hxxps://tryuseelements[.]com/promo-forward[.]html?sid=1141411&an=am&cid=7817944490030559987

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/07/2026, 04:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://tryuseelements.com/promo-forward.html?sid=1141411&an=am&cid=7817944490030559987
Sample260714-e4cdysgv7x

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1880	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134284769779855692"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{9CA8EB55-01FC-4EEB-8F3F-55A5F68C77C5}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1668	msedge.exe
1668	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe

Suspicious use of FindShellTrayWindow 48 IoCs

pid	Process
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe

Suspicious use of WriteProcessMemory 59 IoCs

description	pid	Process	procid_target
PID 4448 wrote to memory of 1420	4448	msedge.exe	86
PID 4448 wrote to memory of 1880	4448	msedge.exe	88
PID 4448 wrote to memory of 1796	4448	msedge.exe	89
PID 4448 wrote to memory of 1796	4448	msedge.exe	89
PID 4448 wrote to memory of 1796	4448	msedge.exe	89
PID 4448 wrote to memory of 460	4448	msedge.exe	90
PID 4448 wrote to memory of 460	4448	msedge.exe	90
PID 4448 wrote to memory of 4768	4448	msedge.exe	91
PID 4448 wrote to memory of 3840	4448	msedge.exe	92
PID 4448 wrote to memory of 4768	4448	msedge.exe	91
PID 4448 wrote to memory of 4768	4448	msedge.exe	91
PID 4448 wrote to memory of 3840	4448	msedge.exe	92
PID 4448 wrote to memory of 3840	4448	msedge.exe	92
PID 4448 wrote to memory of 3572	4448	msedge.exe	93
PID 4448 wrote to memory of 4772	4448	msedge.exe	94
PID 4448 wrote to memory of 3572	4448	msedge.exe	93
PID 4448 wrote to memory of 3572	4448	msedge.exe	93
PID 4448 wrote to memory of 4772	4448	msedge.exe	94
PID 4448 wrote to memory of 4772	4448	msedge.exe	94
PID 4448 wrote to memory of 2796	4448	msedge.exe	97
PID 4448 wrote to memory of 5000	4448	msedge.exe	98
PID 4448 wrote to memory of 2796	4448	msedge.exe	97
PID 4448 wrote to memory of 5000	4448	msedge.exe	98
PID 4448 wrote to memory of 1668	4448	msedge.exe	101
PID 4448 wrote to memory of 3436	4448	msedge.exe	102
PID 4448 wrote to memory of 3436	4448	msedge.exe	102
PID 4448 wrote to memory of 3436	4448	msedge.exe	102
PID 4448 wrote to memory of 4296	4448	msedge.exe	103
PID 4448 wrote to memory of 4296	4448	msedge.exe	103
PID 4448 wrote to memory of 4296	4448	msedge.exe	103
PID 4448 wrote to memory of 3460	4448	msedge.exe	112
PID 4448 wrote to memory of 1476	4448	msedge.exe	113
PID 4448 wrote to memory of 1932	4448	msedge.exe	114
PID 4448 wrote to memory of 692	4448	msedge.exe	116
PID 4448 wrote to memory of 692	4448	msedge.exe	116
PID 4448 wrote to memory of 692	4448	msedge.exe	116
PID 4448 wrote to memory of 1264	4448	msedge.exe	117
PID 4448 wrote to memory of 1264	4448	msedge.exe	117
PID 4448 wrote to memory of 1264	4448	msedge.exe	117
PID 4448 wrote to memory of 2560	4448	msedge.exe	118
PID 4448 wrote to memory of 2560	4448	msedge.exe	118
PID 4448 wrote to memory of 5044	4448	msedge.exe	119
PID 4448 wrote to memory of 5044	4448	msedge.exe	119
PID 4448 wrote to memory of 3116	4448	msedge.exe	121
PID 4448 wrote to memory of 3116	4448	msedge.exe	121
PID 4448 wrote to memory of 4468	4448	msedge.exe	122
PID 4448 wrote to memory of 2604	4448	msedge.exe	123
PID 4448 wrote to memory of 2604	4448	msedge.exe	123
PID 4448 wrote to memory of 2560	4448	msedge.exe	124
PID 4448 wrote to memory of 2560	4448	msedge.exe	124
PID 4448 wrote to memory of 896	4448	msedge.exe	125
PID 4448 wrote to memory of 896	4448	msedge.exe	125
PID 4448 wrote to memory of 2024	4448	msedge.exe	126
PID 4448 wrote to memory of 2024	4448	msedge.exe	126
PID 4448 wrote to memory of 2024	4448	msedge.exe	126
PID 4448 wrote to memory of 4440	4448	msedge.exe	127
PID 4448 wrote to memory of 4440	4448	msedge.exe	127
PID 4448 wrote to memory of 4440	4448	msedge.exe	127
PID 4448 wrote to memory of 1668	4448	msedge.exe	128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://tryuseelements.com/promo-forward.html?sid=1141411&an=am&cid=7817944490030559987
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x218,0x7ffbf900c188,0x7ffbf900c194,0x7ffbf900c1a0
  2⤵
  PID:1420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1944,i,1927569295528221057,9540021114540270828,524288 --field-trial-handle=2892,i,634907854658234636,4215497107804418949,262144 --variations-seed-version --mojo-platform-channel-handle=2984 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1696,i,11977289582528062689,18067826756103804398,262144 --field-trial-handle=2892,i,634907854658234636,4215497107804418949,262144 --variations-seed-version --mojo-platform-channel-handle=2880 /prefetch:2
  2⤵
  PID:1796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2228,i,2367571109137586158,12573639826768348198,524288 --field-trial-handle=2892,i,634907854658234636,4215497107804418949,262144 --variations-seed-version --mojo-platform-channel-handle=2956 /prefetch:8
  2⤵
  PID:460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,13023823560720462643,299007337983930918,2097152 --field-trial-handle=2892,i,634907854658234636,4215497107804418949,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,2347888510057072732,16326057378075767258,2097152 --field-trial-handle=2892,i,634907854658234636,4215497107804418949,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:3840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4172,i,2900769698467761237,8055348773786172510,2097152 --field-trial-handle=2892,i,634907854658234636,4215497107804418949,262144 --variations-seed-version --mojo-platform-channel-handle=4184 /prefetch:1
  2⤵
  PID:3572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4236,i,9192032548464064021,955793947223644330,2097152 --field-trial-handle=2892,i,634907854658234636,4215497107804418949,262144 --variations-seed-version --mojo-platform-channel-handle=4168 /prefetch:2
  2⤵
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4520,i,15547347971113898679,18363148611891507742,524288 --field-trial-handle=2892,i,634907854658234636,4215497107804418949,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:2796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3572,i,1676238690671132288,3154208282289968503,524288 --field-trial-handle=2892,i,634907854658234636,4215497107804418949,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5920,i,4955356135256505295,2062868140293769551,524288 --field-trial-handle=2892,i,634907854658234636,4215497107804418949,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:8
  2⤵
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5920,i,4955356135256505295,2062868140293769551,524288 --field-trial-handle=2892,i,634907854658234636,4215497107804418949,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:8
  2⤵
  PID:1668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6236,i,6121120559981850619,4914365605383721077,2097152 --field-trial-handle=2892,i,634907854658234636,4215497107804418949,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:1
  2⤵
  PID:3436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6408,i,3741416108498496465,2205747065935837949,2097152 --field-trial-handle=2892,i,634907854658234636,4215497107804418949,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:1
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4256,i,1672505874517836968,12541204863353693124,524288 --field-trial-handle=2892,i,634907854658234636,4215497107804418949,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:8
  2⤵
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4196,i,5890634167974280755,14818149833826433554,524288 --field-trial-handle=2892,i,634907854658234636,4215497107804418949,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:8
  2⤵
  PID:1476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4428,i,17701989638553736554,7314963864330980764,524288 --field-trial-handle=2892,i,634907854658234636,4215497107804418949,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:8
  2⤵
  PID:1932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5392,i,13780350735456578939,55145291047642725,2097152 --field-trial-handle=2892,i,634907854658234636,4215497107804418949,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:1
  2⤵
  PID:692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=4216,i,16930764381340401622,12954182760113784099,2097152 --field-trial-handle=2892,i,634907854658234636,4215497107804418949,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:1
  2⤵
  PID:1264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6328,i,18066136356089908667,3069348887402511605,524288 --field-trial-handle=2892,i,634907854658234636,4215497107804418949,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:8
  2⤵
  PID:2560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5312,i,7518277858607545839,15657497642120037230,524288 --field-trial-handle=2892,i,634907854658234636,4215497107804418949,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:8
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6332,i,6316305916174345286,12180866544328473675,524288 --field-trial-handle=2892,i,634907854658234636,4215497107804418949,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:8
  2⤵
  PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5160,i,18265812507407916646,4710814425584260316,524288 --field-trial-handle=2892,i,634907854658234636,4215497107804418949,262144 --variations-seed-version --mojo-platform-channel-handle=6552 /prefetch:8
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,16990233269911533659,12926492760183592334,524288 --field-trial-handle=2892,i,634907854658234636,4215497107804418949,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:8
  2⤵
  PID:2604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6680,i,17452333729181294689,3322895343571468152,524288 --field-trial-handle=2892,i,634907854658234636,4215497107804418949,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:8
  2⤵
  PID:2560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4372,i,681782820150470267,15443478600525876156,524288 --field-trial-handle=2892,i,634907854658234636,4215497107804418949,262144 --variations-seed-version --mojo-platform-channel-handle=6680 /prefetch:8
  2⤵
  PID:896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=6696,i,17676146042398415016,5408109221730883636,2097152 --field-trial-handle=2892,i,634907854658234636,4215497107804418949,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:2
  2⤵
  PID:2024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=6452,i,11305521409085584952,1622134117639904192,2097152 --field-trial-handle=2892,i,634907854658234636,4215497107804418949,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:1
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4240,i,719403531214039730,8501270596358362895,262144 --field-trial-handle=2892,i,634907854658234636,4215497107804418949,262144 --variations-seed-version --mojo-platform-channel-handle=6620 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1668

