hxxp://youtube[.]com

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/08/2026, 09:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://youtube.com
Sample260807-k7ames1erg

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1120	msedge.exe
4720	chrome.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134305676564274599"	msedge.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{A16E79DE-8F46-4145-A714-D9089A674CB8}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{E4981B18-9790-467E-B450-24128A2E033C}	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
5608	msedge.exe
5608	msedge.exe
4584	chrome.exe
4584	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
1460	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4356	chrome.exe
Token: SeCreatePagefilePrivilege	4356	chrome.exe
Token: SeShutdownPrivilege	4356	chrome.exe
Token: SeCreatePagefilePrivilege	4356	chrome.exe
Token: SeShutdownPrivilege	4356	chrome.exe
Token: SeCreatePagefilePrivilege	4356	chrome.exe
Token: SeShutdownPrivilege	4356	chrome.exe
Token: SeCreatePagefilePrivilege	4356	chrome.exe
Token: SeShutdownPrivilege	4356	chrome.exe
Token: SeCreatePagefilePrivilege	4356	chrome.exe
Token: SeShutdownPrivilege	4356	chrome.exe
Token: SeCreatePagefilePrivilege	4356	chrome.exe
Token: SeShutdownPrivilege	4356	chrome.exe
Token: SeCreatePagefilePrivilege	4356	chrome.exe
Token: SeShutdownPrivilege	4356	chrome.exe
Token: SeCreatePagefilePrivilege	4356	chrome.exe
Token: SeShutdownPrivilege	4356	chrome.exe
Token: SeCreatePagefilePrivilege	4356	chrome.exe
Token: SeShutdownPrivilege	4356	chrome.exe
Token: SeCreatePagefilePrivilege	4356	chrome.exe
Token: SeShutdownPrivilege	4356	chrome.exe
Token: SeCreatePagefilePrivilege	4356	chrome.exe
Token: SeShutdownPrivilege	4356	chrome.exe
Token: SeCreatePagefilePrivilege	4356	chrome.exe
Token: SeShutdownPrivilege	4356	chrome.exe
Token: SeCreatePagefilePrivilege	4356	chrome.exe
Token: SeShutdownPrivilege	4356	chrome.exe
Token: SeCreatePagefilePrivilege	4356	chrome.exe
Token: SeShutdownPrivilege	4356	chrome.exe
Token: SeCreatePagefilePrivilege	4356	chrome.exe
Token: SeShutdownPrivilege	4356	chrome.exe
Token: SeCreatePagefilePrivilege	4356	chrome.exe
Token: SeShutdownPrivilege	4356	chrome.exe
Token: SeCreatePagefilePrivilege	4356	chrome.exe
Token: SeShutdownPrivilege	4356	chrome.exe
Token: SeCreatePagefilePrivilege	4356	chrome.exe
Token: SeShutdownPrivilege	4356	chrome.exe
Token: SeCreatePagefilePrivilege	4356	chrome.exe
Token: SeShutdownPrivilege	4356	chrome.exe
Token: SeCreatePagefilePrivilege	4356	chrome.exe
Token: SeShutdownPrivilege	4356	chrome.exe
Token: SeCreatePagefilePrivilege	4356	chrome.exe
Token: SeShutdownPrivilege	4356	chrome.exe
Token: SeCreatePagefilePrivilege	4356	chrome.exe
Token: SeShutdownPrivilege	4356	chrome.exe
Token: SeCreatePagefilePrivilege	4356	chrome.exe
Token: SeShutdownPrivilege	4356	chrome.exe
Token: SeCreatePagefilePrivilege	4356	chrome.exe
Token: SeShutdownPrivilege	4356	chrome.exe
Token: SeCreatePagefilePrivilege	4356	chrome.exe
Token: SeShutdownPrivilege	4356	chrome.exe
Token: SeCreatePagefilePrivilege	4356	chrome.exe
Token: SeShutdownPrivilege	4356	chrome.exe
Token: SeCreatePagefilePrivilege	4356	chrome.exe
Token: SeShutdownPrivilege	4356	chrome.exe
Token: SeCreatePagefilePrivilege	4356	chrome.exe
Token: SeShutdownPrivilege	4356	chrome.exe
Token: SeCreatePagefilePrivilege	4356	chrome.exe
Token: SeShutdownPrivilege	4356	chrome.exe
Token: SeCreatePagefilePrivilege	4356	chrome.exe
Token: SeShutdownPrivilege	4356	chrome.exe
Token: SeCreatePagefilePrivilege	4356	chrome.exe
Token: SeShutdownPrivilege	4356	chrome.exe
Token: SeCreatePagefilePrivilege	4356	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe
4356	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1460 wrote to memory of 2344	1460	msedge.exe	86
PID 1460 wrote to memory of 1120	1460	msedge.exe	88
PID 1460 wrote to memory of 1820	1460	msedge.exe	89
PID 1460 wrote to memory of 3332	1460	msedge.exe	90
PID 1460 wrote to memory of 1820	1460	msedge.exe	89
PID 1460 wrote to memory of 1820	1460	msedge.exe	89
PID 1460 wrote to memory of 3332	1460	msedge.exe	90
PID 1460 wrote to memory of 5080	1460	msedge.exe	93
PID 1460 wrote to memory of 4596	1460	msedge.exe	94
PID 1460 wrote to memory of 5080	1460	msedge.exe	93
PID 1460 wrote to memory of 5080	1460	msedge.exe	93
