hxxp://youareanidiot[.]org

Analysis

user interaction
yes
max time kernel
43s
max time network
49s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 10:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://youareanidiot.org
Sample260808-myvbksvgnf

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4580	msedge.exe
3952	chrome.exe
6428	msedge.exe

Enumerates system info in registry 2 TTPs 8 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134306599846726912"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2301830172-776172150-2531349243-1000\{6FC8AFAC-5FBD-4894-92A3-867F4D09A3D6}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2372	chrome.exe
2372	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 22 IoCs

pid	Process
5924	msedge.exe
5924	msedge.exe
5924	msedge.exe
5924	msedge.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe

Suspicious use of AdjustPrivilegeToken 32 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2372	chrome.exe
Token: SeCreatePagefilePrivilege	2372	chrome.exe
Token: SeShutdownPrivilege	2372	chrome.exe
Token: SeCreatePagefilePrivilege	2372	chrome.exe
Token: SeShutdownPrivilege	2372	chrome.exe
Token: SeCreatePagefilePrivilege	2372	chrome.exe
Token: SeShutdownPrivilege	2372	chrome.exe
Token: SeCreatePagefilePrivilege	2372	chrome.exe
Token: SeShutdownPrivilege	2372	chrome.exe
Token: SeCreatePagefilePrivilege	2372	chrome.exe
Token: SeShutdownPrivilege	2372	chrome.exe
Token: SeCreatePagefilePrivilege	2372	chrome.exe
Token: SeShutdownPrivilege	2372	chrome.exe
Token: SeCreatePagefilePrivilege	2372	chrome.exe
Token: SeShutdownPrivilege	2372	chrome.exe
Token: SeCreatePagefilePrivilege	2372	chrome.exe
Token: SeShutdownPrivilege	2372	chrome.exe
Token: SeCreatePagefilePrivilege	2372	chrome.exe
Token: SeShutdownPrivilege	2372	chrome.exe
Token: SeCreatePagefilePrivilege	2372	chrome.exe
Token: SeShutdownPrivilege	2372	chrome.exe
Token: SeCreatePagefilePrivilege	2372	chrome.exe
Token: SeShutdownPrivilege	2372	chrome.exe
Token: SeCreatePagefilePrivilege	2372	chrome.exe
Token: SeShutdownPrivilege	2372	chrome.exe
Token: SeCreatePagefilePrivilege	2372	chrome.exe
Token: SeShutdownPrivilege	2372	chrome.exe
Token: SeCreatePagefilePrivilege	2372	chrome.exe
Token: SeShutdownPrivilege	2372	chrome.exe
Token: SeCreatePagefilePrivilege	2372	chrome.exe
Token: SeShutdownPrivilege	2372	chrome.exe
Token: SeCreatePagefilePrivilege	2372	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5924	msedge.exe
5924	msedge.exe
5924	msedge.exe
5924	msedge.exe
5924	msedge.exe
5924	msedge.exe
5924	msedge.exe
5924	msedge.exe
5924	msedge.exe
5924	msedge.exe
5924	msedge.exe
5924	msedge.exe
5924	msedge.exe
5924	msedge.exe
5924	msedge.exe
5924	msedge.exe
5924	msedge.exe
5924	msedge.exe
5924	msedge.exe
5924	msedge.exe
5924	msedge.exe
5924	msedge.exe
5924	msedge.exe
5924	msedge.exe
5924	msedge.exe
5924	msedge.exe
5924	msedge.exe
5924	msedge.exe
5924	msedge.exe
5924	msedge.exe
5924	msedge.exe
5924	msedge.exe
5924	msedge.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5924	msedge.exe
5924	msedge.exe
5924	msedge.exe
5924	msedge.exe
5924	msedge.exe
5924	msedge.exe
5924	msedge.exe
5924	msedge.exe
5924	msedge.exe
5924	msedge.exe
5924	msedge.exe
5924	msedge.exe
5924	msedge.exe
5924	msedge.exe
5924	msedge.exe
5924	msedge.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5924 wrote to memory of 1952	5924	msedge.exe	89
PID 5924 wrote to memory of 4580	5924	msedge.exe	90
PID 5924 wrote to memory of 2324	5924	msedge.exe	91
PID 5924 wrote to memory of 2324	5924	msedge.exe	91
PID 5924 wrote to memory of 2324	5924	msedge.exe	91
PID 5924 wrote to memory of 1220	5924	msedge.exe	92
PID 5924 wrote to memory of 1220	5924	msedge.exe	92
PID 5924 wrote to memory of 3536	5924	msedge.exe	93
PID 5924 wrote to memory of 3788	5924	msedge.exe	94
PID 5924 wrote to memory of 3536	5924	msedge.exe	93
PID 5924 wrote to memory of 3536	5924	msedge.exe	93
PID 5924 wrote to memory of 3788	5924	msedge.exe	94
PID 5924 wrote to memory of 3788	5924	msedge.exe	94
PID 5924 wrote to memory of 252	5924	msedge.exe	96
PID 5924 wrote to memory of 252	5924	msedge.exe	96
PID 5924 wrote to memory of 252	5924	msedge.exe	96
PID 5924 wrote to memory of 256	5924	msedge.exe	97
PID 5924 wrote to memory of 256	5924	msedge.exe	97
PID 5924 wrote to memory of 256	5924	msedge.exe	97
PID 5924 wrote to memory of 5232	5924	msedge.exe	100
PID 5924 wrote to memory of 2936	5924	msedge.exe	99
PID 5924 wrote to memory of 5232	5924	msedge.exe	100
PID 5924 wrote to memory of 2936	5924	msedge.exe	99
PID 5924 wrote to memory of 6040	5924	msedge.exe	102
PID 2372 wrote to memory of 3976	2372	chrome.exe	106
PID 2372 wrote to memory of 3952	2372	chrome.exe	107
PID 2372 wrote to memory of 4640	2372	chrome.exe	108
PID 2372 wrote to memory of 4640	2372	chrome.exe	108
PID 2372 wrote to memory of 1616	2372	chrome.exe	109
PID 2372 wrote to memory of 1616	2372	chrome.exe	109
PID 2372 wrote to memory of 5116	2372	chrome.exe	111
PID 2372 wrote to memory of 5116	2372	chrome.exe	111
PID 2372 wrote to memory of 1828	2372	chrome.exe	112
PID 2372 wrote to memory of 1828	2372	chrome.exe	112
PID 2372 wrote to memory of 5072	2372	chrome.exe	113
PID 2372 wrote to memory of 5072	2372	chrome.exe	113
PID 2372 wrote to memory of 5204	2372	chrome.exe	114
PID 2372 wrote to memory of 5204	2372	chrome.exe	114
PID 2372 wrote to memory of 4320	2372	chrome.exe	115
PID 2372 wrote to memory of 5952	2372	chrome.exe	116
PID 2372 wrote to memory of 4532	2372	chrome.exe	117
PID 2372 wrote to memory of 5952	2372	chrome.exe	116
PID 2372 wrote to memory of 4532	2372	chrome.exe	117
PID 2372 wrote to memory of 6332	2372	chrome.exe	122
PID 2372 wrote to memory of 6332	2372	chrome.exe	122
PID 2372 wrote to memory of 6348	2372	chrome.exe	123
PID 2372 wrote to memory of 6356	2372	chrome.exe	125
PID 2372 wrote to memory of 6348	2372	chrome.exe	123
PID 2372 wrote to memory of 6340	2372	chrome.exe	124
PID 2372 wrote to memory of 6356	2372	chrome.exe	125
PID 2372 wrote to memory of 6340	2372	chrome.exe	124
PID 5924 wrote to memory of 6548	5924	msedge.exe	126
PID 5924 wrote to memory of 6556	5924	msedge.exe	127
PID 5924 wrote to memory of 6564	5924	msedge.exe	128
PID 2372 wrote to memory of 6880	2372	chrome.exe	131
PID 2372 wrote to memory of 6864	2372	chrome.exe	129
PID 2372 wrote to memory of 6880	2372	chrome.exe	131
PID 2372 wrote to memory of 6872	2372	chrome.exe	130
PID 2372 wrote to memory of 6864	2372	chrome.exe	129
PID 2372 wrote to memory of 6872	2372	chrome.exe	130
PID 2372 wrote to memory of 6888	2372	chrome.exe	139
PID 2372 wrote to memory of 6888	2372	chrome.exe	139
PID 2372 wrote to memory of 6060	2372	chrome.exe	133
PID 2372 wrote to memory of 6060	2372	chrome.exe	133

