:5956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4848,i,18321485399051151206,1583690579850001216,524288 --field-trial-handle=2528,i,12580231239372966673,16081168855773970643,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:14
    3⤵
    PID:5512
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5188,i,15983400163704031819,2015287872415591000,524288 --field-trial-handle=2528,i,12580231239372966673,16081168855773970643,262144 --variations-seed-version --mojo-platform-channel-handle=4852 /prefetch:14
    3⤵
    PID:5020

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2692

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4180

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5992

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4744

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff97a3cc728,0x7ff97a3cc734,0x7ff97a3cc740
  2⤵
  PID:5344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1520,i,5401210344599161422,6251161004668334925,524288 --field-trial-handle=2016,i,12539044575249125222,5735463582809978993,262144 --variations-seed-version --mojo-platform-channel-handle=2120 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1616,i,17663381525573900518,6441824996551208097,262144 --field-trial-handle=2016,i,12539044575249125222,5735463582809978993,262144 --variations-seed-version --mojo-platform-channel-handle=2012 /prefetch:2
  2⤵
  PID:6128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2292,i,12180045579037746950,10472994918549675295,524288 --field-trial-handle=2016,i,12539044575249125222,5735463582809978993,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:13
  2⤵
  PID:492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3256,i,7905067400679376283,3394465210274558112,2097152 --field-trial-handle=2016,i,12539044575249125222,5735463582809978993,262144 --variations-seed-version --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:6120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3332,i,18085378432635385239,6349259172970795527,2097152 --field-trial-handle=2016,i,12539044575249125222,5735463582809978993,262144 --variations-seed-version --mojo-platform-channel-handle=3380 /prefetch:1
  2⤵
  PID:3836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4736,i,9100743876516558496,16802704762690674522,2097152 --field-trial-handle=2016,i,12539044575249125222,5735463582809978993,262144 --variations-seed-version --mojo-platform-channel-handle=4740 /prefetch:1
  2⤵
  PID:2052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4896,i,15516244402572835170,1996039488371084439,524288 --field-trial-handle=2016,i,12539044575249125222,5735463582809978993,262144 --variations-seed-version --mojo-platform-channel-handle=4876 /prefetch:14
  2⤵
  PID:2040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4872,i,2555442880683012328,10312232437749711305,2097152 --field-trial-handle=2016,i,12539044575249125222,5735463582809978993,262144 --variations-seed-version --mojo-platform-channel-handle=3944 /prefetch:1
  2⤵
  PID:5956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3352,i,13049485051705106695,4424322167061925262,524288 --field-trial-handle=2016,i,12539044575249125222,5735463582809978993,262144 --variations-seed-version --mojo-platform-channel-handle=4748 /prefetch:14
  2⤵
  PID:3852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3916,i,2096123941589578313,13510811088980143875,2097152 --field-trial-handle=2016,i,12539044575249125222,5735463582809978993,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:1
  2⤵
  PID:2380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3392,i,16443034922152993554,2599487056253648927,2097152 --field-trial-handle=2016,i,12539044575249125222,5735463582809978993,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
  2⤵
  PID:4884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5684,i,6156692026990071331,1652783383819912331,2097152 --field-trial-handle=2016,i,12539044575249125222,5735463582809978993,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:1
  2⤵
  PID:2072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5852,i,6136349410935532594,9229143563655690248,524288 --field-trial-handle=2016,i,12539044575249125222,5735463582809978993,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:14
  2⤵
  PID:1608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=4748,i,12286924211664600313,2210374453608096837,524288 --field-trial-handle=2016,i,12539044575249125222,5735463582809978993,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:12
  2⤵
  PID:3088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5540,i,8085548467936833940,5213052525351280751,2097152 --field-trial-handle=2016,i,12539044575249125222,5735463582809978993,262144 --variations-seed-version --mojo-platform-channel-handle=3392 /prefetch:1
  2⤵
  PID:2404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6260,i,9968800121923950284,924450696888949356,2097152 --field-trial-handle=2016,i,12539044575249125222,5735463582809978993,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:1
  2⤵
  PID:1048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5848,i,8433312694396931607,5438842747121321538,2097152 --field-trial-handle=2016,i,12539044575249125222,5735463582809978993,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:1
  2⤵
  PID:208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6236,i,11803686492350796766,17472107150151090004,2097152 --field-trial-handle=2016,i,12539044575249125222,5735463582809978993,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:2692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5640,i,17915212199621657685,13915201662459935302,524288 --field-trial-handle=2016,i,12539044575249125222,5735463582809978993,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:14
  2⤵
  PID:1996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6000,i,9833485289873567742,7797581359654064888,2097152 --field-trial-handle=2016,i,12539044575249125222,5735463582809978993,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:1
  2⤵
  PID:2956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6628,i,11108347377500917002,12527066045658884083,2097152 --field-trial-handle=2016,i,12539044575249125222,5735463582809978993,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:1
  2⤵
  PID:4256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6256,i,5912752332629036383,10409948829146773801,2097152 --field-trial-handle=2016,i,12539044575249125222,5735463582809978993,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:1
  2⤵
  PID:2368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4984,i,16140593185893967457,6434634414143042753,524288 --field-trial-handle=2016,i,12539044575249125222,5735463582809978993,262144 --variations-seed-version --mojo-platform-channel-handle=4880 /prefetch:14
  2⤵
  PID:5976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=5944,i,6711986049451910750,12661583311445600864,2097152 --field-trial-handle=2016,i,12539044575249125222,5735463582809978993,262144 --variations-seed-version --mojo-platform-channel-handle=6952 /prefetch:1
  2⤵
  PID:2592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=6936,i,5726221065715777104,10105633097764543764,2097152 --field-trial-handle=2016,i,12539044575249125222,5735463582809978993,262144 --variations-seed-version --mojo-platform-channel-handle=6972 /prefetch:9
  2⤵
  PID:2448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=6596,i,13286500634475991581,15014016811029500812,2097152 --field-trial-handle=2016,i,12539044575249125222,5735463582809978993,262144 --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:1
  2⤵
  PID:1088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=6900,i,11985876150303656974,12403752633047156258,2097152 --field-trial-handle=2016,i,12539044575249125222,5735463582809978993,262144 --variations-seed-version --mojo-platform-channel-handle=4704 /prefetch:1
  2⤵
  PID:4580