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:704

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 9420686d12b2cba6dc69896d607eadac629280a010e5358a4872ab9753f24ed7
MD5 8be6e81804d8b903ae07c11b2e53e3d9
SHA1 817c41cb00b05a8f2040323b93c6416b92dbc01b
SHA512 c2cfff48ebb312975aa2615d841d0badff185589ad3a3f5e8420c2ea0eb5dc0e5354d917cc43d57bec169a63d4fa21d66e91dc3e195592ece23d37fff7c04680
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7R:fwUQC5VwBIiElEd2K57P7R
TLSH
T1CDB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 39b8627875fea5ac5c5bfb887da12c15116e3fe81f200852c71d5699102c9044
MD5 e3962be2eb3bd350a67bf6309159a1cc
SHA1 c10632202b95ed6f7f4475b6483bf5196e4c5578
SHA512 d12d4acc23b51c071fbc9bf4db2f0575a6b43ec7894b272035e4c01dfce30099cd3ef90a1009dd1e6284cfbcf7a37fd3b79490739946700a2c61ec578374cbe6
TLSH
T173D08C677A0E7815E72F8231A413E360A76B4072A5629702F324C81DA9BC8D85BE63D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a59087fbda784cffb013f4e2a0bf13a7fca483c48e8a7fc15fa022402eb25d72
MD5 dd54db185d82309b854bfa7657ba4600
SHA1 d01c14e8b4dec85ed2e1671545a868fd7ad4fa95
SHA512 f014ab84dd934b90e006883b74ad349d05f60071e57d2cf0bdf8a9bce118654c92139263e082094b602f6900a71e9a7848754994a2ea88642b2376121b581d07
TLSH
T165D08067354D7815E71F42319413D350576B4072A562D702F314C41D957C4D857D53D7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00008c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008c
Size 373KB
SHA256 a5c27d3298042314d98634f85836ab0c48cbdf572ee676981a852c3e18738d8e
MD5 7eb1501498252ec1a30118a2d3917c94
SHA1 b275a098ab3e050e2b4ac71eac10c238c2365c45
SHA512 8f5831b6bfeaea74aba0d23b684687e0a308f51f1528859535c9df335367b946b6be42500ce637e77baff40795bbf152e24abcfcee227c6d9d0e490412e09d26
SSDEEP 6144:bBJYkBiu4su2hIklCVm8ZiLHBd0R+2jBLX47rD+CNOgtU28xNAoWclJ/lo31jjuQ:bfWV22kvnBSw2FLIPDVNfN8nWclJ/Md9
TLSH
T100842306FA0DD6F4A7A40DDD2990A3E04D1372444CFC4A347B8523B9DDE3AEF4A159AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000094