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://youareanidiot.org
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x328,0x7fff90ecc188,0x7fff90ecc194,0x7fff90ecc1a0
  2⤵
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1852,i,15726909604069735357,168767591357044467,524288 --field-trial-handle=2824,i,990114440844810734,627097469180907300,262144 --variations-seed-version --mojo-platform-channel-handle=3144 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1592,i,5121107975934126040,4337496267421114869,262144 --field-trial-handle=2824,i,990114440844810734,627097469180907300,262144 --variations-seed-version --mojo-platform-channel-handle=2820 /prefetch:2
  2⤵
  PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2268,i,8944403878260695599,18259893515503480329,524288 --field-trial-handle=2824,i,990114440844810734,627097469180907300,262144 --variations-seed-version --mojo-platform-channel-handle=3112 /prefetch:13
  2⤵
  PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,14895089523441673113,8435548826717604233,2097152 --field-trial-handle=2824,i,990114440844810734,627097469180907300,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:3536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,11623840434260026496,5277244357635599581,2097152 --field-trial-handle=2824,i,990114440844810734,627097469180907300,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4288,i,14883491449786974748,1294884334974677457,2097152 --field-trial-handle=2824,i,990114440844810734,627097469180907300,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:1
  2⤵
  PID:252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4332,i,7031517929280117306,12201395808461159163,2097152 --field-trial-handle=2824,i,990114440844810734,627097469180907300,262144 --variations-seed-version --mojo-platform-channel-handle=4408 /prefetch:9
  2⤵
  PID:256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4520,i,11231430897882263531,5966273134865192615,524288 --field-trial-handle=2824,i,990114440844810734,627097469180907300,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:14
  2⤵
  PID:2936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3848,i,483533073395058992,5625195149865824608,524288 --field-trial-handle=2824,i,990114440844810734,627097469180907300,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:14
  2⤵
  PID:5232
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,18012991287452469088,5724692842660700584,524288 --field-trial-handle=2824,i,990114440844810734,627097469180907300,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:14
  2⤵
  PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,18012991287452469088,5724692842660700584,524288 --field-trial-handle=2824,i,990114440844810734,627097469180907300,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:14
  2⤵
  PID:6040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4088,i,6782308611794295767,5349210188312730276,524288 --field-trial-handle=2824,i,990114440844810734,627097469180907300,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:14
  2⤵
  PID:6548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4136,i,17613267916641435902,18266601294339410103,524288 --field-trial-handle=2824,i,990114440844810734,627097469180907300,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:14
  2⤵
  PID:6556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4140,i,5705891022177695418,1743485866394023,524288 --field-trial-handle=2824,i,990114440844810734,627097469180907300,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:14
  2⤵
  PID:6564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Enumerates system info in registry
  PID:6408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2c0,0x7fff90ecc188,0x7fff90ecc194,0x7fff90ecc1a0
    3⤵
    PID:6800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,15665158401721141348,16712177674495264404,262144 --field-trial-handle=2300,i,8586014430791090485,8346475791178196123,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:2
    3⤵
    PID:2436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1876,i,5204123195308613521,7647523648373685609,524288 --field-trial-handle=2300,i,8586014430791090485,8346475791178196123,262144 --variations-seed-version --mojo-platform-channel-handle=2536 /prefetch:11
    3⤵
    - System Time Discovery
    PID:6428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2344,i,17218244389629533779,2491715084339886656,524288 --field-trial-handle=2300,i,8586014430791090485,8346475791178196123,262144 --variations-seed-version --mojo-platform-channel-handle=2940 /prefetch:13
    3⤵
    PID:7084
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4476,i,11450643608504128293,13474757122295393613,524288 --field-trial-handle=2300,i,8586014430791090485,8346475791178196123,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:14
    3⤵
    PID:6192
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4476,i,11450643608504128293,13474757122295393613,524288 --field-trial-handle=2300,i,8586014430791090485,8346475791178196123,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:14
    3⤵
    PID:3144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4584,i,1388935358457800987,5672472678861446274,524288 --field-trial-handle=2300,i,8586014430791090485,8346475791178196123,262144 --variations-seed-version --mojo-platform-channel-handle=4576 /prefetch:14
    3⤵
    PID:2272
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4692,i,5205254275033843061,6477176946228717164,524288 --field-trial-handle=2300,i,8586014430791090485,8346475791178196123,262144 --variations-seed-version --mojo-platform-channel-handle=4668 /prefetch:14
    3⤵
    PID:6628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4660,i,12384117390617787,4122654609866319533,524288 --field-trial-handle=2300,i,8586014430791090485,8346475791178196123,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:14
    3⤵
    PID:6936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4616,i,17020202279497453610,7469873134525025041,524288 --field-trial-handle=2300,i,8586014430791090485,8346475791178196123,262144 --variations-seed-version --mojo-platform-channel-handle=4676 /prefetch:14
    3⤵
    PID:4696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5032,i,11589189206175014434,8135661757816710376,524288 --field-trial-handle=2300,i,8586014430791090485,8346475791178196123,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:14
    3⤵
    PID:6872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5216,i,488658810404436223,3906080418608522156,524288 --field-trial-handle=2300,i,8586014430791090485,8346475791178196123,262144 --variations-seed-version --mojo-platform-channel-handle=4664 /prefetch:14
    3⤵
    PID:588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5208,i,17122702905978752447,9836939159665009425,524288 --field-trial-handle=2300,i,8586014430791090485,8346475791178196123,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:14
    3⤵
    PID:1080