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5780

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1212

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:5484

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 5778f0779ba0cec7386ec92d641d9411d45c20bb2bf234fb851d2ab14ce31f80
MD5 fca7c956d34ef3ee95cad19353c9c765
SHA1 cacda96aeca6b9330daf0413c906d49c448334c4
SHA512 8bc1aa3214d9aa6d150a236982e08f6a9b817dea4d13f6c000366b3a7a97f9af1b04c442fbfc006c020965613904c81a71e0f00535e45e1cf8b796b7866260f9
SSDEEP 96:4MkugUCDmq+AzL8+8oypRz+3m3ULSxUUdzv:4wxAmRyrSxUUdL
TLSH
T18291D7E8AFCF5719CF3CD672D4A73F506EA4017B65422F7BF400186EA5872EB0062218
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 891ffb55a65a98b0342e43b0bd24d61781511a79f447d3c1094557de1cb67c49
MD5 e5512a5bde025e2344b87ed687baae33
SHA1 ab9edb951f221b326f0814c366e21a4ba5dedcc3
SHA512 75dd1814310ba7eb174b2a1efd296921180fa302722d1ab4cec27761ac8f83079fa2050c782a70449a28b635fa6c51ba3a77beffc6cbcf9c9a5f188d4e4ed783
SSDEEP 192:D4jIBiDMN+Q5CQ2tlRKTIDI1DIWNPeaPifP7HMhHjGHm849HSHxfdk74Qhz:D4jIBiDMYQ5CQ2tlRKTIDI1DIWN2aqfw
TLSH
T1FC128BF3C3E8C92DC91156F4AB156E1ACE590A24431C3C76C8D4BE1BA3E28B1E25179F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 ab3995abfb68472b24120dd043f7d328ea678090c56f03d77219bab7932d688d
MD5 c3764191e175349914718918fc80f626
SHA1 d42f2dba07876127aee060e06bf91d4af8cbbc37
SHA512 fddd696dde706be152317e9ccdfb71bf160ed2bfa99074d7dd2529e35a6b3da83a2a284ef96a36edad87b32b317ffd739ec0ecfcf877c941cb54b93d0adb1474
TLSH
T1E7319AB7C3D8957D890056F8AB252F2ECE290A54421C3C26C8E8BE1F57E2872E28014F
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 2KB
SHA256 3eaddc662b47b6f4e314aacd11bb206b4210fa31e282f0035e6d280b607b9ada
MD5 50caad630b249dc6709350853df63b4a
SHA1 00cae6b9f4bef855b83e414f30f1cb21052d93b5
SHA512 03d457456336869a808ad53834a0608bb3e00da5417bd886746b9041f78f07147ac725896a33329fa8faf4c6700b21c957ebefc2346b0d745c75125d62270aa3
TLSH
T1375159DB917EB85750AD157F2D407C0979FEB43612527CF4CA9A82ADB0419FB0A21067
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 7c902830ecdce5064aa3d2ccce62e7d19bdb4b5f2cf6050b5ab7d730ec75ac31
MD5 094cddc3400e3b0c86670cd4c38e683e
SHA1 4460e5bf371bd960b2e9a1341f33369372fcd4b2
SHA512 9868c00fb18f1559c3f8f8de125aebb46b83770fcf7be6f64b7aecb4531d92ab590727f1ebb90e643888ce5fe28f412c3c9b2ec770f194c9941de45c28cf7788
SSDEEP 192:eR4cBzNIW2v7DDAPRp2Ln9v99Hsb+WNn1K4zGh2WPtenkVyIsnAUgR:eR4mzNbCmXA/wQv24R
TLSH
T17932853AAD20657B6CCBD219FD617B57EAF2106132D02E88E6FC4E2C11E76CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 75b30bf218df93cb197274e32aad264cdea57f8d84303fe183322dac698faa4a
MD5 716a77c2eb0701eb846a3095a00fd329
SHA1 1ed1d6dde56697c7e1b0bcec6a6d8238705ae68d
SHA512 ea00c1b1111cece9ff54fda3fe131c09e8e899df25d26cd3d194432a8ca9a94bd4f7abd35edc60aabb3514ff18583a09c7dd845a1a1fad5b1f659f0aab27c0e2
SSDEEP 192:eR4cBzNIWcv7DDAPRp2Ln9qH99Hsb+WNpW1K4zGh2WPtenkVyIsnAUge:eR4mzNbImX3/w/v24e
TLSH
T15A42863BAD20A57B6CCBD219FD617B57DAF2106122D42E84E6FC8E2C11EB6CC611741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 0c33c56ff153200e982ba2d0e6a136da7ff2cf23bd3a4a0980e9c3db9801a077
MD5 7e5b34c7f9fddd76ff394889177624d7
SHA1 279f17f91be6e86d08c4797410a3f120295b5c91
SHA512 a303a7035c12a0e6420f4c71822e9ed08e672cb40be62dd439cb380e2f4cb9c7367b6b41f9d9608187816e54d9973bc17b56a51c185e41c65ca3d40dd729b9be
SSDEEP 192:KR4cBzNIWcv7DOAPRp2Ln9qH99Hsb+WNp0ryMpmBzGh2AtenLrPyIsnAUge:KR4mzNbI3X3/wPa25fe
TLSH
T1F442A62BAD20A57B6CCBD219FD617757DAF1106122D02E84E6FC8E2C11EB6CC621741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 a68fa3df3d4b8d40611c924298683b6acc2a9caef6af513dce37b6dd5677639e
MD5 4f7d6506a5c1eec148304dca04f16c23
SHA1 56ba7319581bebf062f326cc0410c9d89d9c98d5
SHA512 cccb956441501afdb908e065d198a1e8e56a589bf2f41d7687804d6679ec3621f9cce9dc32fe0677d7a5ebfc5120e1d76640dc1927eadb314a871d6b4cc4af7d
SSDEEP 192:eGZ4K6tV7KxkXqK4I40pUZNCgVLHrKHfFKslEFPdXzKD/K1+ErUkKN9PlwLBHTCK:3ZjyV7KxkXqKf/pUZNCgVLH2Hfgslwdp
TLSH
T1A732FB27A98D9A7F4FD8D51CCC566F4B6DB5026633240C2452FFAD0803A97CE114A6FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 4e8e453755d557e6b1e99bf11da2ca28ae920f57a76ae17aa7f91e009c71865e
MD5 d3c236cce8e7f2faba6aba3f9c2280e0
SHA1 9e37da2665b909be9000c7910deda6be95dd4c80
SHA512 22c2db1fb5664216ce16e87c2d06b24465cd84cb2be0dcc47a6fdf57c4416d9e0d7a1ba1d6ddce83ae9c8d37dd3007463e06ecb00354585e6dcddb030d652b0e
TLSH
T1D3A0021406C98C15CD008271538506C017045C525B10F24742B408548CA6092E501301
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 8b7949e1cc43b082e8049b75ffef098e97ccb06598689888bf102b6679494099
MD5 35bb4c724c386036c5a8e18e320e1167
SHA1 afa6e36102d3d277fcc1bdf23ec3820dae62cf64
SHA512 2c1633991a1244199b5801a10527c7904003333265e11639b7136ed31434420e8fc5c48bc3541aaab5d480007b38701a52c526a33574c0bd2bbdc4d6e341984a
TLSH
T17EA0022041C11822CE148AB4E0630E625A72591A94D153439492584DCA6B0D18137210
