87c0184b2efb03cf46b291156f8751a5a25d3607b4490dfd790cac861b9ce943

Analysis

user interaction
yes
max time kernel
113s
max time network
117s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 12:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
XMRobloxHacks.html
Size 236KB
Sample260731-pjlr1asfle
SHA256 87c0184b2efb03cf46b291156f8751a5a25d3607b4490dfd790cac861b9ce943
MD5 5865c09415724c94fb17092bb66f2305
SHA1 2a8b102e9c6e5066ad5648a38b1422f2b5e1c053
SHA512 a79709449b0ac1a44287f8db2398f724c7f3ede42d256563f4ee1ec743cf2bfe5a64d6159995c78a10eef907829a25ef170e2b66e8810c941b91b91738dfe281
SSDEEP 6144:dmUIDciNpAe9pI5Te0xqdtlAjr0+2m7jyxWQ8CbvXgmdMeJ5PTQYbeHxHA7op9hs:0UIDciNpAe9pI5Te0xqdtlAjr0+2m7jc
TLSH
T14E34A470B078A23D016F268AF2B09714D7ABA35BE64955E5B53FC2F847C3C94FA93058
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4952	msedge.exe
3184	msedge.exe
2336	chrome.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 11 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134299741078155453"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{98B671C1-A31D-4AE5-B028-9F37C2D4CF9C}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{9A76A899-C412-45BD-A041-C5DA7504F07C}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{4F5BCCD0-F336-4F85-AFC3-1CE2476B5E4F}	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2760	chrome.exe
2760	chrome.exe
2076	msedge.exe
2076	msedge.exe
2760	chrome.exe
2760	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 23 IoCs

pid	Process
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2760	chrome.exe
Token: SeCreatePagefilePrivilege	2760	chrome.exe
Token: SeShutdownPrivilege	2760	chrome.exe
Token: SeCreatePagefilePrivilege	2760	chrome.exe
Token: SeShutdownPrivilege	2760	chrome.exe
Token: SeCreatePagefilePrivilege	2760	chrome.exe
Token: SeShutdownPrivilege	2760	chrome.exe
Token: SeCreatePagefilePrivilege	2760	chrome.exe
Token: SeShutdownPrivilege	2760	chrome.exe
Token: SeCreatePagefilePrivilege	2760	chrome.exe
Token: SeShutdownPrivilege	2760	chrome.exe
Token: SeCreatePagefilePrivilege	2760	chrome.exe
Token: SeShutdownPrivilege	2760	chrome.exe
Token: SeCreatePagefilePrivilege	2760	chrome.exe
Token: SeShutdownPrivilege	2760	chrome.exe
Token: SeCreatePagefilePrivilege	2760	chrome.exe
Token: SeShutdownPrivilege	2760	chrome.exe
Token: SeCreatePagefilePrivilege	2760	chrome.exe
Token: SeShutdownPrivilege	2760	chrome.exe
Token: SeCreatePagefilePrivilege	2760	chrome.exe
Token: SeShutdownPrivilege	2760	chrome.exe
Token: SeCreatePagefilePrivilege	2760	chrome.exe
Token: SeShutdownPrivilege	2760	chrome.exe
Token: SeCreatePagefilePrivilege	2760	chrome.exe
Token: SeShutdownPrivilege	2760	chrome.exe
Token: SeCreatePagefilePrivilege	2760	chrome.exe
Token: SeShutdownPrivilege	2760	chrome.exe
Token: SeCreatePagefilePrivilege	2760	chrome.exe
Token: SeShutdownPrivilege	2760	chrome.exe
Token: SeCreatePagefilePrivilege	2760	chrome.exe
Token: SeShutdownPrivilege	2760	chrome.exe
Token: SeCreatePagefilePrivilege	2760	chrome.exe
Token: SeShutdownPrivilege	2760	chrome.exe
Token: SeCreatePagefilePrivilege	2760	chrome.exe
Token: SeShutdownPrivilege	2760	chrome.exe
Token: SeCreatePagefilePrivilege	2760	chrome.exe
Token: SeShutdownPrivilege	2760	chrome.exe
Token: SeCreatePagefilePrivilege	2760	chrome.exe
Token: SeShutdownPrivilege	2760	chrome.exe
Token: SeCreatePagefilePrivilege	2760	chrome.exe
Token: SeShutdownPrivilege	2760	chrome.exe
Token: SeCreatePagefilePrivilege	2760	chrome.exe
Token: SeShutdownPrivilege	2760	chrome.exe
Token: SeCreatePagefilePrivilege	2760	chrome.exe
Token: SeShutdownPrivilege	2760	chrome.exe
Token: SeCreatePagefilePrivilege	2760	chrome.exe
Token: SeShutdownPrivilege	2760	chrome.exe
Token: SeCreatePagefilePrivilege	2760	chrome.exe
Token: SeShutdownPrivilege	2760	chrome.exe
Token: SeCreatePagefilePrivilege	2760	chrome.exe
Token: SeShutdownPrivilege	2760	chrome.exe
Token: SeCreatePagefilePrivilege	2760	chrome.exe
Token: SeShutdownPrivilege	2760	chrome.exe
Token: SeCreatePagefilePrivilege	2760	chrome.exe
Token: SeShutdownPrivilege	2760	chrome.exe
Token: SeCreatePagefilePrivilege	2760	chrome.exe
Token: SeShutdownPrivilege	2760	chrome.exe
Token: SeCreatePagefilePrivilege	2760	chrome.exe
Token: SeShutdownPrivilege	2760	chrome.exe
Token: SeCreatePagefilePrivilege	2760	chrome.exe
Token: SeShutdownPrivilege	2760	chrome.exe
Token: SeCreatePagefilePrivilege	2760	chrome.exe
Token: SeShutdownPrivilege	2760	chrome.exe
Token: SeCreatePagefilePrivilege	2760	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
5672	msedge.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5672 wrote to memory of 4956	5672	msedge.exe	89
PID 5672 wrote to memory of 4952	5672	msedge.exe	90
PID 5672 wrote to memory of 5680	5672	msedge.exe	91
PID 5672 wrote to memory of 5680	5672	msedge.exe	91
PID 5672 wrote to memory of 5680	5672	msedge.exe	91
PID 5672 wrote to memory of 1480	5672	msedge.exe	93
PID 5672 wrote to memory of 1480	5672	msedge.exe	93
PID 5672 wrote to memory of 5584	5672	msedge.exe	94
PID 5672 wrote to memory of 5528	5672	msedge.exe	95
PID 5672 wrote to memory of 5584	5672	msedge.exe	94
PID 5672 wrote to memory of 5584	5672	msedge.exe	94
PID 5672 wrote to memory of 5528	5672	msedge.exe	95
PID 5672 wrote to memory of 5528	5672	msedge.exe	95
PID 5672 wrote to memory of 5760	5672	msedge.exe	96
PID 5672 wrote to memory of 5760	5672	msedge.exe	96
PID 5672 wrote to memory of 5760	5672	msedge.exe	96
PID 5672 wrote to memory of 1568	5672	msedge.exe	97
PID 5672 wrote to memory of 1568	5672	msedge.exe	97
PID 5672 wrote to memory of 1568	5672	msedge.exe	97
PID 5672 wrote to memory of 5916	5672	msedge.exe	99
PID 5672 wrote to memory of 4900	5672	msedge.exe	100
PID 5672 wrote to memory of 5916	5672	msedge.exe	99
PID 5672 wrote to memory of 4900	5672	msedge.exe	100
PID 5672 wrote to memory of 2072	5672	msedge.exe	102
PID 5672 wrote to memory of 5176	5672	msedge.exe	106
PID 5672 wrote to memory of 4804	5672	msedge.exe	107
PID 5672 wrote to memory of 4328	5672	msedge.exe	108
PID 5672 wrote to memory of 2900	5672	msedge.exe	109
PID 5672 wrote to memory of 2900	5672	msedge.exe	109
PID 5672 wrote to memory of 2900	5672	msedge.exe	109
PID 5672 wrote to memory of 4688	5672	msedge.exe	110
PID 5672 wrote to memory of 4688	5672	msedge.exe	110
PID 5672 wrote to memory of 4688	5672	msedge.exe	110
PID 5672 wrote to memory of 2756	5672	msedge.exe	111
PID 5672 wrote to memory of 2756	5672	msedge.exe	111
PID 5672 wrote to memory of 2756	5672	msedge.exe	111
PID 5672 wrote to memory of 2076	5672	msedge.exe	112
PID 2076 wrote to memory of 2676	2076	msedge.exe	113
PID 2076 wrote to memory of 3184	2076	msedge.exe	115
PID 2076 wrote to memory of 3432	2076	msedge.exe	117
PID 2076 wrote to memory of 3432	2076	msedge.exe	117
PID 2076 wrote to memory of 1536	2076	msedge.exe	116
PID 2076 wrote to memory of 1536	2076	msedge.exe	116
PID 2076 wrote to memory of 1536	2076	msedge.exe	116
PID 2076 wrote to memory of 3376	2076	msedge.exe	119
PID 2076 wrote to memory of 3492	2076	msedge.exe	120
PID 2076 wrote to memory of 3492	2076	msedge.exe	120
PID 2076 wrote to memory of 2044	2076	msedge.exe	121
PID 2076 wrote to memory of 2044	2076	msedge.exe	121
PID 2076 wrote to memory of 2968	2076	msedge.exe	122
PID 2076 wrote to memory of 2968	2076	msedge.exe	122
PID 2076 wrote to memory of 1292	2076	msedge.exe	123
PID 2076 wrote to memory of 1292	2076	msedge.exe	123
PID 2076 wrote to memory of 1972	2076	msedge.exe	124
PID 2076 wrote to memory of 1972	2076	msedge.exe	124
PID 2076 wrote to memory of 1588	2076	msedge.exe	146
PID 2076 wrote to memory of 1588	2076	msedge.exe	146
PID 2076 wrote to memory of 2944	2076	msedge.exe	126
PID 2076 wrote to memory of 2944	2076	msedge.exe	126
PID 2760 wrote to memory of 3876	2760	chrome.exe	129
PID 2760 wrote to memory of 2336	2760	chrome.exe	130
PID 2760 wrote to memory of 6040	2760	chrome.exe	131
PID 2760 wrote to memory of 6040	2760	chrome.exe	131
PID 2760 wrote to memory of 5032	2760	chrome.exe	133

