hxxps://mc-mods[.]online/

Analysis

user interaction
yes
max time kernel
172s
max time network
173s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 13:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://mc-mods.online/
Sample260809-p8rdsaxhrc

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 4 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4412	msedge.exe
4588	chrome.exe
5480	msedge.exe
3320	msedge.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307540355510206"	msedge.exe

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{245498D2-DE3B-44A0-917C-A5B518E6A760}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{83DF1AC7-9FC8-474B-B3C3-90EA95DF22D2}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{C4BC8C89-27F6-4E81-B8AD-39899E44BF1B}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2228	chrome.exe
2228	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
2228	chrome.exe
2228	chrome.exe
2228	chrome.exe
2228	chrome.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
792	msedge.exe
4276	msedge.exe
4276	msedge.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2228	chrome.exe
Token: SeCreatePagefilePrivilege	2228	chrome.exe
Token: SeShutdownPrivilege	2228	chrome.exe
Token: SeCreatePagefilePrivilege	2228	chrome.exe
Token: SeShutdownPrivilege	2228	chrome.exe
Token: SeCreatePagefilePrivilege	2228	chrome.exe
Token: SeShutdownPrivilege	2228	chrome.exe
Token: SeCreatePagefilePrivilege	2228	chrome.exe
Token: SeShutdownPrivilege	2228	chrome.exe
Token: SeCreatePagefilePrivilege	2228	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
2228	chrome.exe
2228	chrome.exe
2228	chrome.exe
2228	chrome.exe
2228	chrome.exe
2228	chrome.exe
2228	chrome.exe
2228	chrome.exe
2228	chrome.exe
2228	chrome.exe
2228	chrome.exe
2228	chrome.exe
2228	chrome.exe
2228	chrome.exe
2228	chrome.exe
2228	chrome.exe
2228	chrome.exe
2228	chrome.exe
2228	chrome.exe
2228	chrome.exe
2228	chrome.exe
2228	chrome.exe
2228	chrome.exe
2228	chrome.exe
2228	chrome.exe
2228	chrome.exe
2228	chrome.exe
2228	chrome.exe
2228	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
2228	chrome.exe
2228	chrome.exe
2228	chrome.exe
2228	chrome.exe
2228	chrome.exe
2228	chrome.exe
2228	chrome.exe
2228	chrome.exe
2228	chrome.exe
2228	chrome.exe
2228	chrome.exe
2228	chrome.exe
2228	chrome.exe
2228	chrome.exe
2228	chrome.exe
2228	chrome.exe
2228	chrome.exe
2228	chrome.exe
2228	chrome.exe
2228	chrome.exe
2228	chrome.exe
2228	chrome.exe
2228	chrome.exe
2228	chrome.exe
2228	chrome.exe
2228	chrome.exe
2228	chrome.exe
2228	chrome.exe
2228	chrome.exe
2228	chrome.exe
2228	chrome.exe
2228	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1760 wrote to memory of 4616	1760	msedge.exe	86
PID 1760 wrote to memory of 4412	1760	msedge.exe	87
PID 1760 wrote to memory of 1872	1760	msedge.exe	88
PID 1760 wrote to memory of 1872	1760	msedge.exe	88
PID 1760 wrote to memory of 1872	1760	msedge.exe	88
PID 1760 wrote to memory of 1956	1760	msedge.exe	89
PID 1760 wrote to memory of 1956	1760	msedge.exe	89
PID 1760 wrote to memory of 4704	1760	msedge.exe	91
PID 1760 wrote to memory of 1704	1760	msedge.exe	92
PID 1760 wrote to memory of 4704	1760	msedge.exe	91
PID 1760 wrote to memory of 4704	1760	msedge.exe	91
PID 1760 wrote to memory of 1704	1760	msedge.exe	92
PID 1760 wrote to memory of 1704	1760	msedge.exe	92
PID 1760 wrote to memory of 2428	1760	msedge.exe	93
PID 1760 wrote to memory of 2428	1760	msedge.exe	93
PID 1760 wrote to memory of 2428	1760	msedge.exe	93
PID 1760 wrote to memory of 4104	1760	msedge.exe	94
PID 1760 wrote to memory of 4104	1760	msedge.exe	94
PID 1760 wrote to memory of 4104	1760	msedge.exe	94
PID 1760 wrote to memory of 5772	1760	msedge.exe	97
PID 1760 wrote to memory of 5772	1760	msedge.exe	97
PID 1760 wrote to memory of 5772	1760	msedge.exe	97
PID 1760 wrote to memory of 2500	1760	msedge.exe	98
PID 1760 wrote to memory of 2500	1760	msedge.exe	98
PID 1760 wrote to memory of 4716	1760	msedge.exe	99
PID 1760 wrote to memory of 4716	1760	msedge.exe	99
PID 1760 wrote to memory of 2124	1760	msedge.exe	103
PID 1760 wrote to memory of 3808	1760	msedge.exe	110
PID 1760 wrote to memory of 3796	1760	msedge.exe	111
PID 1760 wrote to memory of 5880	1760	msedge.exe	112
PID 2228 wrote to memory of 5080	2228	chrome.exe	123
PID 2228 wrote to memory of 4588	2228	chrome.exe	124
PID 2228 wrote to memory of 1732	2228	chrome.exe	125
PID 2228 wrote to memory of 1732	2228	chrome.exe	125
PID 2228 wrote to memory of 4568	2228	chrome.exe	126
PID 2228 wrote to memory of 4568	2228	chrome.exe	126
PID 2228 wrote to memory of 4136	2228	chrome.exe	128
PID 2228 wrote to memory of 5172	2228	chrome.exe	129
PID 2228 wrote to memory of 4136	2228	chrome.exe	128
PID 2228 wrote to memory of 5172	2228	chrome.exe	129
PID 2228 wrote to memory of 6040	2228	chrome.exe	130
PID 2228 wrote to memory of 6040	2228	chrome.exe	130
PID 2228 wrote to memory of 1704	2228	chrome.exe	131
PID 2228 wrote to memory of 1704	2228	chrome.exe	131
PID 2228 wrote to memory of 4108	2228	chrome.exe	132
PID 5920 wrote to memory of 792	5920	msedge.exe	136
PID 792 wrote to memory of 512	792	msedge.exe	137
PID 792 wrote to memory of 5480	792	msedge.exe	139
PID 792 wrote to memory of 1396	792	msedge.exe	140
PID 792 wrote to memory of 2984	792	msedge.exe	141
PID 792 wrote to memory of 1396	792	msedge.exe	140
PID 792 wrote to memory of 1396	792	msedge.exe	140
PID 792 wrote to memory of 2984	792	msedge.exe	141
PID 792 wrote to memory of 5904	792	msedge.exe	142
PID 792 wrote to memory of 4064	792	msedge.exe	143
PID 792 wrote to memory of 5904	792	msedge.exe	142
PID 792 wrote to memory of 5904	792	msedge.exe	142
PID 792 wrote to memory of 4064	792	msedge.exe	143
PID 792 wrote to memory of 4064	792	msedge.exe	143
PID 792 wrote to memory of 6140	792	msedge.exe	144
PID 792 wrote to memory of 6140	792	msedge.exe	144
PID 792 wrote to memory of 1648	792	msedge.exe	145
PID 792 wrote to memory of 1648	792	msedge.exe	145
PID 792 wrote to memory of 3196	792	msedge.exe	146