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000094
Size 39KB
SHA256 20b535fa80c8189e3b87d1803038389960203a886d502bc2ef1857affc2f38d2
MD5 9a01b69183a9604ab3a439e388b30501
SHA1 8ed1d59003d0dbe6360481017b44665153665fbe
SHA512 0e6795255b6eea00b5403fd7e3b904d52776d49ac63a31c2778361262883697943aedcb29feee85694ba6f19eaa34dddb9a5bfe7118f4a25b4757e92c331feca
SSDEEP 768:Vce3jkow68wmT4IBX0tXdlSirS61gSjcz0GPwHbP+w2jec56O:VcI/iEEEtXdFJj+0GPwHbP+w5rO
TLSH
T13703023A5E3CCF1A84157A703950F6D9A8481E548E9D143B4F1AC7BF085DDE2209B6D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 4KB
SHA256 9ec5bc8971b7a6ad241cde9a4f3884978a96b9f04ceb583c34a0806aadc16508
MD5 2eac18218ba19268f878cb7a635c3d28
SHA1 2816bd73de9e4348c4fc9d782421180a07b3a6ec
SHA512 bbc39a9b2c4a1f87a52d0c5df44a2f3d08f56b9a4b1db84e6d2bb9b6c0c9700333a0af862c28ddf125df63aa21277431948d955e8434f6c3f60aa0512c406aa2
SSDEEP 48:6OWbFr/8+95zcCW7jxpTRz9oTtZKBVJEa66ajQYhaAEKe/OY/1k4nElIDJNd6z9:VWbRV9ST94tWVKQYYgeb/DMsJNd+9
TLSH
T18391CB476D870CE9F3748FB1DFCA0A38387268A60F4F2F96006694BD3436715591E92E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 3e1342347ef5fe5fc5275d499306d12e53281cb2d077e6be71085f50fca4a6d0
MD5 fe783c422a6452783629ad63263463ac
SHA1 a6acead91858dd9fc4881e130b829b9351e870fc
SHA512 45c89afbb044a44713b5e80aab5d36c3320f5311d8d1b90b9d2972960cdd0579acaadab13e6cdedd78b0d7a663e7b42b81adae641c92b7cd7731042d63bc48d0
TLSH
T19A7182872E930CE5F3708FB1DFDA0A3834B5A8A60F4F2F46115294BD253A7145E2E52E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe587952.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe587952.TMP
Size 3KB
SHA256 89abaef11b52b5fca4006e6bf9cfe4d2d85d8f276ce55ff176a8eb3fc44cd988
MD5 cbe29a2c54a78d745589fa62dc3d4d9a
SHA1 896a29b686f17d72e54d3ddc3d24c643a0aa646d
SHA512 4c31741aad1e46c971d2e6f099c513305e8768803ec3d9e154b5645ce7be302673a7665833a8b4b550c06836a9d59ebd3022fbafff1db9d52b489552a77a6494
TLSH
T1A06160472E930CE5F3708FB1DFDA1A383074A8A60F0F2F46105294BD25397245E5E52E
MD5 SHA1 SHA512 TLSH

Submit Download

rules.fbs

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DNR Extension Rules\ppfadpgpccljindldolejmgkhgaficka\rules.fbs
Size 5.4MB
SHA256 ce48f8ee5d466c8e3dfa19f47ae7757e2a203f140a4413a29435d529cd13abab
MD5 743dbbd2d240440bc6e13d70eb4b04cc
SHA1 2f7d135bf68c6c271ca95f240fabcb2e8ec02d6c
SHA512 89d18307539e2f7b22c23cefc3c66f9991d489c5193b1fcf96559cebef2cfe378663abfc6f8e32e6d48453df31f804165fe9705cc26b5fe116c17edbcd49308c
SSDEEP 49152:VN7u7Jyud0P6y0rsF7U8zpkCei2je/LMwiWFps4xzXV9WWilI:VN8+
TLSH
T1AD461B73F62DC934F6E600355C864B34065CB77583C8D4F7BEB0824A3A8A6F92169B5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rules.fbs

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DNR Extension Rules\ppfadpgpccljindldolejmgkhgaficka\rules.fbs
Size 511B
SHA256 807068a0a6bd1deb740ebfe9435700a238a3392b80fa477773f17da6262641c7
MD5 90be4f56a8261e9f2a8cf467da894c38
SHA1 d3ebd189d1d987d0007116b2fe946d950fa2b86a
SHA512 bcccaec07540e3acfad56b9162aaf332e29621616a392368d9a18bbf82298f6a4f88196aa33d38ee0772601a91f9fb05f907f4219f576f47132522b574666cf5
TLSH
T1CCF00902FC009B7EC07DA33489FF8062C0883F840BE2640D2410A30D32409B087BAFEA
MD5 SHA1 SHA512 TLSH

Submit Download

rules.fbs

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DNR Extension Rules\ppfadpgpccljindldolejmgkhgaficka\rules.fbs
Size 4KB
SHA256 dae02a1eaacf372139e2816e3fb20b68b403ce1eb8516fb17a58fd2b207ae266
MD5 875b9e8be14696ef071701e2c74a2b68
SHA1 670381132455c7180d626b783dd9128d3138de62
SHA512 c9698fb9937d1004f767ce1a8e69bd482e2fcc77e2ef4a0ba830c8fe0f5c78402b84c01e7bb85e82f81fbd22e9ca59a8494b1a78875c415123a11d3616e6ca24
SSDEEP 96:LrgLZzZt6p9nO75CdgpfWASmgjxMZidsFtqk:6zZqAS7lnk
TLSH
T11CA10EB36C1CC623F1789134905A827D1638376146C4EDFA7EA8926B35C2EF1335A6F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rules.fbs

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DNR Extension Rules\ppfadpgpccljindldolejmgkhgaficka\rules.fbs
Size 9KB
SHA256 3a8ff7d6b9677a274158a181ea549b1278d6b0851bc4d47dca8ac9329e4e10a8
MD5 ea4b62f5cbabba3abdb9cea482322be7
SHA1 d059f5e9392a91a0563483b1a675ff5a3ab99f09
SHA512 3d7c98bf6699d9f04a83ff5a8d8baad511cf21b9f9a2fc1ac553a0d1628102c031db01685bd4fd150909298da78b79cec88a9fea843453b78d09181836bc7892
SSDEEP 192:w1XQzts2uFW2AaryosM59CsTTvEM83zZqAS7lnk:w1ytkW2ASyot9CsTTEM83z/S7lk
TLSH
T13512FCFB7C8DCE3AE07D5534C49E423A412633114A81ECFA3E7845163687AF123A67AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rules.fbs