PID 1460 wrote to memory of 4596	1460	msedge.exe	94
PID 1460 wrote to memory of 4596	1460	msedge.exe	94
PID 1460 wrote to memory of 4208	1460	msedge.exe	95
PID 1460 wrote to memory of 4208	1460	msedge.exe	95
PID 1460 wrote to memory of 4208	1460	msedge.exe	95
PID 1460 wrote to memory of 436	1460	msedge.exe	96
PID 1460 wrote to memory of 436	1460	msedge.exe	96
PID 1460 wrote to memory of 436	1460	msedge.exe	96
PID 4356 wrote to memory of 3656	4356	chrome.exe	97
PID 1460 wrote to memory of 2052	1460	msedge.exe	99
PID 1460 wrote to memory of 2052	1460	msedge.exe	99
PID 1460 wrote to memory of 2052	1460	msedge.exe	99
PID 1460 wrote to memory of 1628	1460	msedge.exe	102
PID 1460 wrote to memory of 1448	1460	msedge.exe	103
PID 1460 wrote to memory of 1628	1460	msedge.exe	102
PID 1460 wrote to memory of 1448	1460	msedge.exe	103
PID 1460 wrote to memory of 4508	1460	msedge.exe	104
PID 1460 wrote to memory of 4508	1460	msedge.exe	104
PID 1460 wrote to memory of 4508	1460	msedge.exe	104
PID 4356 wrote to memory of 4720	4356	chrome.exe	105
PID 4356 wrote to memory of 4376	4356	chrome.exe	106
PID 4356 wrote to memory of 4376	4356	chrome.exe	106
PID 4356 wrote to memory of 4948	4356	chrome.exe	107
PID 4356 wrote to memory of 4948	4356	chrome.exe	107
PID 4356 wrote to memory of 4692	4356	chrome.exe	109
PID 4356 wrote to memory of 4692	4356	chrome.exe	109
PID 4356 wrote to memory of 2120	4356	chrome.exe	110
PID 4356 wrote to memory of 2120	4356	chrome.exe	110
PID 4356 wrote to memory of 4324	4356	chrome.exe	111
PID 4356 wrote to memory of 4324	4356	chrome.exe	111
PID 4356 wrote to memory of 396	4356	chrome.exe	112
PID 4356 wrote to memory of 396	4356	chrome.exe	112
PID 1460 wrote to memory of 5156	1460	msedge.exe	116
PID 4356 wrote to memory of 5744	4356	chrome.exe	117
PID 4356 wrote to memory of 5928	4356	chrome.exe	119
PID 4356 wrote to memory of 5928	4356	chrome.exe	119
PID 4356 wrote to memory of 5192	4356	chrome.exe	121
PID 4356 wrote to memory of 5192	4356	chrome.exe	121
PID 4356 wrote to memory of 5612	4356	chrome.exe	122
PID 4356 wrote to memory of 5612	4356	chrome.exe	122
PID 1460 wrote to memory of 5628	1460	msedge.exe	123
PID 1460 wrote to memory of 5644	1460	msedge.exe	124
PID 1460 wrote to memory of 5644	1460	msedge.exe	124
PID 1460 wrote to memory of 6040	1460	msedge.exe	125
PID 1460 wrote to memory of 6040	1460	msedge.exe	125
PID 4356 wrote to memory of 5496	4356	chrome.exe	127
PID 4356 wrote to memory of 5472	4356	chrome.exe	126
PID 4356 wrote to memory of 5496	4356	chrome.exe	127
PID 4356 wrote to memory of 5472	4356	chrome.exe	126
PID 1460 wrote to memory of 6124	1460	msedge.exe	138
PID 1460 wrote to memory of 6116	1460	msedge.exe	139
PID 1460 wrote to memory of 1244	1460	msedge.exe	140
PID 4356 wrote to memory of 5216	4356	chrome.exe	142

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://youtube.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b0,0x7ffa0844c188,0x7ffa0844c194,0x7ffa0844c1a0
  2⤵
  PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1964,i,15312362098684604745,16659395154288099214,524288 --field-trial-handle=2928,i,1071047482859380987,3928076609925898077,262144 --variations-seed-version --mojo-platform-channel-handle=2964 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1752,i,4697027747007891206,11334315828392368399,262144 --field-trial-handle=2928,i,1071047482859380987,3928076609925898077,262144 --variations-seed-version --mojo-platform-channel-handle=2924 /prefetch:2
  2⤵
  PID:1820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2228,i,4911563617904583878,15208446041700956115,524288 --field-trial-handle=2928,i,1071047482859380987,3928076609925898077,262144 --variations-seed-version --mojo-platform-channel-handle=2972 /prefetch:8
  2⤵
  PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3416,i,10310319069815200257,4058903462342797719,2097152 --field-trial-handle=2928,i,1071047482859380987,3928076609925898077,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3424,i,3063300111165522156,3335114461435837961,2097152 --field-trial-handle=2928,i,1071047482859380987,3928076609925898077,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4036,i,3506650133931118537,8867746531696725477,2097152 --field-trial-handle=2928,i,1071047482859380987,3928076609925898077,262144 --variations-seed-version --mojo-platform-channel-handle=4084 /prefetch:1