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4416

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4980

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7fff8a2bc728,0x7fff8a2bc734,0x7fff8a2bc740
  2⤵
  PID:3976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1812,i,16633531453340409702,18254023699156745601,524288 --field-trial-handle=2032,i,16435498773233984646,2085524600792295050,262144 --variations-seed-version --mojo-platform-channel-handle=2080 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1640,i,7187346776350945941,15119039334944610390,262144 --field-trial-handle=2032,i,16435498773233984646,2085524600792295050,262144 --variations-seed-version --mojo-platform-channel-handle=2028 /prefetch:2
  2⤵
  PID:4640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2324,i,1786245702683135333,17875431865576534778,524288 --field-trial-handle=2032,i,16435498773233984646,2085524600792295050,262144 --variations-seed-version --mojo-platform-channel-handle=2468 /prefetch:13
  2⤵
  PID:1616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3236,i,2935692716248073525,5492167631854210753,2097152 --field-trial-handle=2032,i,16435498773233984646,2085524600792295050,262144 --variations-seed-version --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:5116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3240,i,3990148928420887382,2243239953765685698,2097152 --field-trial-handle=2032,i,16435498773233984646,2085524600792295050,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:1828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4672,i,6191988778193093518,934447023617629692,2097152 --field-trial-handle=2032,i,16435498773233984646,2085524600792295050,262144 --variations-seed-version --mojo-platform-channel-handle=4704 /prefetch:1
  2⤵
  PID:5072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4844,i,3225331972735729590,4754625656786910752,524288 --field-trial-handle=2032,i,16435498773233984646,2085524600792295050,262144 --variations-seed-version --mojo-platform-channel-handle=4736 /prefetch:14
  2⤵
  PID:5204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5436,i,8743580734677776059,3791195270210170325,524288 --field-trial-handle=2032,i,16435498773233984646,2085524600792295050,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:14
  2⤵
  PID:4320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5524,i,17079418967020912461,12128524594434411275,2097152 --field-trial-handle=2032,i,16435498773233984646,2085524600792295050,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:5952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5536,i,11899415602643128932,11780689215712983039,2097152 --field-trial-handle=2032,i,16435498773233984646,2085524600792295050,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:1
  2⤵
  PID:4532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5620,i,11376286989909813931,15208746581827836081,2097152 --field-trial-handle=2032,i,16435498773233984646,2085524600792295050,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:1
  2⤵
  PID:6332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5820,i,10321066746797771705,15177039700771136903,2097152 --field-trial-handle=2032,i,16435498773233984646,2085524600792295050,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:1
  2⤵
  PID:6348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5504,i,15669561188407982520,15124597795365984764,524288 --field-trial-handle=2032,i,16435498773233984646,2085524600792295050,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:14
  2⤵
  PID:6340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6020,i,14167462628108943479,5609957394039617351,2097152 --field-trial-handle=2032,i,16435498773233984646,2085524600792295050,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:1
  2⤵
  PID:6356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5824,i,5573068574085725447,10952627457449427181,2097152 --field-trial-handle=2032,i,16435498773233984646,2085524600792295050,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:1
  2⤵
  PID:6864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5852,i,15508773591938459082,12329173034898724244,524288 --field-trial-handle=2032,i,16435498773233984646,2085524600792295050,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:14
  2⤵
  PID:6872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6320,i,12871030257630675933,1104337381371488959,2097152 --field-trial-handle=2032,i,16435498773233984646,2085524600792295050,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:1
  2⤵
  PID:6880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6224,i,11065668702939745717,12520140571966437615,2097152 --field-trial-handle=2032,i,16435498773233984646,2085524600792295050,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:1
  2⤵
  PID:6888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6440,i,16974220668139835969,6610576584775145828,2097152 --field-trial-handle=2032,i,16435498773233984646,2085524600792295050,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:1
  2⤵
  PID:6060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3104,i,10413811853253336621,1016732015191878969,524288 --field-trial-handle=2032,i,16435498773233984646,2085524600792295050,262144 --variations-seed-version --mojo-platform-channel-handle=3404 /prefetch:14
  2⤵
  PID:256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6796,i,11258374153669050689,6364552708632541301,2097152 --field-trial-handle=2032,i,16435498773233984646,2085524600792295050,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:1
  2⤵
  PID:2636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=3468,i,5351746410130839030,10877100656383397543,2097152 --field-trial-handle=2032,i,16435498773233984646,2085524600792295050,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:9
  2⤵
  PID:1444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6708,i,17204984444239114056,5133241302721885515,2097152 --field-trial-handle=2032,i,16435498773233984646,2085524600792295050,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:6220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6684,i,8489358271074858198,5708656100447126149,2097152 --field-trial-handle=2032,i,16435498773233984646,2085524600792295050,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:1480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=6556,i,11817151074595667433,11245437351070956063,2097152 --field-trial-handle=2032,i,16435498773233984646,2085524600792295050,262144 --variations-seed-version --mojo-platform-channel-handle=6536 /prefetch:1
  2⤵
  PID:6888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=6564,i,2879632736202058722,14854037929944282823,2097152 --field-trial-handle=2032,i,16435498773233984646,2085524600792295050,262144 --variations-seed-version --mojo-platform-channel-handle=4708 /prefetch:1
  2⤵
  PID:6532