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DNR Extension Rules\ppfadpgpccljindldolejmgkhgaficka\rules.fbs
Size 5.4MB
SHA256 6faf0fc0c555f224136e17f66238b9a1cd0538e605db8ff56b2441400c9aaee1
MD5 6227a8d2b7e0a6a39d94c6c600fa8832
SHA1 2466cc3b837377f5ba14d60c878554282c9931c6
SHA512 8a9ae17d7d827bc58edcec0cb2125e197095b30b60da176b4d688a319ec3e2bf427f0727c90013fb6ffa22d74258ddc62fefbe827f533b4e7203a75c90dabf85
SSDEEP 49152:C44hPyKdd0P6y0rB+7UkGpkCei2je/LMwDW9TsFHzpV9ZWilM:1BV
TLSH
T156461B73F62DC934F6E600355C864B34065CB77583C4D4F7BEB0824A3A8A6F92269B5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rules.fbs

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DNR Extension Rules\ppfadpgpccljindldolejmgkhgaficka\rules.fbs
Size 5.4MB
SHA256 52e781f6bb30d7c558cf141656c85e7844b0320dae1e4da2bfbd15072d46098a
MD5 d2e72ea8c4f2b122641565b34e2a3352
SHA1 60d04249eba96c3d6214bfe34d652b403908c602
SHA512 22a8d22eb3d242ef7fa337bdcdaa5155d76bacb3104a8723438ad720be9965e2fdad860abec1015aef3010a7eae262ef032febad65b9fab07a9ba11d431bc925
SSDEEP 49152:gRsf67qfGP70P6y0rJGpkCeiejo/L8wbWFVssoz/V9XGilA:g37qfg3
TLSH
T17F460A73F62DC934F6E600355C864B34065CB77583C8D4F7BEB0824A3A8A6F92169B5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rules.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DNR Extension Rules\ppfadpgpccljindldolejmgkhgaficka\rules.json
Size 3KB
SHA256 289350c3d5e4df1a43e867340fc198319cf859d958a0a062848079a743cdefec
MD5 0cb5f0112257f13d9fc1b873dffe40fa
SHA1 ed4f377bcfa0c88ab72d1c414442fb857e3ff843
SHA512 8da384f15a333615a5cc05baaa5b03b466ea39dc60d5d060a561da3251c6fddc3562afd437e34e05746600519accb43448eca56f5e426d972067ecf8c053f883
TLSH
T18051CEC32D048537569880C85C0C5D4C69BC1337539DEAF99EA8857F5ECAB8630497FE
MD5 SHA1 SHA512 TLSH

Submit Download

rules.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DNR Extension Rules\ppfadpgpccljindldolejmgkhgaficka\rules.json
Size 19KB
SHA256 e41b21539aa69d99d4e141c4dbd5e35fa3b3d81830b34cf15f27e9cef372f039
MD5 eed2d3bea859e73da97c5308c8c65598
SHA1 4e43dc8ae8d34e526f3e097a293e4729b26ee753
SHA512 484374150b6af306be4fea8fc66f221e06b592e61e0b9e19b90b7280416afe6d7dc1fa0ee1139d4f5f358f1c10b0bd333c7fc8f3222dd66ecee2669d482b297d
SSDEEP 192:S7J3HiOfN3HiN7N3Hiv6baCm9A7f14H81CQ7J3Hi3J3Hi057J3Hi0g:UCCCrCDCm9A7CH81/CtCsCV
TLSH
T14192E0C32D14853B569880C85C0C5D4C69BC1327539DEAF99EE8857F5ECAB8A30897FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rules.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DNR Extension Rules\ppfadpgpccljindldolejmgkhgaficka\rules.json
Size 5.5MB
SHA256 93ec0a2e50205873521744c928a16d40ee9bff74880a5fc739cda1d649ddcb34
MD5 6761bceb1f36efec0eef855b7ed69323
SHA1 a49c53ca1a7bde4bbdcb3909842b4c4282553f67
SHA512 53921e8c97f356038ff0f1233633a6836ba660f59972e0fcafba5901c9b593120237ae38971ba4a74c030b7110b40fb4ab24eea811658a0597ce0d06a12dd7ef
SSDEEP 49152:g3Y3a9SxzvxzVoQomrcbWhPdKtHYdJ6o/2uOQx2nEyL8t7z:7
TLSH
T13D46B5124B188A3F57D80289699B3F0745BC0E05431DC5F9AF96D6389E9F389344BBEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rules.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DNR Extension Rules\ppfadpgpccljindldolejmgkhgaficka\rules.json
Size 5.5MB
SHA256 16a1aaa06fdbd1c3fe1f67ea135b73dafc9879b3ef02cbc7b669f108b50e42d2
MD5 7a9480be4381a0c0fdc9c579de699750
SHA1 578e54dcab645143ccc7309fe4ebbcbb49fa3050
SHA512 148c003d2a6376adf814925ef94b57747e29ae4f98d5715f02ee871f2fb153276af122faae9bd63a908872a9b888cb325a3b13f24c19e28d3c7e0088974f082d
SSDEEP 49152:23Y3a9SxzvxzVoQomrcbWhPdKtHYdJ6o/2uOQx2nEyL8t7J:X
TLSH
T1CF46B5124B188A3F57D80289699B3F0745BC0E05431DC5F9AF96D6389E9F389344BBEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ppfadpgpccljindldolejmgkhgaficka\2.2_0\_locales\en\messages.json
Size 8KB
SHA256 68f8de2b2e3b12fc2de603a7e419b94d277391fe35609d39b9d77388bd832af0
MD5 95d112f059043fd63cec27c51ef2b1d1
SHA1 e3055f896b73a294c7f889bffbad587f20647a6f
SHA512 c91b7a06fef4d35b39a92614abe6f159a202ed6e94d80ef1e2d24548c71a3e1124e4436d072960b52e6e8d37a1800e55a4c081189b6f07df11bdd8f99197f018
SSDEEP 96:tTihegSLhroeeefRdXejCpQCKLRJ1Z5rLprCDqh6qpGVA:tTihcMudoUmrt
TLSH
T12402A00AC9607CAB02FA432A7C75A658F670437F6200988F7D7C914C4F76AB7D5A2B1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