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a6e7a.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe5a6e7a.TMP
Size 48B
SHA256 5fe836f74c2c7106d2f6dac903c60540ccdee6319c1e243beedafa4c7d95d1a7
MD5 315c76c3346b4d152a91f2388e6a6cad
SHA1 887a955bf27924257155291c27f3a6c8d0b3a1ae
SHA512 b524be9bada97f3b23e9d4cbc42b3dbd982c1f551ed5321b28f95c3ecce3c2b866a75248f23879a1fa02ff494a14e6b2c1f1d44ad6f0ab3d3e855aa7cdf9cbbe
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
TLSH
T18DB01269E5507CFF074A83A41428B463C3FF0047421C8ABEEA3873AD42A21FE0828C57
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a6f07.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Network Persistent State~RFe5a6f07.TMP
Size 59B
SHA256 c257f929cff0e4380bf08d9f36f310753f7b1ccb5cb2ab811b52760dd8cb9572
MD5 78bfcecb05ed1904edce3b60cb5c7e62
SHA1 bf77a7461de9d41d12aa88fba056ba758793d9ce
SHA512 2420dff6eb853f5e1856cdab99561a896ea0743fcff3e04b37cb87eddf063770608a30c6ffb0319e5d353b0132c5f8135b7082488e425666b2c22b753a6a4d73
TLSH
T1D2A0026ADA612D881B4A839026187553807B0445130982FDE43877A841561AE582C865
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 121KB
SHA256 4aac1b9547531d78a4d49db4dd1cc67f459b49de3a8f5f3e0de660d53ad06791
MD5 e78e6f898d5d379895364486993bd9e8
SHA1 1bb158d4caf9b15044899a9227229f367a9f03fb
SHA512 1c2225d1b997f4ee7abe5fbd5e34ccc118b7875883294f3048b591b8504158516030be1f8d9a23f08ba04aeece20863b450807cb21857d0c8e999006d79de0f8
SSDEEP 3072:RJnMU6FRinYKkQrFTgTSAou8VOYLzkxY9REViGsm0kjLt4Ckp:RJneRinYKkQTo+OYUxY9R+in1qLt4Cs
TLSH
T13FC31239987B6C36C6BB925A3207BA8104FC563240D58EB4E36D6BCF5A17F2231D56C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 35f3d9ae82e27313ca67aab8e04ffe704e29a69bd258050d7f7a521b7e004352
MD5 356f4c77e242bc9509b493efc1502282
SHA1 e811a691bf689a273fa962892c1fbbdd32ccfeaf
SHA512 a8eb13e85e977494fd49ffabb1603916b9cd7da162d62abfcaa5592ec811e0b4dfe82de30d543db93a2852c4919e2ecb9d2750b666b02b7096d4c89d33e22e01
SSDEEP 96:FuC6Cd+T5Kj8OfQo1LrQRDotok5lsDNB64GyvbNsbaYbcLDqv4a:8ClTjVWDUDMTgosbaYbcLo
TLSH
T1DFA1FA71A4799C7764B6C488B5413B43CFBC70ABA5919FC8A9E81F0C00F74B91302A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 121KB
SHA256 a2d3186f7a5fab49f7866a10da4f1d46c56cb00858d1d9816ae936d3dd0db614
MD5 7fcbf54adae47a5c9edb89946318ed9b
SHA1 a4e209e95892c01702eebe524a140e4068dd838e
SHA512 3f011c241597d7238a1d9eebc15f476bdc8c704d1e345016b1c5057bd7daa32dcec3053265647f62802d3f31a4066275fe0ad421e8bf2d9c6b4ebdca7dc2985a
SSDEEP 3072:HRnMU6FRinYKkQrFTgTSAou8VOYLzkxY9REViGsm0kjLt4Ckp:HRneRinYKkQTo+OYUxY9R+in1qLt4Cs
TLSH
T1B9C31239987B6C36C6B7825A3207BA8104FC563240D58EB4E36D6BCF5A17F2231D56C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8a8228174796bcfa36c0e1017a86a51a8185ab1d57c319f913d8dfb21bb36dd1
MD5 db9e031e331480799ad7d3742f0b8c71
SHA1 98bbd505b42b1696bc0da82a4e29b52c33dd1e8e
SHA512 03e7aa82149d0c05e7c415363fd7c4422c223f3172bc12cb8a55c77212c66423e5ab5ba9bac827e9b489ce095f02b46282f7351c929715771ff1f4bfa37e0624
TLSH
T109D02334773875C6C63930338C215700773655623696C1016194850DCD794C1A7D7796
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2cfb77611c6372588cbb86850301c7d4d2a98bc9870148a0233cb9ff0ba848ae
MD5 30dd1402eab1adcd1b7a879da690d903
SHA1 5ad2617a2f54fb4647f217e450aa852cfab95912
SHA512 396e3e6a4f4d2b6cdab94a4fc9fcd07b5b3b76f067ce5666b89e9fb8d48b00e16fe2a2e9189c9d96e3f8d9d2f1a719132c8694f2859c94a22a5b7ecb4e74a3fc
TLSH
T1A3D02B343300650CC89070321C52B249532158300440420000D0B158CC7168102370AE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 809f2bfb4e876b4606c44edf363d6af5b9378393a15d589c240597bc04584fab
MD5 c6b8ce6ed0d0d5b5294ad044bc8ce605
SHA1 5f262fd7c0ee99a7f310f78faeda09e8fc9cfe03
SHA512 33df9fe82ddb927c09c3887588aa01fdf1ba2c4affcd84304bfd5f100031c6b1239fe39d5829a2911628375cd4f571c2d28de346d45af873bdd0a84f63628051
TLSH
T1A8D02334771C7407C5253033DC125B05BF32642431AAC102B4B4414D4C794C197972AB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 174576d263d17c1ded542f85fe22b729d39689265635c9c57a2bfd1af11bcb69
MD5 e54a3dd3758ae26f8eb9c7149476114c
SHA1 dd4159ecc029af9dd3da72970ac8bfa500a0651c
SHA512 eabda803f8f816ad2a6d57d3ce37f9c8cf72ef9a0a1ebecd6f39990ef65120d12a76e6ae5a2cb62c423511cbb36f0da6835b1dfa5907c5559c0ead5b0735873c
TLSH
T1E6D092757764A90CC9A5B0322CA7B29AA322A8300495860444E5F2A8CDB6A82567B5AE
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 93e1527995d2bcb9cb1d236f6aa19746c3e9bb07e2738f2c080ff336986326ef
MD5 1f9c22094d228f511f6bfad4603b6335
SHA1 ce569454c368919b175e9eb6d52d6760b6138ed8
SHA512 0a1adeb475aee8fc1c7adce5bbdeb3c0fc95f8f1206601e3659da2eaeb2c07b20c2596b875d560584408c028f7b2ad35378815051db0d36b7a63db45939a507f
TLSH
T134E02BB6C962DC2728FD072C51654786EB8013476B40955F7B3DC28C8FB057A058985C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 c0beb2d574de5a0720b23c97a680836535c97ba2a12c6fc7efa71176bf62a96d
MD5 4478ee6872cc93e3d17e891ba90fc01b
SHA1 7a5db40bd73628a0dbf4e02e060264afc3c048dd
SHA512 be8094bb19d5fdad1a9f81d9640a1a2aaa93b1ade4659aa69a042da200061333cfaee0e572055f5dd031393ea3f6aae1ad35826616b20422f3cd1ffa430b459e