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1444

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1560

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:4280

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5660

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 216B
SHA256 2ba1ec75dc0be059785774e3a4d15c00c5f0f2e3822aaf0eecfd8e687637873a
MD5 2dd720b870ff40990f31f112db195df5
SHA1 e8d132bbc83ff6a058cc36cb6edfd88f03bba7b0
SHA512 f25ea489f3d45382d0dc1716a4bd4bfc09d9ed5c2248d6c09007595d6fba82fd3df9b4a79c059e1da55f4f780fa0dffd6d44b83f6bf1f882f496d4cac7b004fc
TLSH
T1E3D08C79908CFC8DCF4369F30A148802273D3A2CEC42120191A2BCE8A750D383C06139
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 3b8af36fbde8bdf4634e079f2fea89ff5afab31f85ba58b15f8e2a58de752728
MD5 abbd3f43ace4990397190d5606a04a19
SHA1 8ba3e225862c6baeeffc8c757c451b46fb460372
SHA512 069e15ffda24046c248689f6bc712a3e01812d61817649067fd789e63dc50c3a59c3134b3b0f25b326f952df72a92924945ba9c584f00d1afa720cef0eff51b0
SSDEEP 96:DvOTcO56/VbhUHSVw0fXsS0TLwBTMGgsJ1I:DvOTcO569bhUHSVw0fXsS0TLkTMGgs/I
TLSH
T1DDB18DF7C3E4D67DC92156F4AA156F1BCE6D0929031C3C16C9D8AE1B93E29B2D14138E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 859B
SHA256 3edcf2bcc70745cc581d5987bc1571c5d31eba8b0852d1de79bd23a73dca8ccf
MD5 f984d5c652c86119c7aa6faef996431a
SHA1 09f9eff8fecac4b1d2771875300ff9bf3888d9fa
SHA512 04eabd997abd5b11ed73af5055d94be8789d27c0365534aa226b7d6e84cfa229d23c53a01a6b81c35fda8aa5330c0c719265b21d2808ef9a10e981d3e11a725d
TLSH
T19B11AFA7F77E785B20B9556E0D48F8072A75A8350193A9E0CF57823DE0850F71B12443
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 d58c50d360925ece256621de2d0f938915dc85b50ec2b3ad9af8478cdeb92152
MD5 8d15a5d27a36173482c0bef14d354f7d
SHA1 9cf31bcd872fbc5bf31855e11787e4a5a92eef42
SHA512 86bff336f41c642e3152ff8a77713179044a6fe4cec09b40bcb581e56abc045468c44f721afce4caa2740a74ad5e57fe3fe957f4496fa78e68de849b6afa29e4
SSDEEP 192:WRPWoqW2v7xkAPRp2Wbd9GHsb+WNuNLKunV12/kYLetm2O1ViT6qEVyIsnAUge:WRPWnWCfXXgwgvf2MYZ2O1Va6qAe
TLSH
T17242A82EA914693B7CDBC219FD627767D7F5102271902E84EBFC992C15E7ACC222740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 fa4ac3e6e8f0dcf651550d9aad6b0a7eda0ac53953c670455d119d0a89b7f85b
MD5 6554c33cd21b14cfb01ba4c61c9cec4f
SHA1 f17f6cabd4afe4b3460a00595e374e9c4a3a5eac
SHA512 13bfab55ddc46f5c00bad1ed9c287602dd4dab5a576fcf796f476f770df6ea205a9cb45bf441ee86d3a51d6ab84bb0f8d6163bc82419d1f55060924b5d6037f9
SSDEEP 384:2sjaN7KxkXqKf/pUZNCgVLH2HfgslHFXODaN+ErU3+yHGtJidmUaR:2gaN7KxkXqKf/pUZNCgVLH2HfgspBOOB
TLSH
T11D52F767644C9A3B0FD8DA4CDC16BB4FACB50157A6A40C6857FB9C1903D57CB120A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 2a0bd9730773bd5af64860c0bf1cc63b508f66d3d39943f354f35cc82ce17861
MD5 fc40edb9b4efeda3bcbd8ad846d7c641
SHA1 c274b140a8a9cf3aa364a21e6d0e0848a118ad0e
SHA512 ca435543c1d4ad8effc43563c04c02290bdde5a49d57723761fbaddeb072a3ab8c83b28b4d10f3e42d33754ac706f79737c3f239d20645985b792530807d5cf4
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 b637a25096621181158f27d4d44738d082d916b788e77e0e14ef73d2bbf0e16b
MD5 b5faa64037c212aa831fc337eeadbafd
SHA1 e6ef45de1fd7acd922d4aef107d27c7602e8b5d6
SHA512 69cd4f85674a72a35ac28ec4cc940ac8532a1194d2847733d7aebfef114458c13c99325edd3abd1874e195fdd1ef26fc7ef77da2c784343b679928ff9d928fa2
TLSH
T1CFA0023042C80510DD2455F2A472154216425C2DD470470358D28844EEAB4C0C501954
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 05ace0034ce988e0af20d3d69fcbffbce1c9ac5ac5cb78a42036169ccc15c9c5
MD5 21a12a64c6a5b9677483bc638946eb2e
SHA1 fa70779330b21397ebe945e5e7cf0982d59b20d9
SHA512 47862d55620e841629e166116f6ec3d3737a9b4f70c21a99b5a61fc6e04cd651dc2fd695137289d1f6199f08c67aca183f21bf88c15690b1e7b283518820a092
SSDEEP 96:SC0d+CVgOeTnnGBfYZSK3/jKRDotok5VcDzB6gGyvhyLfOL/EbZP9v4a:SC0JeGnpDUDItE1mL/Ebj
TLSH
T1DCA12C71B46C997354B69889F9527B43CDA521ABDA31AE44EDC95F0C12FB0EC0342537
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 125KB
SHA256 db15d98e16172b6136ef08719ed1396649562ce2d4066ccc6bb21af15b0e1943
MD5 45200ebd2e5d5b133033a6d8fff58bc4
SHA1 5ad5903566e64991c1578b9639849bbf6d2f3f4b
SHA512 e62ae75a9c15eb8bd3082e586c3ac9b24b8adfdcc9cd90570085d65c95ec9c88141ec21f13ab859f1089fc19ce370f792a72a967f578b57f6f2e01d7720aa70c
SSDEEP 3072:8u2gtgPMzIJQbxCLIBg5Bv3tHLZQosLYNO0OCB4RECyNDyOkt:86VzuQb4kBwv39N2ENWRECyFyOU
TLSH
T1B2C312E1FB4F9B661CA44A6C312F5E122EE275ADC0AF6DD8BC8123C842CC79C4D67455
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 125KB
SHA256 688048712ac2c42d8a6847a86799042192c885a80007dc9f571c1d536a567ba2
MD5 01ee2e32f1c399d11b34c9a16dc748ff
SHA1 edda0e502599a1548be4ae3e0f1a7efdc6ef2bda
SHA512 00f235e7c272b0f1e13c235fbb32c479c6bcc893d4cb7fbb3919f9b04d99d3dca3b159dac3493303d6428a75dce17483aacb16a2ec882366137a2101cbadb778
SSDEEP 3072:Vu2gtgPMzIJQbxCLIBg5Bv3tHLZQosLYNO0OCB4RECyNDyOkt:V6VzuQb4kBwv39N2ENWRECyFyOU
TLSH
T1C9C312E1FB0F9B661CA48A6C312F5E122EE275ADC0AF6DD8BC8123C842CC79C4D67455
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 e2cc1d4d00526f020d431721155aff61c9c0b3d16520a4d3506620b049d65f12
MD5 4e04397b6cd0f5d67cfbaa74499ad812
SHA1 bf738da478e23015d9913782534dcbcf1d15116b
SHA512 22126420acccee027ad3de158d48d2014ec8a0030397cce61a6d454814ece747959fd4c4bb50cf521eaf8a33eb2842795f8c9df0b9962f8505af2b63f3f4df53
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P78:fwUQC5VwBIiElEd2K57P78
TLSH
T130B3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c36ac766a384a109222b8b647d2f5c1c2e6c4672a4a2c6b8a01f6eac0a5df074
MD5 f9f896b0e6f281d55b1ca3fa3c1ccdcd
SHA1 db44df3874cd86a961c82d25f3ae2004f249b2df
SHA512 6b8c8d305c2d7e4a3b5efb6e1967d7db1b1ffdb7979edd315013037da369c923060dae4ef8a7219176aa7e0bc1fa4cb98e48470ea2f569243a95d3301f5a40bd
TLSH
T160D09BD575046A14C5A1303A21D1935392604835741945874051E55D5C5479743FB5BD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b53c58762bff2a5723ae446675e8f65fd50818b95383c8f3c7efef01af06e466
MD5 629a18fe1b7a241215c77a30d7d8d7ee
SHA1 5e7bd5b514f4e46a4b986c8b89d0025cf81a1f36
SHA512 04fd58619789dc107f680a57dba3aec42e4bab7c29c0defd7e1b8ca2d078ca4c91317932ff076171bae60d370b28de32c94039c6ab690d5004ddcb857977f38a
TLSH
T182D09BD575146914C5A1303E21D2935392504835601945874051E56D5C5479743FB5AD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 64e1a01015c69eda3cc7664c301fa639980ee588d96de56354f90250f25c23c1
MD5 94a008bc8e25ff38f4cbd3e29ca39916
SHA1 c2a358b44cd118f71d0a4ed037edff780c9824f1
SHA512 e94508197b75561f70d1cb3f18eab6e1cc3aded4924fee30d2f14d69fe5cd672eea9a38b4c25e93cad4961356b1ef92c3f50b6d92df0fae70bf930e545bb3eeb
TLSH
T1BBD0A7E4782577A0D139103D4150520152794572356B468790649C0D9974185A2FBAA9
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1206c79319d54e09f451ea00db98a169787c1fca6dbd569d1b421046db4d6eba
MD5 09cbcb4f605d136ff43939ab326e9e0d
SHA1 e9a13dea215d43f6731738b4086aa0ef1d69a3cc
SHA512 80d150d2fc5afa76845f4298cdcb45ccd9aa1eb887a19d4926473c7afac38d700d27fafb3d86831d4b752840176e4fa761e45f3ffeb396d63aa0fcba412af76e
TLSH
T112D023F4B604A760C12A403D5551F30257F24534307FCA63D0709C0D6858158D3FF56D
MD5 SHA1 SHA512 TLSH