redninja.png

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ppfadpgpccljindldolejmgkhgaficka\2.2_0\img\redninja.png
Size 18KB
SHA256 e569e774fe10ef12dae05b7e3cfe75528b270318cb674d849c2aafef94b568bb
MD5 8ce0d06a4e7dc8930a83937baa1ce737
SHA1 be9f9db39fb68d4a69477392b528fcf05bfbf19c
SHA512 c211b2c15aeaa771ecb0f7fb574ece1653c030672529c2d9b831b8936b9e82f061ec33d7b5fd50d910c9abe04bcc28be5f443638a23b63b37060115761fd0c6f
SSDEEP 384:8FQLOUgSjwfvucp56z0jlXlAXKgZzqt6OHEcmoEKaknybNy:tLJgvGcp5Q0jlXSXvQEld/knybNy
TLSH
T19482E1CEC150BABBA3FBE62959310C4D8998575D2840437CCEF1F6907A327EE5B5D842
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

background.js

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ppfadpgpccljindldolejmgkhgaficka\2.2_0\js\background.js
Size 15KB
SHA256 31deac9bd41dfe54d788052afcad4203e87615e03462903c30e6561e3306eef0
MD5 b63165ede15b8d5ebc484291159677c7
SHA1 84a69e9a42831f0513919146c1594aacc5ad4c00
SHA512 50d9a58d29374da8653b1477af34f6a83c68d5cf12cc1c658f92bcde9e44b364bf1049812eeaf6c8133fd894fa73518628b9a47111e435adddf00476cb0c9da0
SSDEEP 192:zNqEaVawTMAcCubS6iQs8bMRNPRD4u+1YkppPVqI65l61w2OBGTEWGOFl4OL3bDF:hqswIAcRb0RhMJ1dSYt2GTMlQ9xZ
TLSH
T11E62962519F2463915636C9DFB3BBC466626D007E058E910B84E83E46F7C1A8CDB1BEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content-yt.js

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ppfadpgpccljindldolejmgkhgaficka\2.2_0\js\content-yt.js
Size 3KB
SHA256 15fb50330a8a10cf752beecc4982a519a3322558ecf44adbf6ebd6852c232d1a
MD5 3c6ce075bcd670cf8f33ffe8b263e009
SHA1 6a073f748715e6d8e32c3a70ffb1387a6974de56
SHA512 7585fcb0fac2c2855b5cec03072139f957d41f7ee7a4bb1bfe90e94c8a636dc7f0db85c23f23666cbb8233f1d1f68e6454524be046eb8b935f1d903ebac09295
TLSH
T106812FA544E271690627109BD6BB2C1131B28113AA4DD598FBEC837D1FCCD74067DBBD
MD5 SHA1 SHA512 TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ppfadpgpccljindldolejmgkhgaficka\2.2_0\js\content.js
Size 26KB
SHA256 6a382107ad42b819ca346a10fe757700fa25b23a8128b150393057713955712b
MD5 e83ddfd3d08924042bcedbc347985202
SHA1 f830da00e3fa646d09789b44712c9c739af11b01
SHA512 0de44674a222121d4fdea9c185774cfa7f24c956b11742f8f693c0730f3f1ab8fb673cfaf51da2efa181b9ddbf0fe1cf708423a06b6a53f35ecc374968dd047d
SSDEEP 192:i0AEqMTPFRISCcWwx98jFMXNtZeHISCm3iIXYNLuEpA+/riGT6WkO0g9KNnAlLwv:gEqKPLUjqXNS1iqYNzxr+hgurj
TLSH
T17DC270B9085111287672F37CEB379406EA25B2BBB1518110BA8DF3482FFD425DA25EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

main-world.js

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ppfadpgpccljindldolejmgkhgaficka\2.2_0\js\scriptlets\main-world.js
Size 56KB
SHA256 71057d98f117ca95bec2c0ecc934a9d92177f56aa186b14f0b066b0eb104c7b8
MD5 4f523c085a4367663524c04320e09636
SHA1 b86c442c2afb15cd8cd595121d38ec446d2927ca
SHA512 261e56b9d3a5bb5c7a6eb22c1e2e79a8e4a2515d92bf0bbc5a1e61f6e8c4e1e4136be55ac966a074253891df80831f39ad3b3ffe51aa05dd704a6a33f165f9c7
SSDEEP 384:M3VRCwjhZ5yEWv1jdMzbZ0ZigJl32GW2XT+v85VxH9xHErnjtfk18fpdfkzP5BPE:AVFhZ5i1jdMd0R2G5DRdHfHvzP5wQlc
TLSH
T1AA43619DAE562061A933B37C8B2BA105F63A55334056C150FD4CE7042FB4B96C3A9EFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default-badware.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ppfadpgpccljindldolejmgkhgaficka\2.2_0\rulesets\default-badware.json
Size 73KB
SHA256 c5fe51a947cbec7e2f6b9a8a7fbafbef0e4e7538fa6f67b7f7cec0de2dc568c3
MD5 287d76da127e5816d6b5afcdeefdd79e
SHA1 08ba0bd9f4c15e1a6bde50395b5590b578f76ef1
SHA512 1cfad4625fa7f14499eb85ae564fd01d057b6e27299fea6ef75b1e5dbeae726eae9ea21c3dd1b138a793e84dcfc089ae46cbd8deca4f0345350e6252858f0ddf
SSDEEP 1536:LZClovQ7Iw8yc5QHcmG4ultXy+Ii/CHO+:9nQ7IGGxZyX9
TLSH
T14073FF76081C663B969A1358B582BD0344384A10470E96F16DD2D43CEAEE7DB732F7AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default-filters.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ppfadpgpccljindldolejmgkhgaficka\2.2_0\rulesets\default-filters.json
Size 968KB
SHA256 c63380aae525acb70153e2499304f237a3c83b4e595cd331118f4f35369f43c6
MD5 0c37c1d4d8639e8c4b8c6a7d238818b3
SHA1 9811822d36dba7f35d187560a25c5344b1fed958
SHA512 071a96ab602044a108bf9bba550ec1dfbe4ab6bc1d43e3b5dadb154e4539d05561a34f970f3b03b7236737cb94a6af11abec609a478eafe7a2ae5e1d01f22741
SSDEEP 6144:g42hnqWAhC33HNqWHx2vR1Wv2ES0z39VlLXNyk+QlMti7iqzRWjOTNw:g4ZWkC33HNvx2v42Iz9VdXwk5lMGHRWT
TLSH
T17A25BF371808A637CF9A5348B582FD0205344A005B4C86A5BDE2D47DA6EF6CF7357BAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