SSDEEP 384:ObqegEzyEMW+ckkERF52P+IBpDyhCgT1ccxcU9rK73ZmBPM9W5h7d209a0W7ubDN:EnRMBc8R6PPxgxhe7WPPRd209aVcG
TLSH
T13813D67D6A845FB2CAEB473C4A4FFA716F20DD6DEBC19143A638301B461670EC95E209
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 520KB
SHA256 7f38088e3fc9852464c57c20aaf2e3574157c587801ad0615b0c6631013ce1ec
MD5 f5fd03530dd16ba6f6a9ad4194e080e8
SHA1 157876f9e30ee114afc06fd5ed63b864f1dda890
SHA512 317101bd967033ec1d040f3572ee3fde07e4e995190ea7d039ba4c92ea9494549a896d4778e3fa567ac783b55a7a74cff570cfe6b05dc4f0652a256af44639c3
SSDEEP 6144:wv5L/fL/C2idL/sL/DL/vaTEwymEqubyE1VI:SL/fL/OL/sL/DL/v4amEqubyEc
TLSH
T1A7B4E6F31941A41ACF6D42F696063E3CD63B860C6CD1EDEAD13408D52B39F33A6A99C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 d3afb7fd8bb5f22c60006fc019d2191a4b96e01d431707e1473d6963c2e41a29
MD5 df3f72de210e2cdfc46d96e1171ad117
SHA1 04283dc6613415266f28032d5cb57c8c01b1fea0
SHA512 8c0dccb452785c34e5c2eff4ac4c71e22ef1d34d29a73f80118792bf6368a4cbd44206354631a5b71b1de43903a3da9d9add2fd50d4d8c1be3f86db0ca89ff17
SSDEEP 6144:sQtaCnLG6gPmm2LipeGrGMysVv3K3UBdKnxvw8yrkXjrJep4vREF5kpJV6nv1gMZ:sQ9LpgcMzVv3K0QTr
TLSH
T117256CDECB682D82CF67C670B4D0D8077E702183BA9DD0D36941C9A957D2BC176E82AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 8.0MB
SHA256 dca2cffa353baa2c1dcd755afee4c1750178885c563c99789c947d054c229d64
MD5 7ae94f0c865da53329930e19d05eb799
SHA1 016594b33fe1665ffe490d0a80a5866909ca3266
SHA512 aa7fb4e9cdbd392fc99c081c19429e168f3673183ab9493e372c2bbcea7bf4290f77f2ebf8e3a8a28b9469ff6c161e9b5ef83405caf2ee46deea84f1043c3a55
SSDEEP 49152:51/3JxTKyl6hlOW2lj558RN2XWtFoji/LC+yDe:51/HJgw3V5iUtiTC+yD
TLSH
T1FE867DDEC9785883CD629A30B5E4FD577CB413C3F594C2E38858C58402AB7C5BBAA26D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 96cc393d999d5d7bea63bd338c07fa11ed483e601e9b1d4e606d6e24baeefedd
MD5 25132a7930021424c0b202feb8c05d58
SHA1 b3cf48387e04566670f48ab8dafc9f39849f690e
SHA512 06fbe6d9ae891c8563b4dd1f842acb33c5de7a1f81be01f0c03f0be663afe5b318808f5cdca9c6d6b257f55a7b2e46d2671ab082db0046a6c548534f79058a31
TLSH
T19F81B9B0C77007F9CBA5EFB2A0E3D8E93DA9488D4047DB12D88254772847BACE4CD450
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 589e6f2f3792ef2e129cc6abee22abb0418766ae9447a21af96506a6ca7e3042
MD5 ba6e280d73c046645c2e2d8eb0a9e331
SHA1 116c18dcac4a0e3e6e3d12330e1197ae46b12c2f
SHA512 c01ef453ff6ce514ffc738553d045b217eccbd5257c14f4e046048a9cfbbbaca55e7af94fc132095aa6e4015b0628aa36e4cfe610293ee4b849266b25821eb69
TLSH
T1346150F4D7310BD6D735CFB2B1E2E8AE3EB6548D554BEF009C90A0742886B69A8DD460
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59cc30.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59cc30.TMP
Size 3KB
SHA256 ec204ce8bf9112ee6d573c0e680a8dd0c4d100b942d03e5d2dfb454e6c603be3
MD5 3ccf5722127e5f0e6c0a672a08ed515d
SHA1 c0a0319cc7a56b0d76a7db7d589a8473894ef9b7
SHA512 0c5b2bdd8e69f3ab0c75ad394600739ab99599fb303420ef61e5ffa1dccb95c9535987a3c06f7e733027c3f82b8f37bc7dcb4781886d0ca80fa27684cf78a2ce
TLSH
T1036151F4D7310BD5D734CFB2B1E2E8AE3DA6548D504BEF005C90A0742886B69B4DD050
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 da4e0876edeb0e522519e54a80f1456ff2ea726f5113e9f590c106d582619264
MD5 520299a9d321121d4f6ee0a3d52907bd
SHA1 9c1599ca1b60bad868b3a806ba149d0d0bf9d0c7
SHA512 c59ce400b86d914773a0733f4f184301f245f295771c7e01193fba2c5904d37137ffa416dd68a86df5a54ac0f7e8e11d7f3e76b5599cb24cf9809c9573bdf922
SSDEEP 3:MsEllllkEthXllkl2zEkliK:/M/xT02zn
TLSH
T1DF4404047FC01505C54010304113D3D40771DC100D35D743745105D35CC55500C00400
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EdgeHubAppUsageSQLite.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db
Size 32KB
SHA256 019785b928b6d7e8d44822adbed0dd10843f6be1fda4b4d826d3bfde0aedf278
MD5 18de74b27c4c2054832ae4f6b4e70f90
SHA1 f4d90bd94ab43db8876ac50b876c32225870ba32
SHA512 c6080c566b74b5e0eb0b57c8da345f316569545c13f829ee8eb66a8105f54dd950fbcc0294ce150ebc8adcecc4b4219c33a83c0182893ff768216e7ea3ce35c3
SSDEEP 48:TtD4jJ/0UC+lf5kYvb7WxWYv+DFOIVTp6:hD4jJ/JuYvb7/YvOOoTp6
TLSH
T195E2EE8C3B11F511C4ED733DA0D2CAE09EFC682C469DB170523859728C62565F09E14A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 342B
SHA256 39dfdec86949f152a1471442545245ac5f3372b56428a6f61dffac0a3ec159e7
MD5 829a3c6987490c82e6ba954662c1d61b
SHA1 3799630075c4e24b21e810bb5896dd5ecb96c9b5
SHA512 0fe38650c2f79854b11bb4f6564fa45639e74cf8e644f7913c55cc92ee0ebe58c20307360aa83432e6521c046c39ccf2d2e1098695cae563817d0f4af593e30a
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 322B
SHA256 c03947744a46bc3981b2b5db455f7d16f39bc9623285c3f56c6c75a68c224999
MD5 e72433202edec1291ed9d986dffd574b
SHA1 a2f8bcefd1fb8b27940c58a476d7a35bbd0e1082
SHA512 96bffce76efeaed0167bf73cac8c9a4bd8a115962f3dc14954aa07522157153fd3a8f97069102c5e0259ae2754a1c106c7820fe849efbc73865b605e4d304caf
TLSH
T1EEE0263806C8C22ED81C68D7827E7B6C93D2B422EB8C3D02270A9C606342742FFC62D4
MD5 SHA1 SHA512 TLSH