  2⤵
  PID:4208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4116,i,6561405957619553045,1083013409735713651,2097152 --field-trial-handle=2928,i,1071047482859380987,3928076609925898077,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:2
  2⤵
  PID:436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4964,i,12146886737410136235,14341345413690590476,2097152 --field-trial-handle=2928,i,1071047482859380987,3928076609925898077,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:1
  2⤵
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5172,i,6746342163347236622,6849699404803966165,524288 --field-trial-handle=2928,i,1071047482859380987,3928076609925898077,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:8
  2⤵
  PID:1628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5176,i,8857880655927163555,7112062550083822514,524288 --field-trial-handle=2928,i,1071047482859380987,3928076609925898077,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  PID:1448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5516,i,8496150323472644122,11235040575664188643,2097152 --field-trial-handle=2928,i,1071047482859380987,3928076609925898077,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:1
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6040,i,986660872970793767,13832041018726619034,524288 --field-trial-handle=2928,i,1071047482859380987,3928076609925898077,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:8
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6040,i,986660872970793767,13832041018726619034,524288 --field-trial-handle=2928,i,1071047482859380987,3928076609925898077,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:8
  2⤵
  PID:5156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6400,i,11256529991688776366,3920811017378976220,524288 --field-trial-handle=2928,i,1071047482859380987,3928076609925898077,262144 --variations-seed-version --mojo-platform-channel-handle=6456 /prefetch:8
  2⤵
  - Modifies registry class
  PID:5628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6476,i,14703053872386784703,5470060511672632348,524288 --field-trial-handle=2928,i,1071047482859380987,3928076609925898077,262144 --variations-seed-version --mojo-platform-channel-handle=6436 /prefetch:8
  2⤵
  PID:5644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6688,i,16830321261874839550,8910928156400775490,524288 --field-trial-handle=2928,i,1071047482859380987,3928076609925898077,262144 --variations-seed-version --mojo-platform-channel-handle=6676 /prefetch:8
  2⤵
  PID:6040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6060,i,10391454778463461426,6875672877334187456,524288 --field-trial-handle=2928,i,1071047482859380987,3928076609925898077,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:8
  2⤵
  PID:6124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5964,i,2834729903949615750,4527068629845633068,524288 --field-trial-handle=2928,i,1071047482859380987,3928076609925898077,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:8
  2⤵
  PID:6116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,12242854935035052928,12464788066116824684,524288 --field-trial-handle=2928,i,1071047482859380987,3928076609925898077,262144 --variations-seed-version --mojo-platform-channel-handle=4420 /prefetch:8
  2⤵
  PID:1244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5416,i,4590521612844595204,9252072371374364662,524288 --field-trial-handle=2928,i,1071047482859380987,3928076609925898077,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:8
  2⤵
  PID:6004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4424,i,11151951116015607322,10457245051069030082,262144 --field-trial-handle=2928,i,1071047482859380987,3928076609925898077,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5608

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffa0668c728,0x7ffa0668c734,0x7ffa0668c740
  2⤵
  PID:3656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1604,i,17083601294872248124,13649468414576889551,524288 --field-trial-handle=2040,i,3665849600723020122,14940939779276376537,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2184 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1692,i,5964541619135500852,17977124558835136992,262144 --field-trial-handle=2040,i,3665849600723020122,14940939779276376537,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2036 /prefetch:2