defaultlist.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ppfadpgpccljindldolejmgkhgaficka\2.2_0\rulesets\defaultlist.json
Size 1.6MB
SHA256 6deeeb1b42d8f613e0148e1bd431f64a4a36d0447fea9729457f46068d56a343
MD5 f93a2fd242f05803f1b61d696285cb0c
SHA1 490af420d16ac797da569f8cba0dda249b8827ca
SHA512 31da29d5ec9ea253ded5d9c9edd65cd628a02d7608e165611addec93dc653cd3aaf3c55e30ba05243bfb82dc5115d3988d4cf36bd6bcb8d1d22b40f44c8cbb79
SSDEEP 12288:jCV9g8vxWQHrRTaOemvd1r8I7C8COFCUnIZohoWfUs4d6LUd0T7TpcP5lbQGG59Y:eVHQQHdzV1B4XQGfgDRVZL2iwXx
TLSH
T14575B527481C4E3BCBD913C87686BC054A3C0509970FC5F1A996D53CA6AE78E3257BEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

defaultprivacy.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ppfadpgpccljindldolejmgkhgaficka\2.2_0\rulesets\defaultprivacy.json
Size 2.0MB
SHA256 97834787fac1a097b62d5e2958f4baafd8909910f8da9e90142534caf255bf69
MD5 4600b34950661b92e2222b2e078a0974
SHA1 eda654a8dd7f72917d11f8e37e9d9250c9a7b1a0
SHA512 ad704833d14aeb13e8f2530b78717edc516cf2254ac9f3423974ae939e630d5c1f939c1bed5d1abc0794bb0cf8a7ddf2e6ca7bf08277e718627e518b8eb6e955
SSDEEP 12288:yJHgoJON7KOPnQxXszAj5SSCSGTqIfTkDoM1E84yBKztERNTZyiFr:02ZKOfKj5RF+kEvygiFr
TLSH
T15FA5FD26181C563B468A1358A9867D02943C0F14434DD6F26ED1D47C9AEABDE332FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 193ef76bebb51edccec371e6e1a2b0225e7da989862ccd7f98c9b50bc696b55e
MD5 fd4688c0c38157465097e83293fcd17d
SHA1 2b88a21093a516e72bc45c322d1c249ee3325eb2
SHA512 5e2f5bafd247abfe6e911024953a847288a3bb78bb2f4b164e62d66f739b7b4da920568ab04cd649f575b65b1130acaa997c605b6af9df81c7c4ab3424744389
SSDEEP 192:DzE0Fh8031Ub6VPSZ/3vdSDDD5UTkKKrljhmFoG1toglRcXNR:DzE0Fh8031Ub6VPSZ/3vdSDDD5UTkKKL
TLSH
T1E2126BF7C3E8C62D980266F5A7297E1ECE1E0968432C3C5AC9D9AF5F93E2471D10164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 12KB
SHA256 e5020096fdc45945a7943167c1fb77b5d7fd3e4d06b598ac2ffddc430c5b3f92
MD5 724ad557ca9695f809b83077a7cf7f10
SHA1 34a4f51cd50c5b740c086fd8794b91305bc15d50
SHA512 f554e5424a54576d4126bb8476799896121edcba439e1b6450a0cc88d18b67f0bc89649b6c9019977289c229262906c6fee0a35732ef70cd13360e7dff004aa9
SSDEEP 384:DzE0Fh8031U6wrkxwCUScgyXPSZ/3nEDD5UTBqlZB1cRbVXiz5lX9CJqJeVPg0:kSb
TLSH
T18E429DF7C3E8822DD81256F5A7187E2ECE1E0918432C3C5AC9D9AF4F93E2871D25164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 a21e7ae884de0648572a52fa061c7e87eb42459baa3dae1cacbff396859d1df4
MD5 659df3135e3cdfa5cfd8b3ad6e440a6e
SHA1 88f7179750e4ade00a9242678e67a2b9c381c566
SHA512 d3be186803ac6da1c47cee94b1fcf65b28849cc6da648af7af0c6511b21e87634c0ed016ea25b34c34d15f39aebd46af98ecd2510701d12651a05a2e11c9a7ee
SSDEEP 192:sxZ6RHyM/jK1Ml8M/n9/f8srPpUIdp0baXdvHW6+WN/ydq/YHQVBeIgrJ:sxZ653n9/f8srPpN0c9Hb/R/w9
TLSH
T16552E8526A345977CCCBD209FA55BF53D6F51472A6900E48AAFCCA0C05F6BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 c6321f4932ca6c09936807f80ad8d484a17d3ba23734fad21f5132d296f9ef9d
MD5 c51da39b0d5a3a71c9cbb9b93d6d2624
SHA1 6fd41916b0b09519bcf5d4701632c93ab610dba0
SHA512 be1ba2033e7be8031f3e16bc240a69acdf57ed7263b75776c8c6a42ba70e48647c236498c5c3c9823b3a0269d0169aa3b2194c45313cd42d1701ce0ae638791b
SSDEEP 192:sxZZRHyM/jK1Ml8ME9/f8sxHphCIdpmbcsiHXdvHW6+WNHKHIPAUNcbydq/YHqon:sxZZ5M9/f8sxHphrm29HbtxaR/wJ
TLSH
T19772D75366344A77DCDAD219B945FB97E6F5147296D00E88AAFC8B0C04F6BED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 c06b695c04f1c09270b62dcee78e7095a1f6fa9375039de3d5bd6f3cf2c74c6a
MD5 7ace2b2d279f11e416b6e5f05b038442
SHA1 6b87db63f706ade202fbe94cbaa336001b455e19
SHA512 b0b011ceedd3808f641a34eac68253e9824005aec9b5f221b1101dbaf7b7d1f55d3bea869d6d129c16f00309c7d8661a241bb894dd7e6be00c502c4eeda23052
SSDEEP 192:sxZ0RHyM/jK1Ml8UQ7E9/f8sxHphIIdpmbcsjebHXdvHW6+WNHKHq+xIPAUNcbyu:sxZ05qo9/f8sxHph5m2D9Hby3ixadXtJ
TLSH
T14272D65366344A77DCDAD219F945FB97E2F5147696D40E88AAFC8B0C00F6BED220381B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 9d908039dadc45ae9a2bcb9d01dffff8d86b923a0a6c54e95459d55f3cfc2f92
MD5 0d7ac01798ba36e3efa2e73ad642bb9d
SHA1 b0767fb3410e1a0f10d73e5975d7e323da1cbf2d
SHA512 168006198cda07af4e20eee5810bbe382769a2c9e1941ad8e4420b0701e38546f5d9ebfcb093cad62e56d0471527a5825e8bfe401f45cf80f81df52b62b42ad5
SSDEEP 192:sxZ0RHyM/jK1Ml8ME9/f8sxHphJIdpmbcsjebHXdvHW6+WNHKHq+xIPAUNcby7oX:sxZ05M9/f8sxHphCm2D9Hby3ixadXtJ
TLSH
T13772D64366344A77DCDAD219B945FB97E6F5147696D40E88AAFC8B0C00F6BED220381B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 62f690a5bcb44f9c63d1f1bfefec374f3c4620f5bc04219bf86779552893d49f
MD5 77325f2c104fd21824956a73d898b3a8
SHA1 4aa2059f6067bcab3d1a6adff8fc399bcbcb5837
SHA512 7a088e0e4fd0ff74e5683c4f30711a72cb10f5ebe52cf08c911f18391c9acc593c9847a5f42cecf47c9859fcb96d73a53df52245503725bf729254e48b153a3d
SSDEEP 768:z2UZYTMWvg0Po8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOeLlPZ4RIroVD0c:z2UZYTMWvg0Pou1ja7eLZmRzKc
TLSH
T122D20A3B280CCB7E4F844E9DEC2A6F963DD801CB5A984D5447EA884C03CB6EF512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 336B
SHA256 e8459f529dff7846982e3bc3b8f03b621183377ffe0db14136fcbf6385c1e8ff
MD5 33f07a6b9a449775978d45b5e65047f0
SHA1 9619a18cc38ac6415ad98aaec76a4a81ea2ff116
SHA512 dc15dd65aa41349b78d1349657e3b85f85c502b2535fd74686015284c0d55bdd4ce504c99f28cffb6a68c53b5ddd769a013c151cc9426bcc7bfc206b0e6a3a19
TLSH
T12EE097730310834CC02092FA24839052332AC2B6811933EA0425202A3D65032CA26708
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe598207.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe598207.TMP
Size 72B
SHA256 ca41e284500221dcdbe1a58892b5e4aad9523980ba6982370cb32dd5f14f0090
MD5 9d8c66297303166d8b09ca9cc9fcea84
SHA1 5e0304ead650fb6d6f771458a8176496df353a42
SHA512 4af1998f217a24e81f653fcf1f959cce360dd13bfdab59c0877cb7a6ca5d6440e6e7c5c261717420a410182874e9bc19cee8426601e434095f5854a53d171c84
TLSH
T1E6A0022102680490D80005F0A00252482600C96100601A1240E910A4AD710584A26244
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 50c6f4b99456d2888a58aea9e758a64c72e661521606c583c1cb6528b447c7dd
MD5 5cf99a6f9b6b7535bdbabb3c910e694c
SHA1 3c2436579d07a7a4cdd749def3b33727c475f3c4
SHA512 27ae9c52b050cc87f65a2558be0e01f5dcdaf949a193adfb4a972372008f8a365a7cb6a8441e091ca9ba1b63603c3499e442139898dda5dd5773cc1a35e3d334
TLSH
T1E2B0222C0020A303CCB2033C22EC8C80333C2C30330B220330FE080CE832303320202A
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 ac65a1e7ad44079c9ba0c768b2a4d15a4b41954500c9c03efb19203672471f68
MD5 86bcbf025ca551d17f17efacf6624438
SHA1 1b65b1acc6fbbc2520d213714ea3032db20570eb
SHA512 456f57c9b08b1ef2cae024457bc8d1ab65b9eefce1d99e028469d79c021f6c238ba2e76d52d352df28b99c50d53b75d76466ab3a98c060444f56cd8e516cc748
SSDEEP 96:KA1eK2A4hqKao060gKdSmnOKAwGyGPKMob:EMXPoNDm
TLSH
T175D1660231FB16023DFD3A19A2648B2B4782B5633008F52B7BE850B54E6AE345DFE5DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ppfadpgpccljindldolejmgkhgaficka\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