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://mc-mods.online/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7ffb32f3c188,0x7ffb32f3c194,0x7ffb32f3c1a0
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1964,i,14409257682992009006,5625630727485388711,524288 --field-trial-handle=2364,i,10840614560624268728,15174566151894335228,262144 --variations-seed-version --mojo-platform-channel-handle=2392 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1668,i,17300061263687402675,12512813895782395039,262144 --field-trial-handle=2364,i,10840614560624268728,15174566151894335228,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:2
  2⤵
  PID:1872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2344,i,4782093160582342725,8844020417335715301,524288 --field-trial-handle=2364,i,10840614560624268728,15174566151894335228,262144 --variations-seed-version --mojo-platform-channel-handle=2520 /prefetch:8
  2⤵
  PID:1956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,3914290797776962192,12863333901927993704,2097152 --field-trial-handle=2364,i,10840614560624268728,15174566151894335228,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3368,i,3755176190752824700,12598434949395687839,2097152 --field-trial-handle=2364,i,10840614560624268728,15174566151894335228,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4236,i,14054856910846700930,9343357001910263306,2097152 --field-trial-handle=2364,i,10840614560624268728,15174566151894335228,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:1
  2⤵
  PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4292,i,5344982525636626975,7733250061280855397,2097152 --field-trial-handle=2364,i,10840614560624268728,15174566151894335228,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:2
  2⤵
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5028,i,15635822871222106766,2098883765998101928,2097152 --field-trial-handle=2364,i,10840614560624268728,15174566151894335228,262144 --variations-seed-version --mojo-platform-channel-handle=4548 /prefetch:1
  2⤵
  PID:5772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5296,i,12313597170120373229,15074411389273428818,524288 --field-trial-handle=2364,i,10840614560624268728,15174566151894335228,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:8
  2⤵
  PID:2500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5300,i,14036794667736277403,3817168526415980833,524288 --field-trial-handle=2364,i,10840614560624268728,15174566151894335228,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:8
  2⤵
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3716,i,16744454799957391290,10135894987983307084,524288 --field-trial-handle=2364,i,10840614560624268728,15174566151894335228,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:8
  2⤵
  PID:5284
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3716,i,16744454799957391290,10135894987983307084,524288 --field-trial-handle=2364,i,10840614560624268728,15174566151894335228,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:8
  2⤵
  PID:2124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4424,i,5740695213140344395,809771263461866437,524288 --field-trial-handle=2364,i,10840614560624268728,15174566151894335228,262144 --variations-seed-version --mojo-platform-channel-handle=560 /prefetch:8
  2⤵
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4428,i,17706796191286541225,9291238746931806214,524288 --field-trial-handle=2364,i,10840614560624268728,15174566151894335228,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:8
  2⤵
  PID:3796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4400,i,4075442957242499084,1633759987746379684,524288 --field-trial-handle=2364,i,10840614560624268728,15174566151894335228,262144 --variations-seed-version --mojo-platform-channel-handle=5088 /prefetch:8
  2⤵
  PID:5880