  2⤵
  PID:4376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2420,i,4350717811428323043,18049955122733782949,524288 --field-trial-handle=2040,i,3665849600723020122,14940939779276376537,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2376 /prefetch:8
  2⤵
  PID:4948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3252,i,16440679496747246731,16956678131014884684,2097152 --field-trial-handle=2040,i,3665849600723020122,14940939779276376537,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:4692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3284,i,10112303066087531092,1357678744474714151,2097152 --field-trial-handle=2040,i,3665849600723020122,14940939779276376537,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:2120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4220,i,11608365734949592521,2064395306792766548,2097152 --field-trial-handle=2040,i,3665849600723020122,14940939779276376537,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3860 /prefetch:1
  2⤵
  PID:4324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4632,i,11964735210294101125,1497573765529957945,524288 --field-trial-handle=2040,i,3665849600723020122,14940939779276376537,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4616 /prefetch:8
  2⤵
  PID:396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5260,i,12646683859250853754,6279341979074924219,524288 --field-trial-handle=2040,i,3665849600723020122,14940939779276376537,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5264 /prefetch:8
  2⤵
  PID:5744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5352,i,12069968543311676309,4072444740242904745,524288 --field-trial-handle=2040,i,3665849600723020122,14940939779276376537,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5364 /prefetch:8
  2⤵
  PID:5928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5476,i,2378400677260168886,11357927689294780586,524288 --field-trial-handle=2040,i,3665849600723020122,14940939779276376537,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5244 /prefetch:8
  2⤵
  PID:5192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5652,i,12505988522198938887,3875753515868910972,524288 --field-trial-handle=2040,i,3665849600723020122,14940939779276376537,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5500 /prefetch:8
  2⤵
  PID:5612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5356,i,3001762058762777724,9567865497660803071,2097152 --field-trial-handle=2040,i,3665849600723020122,14940939779276376537,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5460 /prefetch:1
  2⤵
  PID:5472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5480,i,645738812249420864,17037851697738423,2097152 --field-trial-handle=2040,i,3665849600723020122,14940939779276376537,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4544 /prefetch:2
  2⤵
  PID:5496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5416,i,9319418540999488718,370467728876066449,524288 --field-trial-handle=2040,i,3665849600723020122,14940939779276376537,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=240 /prefetch:8
  2⤵
  PID:5216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5468,i,12249944205957044004,10890898610573970776,524288 --field-trial-handle=2040,i,3665849600723020122,14940939779276376537,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4536 /prefetch:8
  2⤵
  PID:5208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4424,i,6466529243727638888,11819536637032912324,524288 --field-trial-handle=2040,i,3665849600723020122,14940939779276376537,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6040 /prefetch:8
  2⤵
  PID:1224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5268,i,8793274470379466853,8381883039903926211,262144 --field-trial-handle=2040,i,3665849600723020122,14940939779276376537,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5288 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4584

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2328

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2976

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5144

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 95e262f50e7ae3f796e7921c202664838118b290eb3d664442f122762e6565b6
MD5 7af1b2821da163787a86fa548bc5ad0b