75405899-8241-4b5d-8af4-ba432426788f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\75405899-8241-4b5d-8af4-ba432426788f.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 259eaabfb790cc39650772b5191d7b1bde2ae1557a55e79ae21d25e485fd2c5b
MD5 e9ebc07b25ac5dbf423c72d6fe7f05bc
SHA1 de1545d3a283bbce17f1a9230fe637a601c4c23c
SHA512 17e2cf2eedb23ccdd7a4f27c31041a7254a8d42d787c5cf6ae172427b4401515649d3dccc994fb6b7a58176d3e3bd70335bbe7fd085c2e778a6f8eef6f487750
SSDEEP 384:CiF1tNn/s3n9SXAsNY8TUNTUlIl9nCafnzX5od+2OO+ustJrpkOObjI9G6w7x:JF1j+9LtwgTBbOTOOnWhpk29Mx
TLSH
T1B9C239F248D78936D9AE4757B77E2D138EFCC06BB5846A84B3985A0CCDA61BFC305811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 4f78a768fb306863594b31e057693c664e1b89ffbd4a3afb094de2da966b998c
MD5 a335b7b4b5a3a22ce8e141b65c8760ea
SHA1 befc427c54c236101c5d67b072a3822eb4644c3e
SHA512 c09d4eb47977667460b7716173b131208ce9cb0efe3b7743216c140a80567a7d7dc1a735304511e3548c0443ae2a9175559ccebde971b0eb40aa5f2f90d03410
SSDEEP 192:yONC61VWQmiUywfgGX5Obd+j6OuL+7/ap3BcU6:yONC6WBgGX5od+2OO+ercU6
TLSH
T19302F936A8286C77DEE2AE49F48737235FD5206BEA942F84D6EC1F1C019765C2346C36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 21c6b6b97868d0956eaf0fa9969c657a93daf7df647f26e96ef00128f1d5bf79
MD5 edfaa7b19727347634580aff8dd8c23d
SHA1 bb3d0c66108cb24cd392a14296361d88872d18e6
SHA512 79dcc70792328fd1cb5d66413abd7479db5625355f1c67bb8968d06ceca496fb506e2c9984602b4914220ff00eb6791374e71131cae782fd6868ed7e86d88cd4
SSDEEP 192:aONp61rWQmiUy0fbGX5Obd+j6OuL+usySJr8jJGqQU6:aONp6M/bGX5od+2OO+ustJrUkU6
TLSH
T104121B326468AC275DE2A555F48732539FE95067DB857FC4C1DC2F1C01EB69C234AC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 86e4e20bd41a9f619683e701fc709cd68ee305a9094a3e10bcecbdc7d20ed1e8
MD5 68d90d2545d6572d7cda37e1354dc72c
SHA1 7cc5f9bccf4cdce8b6e6bc1d19aeb5983bd9112d
SHA512 de8fde56a8ab78f19b7b02f8018a73ff3d7c66d87fe9e7fe8dcf8dfc6c25dfd342274a1ab8d7c616622d11b2795a83d8b2a5d3ad5edaf1c316ca9b32a13027f9
SSDEEP 384:/tNn/s3n9ScsNoEnCK6nzX5od+2OO+ustJrLkOObjI9G6w7x:/j+9XAWbOTOOnWhLk29Mx
TLSH
T12B928D3268285D375DE39265F44B3A579FF881BF97842E88D1EC6F0C02EB6AC1316916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 4607699f3fc3ee179b6f4c1397cb7eb57f400a4390ff4ab68a19f562125088e1
MD5 56a12bda20205a6d7888908364372449
SHA1 0202f849e89a16caa7d21aa631295abc2c5afdee
SHA512 93da2f2b4b294b4a74dfd9273d925090923a95a880fa21fcabcf5c9af36c5bb6a15829ed92b62cc99179e0f4b1a12d5c5955eb126398730fe2c17d684b2bf0a3
SSDEEP 384:VtNn/s3n9ScsNo9nCK6nzX5od+2OO+ustJrLkOObjI9G6w7x:Vj+9XFWbOTOOnWhLk29Mx
TLSH
T1C4928D3268289D375DE39265F44B3A579FF8807F97842E88D1EC5F0C02EB6AC1316916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 611799fea22101315c4ef19761110ffa6facbdadc52660ab318245fd6341a60b
MD5 fe3f7a5c6430279d60eb665d7ef49079
SHA1 d27b9edd19a247059a91c167bc5777b57a4fc6c7
SHA512 10a30386d665f9addadef567bcd6aa8850b0587da04b951565a380ebcf068f4b0f5453c4ada721710a5266b605b3cd30c4f1ab33d654b9fdac3fdd28e92d680d
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 0e2bd7e6c192ca5938b84fba90c6a5c6b3faea595ead4f9ef20d0a5f6daac111
MD5 cda82672f202d0ad7f4e046c76b478b3
SHA1 6c1f56f668f36857a709c16e45f2c84a47c87e08
SHA512 aa5fbd104e6faa5e071f216bd4d5070e7733f50f24befe7535894c2bd55f2efecfc3686fe52842241c0949ca35d4d60e6c4f6f146118aad4197e527a8609ee82
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe594898.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe594898.TMP
Size 392B
SHA256 b14f35c5ef542b58d03300b3ad3870b847d2b24166a36a7838eaff85ff590383
MD5 5d2380cdfb544eb7144493de17894611
SHA1 1ef7ecfd5cde71d063e05e7c21b941ae449c6280
SHA512 63ee6497fa6bb743c1e73db5dfabde2fff36822bc0ed0365ab5065cda8434b698ca8d44a8af702748a323b6dcdf709237a4e1cd7957d5bb371f2fd268b5e4dc3
MD5 SHA1 SHA512