Submit Download

8611bb3f-692a-431c-9c27-aba5447fdb76.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8611bb3f-692a-431c-9c27-aba5447fdb76.tmp
Size 14KB
SHA256 f80e62fa5b627d62c0917dfdd8b4a4033dce94a8922648a3ff663eee27113137
MD5 4c83f44bbd63b8fc7a49551f6c335fee
SHA1 b68acc431fd1b055c9eeb2b055b14540547354a5
SHA512 d98960b90af9c8a124d5f22b66468d6ae903bf1195df4783dbc8887ca4fdf2b99c38afc8f3174f17f4a40eee60f43a83bc16ecc179a5b78698df7510f4098283
SSDEEP 192:sxR6RByM/jK1Ml8wbv/fksutWsmZUzoA8pi/RH6+WNIYxvBuGrIgIJ:sxR6tlv/fksuQPi/+IS9s
TLSH
T16B52D815AA389977CCDBD20DFA457F53D6F81533A1905E44AAFC9A1C00E6AED2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 fa839fc66f24747bde94672a76c3cd73c4aa7640b353f4f63d61670afe49ecd3
MD5 000f8524d4be7c20c96ba4fb57116d8b
SHA1 0d7181a4f50eaa07a186c7241e2a799f504bbf98
SHA512 85cd5430458efeb41aef3aae638f69666a9767b41b2bd37293280e3a7eb13c490a804d1bacf9414ab2d7ea42b4179f275c89a238300f62a3c801b5cded303410
TLSH
T1106181E4EF2D19F3D32590B753E086D936B0A881B62B2EBAC174513F8C46F186C4C453
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59332c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59332c.TMP
Size 3KB
SHA256 d116d10eaca127cd69e641e4ef74c820fe785828829558b97dcfbdd0c05ee8bc
MD5 56ed3f93ce10282e3736bd81a17df033
SHA1 8e5429d9bb701d54dc90194d4175aec48e2f3d09
SHA512 9a2b90fd8036236c5f098511d6d3054b07681e2ea2c1ccd36fed5e0ad706176bc76a31550074a85493c0b03e6d1ac21e72394c2dd8164ecf9835514a426a60d7
TLSH
T1246181E4EF2E19F3D325A0B753E086D936B0A885B6272EBAC170513F9C46F186C8C453
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 399B
SHA256 55f8fa21c3f0d42c973aedf538f1ade32563ae4a1e7107c939ab82b4a4d7859a
MD5 a15ac2782bb6b4407d11979316f678fd
SHA1 b64eaf0810e180d99b83bba8e366b2e3416c5881
SHA512 370b43c7e434c6cc9328d266c1c9db327621e2c95ad13d953c4d63457a141fbf2be0b35072de96becc29048224d3646535a149229fc2ba367c7903d3e3e79bdb
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 319B
SHA256 93bcf65696e5a943d8c9498c0097a2cc749ad7ebd57b6b8d4f78a6ce442177c0
MD5 777504545e116d6df6ddb5f3f9d59bb3
SHA1 ddbcd2fec720a3562e6a2431a110eae4461ac057
SHA512 530f72522a086ef176c7ddc03f0b4ea84bb60f9e9853a0b29f23f5d3d4088cb60f4bdf98f57655e6e1fb7f10d6afbe1a425b9d6f45eb6205ddf2037164bb9cd7
TLSH
T1B5E0268454C8CA69A9E468E786FD734A82D03803EBC97A071B088C806241A41A2CB7B5
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 b0c0203c3cd475d0a36c17002301e5b3d5b20219a4faa788b12291790c43955a
MD5 894854a4bf5569fa606df00c4f57ee3a
SHA1 c3a4b687667d1278f2d968809098a3e2c886ce6e
SHA512 b79617250e36e0e34e6df7658237664e9fa5ef809ae8e304bd098818c0540ebbada2fd7916b24a1109c13470d5a868084b0ddb0cf588f05363e895964376bc71
TLSH
T11C113DF3C3D5D56E891116F05A24AE2BCE1D0506421C7D15C9D4FF2797E3475E10159F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 b984500b58ff6a588f9a2724dce272a3c135d14adf7c2f63cd2524825eb9f7ff
MD5 6c9ffdf12513c7c5f9d5c9e2ff4e9da6
SHA1 87ef1307c0676b43acb906facc3f06238efafee9
SHA512 dbd751a8eb5241a16f19df5339bb06105ee6b8917e4076682fc288e6a07e05c13a8c8b8bfd788bee42a5e90f739998b33c2110768982d485a98bee8cb4144811
SSDEEP 192:sxRJRByM/jK1Ml8wbv/fksPtWsmZUzoA8pi/RH6+WNIYxJBuGrIgDYJ:sxRJtlv/fksPQPi/+IY9I
TLSH
T10062D915AA38997BCCDBD20DFA417F53D6F81533A1905E44AAFC9A1C04E66ED2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 d1a2e7042ccf594267eb7e237c4a3fd4b7a32d4eb89e813bda8f93492a237636
MD5 ffe1abe3964214ea248b5a4ccb205635
SHA1 319cf86f958a849a2fd4ee1b706fa74b50c27c2a
SHA512 c22f55dfbec4d63f8a23977aa0f1dc408117c54a730895b70c208d5d30d8e53771712454cfcc0de1518b7e10854b12e18f28a8a46a0f2ff19703ec008dc1762b
SSDEEP 192:sxRJRByM/jK1Ml88bv/fksQWpVxtZsmZUzoA8pi/RH6+WNIYxcBjgrIgDqJ:sxRJt3v/fksQWvxLPi/+IJOC
TLSH