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3796

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:5508

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffb31efc728,0x7ffb31efc734,0x7ffb31efc740
  2⤵
  PID:5080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1616,i,16329405796921553622,4128446451043076319,524288 --field-trial-handle=1940,i,17290793452596367450,12669822301801353313,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2152 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1704,i,14665092748710129256,1966903470348069293,262144 --field-trial-handle=1940,i,17290793452596367450,12669822301801353313,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1936 /prefetch:2
  2⤵
  PID:1732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2388,i,9824838885096498043,4062216326415555228,524288 --field-trial-handle=1940,i,17290793452596367450,12669822301801353313,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2564 /prefetch:8
  2⤵
  PID:4568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3244,i,12774501864492627993,17219948949533523430,2097152 --field-trial-handle=1940,i,17290793452596367450,12669822301801353313,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:4136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3436,i,12838550660286784273,16535976480697215343,2097152 --field-trial-handle=1940,i,17290793452596367450,12669822301801353313,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:5172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4492,i,10915404676981873346,5031326237985098843,2097152 --field-trial-handle=1940,i,17290793452596367450,12669822301801353313,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4540 /prefetch:2
  2⤵
  PID:6040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4664,i,8151576651689679195,906978419296439851,2097152 --field-trial-handle=1940,i,17290793452596367450,12669822301801353313,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=536 /prefetch:1
  2⤵
  PID:1704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5520,i,6148341690125496964,12840084250688023549,524288 --field-trial-handle=1940,i,17290793452596367450,12669822301801353313,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5476 /prefetch:8
  2⤵
  PID:4108