SHA1 844a37b91205117c7125361f33e6a63caec7ba25
SHA512 7d66f886738f24f86f353158227f2482fb0dab8aa32552b4838bb01c4c8b4273afaf10aaa86b0b8aad7fb6b674ed5bea04a9260cc9d3f89af7fff38b24720145
TLSH
T19EE02BB9C861EC3B28FF1729A0918745E721539B2641894B7A3C950C8FF1B3E565581C
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 5a0c781508c157cfbd5f444eb524a27bc5c08f87c715e8e9ae0226aea2cc2b91
MD5 357fe3175180aba0b674db2cf3693304
SHA1 58d91d2000cca8e419057c1abfc6f3411bd7d4fd
SHA512 32c2300397a281d0b5205a535c45131d64efd5a640f8ec151a8fb1de56a2277d4886bf9113e656a5db8c4aed49c4eecc64585f3d304b60418ae04c945b3d4d8f
TLSH
T1C25157F7D3E4867DC91196F49A21AE1FCE3D0A18122C3C6689D4AE5B53E2872D21178F
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 5d862b3b1af8a71dbde0e355c95314e7de5d7f9eb1efc0d71c5fa874dc5e7e1e
MD5 6a305114826aa0f0810aba8ac287bf59
SHA1 ab0d98977985e7c20225ccd37f40fc9541c0a3c6
SHA512 1e07dbdda725c43d72b92be4928e2e08f9135c321b2823c7577090ce8c2048e70f55cf824e5d0aa5a6143d4a4282b155e7d6fbfe373f957e6242b2b255eda68f
SSDEEP 192:DRcLHS6v72vAPRp299THsb+WNnEq08WecFaGlVyIsnAUge:DRcLyWC6XuFwt0taQe
TLSH
T1C132E56EA924683B6CDBD21AFA667723E7F5103136D42F40EAFC892C10D75CC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 ef8eea7a55f81cb5574c46929c2c2dfb5794dfc9cdf82c90f8bdd9b9e71a82ec
MD5 511dbca4e74712b31bdcae994bbbbd62
SHA1 e258bfc400ab7fe996c0f8ae4ffa8a99b0ec5fdf
SHA512 18caeed1ba4459a77a968124f7fb42439c5649115387712bfb74c9435c61530943373d88165d70f4496a3ef2578a2bb49c7acabd5762edddf2fd9fefaea945b3
SSDEEP 192:DRcLHS8v72HAPRpu99THsb+WNnEq08WecFaOlVyIsnAUgE:DRcLyoCCXWFwt0taIE
TLSH
T12342E76EA920693B6CDBD21AF9657B27E7F5103175D42F40EAFC892C14E75CC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 a129ff8b1ebe8437db701acf9afd129db8e55d1435a00679c415ddae78cfb9a1
MD5 cdd0b1a910209a672d2e6bd2afed7e05
SHA1 271fd761f939aea96e08d51cba2e5b65de6bd56a
SHA512 181fd944467ff5b527d6dd15f2efd2be59915bee6b025553583cc269b0fbbf0a5747ca2b5af3aa0423f7a2a2c039f180a4d5183c08f55952e4e13ada4eb1bf64
SSDEEP 192:DRcLHSJv72HAPRp299THsb+WNnEq08WecFaGlVyIsnAUge:DRcLyJCCXuFwt0taQe
TLSH
T1CD42E66EA920683B6CDBD21AFA667723E7F5103171D42F40EAFC892C14D75CC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 31cedfc5d7c51e40602cfdbc3ede9dd6cf0cf854861f51571ae3500acea2c780
MD5 cbd5c86289b5c9cf98394b2c7fc06433
SHA1 c0648f111361c63b0da8f7edae923ca7db7a83d3
SHA512 c124e09f582c0c7a709e6c4cbd16c1f60af1dfe687c48fb73589cde8fe2640d3175f69b0b6adcef1d4a17dae78ab2ca60c2957cdeb742491e5798b62aa9facd2
SSDEEP 192:DRcLHS8v72HAPRp299THsb+WNnEq08WecFa6lVyIsnAUgE:DRcLyoCCXuFwt0tasE
TLSH
T1B442E76EA920693B6CDBD21AFA667727E7F5103175D42F40EAFC892C14E75CC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 c3ab964394c2b3d6feb22429899cb02627f591e3d6b8ebaeddc8371244bfd835
MD5 f1b38d2f248853caad798c3eef63c235
SHA1 23839157c8cf7e1e083f05b3abfa10de0d1c4a0e
SHA512 d5731c3de7f67484ccc1127c8d01399db747dfcdebafe94432c1ec69ca99e8b35afbc169c38af7bd5937118c95320ed6fbe897ac7efcdd140973b2ba79c13a46
SSDEEP 384:/1jbW7KxkXqKf/pUZNCgVLH2HfgslqcXODby+ErU3GJHGNIB3WhmLKoUY:/lbW7KxkXqKf/pUZNCgVLH2HfgsMOOH2
TLSH
T10C52F867588D963F0FD8C68CDC167F4FADB2015666640C2897FB9C08039A7CB115A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 e5b22e58140eb08587ed6be5936bc46b12824a68b818a66442e282c547859135
MD5 0194bae1647099b49018c0d3b420c4d8
SHA1 30d138b5e464a4dcdb207b9e35fbdc62f65c0eb6
SHA512 f9be861f314566ba4e67b768f36eabf766c51e3496c541534818088a3118c985faabca17699c5941e71f3fd9f9c5e57b92adb2e6b7269460e05642a4fc25ec19
TLSH
T1A6A0025059C40413DD035BF0707546B26352D91959A183036CD148789D5F1D95155508
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58f2f6.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe58f2f6.TMP
Size 48B
SHA256 b0437117703ae2c9d69d59d47980798d5b344142fe58297512e7ca6cdce99543
MD5 7107dd7544627f2391130a60ef69d1ff
SHA1 55a698de3ecaacf7c8f0d9ad5e48d773eb18fb1d
SHA512 43d5aed33433fa5471416f4f86efe1f8bee541d6a6683737b4ca835c33c31d6a664c37aa9af6c7d163761dbf2a9c6f4c9d081f7eb06476764308edffba3768c9
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnWebGPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 b501e8a206d8d300a63cf7fc83e458fbe5d0d27a065c4f6f6a45f0a357b0537d
MD5 9f650d128e7f49c724ed061f9d3ca82d
SHA1 6f0dd065896e7aca99bc5da2ad29453e8c4d0530
SHA512 3e03ceda7826c8633e93e2f3d93d226715ca5b1f17d639eb61fac917a3018b9bea4266ac90e12d042bcc266dfa1bd8b02dbe3ce6a1ad908087f53229cf3211f8