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\XMRobloxHacks.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x264,0x268,0x26c,0x260,0x2cc,0x7ffe8c0ec188,0x7ffe8c0ec194,0x7ffe8c0ec1a0
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1784,i,12042591154024073378,15944610554489204855,524288 --field-trial-handle=2200,i,226717514995337651,4472005483765640210,262144 --variations-seed-version --mojo-platform-channel-handle=2492 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1552,i,1576359441701061986,16833384073807460483,262144 --field-trial-handle=2200,i,226717514995337651,4472005483765640210,262144 --variations-seed-version --mojo-platform-channel-handle=2196 /prefetch:2
  2⤵
  PID:5680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2436,i,6165081314242960312,14724850416388820608,524288 --field-trial-handle=2200,i,226717514995337651,4472005483765640210,262144 --variations-seed-version --mojo-platform-channel-handle=2564 /prefetch:13
  2⤵
  PID:1480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3552,i,10156757967454944085,17876193109667730166,2097152 --field-trial-handle=2200,i,226717514995337651,4472005483765640210,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
  2⤵
  PID:5584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3560,i,5452398656300279392,7699208465953368889,2097152 --field-trial-handle=2200,i,226717514995337651,4472005483765640210,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
  2⤵
  PID:5528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4312,i,7540692584706453329,4873923322451918706,2097152 --field-trial-handle=2200,i,226717514995337651,4472005483765640210,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:1
  2⤵
  PID:5760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4328,i,12193063374675210822,4509667984095746009,2097152 --field-trial-handle=2200,i,226717514995337651,4472005483765640210,262144 --variations-seed-version --mojo-platform-channel-handle=4956 /prefetch:9
  2⤵
  PID:1568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4320,i,16886580318979405312,5509255357943798578,524288 --field-trial-handle=2200,i,226717514995337651,4472005483765640210,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:14
  2⤵
  PID:5916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3600,i,7669060810533315929,13226875955562220487,524288 --field-trial-handle=2200,i,226717514995337651,4472005483765640210,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:14
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6100,i,6626341792965327120,10290955661940682086,524288 --field-trial-handle=2200,i,226717514995337651,4472005483765640210,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:14
  2⤵
  PID:5756
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6100,i,6626341792965327120,10290955661940682086,524288 --field-trial-handle=2200,i,226717514995337651,4472005483765640210,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:14
  2⤵
  PID:2072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5052,i,5538549998631085004,10356366587967606303,524288 --field-trial-handle=2200,i,226717514995337651,4472005483765640210,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:14
  2⤵
  PID:5176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4328,i,13584669662850947612,16777966855553358417,524288 --field-trial-handle=2200,i,226717514995337651,4472005483765640210,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:14
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5352,i,3816196272477514718,8084719195611535734,524288 --field-trial-handle=2200,i,226717514995337651,4472005483765640210,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:14
  2⤵
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5352,i,4161950624595999010,11860305003962028551,2097152 --field-trial-handle=2200,i,226717514995337651,4472005483765640210,262144 --variations-seed-version --mojo-platform-channel-handle=2872 /prefetch:1
  2⤵
  PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3736,i,14717665403615091831,5219054703245528136,2097152 --field-trial-handle=2200,i,226717514995337651,4472005483765640210,262144 --variations-seed-version --mojo-platform-channel-handle=3768 /prefetch:1
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5000,i,15048910816610629842,136797818121138249,2097152 --field-trial-handle=2200,i,226717514995337651,4472005483765640210,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:1
  2⤵
  PID:2756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2c0,0x7ffe8c0ec188,0x7ffe8c0ec194,0x7ffe8c0ec1a0
    3⤵
    PID:2676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1808,i,14893128985861339478,9070036664082709751,524288 --field-trial-handle=2364,i,11916330819230017739,2592234871355222957,262144 --variations-seed-version --mojo-platform-channel-handle=2392 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1564,i,12076098405507724578,12944984950283517814,262144 --field-trial-handle=2364,i,11916330819230017739,2592234871355222957,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:2
    3⤵
    PID:1536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2456,i,1080622572963074270,1386184637281357950,524288 --field-trial-handle=2364,i,11916330819230017739,2592234871355222957,262144 --variations-seed-version --mojo-platform-channel-handle=2620 /prefetch:13
    3⤵
    PID:3432
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4432,i,10204085474758241178,13801451532758533560,524288 --field-trial-handle=2364,i,11916330819230017739,2592234871355222957,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:14
    3⤵
    PID:5380
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4432,i,10204085474758241178,13801451532758533560,524288 --field-trial-handle=2364,i,11916330819230017739,2592234871355222957,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:14
    3⤵
    PID:3376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4572,i,7415123336036224631,10179430151217010697,524288 --field-trial-handle=2364,i,11916330819230017739,2592234871355222957,262144 --variations-seed-version --mojo-platform-channel-handle=4568 /prefetch:14
    3⤵
    PID:3492
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4868,i,6998267477420366297,14397787326557157059,524288 --field-trial-handle=2364,i,11916330819230017739,2592234871355222957,262144 --variations-seed-version --mojo-platform-channel-handle=4880 /prefetch:14
    3⤵
    PID:2044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5000,i,5425838450110150356,10326828208131814369,524288 --field-trial-handle=2364,i,11916330819230017739,2592234871355222957,262144 --variations-seed-version --mojo-platform-channel-handle=4992 /prefetch:14
    3⤵
    PID:2968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,11644051706550490776,13501449735097800981,524288 --field-trial-handle=2364,i,11916330819230017739,2592234871355222957,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:14
    3⤵
    PID:1292
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4896,i,5426115296112680720,5854542448495704209,524288 --field-trial-handle=2364,i,11916330819230017739,2592234871355222957,262144 --variations-seed-version --mojo-platform-channel-handle=4876 /prefetch:14
    3⤵
    PID:1972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5020,i,17258598761993891892,12826227325925062596,524288 --field-trial-handle=2364,i,11916330819230017739,2592234871355222957,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:14
    3⤵
    PID:1588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4948,i,8808124826822075845,8498925819733132958,524288 --field-trial-handle=2364,i,11916330819230017739,2592234871355222957,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:14
    3⤵
    PID:2944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5056,i,195393855433759318,3794888076271675051,524288 --field-trial-handle=2364,i,11916330819230017739,2592234871355222957,262144 --variations-seed-version --mojo-platform-channel-handle=4596 /prefetch:14
    3⤵
    PID:6036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5068,i,3175142350747646008,18161880094144488617,524288 --field-trial-handle=2364,i,11916330819230017739,2592234871355222957,262144 --variations-seed-version --mojo-platform-channel-handle=600 /prefetch:14
    3⤵
    PID:3148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5388,i,6387166355143999795,11897219607807693543,524288 --field-trial-handle=2364,i,11916330819230017739,2592234871355222957,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:14
    3⤵
    PID:5756