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5892

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:6056

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x25c,0x7ffb32f3c188,0x7ffb32f3c194,0x7ffb32f3c1a0
    3⤵
    PID:512
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1808,i,13715299731359773794,11689178372787954027,524288 --field-trial-handle=2992,i,7820892343850852894,5155623493191144262,262144 --variations-seed-version --mojo-platform-channel-handle=3076 /prefetch:3
    3⤵
    - System Time Discovery
    PID:5480
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,7912488221564728176,8299423000312031174,262144 --field-trial-handle=2992,i,7820892343850852894,5155623493191144262,262144 --variations-seed-version --mojo-platform-channel-handle=2544 /prefetch:2
    3⤵
    PID:1396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2292,i,6115265107823162759,15304506492536918183,524288 --field-trial-handle=2992,i,7820892343850852894,5155623493191144262,262144 --variations-seed-version --mojo-platform-channel-handle=3084 /prefetch:8
    3⤵
    PID:2984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3472,i,12243361694996690050,4013781563889039258,2097152 --field-trial-handle=2992,i,7820892343850852894,5155623493191144262,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
    3⤵
    PID:5904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3476,i,5453536012935883586,11348492859537547888,2097152 --field-trial-handle=2992,i,7820892343850852894,5155623493191144262,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
    3⤵
    PID:4064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4928,i,6923621278579379693,5806366611433390629,524288 --field-trial-handle=2992,i,7820892343850852894,5155623493191144262,262144 --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:8
    3⤵
    PID:6140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5052,i,5909139912093022193,2521484744473317850,524288 --field-trial-handle=2992,i,7820892343850852894,5155623493191144262,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:8
    3⤵
    PID:1648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,5069885413713557761,6654101559315645847,524288 --field-trial-handle=2992,i,7820892343850852894,5155623493191144262,262144 --variations-seed-version --mojo-platform-channel-handle=5088 /prefetch:8
    3⤵
    PID:3196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5024,i,6837713537218740812,156674429604957950,2097152 --field-trial-handle=2992,i,7820892343850852894,5155623493191144262,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:1
    3⤵
    PID:2096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5584,i,12345467797200983426,15927820346588732791,2097152 --field-trial-handle=2992,i,7820892343850852894,5155623493191144262,262144 --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:1
    3⤵
    PID:3972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5604,i,9483081775310801693,12930383369934519459,2097152 --field-trial-handle=2992,i,7820892343850852894,5155623493191144262,262144 --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:1
    3⤵
    PID:4372
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=3552,i,4645980182796258457,674720912830105621,2097152 --field-trial-handle=2992,i,7820892343850852894,5155623493191144262,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:1
    3⤵
    PID:5748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5744,i,16825058865915173215,17687531075422653111,524288 --field-trial-handle=2992,i,7820892343850852894,5155623493191144262,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:8
    3⤵
    PID:5436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5740,i,33082578427634215,10358733813696159009,524288 --field-trial-handle=2992,i,7820892343850852894,5155623493191144262,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:8
    3⤵
    PID:1124
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6504,i,9802032302957202862,17068179517888360390,524288 --field-trial-handle=2992,i,7820892343850852894,5155623493191144262,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:8
    3⤵
    PID:5264
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6504,i,9802032302957202862,17068179517888360390,524288 --field-trial-handle=2992,i,7820892343850852894,5155623493191144262,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:8
    3⤵
    PID:4944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6692,i,15834829187330866689,673268275032624165,524288 --field-trial-handle=2992,i,7820892343850852894,5155623493191144262,262144 --variations-seed-version --mojo-platform-channel-handle=6832 /prefetch:8
    3⤵
    PID:3328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=7004,i,730903552122825986,18287648636638833282,2097152 --field-trial-handle=2992,i,7820892343850852894,5155623493191144262,262144 --variations-seed-version --mojo-platform-channel-handle=7052 /prefetch:1
    3⤵
    PID:1720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7192,i,5534657348958586039,5182209589038306995,524288 --field-trial-handle=2992,i,7820892343850852894,5155623493191144262,262144 --variations-seed-version --mojo-platform-channel-handle=7188 /prefetch:8