Submit Download

ExtensionActivityEdge

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ExtensionActivityEdge
Size 32KB
SHA256 475f12864892aa7b74be2630191c6d8f0223c403e99ba88c526ed36a19ab91bd
MD5 eec0746e532e1aa3315a9bcbaaec4a2e
SHA1 b3092a8c10c8f3ae716f6e3bc8beec6eccc0e4d4
SHA512 dbb680492930aaf08078604ab14d0d1e63853a735d0a896644c8eb4d4ed380aa94f0cc9f573a04a7abc1c06fa1ad335a082b07b9242e5b463f1c06605f0a2bbf
SSDEEP 24:TLlWK3iOvwxwwweePKmJIOAdQBVA/kjo/TJZwJ9OV3WOT/uReQQ:TWm+/9ZW943WOT/
TLSH
T156E24B2A5E7C7121CD667136AC2194665CB910DA977336F23EE000796F8228BC535CEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 32KB
SHA256 d3af39e21463f872d23342709e44743f69841229bc5a2c7e351836f98f2ed37d
MD5 9073a7bd2fceaf3122f62a960937ea20
SHA1 2db37825b2e27ac0ac34013db8cdfdf19ecdb127
SHA512 efee446a2260af8e6450ff80965b36db7d16cbb70d3c7e12fcb4001e1f748b5372d0544495a0d60f4ca44a0859431384a52a7269c857f580578eeb563399127c
SSDEEP 192:1aaBcD9OL3iBct+37+u4JycmzkzRGtf91sa/bea/yZkjS:saBcROL3iBct+3pCu51vbukj
TLSH
T126E26CE3BEB57C22DF4A7E3355A91931CE32E1959E9B9D4C3A020050483853B587A9EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 224KB
SHA256 414265e6aa6ffaac429f4e980cfc6fe87517c463f6dfb0c27a5712ef9c5035fe
MD5 af163eed5e1219fb79634d5bcaa5642e
SHA1 639781a58a37d11bda8bfadaea074b4827d9b6bf
SHA512 01587804e3fde0afcb085335c9af3a9b9e48c340ca93fde2e7b2b5ef570e62550f6435a1e6080ebbc5ab8d577edca4436bb7a9ca3aef2352314375714aaf49bc
SSDEEP 384:E2vBcRPk+NIkUI3ijVoWN3qL/yGBcRAfiBcRcpBcRf0A:E4BcRha4i93qDNBcRPBcRiBcRs
TLSH
T1D824B56FAF643712CE7DD17169EA18A34D6DF02B8B4395CA78511060CEE2A36905C8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 25KB
SHA256 4dbc2703846ec0c547629663c794fdc94431a563bc412a80157133c6b1fe1ae2
MD5 abd3670fa2748e2ed793ec8ba0cefdd1
SHA1 5e0ec7c0f9c1841cc24d331a53b7514253c3c4b4
SHA512 56ca637f0ce10a3e8be5c90bdf1e04668599b393a57fbda82f0522dce3514efe5e04f71ac4ff9803a4e9c684b8551c0cb8238dcf2767985ed50b3705e54360cf
SSDEEP 384:vmfiVFVVMhVVwaVij4DxRVuc1VOiVVCcm+VpvYxQzVIJpIM:+wFEhoaHXP15Vbm+Dv2QzoWM
TLSH
T1D4C26C5DA6FF0214F3FF9F2A6ABA145C8D3B7D562818CD4D10605E4E3826E44AD60B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 334B
SHA256 c429d6deb545efca9b6196ca81783bd3cdcdde2ea8ad4d151e868009b332398d
MD5 0b021d8778872dd711dbe27cd0328706
SHA1 1607fa2928c247b7074466818924caa699f785f1
SHA512 5296de5340aca981d72a78298f98a476052781f57729d08cfea6e10ef7460de7458d344099372318a5dcfda2f98aaee7a73a2a4c31de3ef9a662bbb1bbfd8a0e
TLSH
T182E0D8B446CDC19E924C60CB92397F1CE3E0741ADB8C6F112B05AC41B146104EFC11EB
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 32KB
SHA256 d3d9b9f2c1f825b69bea96c31b61be7d9869a3d6dec09a6d2bc75a3a27d09b6f
MD5 13b0779b38dddf4db069accdb1850703
SHA1 68424cf09c754401fb5cb58e021edf441b67e7dc
SHA512 f9e91bdcf09f0f8485bfbdbcd49970de1e3abf043d8ecebbc2adf63c360387b0c535395286fa29797931902ca1c49c8dd1874b1b23949dc1ba529f33e1ae2c9f
SSDEEP 192:cDLaTaHVEXR6HEtZ0Y+I4WQ+Ag8I7sowF/r1MseCi+j1ma7WG:GiOVWce0YbO+SI7sopsjj1mqx
TLSH
T167E22AEF2EC42041C59B65B26CB19C65683A2085E603DADB757E207468352FF3D276F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 525d45024b61df9924fb66d5394994d94dfbc2cac770ec50c2be152a8b182e49
MD5 406c5f95ed7b04e298020c527d7027b6
SHA1 1dbe886b35e6ab708ad9ef9de5ab459d26eae58a
SHA512 9f00af3a6119669295f20aa27a1fe986aa85892e49ebbfd10efc7b4c946f43a6bce0b1fdbad66e73a81685d1b8c8d29d1ed1a7183906025da6625b3fdfee1a56
TLSH
T1E731BEF7C3E8567D9A4145F87B142E1BCE2D0964832C7D5AC8D4AF6FA3E1471E28089E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 7454a1f8c707a76bd0f18b200fb75c78c4d38a47ab65c8647df3a214bb3b38f0
MD5 862de930de7ae4ee74d7a93777392d31
SHA1 3d837080e686751c9b425fe3e30029037be8b6d6
SHA512 3510466b7da37fc973ec1fbb0eefe8ff0d35258723f7b8e3248f829aace69455a994a76e1f25cf3c17664f23a4235c28741ffff912c172a1adf2f6a323f0dcee
SSDEEP 192:DS00we4rbCXYkHKR0B4zjhn2iPxkj6yzWEAUEvUhjameaPfBeNPiLnfZ2H+BVwNr:DS00we4rbCXYkHa0B4z52iPxkGyzWEA5
TLSH
T1C632ACF7C3D9962DD81256F4AB256F2ACE1D0914432C3D2BC8E4AF1BA3E2470E25165E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 5b20c3f503727a0bfc81529e737b5ee78cfd6bf6517f553cac55779ccb25c6b5
MD5 6291cfabded7e93bc85002391c1b7013
SHA1 38596caa22229395d551936d441d89c8045debd0
SHA512 2628e737bf19dfb52fa2a8704ab047af98e4dfee837b015a711ca0609f109ba4d25764a79efb35aadb2750cfee8acb00a0ea91ca124fd54979ae484103380537
TLSH
T10C217CA781FFE467606C59BF0E547C46393AB43502C2A4F9D99692BCA0954FF0B03032
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 4d02b0929858bbba66d16a81efb897dab8948929f2a51587daa157154c4da39b
MD5 72595fb5ff43fdece91c2f72633bd4de
SHA1 0fca2756e6949e6701055499f3eeec8eb15518d3
SHA512 67ab55d9f9ea7b76331211d4cd27d726a25ec7843d140fac6049e93b31fd30e0547ff949f6e11c086ecb27d0f9ce817cc96aaa80b95c2627d5ff2d62c5c93f02
SSDEEP 192:sxRXR6yM/jK1Ml8wHcB1r/fKsVPF78DoA8pJeh8NRl/g6+WNSM8yaxOivpF/YtZz:sxRXUZm1r/fKsVd4+B/5adH/si9Xloau
TLSH
T15F82EA52A5349977CCDBD60CF9617F53D7F9546397911E4CAAFCCA0C00EA6ED220282B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 2929558ad8abac58d95998b2e68d389ca44ddc93d917b60358a45d9533503272
MD5 08fd8c2b10029b9dfd37ae1e1c77b686
SHA1 ee8d00715a1a7ea57778e991482edb2340322d0e
SHA512 fc1ae89dcd2ad07bd114e34ca237a9d4aab9f022abd2334aa51f9bdaf71b9f02d239f3107b0bbb91c5a9f17aa23d86fa46bdd783cc382654ac27af6cff4c36c0
SSDEEP 192:sxR0R6yM/jK1Ml8wbr/fKsQPY78QzoA8poNl/g6+WNENpo/YtZIQl9WqDGGIgIJ:sxR0klr/fKsQg4JK/5v/siUXls