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4272

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2336

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5900

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1968

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffe8e37c728,0x7ffe8e37c734,0x7ffe8e37c740
  2⤵
  PID:3876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1432,i,6672694397497937240,2475303381093959458,524288 --field-trial-handle=1948,i,14100339016588170655,1361963196122012843,262144 --variations-seed-version --mojo-platform-channel-handle=2028 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1672,i,5717238746762901242,14163844304905476697,262144 --field-trial-handle=1948,i,14100339016588170655,1361963196122012843,262144 --variations-seed-version --mojo-platform-channel-handle=1944 /prefetch:2
  2⤵
  PID:6040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2336,i,2813755289333262462,9452250099558053264,524288 --field-trial-handle=1948,i,14100339016588170655,1361963196122012843,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:13
  2⤵
  PID:5032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3244,i,16192648629170908459,2922196825487308411,2097152 --field-trial-handle=1948,i,14100339016588170655,1361963196122012843,262144 --variations-seed-version --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:1480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3324,i,3302744793559544646,8874583332108690124,2097152 --field-trial-handle=1948,i,14100339016588170655,1361963196122012843,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:4008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4692,i,4090102587550388881,3520499636948500657,524288 --field-trial-handle=1948,i,14100339016588170655,1361963196122012843,262144 --variations-seed-version --mojo-platform-channel-handle=4704 /prefetch:14
  2⤵
  PID:2272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4748,i,14918986638005378382,61718262593135316,2097152 --field-trial-handle=1948,i,14100339016588170655,1361963196122012843,262144 --variations-seed-version --mojo-platform-channel-handle=4876 /prefetch:1
  2⤵
  PID:5740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5396,i,10122376562696265246,5739307435939013161,524288 --field-trial-handle=1948,i,14100339016588170655,1361963196122012843,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:14
  2⤵
  PID:5016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5488,i,4529072107182279121,4319646248255579794,2097152 --field-trial-handle=1948,i,14100339016588170655,1361963196122012843,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:1
  2⤵
  PID:2404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5524,i,8379375247764679735,1756871557740082201,2097152 --field-trial-handle=1948,i,14100339016588170655,1361963196122012843,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:1
  2⤵
  PID:1128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5584,i,14856638930050130014,11290521123185934900,2097152 --field-trial-handle=1948,i,14100339016588170655,1361963196122012843,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:4988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5692,i,17543936156887909171,5434301517723142165,2097152 --field-trial-handle=1948,i,14100339016588170655,1361963196122012843,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:1
  2⤵
  PID:5888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6084,i,11572670073160660160,5761258093609036559,2097152 --field-trial-handle=1948,i,14100339016588170655,1361963196122012843,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:4620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5844,i,235215495482389343,1831933121879177527,2097152 --field-trial-handle=1948,i,14100339016588170655,1361963196122012843,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:1
  2⤵
  PID:2908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6184,i,3810343618142695019,14177334207957236133,2097152 --field-trial-handle=1948,i,14100339016588170655,1361963196122012843,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:1
  2⤵
  PID:1588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6460,i,11597621059931473663,13377724658781445530,524288 --field-trial-handle=1948,i,14100339016588170655,1361963196122012843,262144 --variations-seed-version --mojo-platform-channel-handle=6504 /prefetch:14
  2⤵
  PID:5500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6648,i,9627527017444461608,11550718648850967120,2097152 --field-trial-handle=1948,i,14100339016588170655,1361963196122012843,262144 --variations-seed-version --mojo-platform-channel-handle=6668 /prefetch:1
  2⤵
  PID:5772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5480,i,4680042732345188013,16502954060050820655,524288 --field-trial-handle=1948,i,14100339016588170655,1361963196122012843,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:14
  2⤵
  PID:5560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6760,i,4273367495911588895,2217721710608495117,524288 --field-trial-handle=1948,i,14100339016588170655,1361963196122012843,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:14
  2⤵
  PID:3712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6264,i,17363055187310149143,7975521097904200249,2097152 --field-trial-handle=1948,i,14100339016588170655,1361963196122012843,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:1
  2⤵
  PID:4620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6300,i,17547810463010868293,4088428139114762916,2097152 --field-trial-handle=1948,i,14100339016588170655,1361963196122012843,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:9
  2⤵
  PID:6112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6280,i,13151550633654528355,6454765107945484520,524288 --field-trial-handle=1948,i,14100339016588170655,1361963196122012843,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:14
  2⤵
  PID:5828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5752,i,5670268673724422066,1191999968265559165,524288 --field-trial-handle=1948,i,14100339016588170655,1361963196122012843,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:14
  2⤵
  PID:2732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5764,i,12095077760433318679,348173298903766438,524288 --field-trial-handle=1948,i,14100339016588170655,1361963196122012843,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:14
  2⤵
  PID:4824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=5764,i,17899616973207494120,16675571734491929670,2097152 --field-trial-handle=1948,i,14100339016588170655,1361963196122012843,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:1
  2⤵
  PID:5140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=3656,i,7183324364981188801,15850807846140053186,2097152 --field-trial-handle=1948,i,14100339016588170655,1361963196122012843,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:1
  2⤵
  PID:1564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=4760,i,9619050686087481464,5207609137644830096,524288 --field-trial-handle=1948,i,14100339016588170655,1361963196122012843,262144 --variations-seed-version --mojo-platform-channel-handle=3924 /prefetch:12
  2⤵
  PID:2524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3544,i,13024984044869952300,1199266577373253389,524288 --field-trial-handle=1948,i,14100339016588170655,1361963196122012843,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:14
  2⤵
  - Modifies registry class
  PID:5772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=5836,i,3037094794206773150,11234514942241681841,2097152 --field-trial-handle=1948,i,14100339016588170655,1361963196122012843,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
  2⤵
  PID:2212