SSDEEP 3072:TIGaUSkdPfxJpbt9k83Vo4bQBjGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMD:TIsBPtDp3KgQBam7Rkm1tYpBeh2BAoD
TLSH
T15B3412376D29AD312D667B25B24A072F0EF0DFE3C528E545D8D5890466EEBC82F1AD30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 c0de78c4b6c6f7c69f77a829e93e03b63d062bbb47c81574a9b61b030280cafb
MD5 59efbe32671fd6fceccfc6be6e372b0c
SHA1 ceaeb0718fdb9f0564eb415d2179fa5c2231192c
SHA512 12a23ee1108ce8e5eeb1a670f20393563a0b67664ab3188e2924c77dca1a38deee05c3832f5a620e574977ea8801f5cd26f7dcb45fe7e1d6a6c63c91161ee02d
SSDEEP 3072:NGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMm:Em7Rkm1tYpBeh2BAom
TLSH
T1AEC3123B5E71E97759B9A74EB08E0B1F1EF14AA2C930DA42C8D86A0437F97CC1A05934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 0fcf656e0e1fc03e080884023eeacf507e1dd52bad8e36c3ee223f5b2ab47c52
MD5 b7f99768efe87528a786791080d4584d
SHA1 d7154b07e946adb39be7dd5680907d6c8a4ffeed
SHA512 a3ec05e3e8c9a428491d4b0ecdeb3ac95d8e93d9a6d703669fcb4ccaec791c781ab8980dc5f72fb7a5ee724430e162609ba4275a1800d9ad669f082672a597f9
SSDEEP 3072:qmGaUSkdPfxJpbt9k83Vo4bQBjGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMD:qmsBPtDp3KgQBam7Rkm1tYpBeh2BAoD
TLSH
T1703423376D29AE312DA77B25B15E0A7F16F0CFD2C128E145D8D589046AEEBC82F19D30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 8b7273965db053f81d7dcde1fcd549682aeaceea2caaea28d021e3acfc505646
MD5 0ebcbb1e65ec00da2a64c261c6495cc6
SHA1 b17554b36916ec89a9a6c5f916f5d7d3ec56c578
SHA512 3ecfc5034b2ba033aeb8c5f38bfb89be1f3902ae084e81ca8ccd1797dcdaeb2e621a2d9c2ca6d75ede6f9883288567e30c328a5abcf7e195e5c4ee635b14add0
SSDEEP 3072:FmGaUSkdPfxJpbt9k83Vo4bQBjGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMD:FmsBPtDp3KgQBam7Rkm1tYpBeh2BAoD
TLSH
T1BB3423376D29AE312DA77B25B15E0A7F16F0CFD2C128E145D8D589046AEEBC82F19D30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 d5e01f572f200ae0d9d64d79018ae3bde45ebb286bc5bf50a62989856dced547
MD5 01f48c1fbe8ccf941841ff8734c129a3
SHA1 577248a196b207fe2e3a1315a5d217cfc6b0f71f
SHA512 baec84017a6e59e94e80c73714d4fec85916d9266f02b870d61660cfe34dc3a7ac847221ae594e9534f37e2b4b9db895127fbc895e83d5a7a319308fab679fa3
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7f:fwUQC5VwBIiElEd2K57P7f
TLSH
T15BB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9aeab2c92c5f26a8ca39382cf1bb4652de05a24b8d0a9ed661920c6197bf4c98
MD5 722151c3c2c9d1bf9273dad578c24b92
SHA1 8c73ee2f65f9c7a61550c77f0ff7f3b2e262dbdd
SHA512 2d701005e69967e2b1d86e637b7e1011658167d340aa89a1d8a3826c1a0cd883f9a6d2e8ff8530362b27f034273eb9c1e432fc1a63348092e3fcfc9ecd12dada
TLSH
T19ED012323A18644AE656A1F0A413CB411637516624535B21B215949D9AA80D562C6192
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 46246483d08868ff03d5f9bb48e547ca61f651c3e59a4138f5a5da74c69b3ae0
MD5 c70fc44a424269679b1300a5be3376a5
SHA1 6162f1576d71e2726435c2e688415ae394c1369f
SHA512 c7fe73655fb22ef9d6d3620fa11cc8586300f67f906224e15b5de9802f495a10b66f3fdb475a44e7ed7af1a7d84be1c87f05f52d39641755f33237ede51a6e35
TLSH
T1F9D012323A58684AE656A1F0A412CB411637516624539B21B215949D8AA80D562C6192
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 d0005d51513fac9cdac92d6d0da9dde0f9adbbc10fea100a9833b5c165964706
MD5 7c6f59dc2b1fc84ca1ea1720fdcf5e9e
SHA1 9d3eb77f71394e6db5fee952107c3938f26f77fe
SHA512 1ff8fdbf866590716e5944a05a3c57c38122e175aacdf916e2de6dc026dc76338f47a5d825bf8b72ffe1b3bfe72201ca84b5bb7c31b3644f15e9ae06153f4d01
TLSH
T1D271F8BDC9919091F7B01139E5CB067235360EC6FC576E7201E0DE703AE6B65C5168CE
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59284e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59284e.TMP
Size 3KB
SHA256 fb85072e7b08f3e63ff4e30f4dc08b9188dddcc37816945106c0628e2be73b5a
MD5 5493cbefb339b74ae3c0226933bff47d
SHA1 65908bbd3af2ea8ac101825cbdccf8af65863766
SHA512 cccb880019b4a419c06d18fb5de030b8f83f49ed1838ee6927caa34c39208f4cdf733abb5b4093af92e623cc9fce9af707a1b10105c2d2b4f36cbd4cb543d3ae
TLSH
T158614E7DC65244D1F3B05238E4DF067279760EC9FC275E7611E0DA7436E7B61C052889
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 534891f2b77da11ad4eee900369962c73eb73d70be29e8b8e811cab7b3789d4d
MD5 5bc7cd9c83af93fcb876a87b69477976
SHA1 756bee851f12fe41116847eaf3c0c24cfd44c10b
SHA512 6e9386af9d52b9f7a19b86ce625cb608b3ae6a6fdb0cc1ec01254b16e2ac41d95baeebed60883aba9d6c73e38bee910826058d21e1bbee18bc29cae6e010cfec