T1F262E915A928997BDCDBD20DFA417F63D2F81533A1905E44AAFCDA1C00E76ED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 6ac81928963ccd56fbe5483a002f314fdedee0ba42055b4f507a73953f1ee231
MD5 0582dea04ac2842b6b99025b5ee7618e
SHA1 3ec124b88f73f09824043b3f04f92a5e42f5f9c4
SHA512 baea7376633c08e836e0daa1b67d31f26ff2ab47cabac311cb8c210edf2c3ab191375d88c866572b178e60f477b05f5874349f59733114c60db9a8b244020ad6
SSDEEP 768:0xCyAjWgbrfM18F1+UoAYDCx9Tuqh0VfUC9xbog/OV9rVAcroJPe2k:0xCyAjWgbrfM1u1jacpAHJPPk
TLSH
T12FC2EC3B640CC77E4F844AADEC25AED77DD802CB97984D544BEA880C03C77EB521A5DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 363babe88e8985c19d7882f9fab8e1bc84fb0b8558b48e7ddef4aab77d36d93e
MD5 e7ad9b1a1ea455f6e204498eaf0aa04b
SHA1 cf21e0acb3096958348785d7fef66b3ac7587a27
SHA512 a4cd0c53230ccfc85d47904ad1a86255222d926a433be7010f7ec6a1216263235fec9cb10a7d4453722cafcac35675efa9d6701af7a8fef4381d2af44480b35a
TLSH
T11DE02014B5C4CE7DE6953087097CA30883D4B807D7C83E071F00C98052866047267663
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 2eeadbf4f6d545728cba8c057f6feb0252f42eb9d1299c241e59b025c1c85300
MD5 7729e8deb92f8fe099634b3c06fc58d1
SHA1 cae8ea4ef6c7ca41e72b58af90421197d65ccbcd
SHA512 546ff2b33bbc1df46707910cdfcf9b6083c96f3ca35484100e9e20a158b1613d433aeba3decb81ce8088011e6515652f4221916b84b2dc524070797de3fdec48
TLSH
T1F0E0D87475CDCB2E66C6308B5268F70CC3E27453DBC96A6A2F0898C2620A540B247661
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 46f19a2ae3dfafce4ce8ffe3f18b9de3a9fff579be8ffcd987d5a8b47e5ef3b2
MD5 eca54e8c6e0539756f67f1c10d7eaa30
SHA1 f237121997ad0dfa936b06abefd0817c00dddfdd
SHA512 dc09e82c3217868b83b212dc8b56a73e32bf57ce31599488c5fdb2ad4e507acc3dba788c06af4957b5da9109a364304120417aee2954ec9d0d0accbc6a80e80c
TLSH
T182E0867095C9CB7D6A84708746BCBB0DC2F07807DBC97F7B5B084881A145658B6BBBE1
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 87bf430f1304cc154bfab3a83b2f9a067496f42703e0bb64dce19ffbe02ee643
MD5 38755983e91a70829ea8d8791e617680
SHA1 420b284deb6c3bda1513346042fb7ce57f45d5d5
SHA512 d5877e414b2b1a4b276d7da8ba3d82f56f95592b74d18c6bfd0ee9dcab8f98a77457d81ae6c428379d99033f763c2c6ded356d69c110d8aca96c34b2abfab64e
SSDEEP 48:KccIfKF+cXyRAInKVecV1I9K+wIHyhOIXKTKQ8:KccwKF+OCAwKVeK1GK+wCyO8KTKL
TLSH
T1E8C11D52B53A465138BD69198190C627DAC2F077311AA82B7FE819B20B7FF019EFC4DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 12KB
SHA256 cc98913314eedfbffe88940b3d9f267c709ed10c315ca305813d05c1f243375f
MD5 2e47a0331d3a5a8cf2e44cd8a2a0c264
SHA1 c9431af1214dac8d539e611abb87d2ea759e81e1
SHA512 bba27f2a473f8367d52f468f6f7bea6f703942654959c59696f10ca06f08bb6819b27a2bb3b35288e964674edf1566b481a779e81655f267f00a56f90947ec0e
SSDEEP 192:sQrIII6b6MIME1YcYPZcOOJAsWgl8+MQ2s7ogd:sQrIII6b6MIMiBIJOqsTj2sXd
TLSH
T15F42956A26051B77D2DF5F7613A68640ABD88C824172252E31633C0F8DF3E978AC57F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 319B
SHA256 e8302838b8a65b6fe100ae9d711d0dff4b7bcdec196f1a132f3da0c67352680f
MD5 9c7c91142a761c42822f899cd589fe3f
SHA1 4e371b0e6b0c4cc28dd1449e8124dcf59dd8ae88
SHA512 1913ea4269df0f4412ece0c8d0f4b65707754d268a828f83404f315166eb0fdd6cdd71e2024680b60c16c7aba601ee4f95ac061199c4068610f905771d101634
TLSH
T194E02054FCC4C57EFA94208B527C63C882C03443EFC56A0B9F00C484E049100724BF62
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 1a65a9e10ba4cac38375e1cfb806aa80df653358135a690cc0eabb3dbeb6ecab
MD5 94ebd7093578c41392a3b8e4761e66b6
SHA1 9f1950aedde3dbabe691bfffd5a017bd03869e1b
SHA512 9a8e32ba4c55d3264571c533701f64070e87de841f9a7b3e72d38bf51a9f56864f9ccddf1089e0e030afc3205ccf45a8ed1500b72220cf3e33e924149b5d62aa
TLSH
T1A1210455F330C148D15A867E907F9B360734E8168FBCEC0F547A20646E75B540D8B2E5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 337B
SHA256 112b39e3d985a4730d830723901fa8e2703ec947ca46e1184ceb92f6e9d8e7fe
MD5 f5699459d84a5826776f4a4c4b669de2