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5580

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1208

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:1344

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 2c3478f0a456a025a7c920c1972dd0fbc02aeffe857e55958c51d752721dc411
MD5 2d9305cf60536e013b267543dfc8dbce
SHA1 bd9baf4045fffeb327f6a5dda81256a798ceac8c
SHA512 bfea959185f145ef8ced1a5fc4f2dc4948cea9f23d07fa894a7f83e21620d25bc3c01469c58e2c55a5edc1591c5837ea4a2de6d3f115410e82be7308664e85c7
SSDEEP 192:ORqQCfzmv7dAPRp2l98Hsb+WNnuc0Ze2HakwEcVyIsnAUge:ORqQ+zSsXauwh0M26k4e
TLSH
T1F932C56EBE54797B6CCAD22AF9213B47E3F5102271D42E84E7F88A6C15E75CC2227407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 dcd0246361690550818023998afbc41606ab2e96f92e48ad9c6132bca73193da
MD5 d1928fd92d5cbc86748895c9278b8190
SHA1 d921cd7aee589eb971ab85ef07593030bda11eac
SHA512 8847516726310eea4be12f485c382e2dec92a17e095d09dc523eb9dca7061c117a9391e2fbb1730f3fbb11901cd467e9c850e1c239c18a4089f3cda8aedf4dc2
SSDEEP 192:ORqcBhQCNamv7KAPRp2Gx198Hsb+WNnvls9D2ve2HakwIJcVyIsnAUgE:ORqmhQKaSXXPuwNu2m26oJ4E
TLSH
T1D342D66FF950797B6CCAD22AF9217B56E3F5102271D42E84E7F88A6C11E79CC2227407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 6a90fbe6c931215a6b6bb73c39815a8f9c7346bf0b71d60eed498d5935c8dfc0
MD5 2e888d996dba8b31cf56aae74f30ba3c
SHA1 6483739895e8f34ca4f57d045801dd3d5112c162
SHA512 478c778efc1788714c452c184b50431a44115361b6ecca6d68f186d66bf05c23efcb49ee2c3349b66435aa796e4e421ff8de17090709eacecbd900a4f00acc28
SSDEEP 192:ORqQCNamv7dAPRp2l98Hsb+WNn0qh+e2HakwIJcVyIsnAUgE:ORqQKaSsXauwJht26oJ4E
TLSH
T15C32B56EBA54797B6CCBD22AF9213B43E3F5102271D42E44E7F88A6C11E79CC2227407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 dcfd2c07238468a41f2659171d80536d8fdc01c73e39d13c8beabf9491d7197f
MD5 3a2288133018dc1d4faac7c25ece986c
SHA1 559ea3160261ef6f421614093079b08b03de9259
SHA512 4233287b3019dc2fa5a1be6c0bf82e699aff6917e5c6e02b5072aa625aa146e33761bdbb088a073005d4ffb24bfee2e12addcbdfd77482d419426923b5053459
SSDEEP 384:Majm97KxkXqKf/pUZNCgVLH2HfgslN1XODmd+ErU3kxHG8t2rYVgn:MKm97KxkXqKf/pUZNCgVLH2HfgsLROqi
TLSH
T19452E767688D9A7B0F88C98CDC166F8FACB6025762680D2856FB5D0803A57CB114A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 f1c8f866077a7dfa7f237b9663af3ca56ea89d20b5d0fdf0f53855ea1d11b384
MD5 226d30a45f65db5af0b8040122afef91
SHA1 e62493066f13e107dfecd22c5dff78d824134698
SHA512 3b71b9a7f7bd65b994a5d08747690e211dd6eb062116b89e8745ab53cdf769266ced48527de9b3000414a54c2d79a3777dfffc3e560bde61fc9aefddd587716e
TLSH
T150B0222E80000C83CB003FB002C000E033B80E0033C3C8CA00B00320C0BA2A28300B00
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 963dfdcfc593becbc0af9ec8c9a5cde1fe7f4b4dc43cafff8aa4c3c888541c9a
MD5 128580861a5489124bb281a0ee5e0d37
SHA1 eb5147a54e3373ddcb05e6a1a74e64ea06355172
SHA512 3efb60bce93313ff5e719703f18b7e416e28d6c1e2ae896e62ab3e9b8305e38f77aaf1d92805596936faaf1081ff1014ce4a2ca97a4d6d73087e8a960a8fb993
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 751066f5d5efb31ccd8ebf5eb3affd0f2f64d5357ee3aa2cdadbc7ccdaad783f
MD5 7ca79b26a8d79bd43ce30b50333415ef
SHA1 f179ee7a2063a746cb966bb36d2de5f8423e9d11
SHA512 4552a6dd422fdb8b47f2c719626e0bfff7371d233a4717435b3f058f25bce8c21a2e2f39c1ebbdc33f7242c5edac7e006b513406d4ad00b8031627dfd3650548
TLSH
T1BFA00218C5D00411DF1442B560A50A4177534D16F651532798952C458D6F3C2A115104
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 125KB
SHA256 2868bc6d2e8dd1fef24b8fd706c95a49e093793f7176dfca5e25d0cf62542bbd
MD5 2daac2bbd97494d81a94df3a4c49270f
SHA1 ab210279a3353ecb56d579eac42d86fd4e1c44ac
SHA512 c176b71e230300bbc083f9d48bf8b15fd70f5b0ea099630ea6bf889c6e78c5814e043358cf21af454699ac5fd5221ce6d69675ffb98c02d34f83fec711a6623d
SSDEEP 3072:cRyMTHfDL0Qs395M1FrbbNEzHj7AaHE7cWuK05W7i:cRtHfDL0L3IFrHNE37LHWuPX
TLSH
T112C312983DB0ACAEE658E612F111382F98D4F447A1CD5E784E9058894EDFBD9432BD0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 125KB
SHA256 a2e99ad79924be46c6c6966aebf6b4c1fd3a643d17f20daf504a8f860931b0b4
MD5 0a0328d6761a2e5f1e8249c36929c4aa
SHA1 c43af38233ace3c4b53ddacf1e8aa89a1609f942
SHA512 34980a3ce42d334dcacbff0aa9a7ce6ea433f33fb4ba44ec056498da7153a0571292a6eaf197803ff7a2186c8f6f122321d51ff3d55bf442360865c720031373
SSDEEP 3072:hRyMTHfDL0Qs395M1FrbbNEzHj7AaHE7cWuK05W7i:hRtHfDL0L3IFrHNE37LHWuPX
TLSH
T1E1C312983DB0ACAEE658E612F111382F98D4F447A1CD5E784E9058894EDFBD9432BD0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 419eedfa24a2e99631dfd95ba973a708cf92bbb092971c91e58cbd473ae31de7
MD5 532d96ffab77b9f3d3161a519102f47d
SHA1 139079cd0d95e70bc669e928f71b9cd6881bd550
SHA512 b94fec249540b861f8672c0a8f6b6ed3259f048f595793e4078d4194ba2c1dc070144e8e2eb69780113c41203f50d1431cc25c4bad236e41954a00cb9422ec19
SSDEEP 96:5KC0d+oJm4V0FH+pqf+HBKyoytsRDotok5AHDJB6eGyvkonYob1v4a:MC0HJm5FHuPgXDUDiPW8nYobZ
TLSH
T103A13BF2A8B94CB719B7D245F8823E83DEA4A227A991EF84D9DD1F0D01F71D81341927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 eb3a2def9f4b6035941af73f13d4e0d6dabd1a81fd366178ace6a15412f5055f
MD5 892727a92ed5bb3d076e7c015f303461
SHA1 c06b37f3dbf604ea389be640479af6199627117c
SHA512 dd21d3eda95d2290b95a2fdb5d449733dc51ea5a65837f18375653e4a597ae34477d17b2c2d4b6dbb5ab366f9996fd2e1597cc7b409afac363ac88a6a4624414
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7Q:fwUQC5VwBIiElEd2K57P7Q
TLSH
T1D6B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2b569abebbaaf26f699fc69b66ce0f336d08065af2ccdaaca5421accc53b1c38
MD5 15b32961d6a7ecf7cfd3ed499d358e3e
SHA1 589fb245bb41b29e13242bd8947dc01c5b630829
SHA512 3a094a8184c961e25b25654d47755c2deb772e3e1b40c8e2d156493c5e3abf0dc6eed344ee5135af14f7c22f3d3e81b8799bc96aef8baa0b1a851cef7f08b753