SSDEEP 96:DDOusVu4EuDuYIukuSpzWujuHGu5UuuuJu3uaugyuPOwQ:Dat5E4FIPByUmGv7eSxepT
TLSH
T11691ACB2C7E4C22DD81117F096687E1BDE2D0E2483283C69D9D5FE5B53E6471E241A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Platform Notifications\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 700a673f4034817cf52a5f33949debc797b36f37c7ced58276c0f42aedd8be9b
MD5 f30bbef49e4e1ae7c8cd3a3f4ac6192f
SHA1 2d0a94b2612efc4be1f1ddba8b76600a300e8e24
SHA512 ba3e502ea6af79c517402b9c3363394331722a5135db640e640878f208d14e5a3b473c1041d441af5b4373048fad84472e854efad609c3cdf59870e65ca33354
SSDEEP 192:sxZ/RDyM/jK1Ml8Mkk/f+sFm6ROIdpAiqdHW6+WNnvL/Y9IXZ8vIgrJ:sxZ/nMk/f+sFm6FyHbD/y9
TLSH
T1DA52E8526A386E77CCCBD209FA44BB53D6F54532E2900E58A9FCD91C04E6BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 506a1668d3db135c84e115abb185d836374bcab164c4df4730ef87c9ad3c1d29
MD5 5b2518ebd4c84ce88bd5aed76bd54c3c
SHA1 f3c7ec8ddcd92912b0bf1db7e89f02f7715aff8c
SHA512 a3ed0327045cb1385fbe8efc9f4090805af4f8c516e58e0e18ce490358623bf9e86297f681a58b9f2df06aa96bd49a23ca69a9b7a6114489de12fc3ca8150851
SSDEEP 192:sxZ5RDyM/jK1Ml8UQUkk/f+sNmwROIdpijiqdHW6+WNnvL/Y9IeBtvIg5SJ:sxZ5xqvk/f+sNmwF+HbD/4o
TLSH
T13462E7526A385E77DCDBD219FA51BB53D2F94432D1900E54A9FCDA1C00E6BED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 707759e7d655232c712e71ffc86e59a11e8a479747a3bec720b35f9262b4188e
MD5 572c05ad741c1a4d42025000049272ff
SHA1 61996559b40903b15b63bc0a0e2679a343ae8fb0
SHA512 8acf65b1cd9efd05f3074b8944a0395bbe02a5ecc2a1d68178feaf84b58f2ac1ef25312bc0be1faef5068715215c200bbfe4b7605377374d0eb32e29e233f9c5
SSDEEP 192:sxZ5RDyM/jK1Ml8Mkk/f+sNm6ROIdp0jiqdHW6+WNnvL/Y9IXi8vIg5MJ:sxZ5xMk/f+sNm6FwHbD/Lu
TLSH
T17D5209526A386E7BDCCBD209FA51BB53D6F94432D1900E58A9FCD91C00E6BED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 cb3cd2b33e8f6f46dd6fd99365009dc1b222202807c884d6e7cda3c9e2df56c5
MD5 76314c1a73e560c544be11eb0c49dec7
SHA1 237a22eb7b3b7f49f6d60f52dd96f98c1ade7a74
SHA512 ab6b8eb383f922acdde96c81e3ea802af2c4f4b3366416dd5c306625cf46482eac4f3c7d34d8d56b7b368a4fc9be3986749829fb285340403f47b598ff168828
SSDEEP 768:Upcv21wWvu+Z+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjFLlwmWNHrokg6Q:Upcv21wWvu+Z+u1jaeFLeRNUkA
TLSH
T17DD20A2B280CCB7E4F841E9CED2AAF866ED801CB56988D5447FA494C03C77EB511B5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\acff41b9-1d8c-4ba8-84a5-1cf9a63c03a3\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 214B
SHA256 95270ee3d4f2ceacb4f5294aaec7c8b13f2b4ff4fae40e4af526d55ade23e1bb
MD5 f1651463393a02c3b8bb01cdf6f663ff
SHA1 75e0d5d0611a7de3d61f5492b96b7836d9b4c572
SHA512 27fbf904f63f396deb4cf12285d6b9a952385c31f3ea65a66fea14fc4e4e6cdbc62bd9c258903e7cdd3faa708eb8c5b094a440bd3d9bad64724e36ed806a020a
TLSH
T17AD022CF82308AD22A30BAC4253C618F821F9D09C888ECD4EA8070D3347A913C042AAA
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 130B
SHA256 eb626fe6d8478a5bc2ae00027848fdbe843a64ab20d36befef8b45d6cb655108
MD5 d7e4b1611c71ddc1f56cfabde5721ab8
SHA1 3d515e2cea9f137c5eb825da09054a75da324cd9
SHA512 034efb5630cba18dbf3935ca14324273d2a2cf3f8ebf2589312b19dee5a4be927643519b67ae843e2a9763850180608affda71fa5d0ce845b4ec8cd857e94cd6
TLSH
T1FAC092E759208AEB5A70EBC8313CA39FD94F8248C8D4CCE4A2885087303A9238482969
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe58ab2f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe58ab2f.TMP
Size 137B
SHA256 32341b7760d7da5c87631cd3d0554d29175aff67ef12970984d814ac9c160859
MD5 d2792d0911e51c7ac6361ea8468f4b70
SHA1 cad24f58963a0af28786fa6aa2f888c4d0cc4098
SHA512 69684df9e435c2ce9b3be1960bcf44eb101e625d9d6ad0e1c0fa060da1292214755f9bff536444485f6f5f9a3a8adf91717968572f7461c1661eb4022b28893f
TLSH
T18FC09BD7553046D75F70A6C4303C534FD59F8D58C8C0CCE4A1897047343A5138545535
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 559c3fd2db3326010a588507a8745a17a84ae4899b0c5645582f096e80f0901a
MD5 0480049bb74e3158d96ec2fe0c9e8720
SHA1 994809ad01f7cb1cc43066ccd6cc41f61aaecf43
SHA512 de003d032235174fc944084b75e96898aba244bf871133364743cd10f800385f248f0de8643cb4d439b59a9f944e7b24225706647b84be2dc9c278b201f73e88
TLSH
T167A00210058E2102C4900FF13847197933B19996010926894A9CD1AAECE2245714A905
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58f9bd.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58f9bd.TMP
Size 48B
SHA256 b7cf264bc49b62e6ca797fb5081a56eec7f294bbf0724f70b860fb1a5b70a47a