TLSH
T17C62E906A634997BCCD7D21DFA517F93D6F91573A2901E44AAFC8B0C04E6ADD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 fb04af2525a66a635ef6c98e1d066e8461f8a8732c7ee01cfc485c244e2e8a08
MD5 4a4ac3110f9e74092fe4f28ad39d1f7b
SHA1 d823b46e3385580072788ab73fa8ea05492ad25c
SHA512 b7f1cd8693bf0fbe0037896240d2d10bc71eb5ac7e45add46b267576cc07fc9220c5ecf82baa461d51f3528380b091e8a6dee5bc038bfe40622e5bf592753f6a
SSDEEP 384:sxRXUNm1r/fKsKWvFd4fScv/5C9H/s29Xeoau:sTWm1r/fkYFd4z/5UsIXEu
TLSH
T15292F842A524897BDCD7C21CFD517F93D6F854A396915E4CAAFCCA0C04EA6ED2202C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 ede5ed214481826d405b1608813abee1d36aa90925bc02cadc524c073d5ac5e1
MD5 965c1979f2b3cda60b702bbacdcd24ec
SHA1 99ef81d609812143dd77a04532f4a4cd515edfbd
SHA512 612fcf836d236b69098779dff4c50b5e2e11f89a378eca345eaed1f1dd62c74ad937b755831ee8d997d97ce244fe3d9e3291664e44c37b0452fcbd17002310ad
SSDEEP 192:sxRXR6yM/jK1Ml8wbr/fKsVPY78QzoA8poNl/g6+WNENpo/YtZIQl9WqDGGIgDoJ:sxRXUlr/fKsVg4JK/5v/siUXlw
TLSH
T1FE62FB06A634997BCCD7D21DFA517F93D2F81573A2901E44AAFC9B0C04E6ADD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 be8d942aa972997786aefdce45f7e1a83d6fc192dba9db81a4ca0997aa87a51e
MD5 5a19f675e8e065226abcda763e0e10c0
SHA1 66a744cf666d807e864c102fc74c3c7940eeab09
SHA512 0d3638d17f33a134ec5bf26395d5cb22c6ecd278b5201543c7c8e670e802d33a189b42a466820c06cc924e2718e11677bee5adc9a5f38935aff6a3730c8c37f6
SSDEEP 768:dOwS1wBzwRc1wiWg1zwsf+ZwK8F1+UoAYDCx9Tuqh0VfUC9xbog/OVVlwmPzwx1x:dOwS1wBzwRc1wiWg1zwsf+ZwKu1jaQlU
TLSH
T156C2EA3F644CC77E4F844E9DAC2AAE976DD801CB5B984D4447FA880C03CA7EB521B5DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 8f4f6c73362d184eb3160a0a8b1c0531878694540634296bf88ad16eaa5a4882
MD5 f5d0a5837f470602bbf583b1ef8d2820
SHA1 524e2d4409732c19dbb6267962211b1e421b4e66
SHA512 ae64a25c239c24d2a65c0ffeecbe058eb1298a739595ee5236df14d68ba536e32ff56de7e2121dc7a9223bd1e2eb7a771afef04ef95fde04247f05745b5e5282
SSDEEP 768:dOwS1wBzwRc1wiWg1zwsfMZwK8F1+UoAYDCx9Tuqh0VfUC9xbog/OVVlwmPzwx1x:dOwS1wBzwRc1wiWg1zwsfMZwKu1jaQl0
TLSH
T193C2EA3B644CC77E4F844E9DAC29AE976DD801CB57984D4447FA880C03CA7EB521B5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 332B
SHA256 9cd7342752afcbf879baaf849235a8e0fbb0df0e150467ac90c1f531d8962ee7
MD5 d4d9c132ce93046942be5da2678bc831
SHA1 df316c8b769df2ab014c65e4201cc326394aa519
SHA512 5a30f327c17df8e8f27f9ad69b50fdc1debb9f4fb1a53c7880e0990dbcc0de85d6ff48910aff3a2690fac13976cc7844184d0099ff54b4cb20a458bacff37a28
TLSH
T1CCE04F5807C9C5BEA01D208302BDAB68E2E47827D7D879222F45B9646243555BE922D5
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 01f12c8d341091765deb6733d20737b84e47a157e43b181841d728788b5d4402
MD5 98432b7929f2191e7b1c3656c4405502
SHA1 4bcbdbb3e51d1d7e86fa11b54eec33e429bf8d2a
SHA512 696f84efb59cca479bbb153448f8b04bc280b6f239dec062b8ebe887568109fe3fb0fe4f71150c064292751239e23ef7944202c72328d9b829d51fe881b9b704
TLSH
T117B012843F1050A9D986C5B506808F191340F4FA40804187F8C85F344C0E7B82B33488
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 344B
SHA256 fff1f7c2af81618ec00a84b10c9cc70ab50391508cd090ae21bdd935a8124eaa
MD5 7be95ffe188c6c387b91d51eaf6c2a31
SHA1 383c6667abc65d9da69fb030e3cd8527dede04fe
SHA512 4c3578b57d3818e1c6ce218aa292666ba9917f598520b3542a1f5f57e771d32377b5c7d210590082f27dacc1ff0b4c536f3a2aec43961f344c62d31f9c945949
TLSH
T1C9E0D82817C9C66FA18D2087827DFB19E1E27852D7D869313B09AC5063071407F831D0
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 320B
SHA256 536f5ea16bd6cb172010f36d17bd87e507a5942990ba7ea69feff9c060b1374a
MD5 2a8c7e8f8490e3001e68a6bbad6f5520
SHA1 a731b7d533f15b2c4581fde4f3673be0bf55b9fc
SHA512 71e148f024b17241990e49728ec14fb9960c82a4ea251442ca0061f14967fbc9a0bc30de929591acba32db27c6178e4e52497ac062554967bb08f6998cb1f4c8
TLSH
T1E3E04F7847C9C67E9408648342BDBF3DA2E07C1AD7D87A6A67086460A202155BFAA5D4
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 268884f6f9e481f379d1d2c6fd4bc56fd984d3e9f3a5e09aa3b20ebf4f69adcb
MD5 fa834ddf418e88804f56fbe8d3da4488
SHA1 af7d49735e59158a17cadc2f8e5774e7b645e50f
SHA512 d4dabf6327e0de277717891d28cb3f568f637f798124e7e76c958bdd591e8c3d960e493595140528266934dbe0bef286f33babaefd10fec74c66e56222074843
SSDEEP 96:KRv4dZvtNhW528gBhK4Igvhc3f+BtiHxOf7JrvbWf8qgjbK4igtbcx50HPoHT8Zu:Cv4dZvtNs529BLIgvO3f+BtiHxOf7Jru
TLSH
T114A11641B23A16C5387EA54990B994AAD5C271A33015A43F3F6B06E24F67E039EFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 ee664800994988f2d1fe91a023236f14497ccc0b1c57f743624f0dff5c26d873
MD5 78b3ca94d36d1a17bbcf7897276994eb
SHA1 c067b27684206492a6d4d58a7bf14dcb8c8c619a
SHA512 4440f20ac2b7eefe9d4e1c34d9fdafa5348435eae79bd293424cea4384518a19d737ea084381725a0e4b0d3f4843b950085c7bf8ad347a69cf0ef9d26012fbfc
SSDEEP 384:DNrRZyCSDnxTICHjkMEhIKyll7svbFKfk7:xFZJSDniAjVyI1l7svbF9
TLSH
T1A844740A7B747001EDE6DD725CB080771E3CB16D8F22A6916DA254698DB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 12KB
SHA256 8bfa6e0c7e47fa44aff7bb9dd635c34d6830012015eb495fa4674cfd67004c79
MD5 d245583f6b7e763b965749d594497cb2
SHA1 34c145c6b598fd96784c2e668bb37b29358c605d
SHA512 ed38bdb989736bc26e219368f7f8111ed43ca819072e198391ce5f66748ed5ea7339aa3d09545a4eefbc01d3305a990f11a38462dceae01440a53a45544455ae
SSDEEP 192:x95QkIIIbbLMIMNsYcY4ROhdAsTlrhNusYkdkBkTPk86CN:RQkIIIbbLMIM2Bwhus52s
TLSH