TLSH
T183D09734A536AA91E01A813504A0360021260133359BAB8321A0840C89B000092F6DE9
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f6967b295d14519f0b63dd57145c2a1f9245df5d3d661efe1079eb9376919dab
MD5 a043d59a7fc921e2e59f57e11234e508
SHA1 5d35df84af62d890d0bca7e5dd95abf82b5f8ff2
SHA512 47da01e48be3bb0e3658abbeeb5aeb8c4ae9d63f2bfa40f203f259f05ccb77d4ace4a4675c4d9d8a066bcd1a81c0502d745cd98126a08b591631016a175150e7
TLSH
T158D0A774B625A911D60BA1311480B66137634262799EFAA351B1501C59B015492EE4D9
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 fa87b7c791a1238b9509ccd076a58c61f6b4f494148be1a3876482d6cc1110d6
MD5 c0549c03ff16ae62626546ab089d743d
SHA1 f9828dbbfcfbbc33a6f1030c1f838466567448c0
SHA512 13c85c5163378bc6d924cc736bc0f557d88d2e3bb0ba5de519b2c9c087de1eee78da098de3b5fd400305ad8bca0af7aa8563fdbe87d5c1a39329b10b4d0e86b3
TLSH
T1AEE022EAC9A1AC2B09FE0799A4448706F710632A2B50550F3A3E910E8FF4636098AC6C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 b9846a438f81e752d2d219c1f2bc377e3889864b6da64c9bdb425b4001e1dcba
MD5 607bb669399bb7d9e0a3e8c957d7380e
SHA1 732200d82e645e7d93ca7528dbfec5d9db8f1096
SHA512 03db4cb872a5a3c65124c58fc8ad8dc3efd451a8927c4f7ce77d23767ad7b52e81731e6214abf9b4df4b1d9d97a0d30df05d12e1c2649b207a80f94f82b6dce4
SSDEEP 384:PMVDTTmf6rZd6pNoJ3a6+Brba8STKL5f9qPquIexl:EV06dd6zopa6+RjSTKV9mxIex
TLSH
T13D1380BEBA890E3DC1E2113E159B6AB263B2C064F0B05513577B3E14471AF4259EEF0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 8920efbae457e53e2bae3c9205f51885bbc907f5cb44cad08b62fddbe31732d0
MD5 ee7723abe07723fb4dbb6507b4242d52
SHA1 c19c7949e6c1985a363943db2510984e1d631b47
SHA512 52e55856a9327b586429e2be95d3c7e0b6d66e3f405b584d047ffe732a65558c345246fce46a6bb3cdd59953bb67b199244be45f5ee6eff82fff12e880ec967f
SSDEEP 1536:AHe15oHkL/kbL/1I2B3fB1NdwpXG8AGZxtYD+NO0FXkZNrB:D15lL/qL/r5N8mGFXUL
TLSH
T1AC4493F71861601ACF9816F6D7133A7E917B820DBCD1E9D9E1380CC57824E32A2F9E56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 a2bb26759ff1e8ec9fa51e94fec2fdcccb97f8bfd355a9e2430b440f2026fdac
MD5 29e9d8b5a40a95095575d97c5cfee194
SHA1 d1e5006960c0d0e73233a6846142ef9d7bb85cf7
SHA512 58e744b6c26c216c5df15029a41092cd20bf608091d7b6e70c62f40c7f657fadb668c53f85d85a8ffed2ed9dd7b86a3672382cfebd2135596c170f4c9c7799dc
SSDEEP 3072:0v9G+9/3MmVHp3gVpY706WlJzdDkBTdHediMNUtBz+Ot+cmKQVbqfact4:0QS3Mm/3gUiS5yNYi1cmEf1
TLSH
T145257BEEC7682C42CE6B877070E0E9077E712183BA5CD0D3A944C5E997D5B8176E82BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 8.0MB
SHA256 cf3a9f493abce7f545d7df951445b8b1758b1e41b863bf275c9e8976ee451343
MD5 290ca776b3b2258e23d3f30b4a4115de
SHA1 8fa655424416933279830b69e85f30bf82c1cf45
SHA512 e06cd4cb66b408844e7466c37ee4fa6c5e7829c9aed4bb375ba24ad3c08da8c5e7fb827308e34a7f4806f22d24a75ec90b479a62a02bb87a7594fe8614ed1700
SSDEEP 24576:/HgSszPa3dUjKxppGlAc7J8xr0lEdPZGDtemuaP4iUcDExfFmVN8fp+DEel4SZtv:/AUaexvGlAc7gzgkdg96Uv1
TLSH
T1B8869EDED67458C2CE928930B1E0FD973D7013E3B9A4C4D284A8C598469B7C6BB9E11F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 48dc7ed42117605e234ed1b706aaf08459146300de960703ce8d01c0e6dc25ef
MD5 e496f9c08adfaa0f55dae22263330a78
SHA1 ed6696b122c2d4ff5c8eddc8b1e14d21a342c059
SHA512 902c3ad82fd38fbe067895c0bb295026cf956871356a38d94e2a528619fe4052ec31636c33861be61cfc14358bdab6bab16f2cac1b794ef573993e76ed84f508
TLSH
T1D2519EB807B129F2CBA446765AD1E60A32F8889504B3DE5B40401DB55F07FAD17D2FAB
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59bced.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59bced.TMP
Size 2KB
SHA256 81d38356378cbc99c402c1f4eea1f53c238ba339c1de7d38219c650090289e5f
MD5 f19416b17ee0f5cbb3069ff79565ee75
SHA1 650b2803c4bebb2ca23dd6ffcfd976686db03eb1
SHA512 35bce156c001a27378cd397d4631c8ca3067e737d2659503c3cdf7cdb9cc1ac8ff72f4fb01e3d75b9772453e08274fa6212cc3d5fa8b47ee399e37bf77a5182c
TLSH
T15151A0B807B129F2CBA446755AD1E60A32F8889900B7DE5B40401DF55F07F6D17D2FAB
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 4ded85ed056032e6d4176cd13124718b706c51aff1bdfc5fc6e6508ea405162b
MD5 341ccdccdd0274cbacee1a272db43c65
SHA1 94fe312d6ead519b6c5f47adc8ed4567717955d3
SHA512 6e8f5d1c766d39147a2f70c3f711451c6aacf2f6fe585f9ba170e176115fb9f5b3af6838753494272d5cb11b7a44310e174e265eeff0b1f10d4fd8357b730a1b
SSDEEP 3:MsEllllkEthXllkl2zEkl/+Kll:/M/xT02znl
TLSH
T1624404147FC0440DD5001030C013C3703370DD11151157D335D30C13FDC55450C40000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 346B
SHA256 405f4c639d19a94cf0a9d26a38b1b02d14a5c56b9c302f7771ca54c49e3c5e61
MD5 ed5cd110c9c1962d4528705ec80dd249
SHA1 1b0d6c058a493e200ceac1f87cf29b7e656dc387
SHA512 04830724230027cc2d6a3b00d152407cd1e7a534af8259981509c2da186e24b57985bb1500dbfd41b88161bd0d7307e6f52bde5ca2b5f38a27bf60ccde2fa003
TLSH
T1B9E0D8D965CBC65D55507CC69174A74C81C8344AE6D56DC76B0888D07643001B7899DA
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 342B
SHA256 39dfdec86949f152a1471442545245ac5f3372b56428a6f61dffac0a3ec159e7
MD5 829a3c6987490c82e6ba954662c1d61b
SHA1 3799630075c4e24b21e810bb5896dd5ecb96c9b5
SHA512 0fe38650c2f79854b11bb4f6564fa45639e74cf8e644f7913c55cc92ee0ebe58c20307360aa83432e6521c046c39ccf2d2e1098695cae563817d0f4af593e30a
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 322B
SHA256 62394bf6eee5309af4d50af52e7b9a47d63ba0719be1822df2fcb36c94707aea
MD5 53c264a8759231922dc4ea0abc8ec796
SHA1 e0dd837f3bf40e83bb7b5466b6bd7bc9d8b41759
SHA512 437b96faa241e25bbb5e9cb8a1528c1ce8b1f27034070016a1493082709f645f88490c13c126c66337672c2ae39b48b95f4c1e5c97af54aa882b2519976a7177
TLSH
T106E0785918DDC3395C54A4D7536D574887F57847F2D43D873F088841710134273CD14C
MD5 SHA1 SHA512 TLSH