Submit Download

5d8e41af-9014-49d2-98d4-17c2b08358b9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\5d8e41af-9014-49d2-98d4-17c2b08358b9.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 176e60771bfbafa8834695b1e950309980a95a92f759361d610254364d84b812
MD5 0a605738eed4fee73fddf769a2eb76e0
SHA1 3aececc5c6bc80bbcb041ca783eef0380ba96de2
SHA512 c39d1bad14f4a3376716f4c4075f77d8ba99270874bc63fb93d9e3fb7bb5d35afed9bdcb422bdbc7f06faeff1d57d8270659d34bd049b915c09539d1c27958e6
TLSH
T1D1411C5C66EA1149B3B36F4A9BF6A46D887BB9632F0AD45E10110E4F0A77B40CCB1737
MD5 SHA1 SHA512 TLSH

Submit Download

redninja.png

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4448_1814060788\CRX_INSTALL\img\redninja.png
Size 20KB
SHA256 811b278fdad96a5fa3f7b746f3b40d62d3b0b871d9bb46b3fb5a25abeed00512
MD5 36d03c40812da69653e8432a7b4d1e05
SHA1 ce36491636866bad1f030e94ed91494a6398791c
SHA512 aab18dacde5b21e51f9bb8829936c6e2874e57472ec5de1956b87072e2796f672a8a08d17d9989a69817e1f8626b0f1487c8b9de2c17c806740917c4fd04f267
SSDEEP 384:LkI3awbezbTVsC2Rl/hpfBSjeppXtx2jRqv8H02I6YD9O6tW:LkI3pbeb27/hXp12jyOs6YPW
TLSH
T16FA2E1B482CE156819063F4AA6805D5C906BDF35E77883D4ACA12CA0E5DFE86D362F01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ppfadpgpccljindldolejmgkhgaficka_62797.crx

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4448_1814060788\ppfadpgpccljindldolejmgkhgaficka_62797.crx
Size 1.8MB
SHA256 d4e964b29f79300900eef177f99613df6a210bac77968d3c5f2d8800faf1585b
MD5 a476a9630935ea9c5129b1c6b56594e0
SHA1 524e6ff526d273c70f6a5b4ea17696fabdf5e553
SHA512 320e29aad569f4fc24d35f6c4f65e6b43a03ad9ecb27b1b509046f7df7e2ebd16e0f7b53442f09ab8a434f77f3833e4ddcd255d276883a7a289fb9503215aa23
SSDEEP 49152:nrAnEDtxbr4itC0g2ut+PRo/2q0ar4Mm6voDlBZ:nrFDre2uUGOcS6YlBZ
TLSH
T1D49533AC014FE6F1F85F72F2DD4B2709065CAB5EA195874729CB2C7E223017A53A325B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download