MD5 fc64e3a3c4c8c99404301c1366ddd7be
SHA1 3df5df84a82508f8f97dab776456c1b6623c9d2e
SHA512 6a08f90c21c31eba1cd4a926961a91a17a05ca07a0d587f4641429ae65e29ffd4b4e4b05eb45caeb28d6e2e7b3ff5be7fbccafced3a268e29edd61475d59f7f8
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 9aa5479bcbfc3b34881861651bda20d63dc4421c3b0c53377c3de7d7e8e49d4b
MD5 bb97bba38827bffa42356e63bebdde50
SHA1 dc1b74751847c1b70d0d672bba0fd9711a31bc40
SHA512 f80c46c5f8aeb08dfebb7191e7e37390b13b556d62d83c9bd9c5a3485c7fec45a35b1faeb4516092d503a9c85d5107eb77549a906a63b29ff464581604639f7d
SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBDauoKf6yauIKXKLV8bHtjzFz:mT3/XUV8bHtjzR
TLSH
T1BF91F20A313B02E2787E694CA39786364E4139A77819F46F7BF840614B2BE121EFD4DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5960a4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5960a4.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 62c13278caff3e5233c199daa9312ec75075406c2e2c34ce4331135a1246f66e
MD5 596c25e384120fe5cdde297a5292b776
SHA1 da2cb67cc3ef1892105c810717874091a19d0072
SHA512 ad0dfdc0a33ff76b305beabb9f5a0b4a0a889c085636bbd30cf77ce1fff7142c2530a019fd937fad832fa39e5ba35e330f53db906dde3029b9e4acfd7b6d3498
SSDEEP 192:qONA6v+YLoQmiUyiIhh+CGU+Fdes9oveDSJrTCHGqzU6:qONA6vzsehh+COdPeTJrgHU6
TLSH
T12C122B356C786C6B5EE2A541F48735139FE89127EA8A3F90D5EC6F1C01EF69C2306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 f2e6993de26b890dd9ae04ca99ad3b4b24b33b55e7521e207bc8f3150ba2183e
MD5 b83a1452ce532bcb49efc0e369aadadf
SHA1 fc1986fbf004b590a1db340b9119b37f7a125f57
SHA512 b7c212e8cf8e9573f2e5ad5f49ea8514d8b8f2ad481eb2bf214aa688e607a7036fc11d90eb0db03753f66d191652b1add41ab2fe1ad0ea77d194a7212bfa7ed7
SSDEEP 384:MiFwZcIOVsNv8TUNTUlIlDTfzieC+ze+COdPeTJrcHf5UrzsB:3FO02wgVrTnS2cThcHSM
TLSH
T1F3D23BF208E75836E99E9B43E73D2D168EBCC163F5812A94B3D85A1CCC961BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 5c187c5025bb8343a147ccf7dce7cf314b49e52136f5d31f7336437d146fe36c
MD5 7a93cfe70e1d24cf27e91e71cd55a6dd
SHA1 84a9b40ea6e1392871d0dd32b03c50d9f462319a
SHA512 4f1f4ed8bf55f77916be46a719ecba9a55387c53430e4e52d453e8ec9c94ebd6dbcc1b82d2e25bde867e02e42bf809189438c50a1f0940ce20620c1b284797c9
SSDEEP 192:JONVm6v+YLNQmiUyzIZh+CGU+Fdes9ovtusdEU6:JONI6vz/RZh+COdPeFyU6
TLSH
T19E02EA356C382C6B9FF2AE46F48736275FA82177E9922F94D9E81F1C01D765C2306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 b4667a58ba8ff919ff927c81d9102159517a7e2e67fc95463f976b96c25f33eb
MD5 fe3f77fa92873ecbbde459faeb8cb0b1
SHA1 0665b426d0097f962e7960e8c36cd49940fad5bc
SHA512 f98219150b7ab75b36021dad28a9a101f628450f47ea4946341de8be4bb6a48f4a90399d231d23709bc942643c66c139bcedda22c69e356d6da0bc5d394501fd
SSDEEP 384:FZcIhsNVeTfzieCfze+COdPeTJrfHf5UrzsB:9hHrTuS2cThfHSM
TLSH
T14F928D752C386C37AAE2E545F44B36178FF89123E2C53B98D5ECAB2D01EB59C130781A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 d3801d5d2bc65bd7c678b3d14905d6845f1fa27932bfbb6efdac600d9b0b6cb5
MD5 d8958336ab7748118029086253a850ba
SHA1 b10122afbed7f34f36182076d846fb6788103b45
SHA512 7d91925e6ab26031e6bac2ded82d560cb5b27d3f0d97284a528176064347685f8c3e7873af533ed525a9b61e60e43cddaae6be18a51d574e033d7f7b6c0c5fd7
SSDEEP 384:xZcIXsNVqTfzieCeze+COdPeTJrfHf5UrzsB:ZXXrTvS2cThfHSM
TLSH
T1F5927E751C786C37AAE2E545F44A36178FF89123E2C53BD8D5ECAB2D01EB69C130781A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 9575e94541a2e68835ea41d5e724956814b438fcaeb45efb1c7ba2fd58eb1c35
MD5 d3a262c1627e67ce8c29865b86ce66f5
SHA1 0dcf077c1481c176d7c64dd252d2c37e072a302f
SHA512 5796cd8b8d0f874890669a4965e38b9537cd6242d39721ca1165131f2efd03415c1b65cf815980623b8f07999bc3eb6da504158c784b069115cc7d20ecdf6245
SSDEEP 384:uZcIXsNVDTfzieCeze+COdPeTJrfHf5UrzsB:MXirTvS2cThfHSM
TLSH
T11E927E751C386C37AAE6E545F44636178FF89123E2C53F98D5ECAB2D01EB69C130781A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b231e72c-6891-4a88-974d-6693b1745c43.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\b231e72c-6891-4a88-974d-6693b1745c43.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4356_496697141\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

a2a0da41-20de-4abe-a176-1e27a237236b.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4356_496697141\a2a0da41-20de-4abe-a176-1e27a237236b.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
TLSH
T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download