Submit Download

ExtensionActivityEdge

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ExtensionActivityEdge
Size 32KB
SHA256 475f12864892aa7b74be2630191c6d8f0223c403e99ba88c526ed36a19ab91bd
MD5 eec0746e532e1aa3315a9bcbaaec4a2e
SHA1 b3092a8c10c8f3ae716f6e3bc8beec6eccc0e4d4
SHA512 dbb680492930aaf08078604ab14d0d1e63853a735d0a896644c8eb4d4ed380aa94f0cc9f573a04a7abc1c06fa1ad335a082b07b9242e5b463f1c06605f0a2bbf
SSDEEP 24:TLlWK3iOvwxwwweePKmJIOAdQBVA/kjo/TJZwJ9OV3WOT/uReQQ:TWm+/9ZW943WOT/
TLSH
T156E24B2A5E7C7121CD667136AC2194665CB910DA977336F23EE000796F8228BC535CEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 24KB
SHA256 9aac5b1cf3b18f1783450625d6216bfbbe5aa4cd04030ae0fa683d39647734ba
MD5 70b6c14c8903e0b44dbb84f978172d34
SHA1 38d3682f200452eb7f5c2223258e3a34b07ec00b
SHA512 40c9a7e50eb04ed36265f51563e7a12429e5748f86939be7ca5b40ae1402daaa34f9e4da33cf03c81bb67743d967c4a7c089a8310aae0d3750e2408e8044b57d
SSDEEP 96:UBCx094yTnFOJsUYlTCFad2bybsq1pW4EM0j:GaZyLFtUoTCEIIhEM0j
TLSH
T133B218979E313007C7040E3F25596DB68D3BE16CEFE1ED4170344426A8B889A9070AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 224KB
SHA256 c6d3fcbac0b1c81de593f992ffd81a485e703964bd2223de45aacd72d7f3b283
MD5 049c4883dd8b37266abc66b191026520
SHA1 b751ff1e814d7ffe8606be37f4da00faf8901f7b
SHA512 8f8ee8b4edb8a93a139bdcd25e93ec718a8c53af91c19bb8a42a0de8d91c25a266f9fe29cb857148fb5551bf2cebdcbc143c879be90fa5d35ece0e65107d9e31
SSDEEP 192:rMbfu6RBH+bF+UI3iWGVoWN3qL/4VVV63:rMrHBIkUI3ijVoWN3qL/4A
TLSH
T1E224204E5F352712CDBD813668E744A35CBDF03F871366DA786118B4CEE2652A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 bdc23487edf921cb81524413034401e37f41f47c8bef1bc4b2d1e817993b61c6
MD5 62be830f3cdf0d7a53a527a7a10a0570
SHA1 1fbaabf6dfc65494733dd5f248128ec0822e87f2
SHA512 41b6a27cb9a87385c6ffc504a9ca3280d768fe0f7d7a406d894cf867b8a095d8ba39230014159edab95e68fe409e347c1e8c5fc1fc3b6aa02b18dee57f4137e8
TLSH
T1F7E0D8A944DEC61952C4A4875218774CC7A5350BE6C82A861F08A895B901444B38E1C6
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 24KB
SHA256 893626a04daf0710118410d61b604fafa26347ce4e766b5ceb2f5ae80e4263c5
MD5 8a034751b5a25f15f82b69e659eec0cb
SHA1 17cc51dd31b41d4b883e4b8efd5b03ce4fd67ea8
SHA512 c73748e51693c22aab2398818dd3104d0fe4bbc8861ea0dab81fbc703caeba52481671b35f0404b9e2f246d5ec69527522212b88709c3f06be9da5dd39acc2c1
SSDEEP 48:Txk/LopFMaty423w/a9NUuTjAw7ofwy2G7rA:qDeMatha9RADf1U
TLSH
T1ADB2204D5F347151D1F44B36EDD0886A2F7C111C83A326599E2860F28DA266BFA1606A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 723e478dfffa73460ca66a42295aed711f91488b382333ac87f6132df9ac91fe
MD5 459763ef6cbdbd2afedf6d7f9978e19e
SHA1 96c0fc0baf19b8afb07803d93314b78c3dcc16bd
SHA512 b656036cd50486fc7b87121990fa4f00de96bbe76b94b4900a89bed76a209b2f550d92e606f35cbfd77bdaa12205824a2187f15b5e9344e8203824773e1c9d9a
TLSH
T11351DEF7C3E88A3D890156F0AB147E2BCE2D0915832C3D1A88E4AF1BA7F2471D14169F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 524B
SHA256 9e95a8ed68d6ae27f91713d1a64844b0e9ce3e7cecc0429159d428cbe9427b10
MD5 9fc2190f5b213d1e6c2f6e4858f4d02b
SHA1 d691332a44ff541c58fb987effdc1962c81d9640
SHA512 cfbaa5eb56b637f7ac0d7bea9c8b372ddfb4bd7e2372999a4dfb6ebd8b242ecec02f33f1e90803e7069d6ff9be919770064808d431335f2cadfc0fe6cea32bd8
TLSH
T1F1F0E09B457AB46B507444BB2D44B4056675B432016264F1FB91867CF0D14FB5F11539
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 1071746bc219ca2748d42730cb93c8a46ea5780a2c081c458a9c7ee140b33daf
MD5 9c09d49662bfe686314d0c7268798754
SHA1 3505fa1907401fd8946a6d011bf17fd6b5871528
SHA512 36242fdb83de87ddc03704bba64e93a7e023520ade7bded55373bb58d978e37a2fecbd4ae32e1548b7048f47ec37a196abfabdfabe1f050b797749999dc8493a
SSDEEP 192:sxR2RVbF/ftse4TDde5lS9zoD8p4y/g6+WNIYCyuOlGpIgDHJ:sxR2fF/ftse4Tc5luX/5IQSN
TLSH
T1DF32B756AE68993B4CC7E20DBB55BF53E2F95032A1D01E48A7FCD60C15EA7DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 c72345101f0f5f1687efff95e307a12cd83256d8192572eb16cb54aea3b471da
MD5 f9193e154398e901d849f8a95fc2d045
SHA1 bef2e7090bbe72aedf97c5c575376d4645b14f69
SHA512 002da0f8c84ecd6290f8de5341a1dcd9e0b46781b812e73397b1d424c39670659afa438c2460f79b6fef7c48126fc3a638d4be5417486507b7fdc92913dfe105
SSDEEP 192:sxRBRVbF/fts+4TDde5lS9zoD8p4y/g6+WNIYCyuOlGpIgIJ:sxRBfF/fts+4Tc5luX/5IQSs
TLSH
T1E832B6566E68993B8CC7E20DBB55BF53E2F95032A1D01E48B7FCD60C15EA6DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 2403ee37fbce4edc8aa43801cd85d3335bdf88b1747b7d2e01f29531939c3d64
MD5 0605c401675e16a8c45d71d6dc318dc3
SHA1 4b7543d8549d1693ff60180887d7d3c7016dfc84
SHA512 f54a592592fb6781cbbbff2b1a4045113f78dfa66ccfaf42a9d0e0e230ee1482f67a8cf3f464cbf190ee194002e2511f41d67fd39b5707d3b09e45ddf0fccbee
SSDEEP 192:sxR2RCbF/ftsAWpVQ9TDde5lSEzoD8p43/g6+WNIYGluOhgpIgDZJ:sxR2SF/ftsAWvQ9Tc5l7W/5Ip4X
TLSH
T15042C756A968993B9CC7E20DBB557F63E2F91032A1912E08A7FCC60C01EB7DD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 ff796538b64ed889f196296eaca638885ddd92b2d2703a06001af49ce19b7577
MD5 b84fd9a44100196f387d79a8042f79fb
SHA1 955f0d88d7ab1299039c234725c0ec458fdb4e1c
SHA512 0cedb0a5c6a77d9a32c94032b1cf5e58597a75ffdabd1af42ec705e218499760e0870a2f4e75571c47f135ff864cd1ccd36e64037f129eb5769938c15ba4ee69
SSDEEP 192:sxR2RCbF/ftspWpVC9TbZc5KzoD8p43/g6+WNIYGluOEGpIgDwJ:sxR2SF/ftspWvC9TV/W/5IpVQ
TLSH
T15F42B716A9689D3B9CC7E21DFB557F53E2F91032A1911E48A6FCC61C01EB7DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 7cbd60235a663c5efad0091d9563a0e9d27dd58fedc792c958513c1ec83bb5b4
MD5 3d4592fb620e261811abe9586c6c71bf
SHA1 c744c6e80f6e952b39787e460f4d9ac039ece860
SHA512 22bcba5c85f7349ca50fa6305ed4e67c998a1a3017c2983fcf1dcf86255b22a2e8a570a1f70659fc3bc85ba8ace2716d799247d23ae1068995cf335f5a95b629
SSDEEP 192:sxR2RVbF/ftse9TDde5lS6zoD8p43/g6+WNIYCEuOlGpIgDZJ:sxR2fF/ftse9Tc5lhW/5IWSX
TLSH
T11942C856AD68993B5CC7E20DBB55BF53E2F95032A1901E08A7FCC60C15EB7DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 bb20fa00ab48b8716f09a69328af2cd1b4a2157e7cb976a05a63cb8183959037
MD5 94a5b2f5ed356dadeb76f1709b7c2bd0
SHA1 dd981bad46bfe67bb89a6cc3d2c3b1975b270497
SHA512 9f6617cfc76a7e14829a2d380fec1ade4b5567baf28b4e7f81014f5e55d3a1d470a82293f0ca353e2d9f02c95adf071e982ac8c1f0e568f35544575dcb9c4425
SSDEEP 384:jjm+vhKfCtgQCFf4+KhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVmC9qyRvWroZSu:jC+vhQWgQ+f4+8F1+UoAYDCx9Tuqh0Vq
TLSH
T156B2EA2B600DCB7F4F800AADAC196FD76DA802CB97589D5047FED94C02C77EA92194DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 338B
SHA256 377c0decea1016b7089ebf286335fdf2fcdf71bbfe4133f1a17299fd54dc81eb
MD5 f6f7d14b91e202f3895222eb35eef010
SHA1 7672e473d2a9d7cd947b2a72f761eb70e0f13c94
SHA512 cb7d55299adfc1df8e4e29e216415eb150d112bbed4203fc8f9dbc188c18311f3a51ef993405bdcd1d1f64967394f4ecd396cb3b2120424621f47eb1806238a0
TLSH
T1D2E026A805CEC2BDB096A0C71234A38C82EDB42FE2C83E872F00CC407142604B3AE59A
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 ac1210d7cbd7d5494df296270432798d25a7b987c05a9bf682e5f405bac643df
MD5 dc2b6141ffcc80478c0db9fbe34ae566
SHA1 54d11dc4da9a25a443dec9ef14bc5670f67fbfc9
SHA512 d03d3d1bac69261292f5968fe41fce21a0dfd1e4eb3c6d984814e0ef69372010b8239c28af11b7c14a10e81c190cdb34d28663423940fbb04057831a164ee042
TLSH
T14CE0D87416CEC7AA71C6A0CB6228F34CA1A6B40FE6D829DA2F0898807306240734B159
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 ad97498a3f28e039c4519a3890ce15e50ba2b8d6bdcf79d4a1cb50108ebb001c
MD5 ad85b424d5954302983cd2307fdae50e
SHA1 ae30a026696ea582095387bb27752bb17e9ac321
SHA512 ac2ec8c4f8f40b35b0ab790a5dd72e24fe22f3d733811cf2a3fb033b42ef1925c2b10d9c4bede0c15035693561cc44ad3bac10418124a95b9815ea9fdae67e1f
TLSH
T147E086B556DFC7396044A0D74264A74CDAF9784BB7D93ACF5B088490B205344B3AE584
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 0eff6d006b09d991e6f778c2f1de49190181d8958d8a48c112bf472514321475
MD5 9dd77761d2254ceb0e1dcbfe42717452
SHA1 f99dc9f251ee491f60c1d342cb2374ac08718d7d
SHA512 1fa5faabf3b12f069ee610f92572ee965e4d8ba2727cfb2c0fa3ee8ef8753eab096f0349a3eaf7022865bc7bd4df3f01c3bf63a1f228058e5d371fbb31201ae7
SSDEEP 96:KRbEBVj5J1WdSIg91K4EgT1c7j6dJOy4wKl2SaOkKPaKTeKkAWg:CbEBVj5JAdSp9/EgTK7j6dJOTLPYlg
TLSH
T180B1335AB13F0641393D3C0C9964842ACAC5F0A7303EE5AB7FB855960B66E427DBD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 0860dc99c48c504731e707d46956098e5b83352aafb023b74b761fc98b83cef8
MD5 12d4888c09923432928afe7af2cd97d7
SHA1 7411550d1184938c9bf6b712e39caf333766163b
SHA512 893644b000d6358874d6ea4c5b171e2917939f7c0c7669779f76221f291ec27f472ede39ea38d89e95934ff8b1ba8150152e24cfe6e5a5e1f7c4fca9100c5951
SSDEEP 384:DNrRZyCSDnxTICqkArMEhIKyll7svbFKfk7:xFZJSDnisAgyI1l7svbF9
TLSH
T16444630A7B747001EDE6D9725CB080771E3CB16D8F22A6D16DA254694EB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebAssistDatabase

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebAssistDatabase
Size 14KB
SHA256 09e772cbcf94099dd6fe57b94a1b434924de3c2eae2af80122a3435b9b766537
MD5 271ec19ece98d52d358e1b4e53c45923
SHA1 5216a1263535a6b5d580a8db9b77339891eeeb66
SHA512 2a8a51522b6bf4e690491054073b8c944eb5f6c0617d1e4e09901dfc03ad502d3d5888b31b572f3e572aea12ce49ac821e4985e8e8ff9e29baa9130d02765653
SSDEEP 24:LLTGxhK3thdkSI5QjUsEGcGBXp22iSBgm+xGt:DEK3tjkSI5IUltGhp22iSBgm+xW
TLSH
T14252879BEE342212DCEA83318AC001E17E7A903E8FC1EB0254D610211FB4691A31E58E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 337B
SHA256 d0afab1e0072dd52750b220fbd77086284477272fe0f737ef44c96859185087e
MD5 1fd9133ea842b4e74fac8d6ba7ecc4c1
SHA1 c35793f474e8eee553c524944d70e16eac0884ba
SHA512 de29875c74d49dba540d9e0f13ec49f6a4953ed49cb192368a985826992c4d64fb75040bf697899276cec7b2610a2f051cf03411425b2e04c4c0c38fa41105c1
TLSH
T199E04FDE927E2CD06A8CBD40D6042807E8C8F9DA151E48F33B6D55A44B8480A7F2DD7A
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 12KB
SHA256 b38199065e66de387e36011abcbcadbceb9dc77a4af6064e3ea039348699d65c
MD5 907e2db56173bc3919b95fabf688131d
SHA1 8cd2f7a0106e4006e5cd092f5439cbf1ff053615
SHA512 d2edba84aa85ac80485dede6c7382db0d029e7c6efc0135ebc7faf0497c26d981a1588feac651c0a0112130cd0d351e8ff43651c4b460371b07e20e97983f183
SSDEEP 192:/dQuIIItbtMIMfGYcYKVOjyzAse5lr+uCseJ7:1QuIIItbtMIM+BsjyMsebkse
TLSH
T11F42966E27052B73C15F5BB623668244AFE848824136A26D31536C1F8DF3F9B86D52F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 322B
SHA256 6b9f273c7ac98238fc708d7eaf97ad59c5a067e20fac305a8cb9dcf3d47b762e
MD5 bb53b3c586ba81db16ef34c31b4c0f54
SHA1 dea1d40725cc990bcb563fa809a70ca8b9dfab38
SHA512 14d4146acb9972bba9d92f41458fd764df9cb5302e9e5d194abbdf757b55ed516d0fcd80315dfe37a687c08b875a50cb325726aea1199fd06b72490ed1a63edb
TLSH
T16CE026A6B8CEC37EA49560CB11296789828AB84BFED829CB1F00C464B041200B38E58D
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 b6a4c10bc1b1ae0c040d920089979b9476beb370987d081a94e56c410cc4a459
MD5 d3eb105f2f2adca87079c1d1c76c401f
SHA1 a3668a0c8441b98e3d6ebcb2a543ec758bcae4d3
SHA512 bc86c1efa3b7021c6ea6a2fc9b18f50e6b2649192f6e28c5b72f10e5ebe6255c662c10d23928667f9d227994c43f6eb665309ee8c8ba7c2da534f50900abc8f3
TLSH
T11C21C495F330C049E15DC67E507E9B391738E8128FBCED0F857A20386EB2A140E4B6E5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 340B
SHA256 af8670d39f641e880a2728980b674b2e96ebd643e7db23f76be32919dcaaa354
MD5 eaa76296dc30432d06b3de47a82f82c6
SHA1 6874af3c48eaadab8f0e8c5437f54c2a3219d1b3
SHA512 18fbf405c3347c3621693489f55bffb71438711a56ae0a7b400171e3840a8acfd4a2e0bdabb742cbf347839a22d79d19ef734358d9cb3698e0af62155307344a
TLSH
T17BE0206974CDC27F5451A0C711689788E29A7C47FAD42E872F00CC46710124273CE145
MD5 SHA1 SHA512 TLSH