    3⤵
    PID:4508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7340,i,5721798495645048626,6072459918719856664,524288 --field-trial-handle=2992,i,7820892343850852894,5155623493191144262,262144 --variations-seed-version --mojo-platform-channel-handle=7388 /prefetch:8
    3⤵
    PID:2956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6760,i,13011612915827921762,3250275264684421395,524288 --field-trial-handle=2992,i,7820892343850852894,5155623493191144262,262144 --variations-seed-version --mojo-platform-channel-handle=6808 /prefetch:8
    3⤵
    PID:3284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7392,i,6177684455753492143,528678959231614241,524288 --field-trial-handle=2992,i,7820892343850852894,5155623493191144262,262144 --variations-seed-version --mojo-platform-channel-handle=7396 /prefetch:8
    3⤵
    PID:2600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7544,i,3539583853544075730,3172772906516246669,524288 --field-trial-handle=2992,i,7820892343850852894,5155623493191144262,262144 --variations-seed-version --mojo-platform-channel-handle=7548 /prefetch:8
    3⤵
    PID:5408
- - C:\Program Files\Java\jre-1.8\bin\javaw.exe
    "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\Downloads\mc-mods-online.jar"
    3⤵
    PID:5084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=120,i,14369121031098742814,18434699119099298654,524288 --field-trial-handle=2992,i,7820892343850852894,5155623493191144262,262144 --variations-seed-version --mojo-platform-channel-handle=7612 /prefetch:8
    3⤵
    PID:5764
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6504,i,6069388464216993775,5512812545354132415,524288 --field-trial-handle=2992,i,7820892343850852894,5155623493191144262,262144 --variations-seed-version --mojo-platform-channel-handle=7620 /prefetch:8
    3⤵
    PID:2044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6564,i,5620313023338360509,155222605876494574,524288 --field-trial-handle=2992,i,7820892343850852894,5155623493191144262,262144 --variations-seed-version --mojo-platform-channel-handle=7212 /prefetch:8
    3⤵
    PID:5524
- - C:\Program Files\Java\jre-1.8\bin\javaw.exe
    "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\Downloads\mc-mods-online.jar"
    3⤵
    PID:5404
- - C:\Program Files\Java\jre-1.8\bin\javaw.exe
    "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\Downloads\mc-mods-online.jar"
    3⤵
    PID:3460
- - C:\Program Files\Java\jre-1.8\bin\javaw.exe
    "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\Downloads\mc-mods-online.jar"
    3⤵
    PID:5904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    PID:4276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffb32f3c188,0x7ffb32f3c194,0x7ffb32f3c1a0
      4⤵
      PID:4052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1808,i,8245473655484568660,1705065207769119505,524288 --field-trial-handle=2300,i,7277856261718057964,4885536755376227152,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:3
      4⤵
      System Time Discovery
      PID:3320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1692,i,15833529842811775910,1688320846809683775,262144 --field-trial-handle=2300,i,7277856261718057964,4885536755376227152,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:2
      4⤵
      PID:5764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2604,i,18372965248298006282,811766581291503998,524288 --field-trial-handle=2300,i,7277856261718057964,4885536755376227152,262144 --variations-seed-version --mojo-platform-channel-handle=2616 /prefetch:8
      4⤵
      PID:5968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4448,i,10432070375513915156,881010279851972422,524288 --field-trial-handle=2300,i,7277856261718057964,4885536755376227152,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:8
      4⤵
      PID:3460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4448,i,10432070375513915156,881010279851972422,524288 --field-trial-handle=2300,i,7277856261718057964,4885536755376227152,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:8
      4⤵
      PID:456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4828,i,17222113213760839973,10177177887712390918,2097152 --field-trial-handle=2300,i,7277856261718057964,4885536755376227152,262144 --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:1
      4⤵
      PID:1448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4980,i,15545075236903240104,3113286680329880296,524288 --field-trial-handle=2300,i,7277856261718057964,4885536755376227152,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:8
      4⤵
      PID:5712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4972,i,66442908234530862,5338960844316901516,524288 --field-trial-handle=2300,i,7277856261718057964,4885536755376227152,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:8
      4⤵
      PID:1764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5548,i,15228243999874044631,14431495064020677559,2097152 --field-trial-handle=2300,i,7277856261718057964,4885536755376227152,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:1
      4⤵
      PID:2128