T18642726B16051B77C19E5F3A57638244ABD88AC20173A16D7392AC0F8DF3E9783E52F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 319B
SHA256 6e4e368d1e9d00c31d83db7045584d426a90af0fb6856af633e09f848647be78
MD5 0625578e7a8c1ab80e3095b98d721bd0
SHA1 af433be2b2e4b359b196413444547bf440e9db9f
SHA512 4dadcd17b09b05d87bad6a1da85a0188c0eabba0e898650d2ba3edd42c2c8ca6847268debb70329c14ac89835163b7a72549f9c3474617d81a9db47320c3fd12
TLSH
T1F2E02624EBC8C16FE51C308B813D6B28A2C03A13EB8C29063F01C844AA42201FFC72D1
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 848d44a95ab0adb2b24b26e0eeb03b3cfb20371252612ae0093126a6fdde86ac
MD5 bc559903d97cfd3ef9964f85ae11743d
SHA1 1c1aaedd3f1f9e6cbdd569796870e7a4b1277752
SHA512 d21e67382bbc890064984d74035fa6422904bc532eac074637d8d59930c6ab56f5ce6f796d63a6c78cf1ee1be6f3a6ddc4953040745c84c59e67058dbc06ea44
TLSH
T1AD21C455F330D149E159827A647F9B291738D8168FB8ED0F447A20646E71B440E8B6E9
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 337B
SHA256 7804066d6cffb45c543355e504573bc53f49ce8f5527d7856ea61733c4ec8ea1
MD5 362bdc29533a47654d1ba489beaed849
SHA1 4fda00c20bd688b0cab2520ddb43a48ae46bb329
SHA512 529e77647a467e246ca84bf027769503c642438a1f59c85896966141934de8a5d73939cfdd0a6ed309d458d648362ab261e680688dde886e6ff52d2c8a644dce
TLSH
T1BBE0D864A6C5C15F91983083817DBB58E2D13912EBC82E093F019C446242146FF86291
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 8d3934d85ab92a9e36adf7516464eb375de4472ce7a19582e7bb9f941aca1afb
MD5 4e90b6b5bc28ddcd9373abde91c8dccb
SHA1 227847657a4ed5c3d7fea7e76efff00af6f21b51
SHA512 0cae98d2cebefd5c10e1d8e0c73afa5a0add066bede10fbf5f96f859ed0a81671ead4093f51103c493fb0b76031018db07ea18fed716d2b78b1ec4db8c82e55e
SSDEEP 3:MsEllllkEthXllkl2zEelQmwK/:/M/xT02zNQmwK/
TLSH
T1D944040C7FD45D07DD1454304011C7500771DD100511575734F30457FCC75404C01404
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 c69e9fcb97da76b1a5f4eb7cd3e0e99a43f4dbf34a4cf84137bca81eb96d21dd
MD5 cf738c6a4daa80d55f5178c2d7d19e4f
SHA1 d521bf79f4471d872b4b88d8904cea11f7f340a2
SHA512 866d8303e0487e75a47db71ee28ce7002f93b3ad9a24e70cfccfd6d816c57fb78d9b421e3b3f20c9a8bb6395e0993e71c6202562291c0f8864eea0d95d610473
SSDEEP 3:MsEllllkEthXllkl2zEelnwK/:/M/xT02zNX
TLSH
T1124402086B951946C5242830441283500360E81409125747355204535CCA5C00C00400
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 93ff67f940877d07ad0f2a70e6d5f9d63bf229eeec0373cc3bc215e39355cebf
MD5 39cac7ac6c0e1b59b5b1f50577e4bbae
SHA1 f90400652a5fb3a000f1bb1118a938030fdab8fc
SHA512 b8300db6444fb33e614b581f30880003430b4b8429e57d5b3b9674a4955468562550743d2ce53b589d405007eb5b145abca6d2bf8e04441edae0135393572415
SSDEEP 384:a7srv+89zHqlDNP9oidH38NrSwK4V6/z2fppPQuvbfEDvuh3n39WoBtAdEF7jgHv:aQrv+4UNbdH3mQ4hUu37BtAwjUSzF1bO
TLSH
T17F03CF32A85499739CF7D295F25A3A43BFB45163C6C92F94C8ED2B0D018B1A9130BD77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 791ca106cb13209c9c4a8a421c6c4610361868283245f9c8715769c08e5cdd67
MD5 34fa29b43270b01481678bea990089c9
SHA1 060ae5519816d6032267d0fe1df7ea31dd30b848
SHA512 022fc4c548f40054e15e2664c0eced3b55ac5a4b061e6f35277e12858ce913e4350c9855aef840768d97acc42ca336e4e38ffc30b5140d60b7b58ec681960aca
SSDEEP 384:2MtNn/s3n9S238NrCTUK35+/z2fppPQuvbf1Dvuh3n39WoBtAdEF7jgHKX3PbTRa:2Mj+993D04hFu37BtAwjUSzF1nsi7bw
TLSH
T1FCF2AE32A8809D679CE682D9F31A3742AFF591A3C5892E9489ED2F0D04C726D5347D37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 40573d45e519cf9bc26f4598b1060f9f5d687bf3220472b3152c9b4f59efde60
MD5 cc2dc000a7036f1580199004acd2b03d
SHA1 ea43f96eeebad8ab94930b3eff08763b69d428e5
SHA512 8741ac02eac9d7437d3d95be2f09d8038034590c7e7beb6c435da3c712ed4bd86518c73591d03d09829c19af3090a4b8f650fb400777532da1f90278360365f8
SSDEEP 768:2Qj+993I04hFu37BtAwjUSzFdf4KLx4XJBnsi7bw:2v993r4TuoT2QKL25B/7c
TLSH
T1C2138D7C9C809D3F48EEB748A30E2A629DB45173C4B81E98C7D91B0DC073519F787926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 b76d08cb76fc22fcf2676b5149247ff815618f0991da2aa4ad9ecc7d3ecbe096
MD5 4a07d4d2a79629ceaa42a69b89d154a5
SHA1 1aa9fcea7a5d13f28a726cbedbc1b874f5ff5219
SHA512 0c57e11c4d9f2fdd92ae73f1fcc5ff9847132bf41c0aee4cce238b399a680888ee8db720f8ad67f8a99fce957d1d8a4be2396ffb75d0c1a446294215073603a1
SSDEEP 384:+MtNn/s3n9S238NrLwK0G6/z2fppPQuvbf1Dvuh3n39WoBtAdEF7jgHKX3PbTRH6:+Mj+993aQ4hFu37BtAwjUSzF1nsi7bw
TLSH
T1D8F2AE32A8809D679CE682C9E31A3742AFF591A3C5892E9488ED2F0D04C726D534BD37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 fa47137b39d119198125662ca3c9765162b6c3025414b003f1916c16e9972fdc
MD5 b2998e8415d7840f59235dc4c2b00408
SHA1 db04520e618e88527251ea3b143d59702c1900a8
SHA512 83ae13a04da2a4d8b0714bc4050ce55b5bf613b09055aeccb0a0fa3479f660e635e50e4f444db839352f5c906314313f8f5de65983f4bb93e24b7771a5562ab2
SSDEEP 384:nyQtNn/s3n9S238NGCTUK3o+/z2fppPQuvbf1Wvuh3n39WoBtAdEF7jgHKX3PbTz:yQj+993z04hwu37BtAwjUSzWinsi+bo
TLSH
T1E4F29E71A8809D679CE692D9F31A3783AFF450A3C5C92F94C9E95F0D048326D274B937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 69082a4d5a8dd469dab803e2e476d0acb38ed1d454bfdee34f34e7515deb3061
MD5 58fc85c7e5269d85319f86c75f215423
SHA1 c8578dbe0721a7262671963516e47697cb72b6ad
SHA512 9c6dcad7b2acb18ef3badb4f29b82f6aef3227e6b4a301ecd6243e123c6a00941ba17a1239c43ae5e5eb28839ca9ea8c2aaa871e9da03050422997908d1eb518
SSDEEP 768:CIrv+4UNbdX3H+He4hqu37BtAwjUSzZPUikB+:CIbsbR3HSe44uoTiUJI
TLSH
T17403CF32A84499339CF7D296B25B7B43BFB45063D6C91F90C8ED2B0D428B15D234BA67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