SHA1 a1bb1ebb314e0da44be8d00af107e6735ab05110
SHA512 783fb6e3f19f7987fd9dfe4df91a9e9285ed2ed8cacf129b7a64d8f1b6288649a8989b84ab255b8cbe1bbf3871d0cb3814ad47be03b467215da75f2484bbf949
TLSH
T1C0E0D854B8C8C56FB694209701BCB38882D13947EFC42F065F04CC859119145729BA62
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 b462ce6893b58a44693b954d02894ee99dbc680fbc2c3ebec96f94eb2c0abdb1
MD5 d5374e5ec6dbacb347b108c532652cc9
SHA1 78515ffb259e1fcf82c985de193e3e99300a5679
SHA512 ce8e42c2591ae74c7aaed7a10433dc8de7314c0ab00ab734179365051b07bed2a550192e607609f98da8100733edd66af907e9d3f1b61ce9491f54cd6c0fa5cb
SSDEEP 3:MsEllllkEthXllkl2zEeloKll/l:/M/xT02zNXltl
TLSH
T12244041C7FDC1405C51510714111C3544370DC5C471557C374511C57DDC7D400D01000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 61833deb21889349145d1eef5f75eaa84ab69d41f05b3a74e8ba5fc27b6bef22
MD5 f5d5b8875d3fc0a141cae636bb5febba
SHA1 824c39402d84360ca875d059446b3cdb5ad30647
SHA512 57818af1ee57f7d5b0c122dfd6930ddf9bcb961119ad099c1a58fe4e8dbb3f8f9c8855f1488946e5e628ea430eda6a2366cf662d539ea2bd69c7f59eae94236a
SSDEEP 768:1rv+4UNbdA3dV7/kKL2StbjF669yrqUjWiIwwxMt32ewBKZOO04:1bsbi3rAEjF66INWZTMF2evZZ3
TLSH
T11113BE70B8285AB3CDF2D785B1137687AFB4519396C40FA8CACD6B0D069B4D9234BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 22e978e37c11343faeccd785096657facf6f8718a7fed4ee0f54d1871619728a
MD5 d212b394de8f5ef54abae086e93b4032
SHA1 ec761be032a9f1b59090063aab7c90f2ecacfcf8
SHA512 efaa56ea089163a7e0a242be8686d0fed83b31590785eff4b3440cce09000be50a76327daed07f6d83023d0cc638a82d0048477815fd32724dbff62483f2eecb
SSDEEP 768:Ed3EVi/kKL2StujF669yrqUjWiIwwxMtm9KAi4q+i2ewBKZOO0K:Ed3iFdjF66INWZTM09KArdi2evZZB
TLSH
T18713ADBCAC681D7F84EEF748620A26A2ADA41173D5F44E4CD7CD570DC172889FB47826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 0366de567a1e6e524d2ad0daf2672edfe4e96dd25dffc466acee71f14bbed496
MD5 b6712a9ea10ba2ca96e12e652ba9ffb8
SHA1 bbfa729ab72e8777e95482837a8377e1bfb9cafb
SHA512 c154df8994d72a51b2a3b086e9e7d4ed287e140f2dbaa31ad48ac8914a82422bb22200a99aaf0e533d1330199a6fda99dd467c5c8daf2f539244bfe4b3d0fccf
SSDEEP 768:rL3dVO/kKL2StbjF669yrqUjWiIwwxMt32ewBKZOO0K:rL3rxEjF66INWZTMF2evZZB
TLSH
T18FF2BEB0AC645AB3CDE6D745B2123387AFB491A3E2D40F98CADDA70D069B4D91347C36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 89be3f803b342a187cb78ab75f1856ab0b6ad5aa185ebe85f8790fd754783714
MD5 1c92de03d8565bbdd923bb2738a4a707
SHA1 7d1da3eacb72d7d072b7c6f9d929a6664dfab473
SHA512 f357f6557c8436fad35deab64774bd084962159de3451ab4c441a1f7ec92c1fc586e849d4aff9e7a4255e5b266002173090c65bb7b581974f94b014b3415f200
SSDEEP 768:/23EVO/kKL2StbjF669yrqUjWiIwwxMt32ewBKZOO0K:/23ixEjF66INWZTMF2evZZB
TLSH
T1A0F2BEB0AC6459B3CDE6D745721233879FB491A3D2D80E98CADDA70D05975DC1347C36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 9a379d5d798998edcb2d1dc5f437192ac88f0c49402b86e5595b5889a34719f1
MD5 49c76c746d119f53e997cfa6a6253f5c
SHA1 889ec9d29780c1e6bb5acffc667b038af27f0b13
SHA512 e726f922414465f7a7483d17728ab98d20217f55c87d94d1ab45efd4457fdc65cf36430f687ad1ccd04ac7044f7a25d63db7226a6d3ca2c33702b47abb25e19e
SSDEEP 768:arv+4UNbdl3zPkKL2StsjF669yrqUjWiIwwxMR+Uiler:absbX3IdjF66INWZTMwUsQ
TLSH
T1C203CE30AC589AB7CDF2D28672533783BFB4509396C50B88CADD670D469B4DD2347A2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 33e8a52f1d8236a44a010e9fac975f9f79e4d849c41c5e5ceff491a63250619f
MD5 53648946ffa2910fd686fec5e882b115
SHA1 c15db14e734d83a88c026681aa417b1cb46a0652
SHA512 0b0672dd0a5c526a4200e72036102dd097d1c6a71bdbb61673d65be227796474e3d4bb6f97727e7ca60439961cbc3881fcbb5016ce32a2159d045e44119e3fda
SSDEEP 3:MsEllllkEthXllkl2zEeleiltl:/M/xT02zNJl
TLSH
T17B44041C7FCC1415C51C10714111C35003F1DC5405117F4334510C13DFC7D401C10401
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