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2388

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1132

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5004

C:\Program Files\Java\jre-1.8\bin\javaw.exe
"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\Downloads\mc-mods-online.jar"
1⤵
PID:1720

C:\Program Files\Java\jre-1.8\bin\javaw.exe
"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\Downloads\mc-mods-online.jar"
1⤵
PID:2120

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 a368c817a4d1189977859f64920810ff7cad8bca8d19668c9c07d4ffe7786f21
MD5 44ff54be3c715eed123a829d392864ae
SHA1 6b23a2f92dc9571d8a9b15b8458f214ba2a89e43
SHA512 4aad1da1b027264fbc272445dad6f5cffa42150bc1415db70620b642e9189a0ab4768a9fef7a694197940743e0c7dfae22565e2a1d662cf8ba51a772489d11c4
TLSH
T179E02BB9C925AD3B0CFD072924580647E795231B2B41456F3A3C920D8FB96770986C1C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 42646e79c49d17a12e29507505565baa95445b290a8921a328c1c2f41b53734e
MD5 f3937a34d7944ca977d8ee3d0bed292c
SHA1 4ca0284133aaa55dbcc6897fee0c9a836bad09c0
SHA512 188eaa68e02e32d417ba66556d51e7770d11f8afac91e36b7117caeec054ba1c1025179efce15f9632ff533f77e4b59bc2fe7c47a889a65221bf4aa6568311bc
TLSH
T1F441AFF7C3E4897D8A0096F4AB256F1FCE690A14131D3C96C8D8AE1B83E2871D24068F
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 dda7434eb67a0950519d61ab6184552e20bc894d256d8891f8c803d9aad951aa
MD5 f5a1618aec32e5a288d14fc023623c45
SHA1 b468196c97c7c6101c596ff893b8c3bd346994d2
SHA512 75d473cede5ec97fc4ff557d6e29d5160a1830e4fd15fc83521ae59f2035f38ad019886f7c7e559b5127c11b00deab9c6912bc0729244fd12b9d84b0b93ca3e0
TLSH
T125F050979B7A706760FE46AB6D147C09547BD8351180ACF5CF9A421CA0C50E71B12433
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 38b92bee4c981d374afb8ab838e0e6f46e70730a243597852c5a98bc57243afc
MD5 ed261bd5426de1aae3546324f9b5b46e
SHA1 9634c5bcead24ff7a9449a8f782d6dc448cbbb5e
SHA512 0d13a970bab68b9091c4aa18449694bad0bc129f1b98bd7a6c417de27561499e09a11510f959269fbe0238858f67910ee1bb3645c3a2a1a7784267953f75bace
SSDEEP 192:dR3yCtWJxGBEv72ympAPRp2/95Hsb+WNnLE00qTdpPyIsnAUge:dRiCTBgQUXo7wo00qJde
TLSH
T15542A61EA914697BACCBC32BF9267B63D7F5102628902E44EAFC8A2C15E75CD3217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 93a969d5494520a313d59c847d3ee10e51ce49e2c8cea4f6ea38850cfab527d0
MD5 65eaa0a57fc2a07c6f5f8e9c22429ba6
SHA1 83b5d3c038efb456e4191e45a08c6c1cf8b7d43f
SHA512 2f69609ebf02ccda7dd197a901863ecdf075cd94dce3ddcaf8f69f28aa522eed4a257c71ee04de563d2d250a18b8f7b4dfd5e90247d3586bee22fe519ccbce35
SSDEEP 384:Q+jM77KxkXqKf/pUZNCgVLH2HfgslAG7pLuLcSjW3XODM3+ErU3oPHGqkkpLtE:QOM77KxkXqKf/pUZNCgVLH2HfgsSG7pu
TLSH
T136720A67684C9A370F94CACCDC16BF4FACB5025B65ED886492FA5C1503D5ACF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 ecdffd655b967900ef46eb2e617dc13feed35f79c176663c2684a2e981862c3c
MD5 fb1a1834c3c54bfbe3feffb083aba5bb
SHA1 6feed04fed176349d20150c7614f98e49360d38c
SHA512 c9b330ab90dbf9e7058d7542b8ea2c87db6c77c710c3cd298c14c7321129f6aa265cab2748385831cb3fec2c342be48feb6bad090fdeab3b720cdcf566b57416
TLSH
T156B0121080019101C84203F43513A88861049F20950F170583E07D22D82607181280A1
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 6fe631927b4dfcaa14839f9b6624f70623a4be339d3b326429bbc5aba3376b3e
MD5 808669dca4f2063dff3a819e28e45522
SHA1 1ae6fd2460a682cfb4c70b9bf6d35fb5856514b6
SHA512 368aa571f8a9bdc8ebb0e915eea475ab1a9afeb5e2081a77ef5b5a9f8b8beae10cf9db0dce62e588417761950afc88c1a19d1832364775c6f933567031872a0c
TLSH
T105B02208C0023303C80203B038A2B3C83020CF20C203A20282F00A23EC23A2088300F0