campaign_history

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history
Size 20KB
SHA256 8ab7a413ece6c8507d8538f741df788af26d827c67c0ad54f82bd9b546e119d7
MD5 038f8bc58baff8d75e50a62691eb4a83
SHA1 270663671179b523b2bc01d2ba7bbdb3791b84a2
SHA512 bf8c83bb266a32c697fa1854f741dd203b2048969fa9d4f0131ae95233dd83c126e9e7f57a567bf939f7b130867942769206148014d7ffe8740759a3eec852d8
SSDEEP 24:TLE/j0afDdWec9sJVUOTdDLhL90sBMXjy:T0Dbg34U0dDLhh0sBMTy
TLSH
T1F692F071B9302427E4EF1BB6F8934CA00DFC12AF8E6B7450D9A01D920552BC67B811FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 6a99c3ecb3a0e5758530d573b3f19bf85e76e2c699a388846fab0fbcb0f5bbab
MD5 3f41c13f5f3f7d7d46f2370edd66bb7f
SHA1 a291760688c74bdc2d4037b0bbf4ad889fa6012c
SHA512 a40201802edf7811419ff1c7f46c97eea45b14334fc2566d1516e1f96ec7d81139df997ee7e860234e81bf2ba917c5ee1ddd91b32158e4a5633a4bd07ea3fa1d
SSDEEP 3:MsEllllkEthXllkl2zEel+bs:/M/xT02zN+
TLSH
T1ED44040C7FD41D57D71414304011C7540370DC1005515757357104135CC7D400D10000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

576d701e-6424-4ebe-aad3-e92207869feb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\576d701e-6424-4ebe-aad3-e92207869feb.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

6725bab2-c59e-45ed-a97c-d45809531735.tmp

Path C:\Users\Admin\AppData\Local\Temp\6725bab2-c59e-45ed-a97c-d45809531735.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1420_1822557935\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5788_1584082946\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/636-215-0x0000013EEB680000-0x0000013EEB8C1000-memory.dmp

Download

memory/2028-986-0x000002006F590000-0x000002006F7D1000-memory.dmp

Download