039f43ad-1b47-4bf8-b700-f7296edea601.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\039f43ad-1b47-4bf8-b700-f7296edea601.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

fc4748f7-cf95-4f73-8452-21bebb129210.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\fc4748f7-cf95-4f73-8452-21bebb129210.tmp
Size 35KB
SHA256 4d122912b9197e94df69f188c3dbb9f976ed1f0f565919485fc7771d2c4a3f16
MD5 85653624e51ccfa2a29837ddc49b6ed8
SHA1 855e1961bc730442f23d8abf6f8dd42c6485c598
SHA512 3ff839c9e9f195193eb2f8d800822ed614f9f5c8a852f50509f47b969f10b50f29ac7c64d521ad815c547f56b41dead52dc360f4cd5f4fedcbac0a08cc808989
SSDEEP 768:v23dVO/kKL2StbjF669yrqUjWiIwwxMt32ewBKZOO0K:v23rxEjF66INWZTMF2evZZB
TLSH
T1EFF2BEB0AC645AB3CDE6D745B21233879FB491A3E2D40F98CADDA70D06975D81347C3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcb59c3f-f9b2-4ef2-a913-37ca0cb33356.tmp

Path C:\Users\Admin\AppData\Local\Temp\dcb59c3f-f9b2-4ef2-a913-37ca0cb33356.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2372_611855058\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6408_1228858652\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download