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 5134b3e6153702e17a3ae0d43976ef9cdd24a9449f593143a764b716a2d7324d
MD5 b42883014bd7d41f1b74db992f9c05ee
SHA1 170fd2617f49f49e2efd1278f5892de7379cd632
SHA512 c8f43774ad88b3517009fae8530a516c18f60d1e6459547a27e8cebabc059475cef17f3a3ce1aca0ff0b442d446f400924eda50f802a916670912983225beb8f
SSDEEP 1536:T/QyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjf:eqfd7NtZL8cHQRZEQ6Spsk
TLSH
T1DDC30237DBC21F339E96CB60B9530FD697B644A99034D301AA6D77BF6C83891684289C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 a8bb4b3bc1d5b1d28c17b57c4012e528a665e75f39bcbbc0cc8d9daed6623aa5
MD5 69dbcff414eda52a3b870f4b1a158abb
SHA1 b2e7dc5c945714a508488d11ad935403a6528dd4
SHA512 2eb0e916784e1e8b0eabeed2c4c3f3299c56ea530975dd3315a70e9dcdcc62d4a64b9586ac275862b5b27c195d7a410904c00122a90502b68625caa7e630702c
SSDEEP 3072:gUreL4QqSB2Xgih4noFwgnP0yBrxIXAy+SG97DeXqfd7NtZL8cHQRZEQ6SpsV:gUrrSB26M/nP0eaQErqZ/ZLW3ExV
TLSH
T1BB342232FBA6EF339941CE10B9330FA51BB609D19470B7069D6E7BEF650389058028ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 6130c8553b6b7a2db7b2e45115438707d58889218f67855fd135e735b457363a
MD5 12be8df10fec41dbf27a25c1c279b0c1
SHA1 33b90875d0895cce19bba03a50342a2ac338b0cf
SHA512 048871038871b434c649aecafc4bbbe60a8a78f34616d97c98e037db9c3622825294e8f24d0f7f5626a5b30b862451ae61f9803a791c84140586e516e5f58d6d
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7C:fwUQC5VwBIiElEd2K57P7C
TLSH
T136B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 39b8627875fea5ac5c5bfb887da12c15116e3fe81f200852c71d5699102c9044
MD5 e3962be2eb3bd350a67bf6309159a1cc
SHA1 c10632202b95ed6f7f4475b6483bf5196e4c5578
SHA512 d12d4acc23b51c071fbc9bf4db2f0575a6b43ec7894b272035e4c01dfce30099cd3ef90a1009dd1e6284cfbcf7a37fd3b79490739946700a2c61ec578374cbe6
TLSH
T173D08C677A0E7815E72F8231A413E360A76B4072A5629702F324C81DA9BC8D85BE63D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 94f40511ea08a0b6a5296f0532f655edb1ff5b802568267057a10b9a850c3df9
MD5 1d5dfbc6f7dec6803aa8fc7ec805839e
SHA1 301f0013a4f8dff7ba9babad8791aa3ced8c30a0
SHA512 c72b47d1d5b8cbfb51273c5f54f380345f34c6234f6c4cb560c31768cb9b8965c22d1cff5b0f4f68e25ae5facfd1c5b91e33c6d09e6baea7aea919322ffd1514
TLSH
T1D8D023B4B42A75A1D72F00354430F150A26541737277938671554C0DEA7844497FAFFA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a59087fbda784cffb013f4e2a0bf13a7fca483c48e8a7fc15fa022402eb25d72
MD5 dd54db185d82309b854bfa7657ba4600
SHA1 d01c14e8b4dec85ed2e1671545a868fd7ad4fa95
SHA512 f014ab84dd934b90e006883b74ad349d05f60071e57d2cf0bdf8a9bce118654c92139263e082094b602f6900a71e9a7848754994a2ea88642b2376121b581d07
TLSH
T165D08067354D7815E71F42319413D350576B4072A562D702F314C41D957C4D857D53D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4371a57d104cacf01835d7b1e7c57cfe938b72a37ce2255f489f558bff1ddbf1
MD5 dd0698d0915344f95f2ec4407fbaf7b5
SHA1 1e7d9cd9f6b7559e4b1cc2b57458517115c471d4
SHA512 f75310014f771e0f700d554959e2913d57e46b85b378fd9029eb6450fdfa40fc7fe022a0d09c9e5c0fc676da30865f425cc58c6ede7bcc8122942df24aac437f
TLSH
T19DD0A7A4B205AA20C61F40355811F260A6A241317077C6A2A061580D65B841893EE5A9
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ae1124c9c8979ecaec67c358c8313c06d2bb0d3feb7636968cc9a24483b633fe
MD5 1522558780c86e6c2aae39cee93e748c
SHA1 2d4824cdb48b3424b5a494d7f46c5b21a1a139c1
SHA512 5a5104603caed9348fdb863b4f88e96122b91edc258d791e1cd5b769b7654e22ab0e850f52005f8a60e46ebc025baba93571f612d1f497a9e62c9102f54a1fb0
TLSH
T163D0A7A4B605AA20C61F40355C20F260A6A241717077C6A2A065580D65B841893EE5A9
MD5 SHA1 SHA512 TLSH