Submit Download

e0496362-cad0-4843-82ee-20b7e9e6bc86.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\e0496362-cad0-4843-82ee-20b7e9e6bc86.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 0f5721a8d9d03e967f37dc6df0e6a0cee137a08a0ac077d4e983fa8793bc3410
MD5 4ff8fdf4a23c13230dae59dd9c722d6a
SHA1 51a167370d8cfbac2bb505e5d176559cec095cee
SHA512 8411f2609dde714359d85141c53ed26f07ecf3b8b7b587af78ca8b404ab994641dae60ba995a6334b6f60c42dfd20ab9f91658cafae9513c483f5be7aec1a4a8
SSDEEP 3:MsEllllkEthXllkl2zEelVN:/M/xT02zNL
TLSH
T1A144041C7FC4140DC51430304011C7700370DD1515115F5334530D53FCC75500C00300
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser
Size 120B
SHA256 9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4
MD5 a397e5983d4a1619e36143b4d804b870
SHA1 aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4
SHA512 4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816
TLSH
T1E0B012203BF9062CF3F74D00AA73AA3428BFF4080A14811D505102080C33E19C478FA3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 5288f4221c95ed99cf549b53208eb37661769fcda321eeecd11e6ef886b534db
MD5 e0f3bb613b34e99d16c64c9c51a9d830
SHA1 3834a349562fba7c9eaae88b9952b30f9670cb4a
SHA512 e84439d46856ce2e537cff8c0c638af288fd5e836892e15df1777361cf1ec7ce34e7f9a04b644703ba141cb70c73c1fe0a9c38fc1063b5b3eb15bb0ccd46ce7d
SSDEEP 768:BC3Yhw2KUmp8+p3bd66j+4BRv86aLIWWb9MT:BC3MQ8+p3Z6n4ykb+T
TLSH
T17AF2BF72ECA49E778CE6C604B1863B436EF45163D7C41EC8E4DCBB0E159B1AD570B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 c6185d08df2149c572893a91b0f855b597fd1d8acab8e39d40f97e837b78ad51
MD5 7b120609e1086894d1bc56d16a308150
SHA1 a71d943040d1b6f5e539883394e593a4bedb7936
SHA512 f063e946eff02650e7cbdfc9ab2d8d9a9f96e135e7bd4c9e3527877cd371b861e28c0132641fea8f70142aeb4807ee80fa331d47d6823565f3ac6b38eaea2b00
SSDEEP 768:cN3Vha28op8+p3bd66j+4BRv86aLIFhJ93f9Ml:cN3828+p3Z6n4yYzf+l
TLSH
T1B603AE79ECA49D7B8CFEEB05728D3A132EF4117BD2E00D98D6EC5B0D542219DA707826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 7135e851625ac8a56569977296207a649920193cfcddb96d8ad16ca1e3a1ff70
MD5 842ab6d3263bc0d93b37c2d72d81dc46
SHA1 247bb969b49110e359e4e2003142a02ac6aa4d7c
SHA512 8b272f65891dbd5de2f9b50b60ba4e4a44de95d441070f4d8e7a25518a9744a4d409195338f2403b2b88329d134664875d8c5729e473be70c29fef92e3e2ac8d
SSDEEP 768:aN3mhx2KUop8+p3bd66j+4BRv86aLIW0cK7xjhnb9MT:aN3z28+p3Z6n4yicK7xNnb+T
TLSH
T127038B7DECA59D3E48AEB704714E2A626DB81177E6B00D98D3D8AB0DD03215DFB06826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 3cdbc81b75ff9735a8a0bfa09dcd74fb049ecebc6e657f36ac81f323f61add57
MD5 d2ae62211a03664d04124f519b0d39ad
SHA1 f9d0bf466b5b32b6cd6c9d1463fd688445df6823
SHA512 20709006631e8b443e4a2a10ecc88a2f7a596fa562c2ad97b4b953b2b42d8bae7662585373856c85fa76eab142ef43de9246bfeeedb3a486f4f8108e0019561c
SSDEEP 768:2N3Vha2KUtp8+p3bd66j+4BRv86aLIFtb9Ml:2N39r8+p3Z6n4y2b+l
TLSH
T112F2AF72ECA5DD738CEAD605B2963B436EF4217396C00EC8D4ECAB0E115716D1B0B82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 d175a4cb824d67d0d381c25e834cb6b2e6bbf1745d931c89c915737cdf0fd2a7
MD5 f47f44893d263a121b0c9fb798031f2a
SHA1 17d79b4da9952d186b9757bb460ca968e93624b0
SHA512 1b00b53028d5032eca18219cf4ac4eab7102828c86eea59463059527e46b7db2f12ebe6ac22616f3d595db52a3ef69de5d9811aad01961395047ffcecc1e2049
SSDEEP 768:Irv+4UNbdD35cwNp8+p3bd66j+4BRv86aLIig2bwCl1:Ibsbp3XL8+p3Z6n4ye0ww
TLSH
T19503CE73F8A899739CF6C644B2867A437FF851A396C10AC4D4DD2B4E419A19E630BC37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 425a4daa1995cfd84f3f18bda0f901cd96d5ef22a3aafb0a2923154fe7c4a95b
MD5 d275d87f736261e431d0107fd6403d77
SHA1 8d37ee61dda6364728f49bdd19d2af6d1e89bb7f
SHA512 506d2e047b70087cbf8d9e715b16143c830b23280c4a5bf6afa5e59c26c8c81fa6c8aeb19c646302a821ce63ddd18a073a252bd481cbea23f4c505a60e79c8b4
SSDEEP 768:MC3mh22KUop8+p3bd66j+4BRv86aLIWWb9MT:MC3M28+p3Z6n4ykb+T
TLSH
T182F2BF72ECA49D778CE6D645B1863B036EF45163D7C40EC8E4ECBB0E119B1AD570B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 b87cac93c65dce3ba17b9769fd437e722dd8d021b4e1bf224db72845f6ad3962
MD5 de4856eaea2d9a5598332c6af068c5c9
SHA1 55f82659865c3c6a29e683358ef8cd36e0d714b7
SHA512 30325a41562ea9a7f09a339a4f27445c6b0a5fd45c42d0e67c45048d2769208328d3805ad459278d2fb07a53dc5e51b1fa287de78f6acef885b8b51804981f7a
SSDEEP 3:MsEllllkEthXllkl2zEelNQG:/M/xT02zNOG
TLSH
T1774402087B941409D9141030443183700360E911151157D328620812AC875510D05444
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

f86acbed-a684-4765-8a0b-a8748bfa743c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\f86acbed-a684-4765-8a0b-a8748bfa743c.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

bb2eb1bb-bbf4-415e-a493-054a112bf9af.tmp

Path C:\Users\Admin\AppData\Local\Temp\bb2eb1bb-bbf4-415e-a493-054a112bf9af.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2076_1498937918\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2760_1926791241\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download