Submit Download

9445c63d-37c9-4aa1-b764-cce40d36ebbb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9445c63d-37c9-4aa1-b764-cce40d36ebbb.tmp
Size 414B
SHA256 7e9de7bc5385378eb156eed979dbe17a7bd31a28776871abf87f02bad1856e5a
MD5 cb063a1136e214f76911620674ed4021
SHA1 32005a7d0ad9ad27d93346ac7f7b8600ed9fb55f
SHA512 b6c888bb1e01688308546933214c06cf70ca92e2291c73eba1596e2ec6b1622d2b554815d6c05ceab7f399ad7ac585a693c69bfd72aa1d5662c31c1727357cc6
TLSH
T126E02BA9C821AC271DF9571A64950646D76013671750890F3A3DA1099FB163A09C685C
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 3b80c2c431aca42eaf87ded1f90f4871c0fc277a95949dd145cd85f243db8644
MD5 d987397b2c0d44d62adec8e5c8497845
SHA1 856910a7d301241bd58e900255a1d58fb55d2629
SHA512 ca74a6424336036ab193f13bd6e0024dcbbab4a4888e403356d6cf7b24214fce63f44fc0bb3be4edb2aff3f60cb328b7efbf6ffd0bafcae6e8ab992014b38c64
SSDEEP 384:xXc2/kurEUhE+CbyKnlfA486Q8/4HOF1IQ/5tHtDPOOCXBg9i:xXcidCHQ8/4HO7/btJi
TLSH
T1A6132CBF76105D12DFC2587C186F5A31A3BDE826C8E40B873B36725E03563CA884EB85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 037849fafe6673fc4f8964b23569c83a795403083d1bc2bac21c3617642c2256
MD5 84294cc17410f2dd554926b7f4ac476e
SHA1 539ba2ccfaec67a081962424459ade59aeb47fd3
SHA512 bf3c19e820998a1ae7fbad3b9df116b4f3d0bd25c0b1c0fe8d5e494ca09698ed803b1de90934b91c3e31006fd06a4084bfe218d8f3233ac9300359927a5f1b51
SSDEEP 96:r1yJMu7Sm3jdQiQgbxBD5uw2OXpxu60oKEUl:rwxTdjQgbTduw5XVL8
TLSH
T1AFB10BE446880FE5EFA42635E8F19D5AFDB1AAB68A330FC2C5049D7C140BB94D65B730
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 02e58d9f0237d0784c8d8573c0c09fbff3d77c6cb7db52024c4301be13e3aaaa
MD5 0a2d6d9569f727e2bee09ca6651eae29
SHA1 ad992526964d73ecf5ec64f1fb33a93bab033896
SHA512 e1babb4e45eb39d1d6735a08d56679cf1d2936889c1688128523f634b7b1193bc62275c02a7749d768270de6310516cb01b30cc9279a6cd31f6c16411d7f82a6
SSDEEP 48:uMWzGgLLmqAxktLCBhbjCHzhgtVDJTSrgsfsNSFRwABnj8mcQ2M3ZFQPOegDbvuG:UAb0LwSkVDJa4a3Bnom72MJCG9DbGS5F
TLSH
T1BDC195E485D85FD5EFA52139E8B0DD0AB5B1AAB79A270FC38A049D7D24437C0D197730
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 f085230d22d0260189c5fd5f0dd69a2addb8db50ed468c4e9e4435de8eec4874
MD5 9d0b2797a9072d4da55ed8eaa61c7e58
SHA1 a76c49bf403fa91482b047a9bf1a7a6929e04602
SHA512 60de3c7bc557146254132b04a43dc9c560b67373c167603859b121dafd0fa4d0edaacd1d356bfdd47e6f96c61e0a8e7adb6baa8bafebccb7fdf31abc6a0b55d9
TLSH
T17E614CE5454C4CC1EFA21230E8E4CE1AF4F19EBAC97B0FC6EA0459BE2505B60C15B330
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe586983.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe586983.TMP
Size 3KB
SHA256 8c9a1fe876d777aed614604df6b459fe1059910c57a2655237a84c0ad8959b5e
MD5 ae49ad0f8fe015be953f7424bbcb0bf3
SHA1 a349257339b0b68725d18fd2eee30c52d5c6ef21
SHA512 f2543b24fba407d6048022f9c3b1ab1b9bcd42d6886a7ecd3f23d020bdd7a4f80e4e27770b95b2e5dda4d9d60ab531627c279b3f9693d11028263bfbb8312c14
TLSH
T129616EF8454D0CC0EFA21230E8D19E0EF4F29EBA99770FC5E54856BE2505B60C14B330
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 cef6c8828ea26cd9a9161e5d7c44d1675f2df55a3d7dd6289bc700e974f1ca41
MD5 a6b1331c0ebeede6ef1108099c10834c
SHA1 f311472971866cb0af3d06967118b418ec2deafa
SHA512 1eb1c6c30f34a8f65e8e7695d816ede359b90cc02299950ba60bc237cd845ff382ee7c00f8073c5cb8a8f8a22a0f4bdcfef32fde291183b39839bc65965d06f7
SSDEEP 3:MsEllllkEthXllkl2zEkla5VK1:/M/xT02znyVe
TLSH
T19B4404047FC00D45CD1414314031C7530370D4D00513774335510C13FCC57400C01445
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 570B
SHA256 99def1b557f19f04c1affc6f247d0451f33fc10ec42e73792223c3215ac98be6
MD5 d4ba0ae0bb0b9faff3da6f35fdbc3c8a
SHA1 fb3e9dec7f35a9b1d94e54a5659dd0de484055e7
SHA512 86fd07c34b9abd4c52ba19eae291936f92bc6d38a75c021edc1dedbc15617669876180cd99f959c62476d82ec6bb9f5fe4c6cb4d82cb037efb76d99a4d3d9c51
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 322B
SHA256 91bac221f37be387a3579e47e617bc38d5d2ebfd3be813d61796c5e327ca3b88
MD5 27b5eae775fbcacbbbe61de7c10f5836
SHA1 0628b3ff3225464e421b1cb0131affb33e672a2b
SHA512 da3be4841f872e8f7cb80c4b61ff529b2ca2e750f3e548557beac7f623a1c4041bea24ab8ea61a633c4c3fdd42c33f2a7c2bc3ac6007181d2eae4387908be4cc
TLSH
T1C9E07D8855CEC16B951468D39378670EC7D0340FFA88FE022708D8A4B201E42B2F6695
MD5 SHA1 SHA512 TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 24KB
SHA256 126c244f05167ee5b36324dc13fc876ac7f1d055d0066f2c10205bbd426c72ee
MD5 60b105dbcbf3e8954d37ec5a6a820d62
SHA1 54dd9691b27a0f9a74de17e53e35d54deb206b90
SHA512 505f92a35bdac56ad479e41ed81dde54620852b5fd29f3820531f1bd6b0702c18d93a4a8d80d6d607451890ae141cd34090998226b47a09a204b0ed1ba96a5e8
SSDEEP 96:UBCx3ZivzLMti5xeBO4iuE40cr4rYKFQ74Fq:Ga3ZPtAxeBO4iTo0034Fq
TLSH
T1A2B2F8B71EF83A03DBE10E7975A69478DA3BD06D5FA59C40346248617C74031A1348FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 204KB
SHA256 b119d6c0828acc597254c8c24ceb416d2136b405675dfb10c995a3366b85a014
MD5 76e7f7122ece55f66f7a90db50ba3a5c
SHA1 640e25c0090354762e384b23bbaded7229cd273b
SHA512 5c6c65bd730a56d85f95df99f6bea35120d684c8aeef26814d8c64f96f6976dea46d59085cd36ef73bfdbcbc4117229df9c7ad718c75362717cead811a378083
SSDEEP 96:nCKpieIU+bGz83uy3+u4tgp4DLjGQLBze9z3JjXbjBHMsDEuspU0wbtqrOQpPfRb:n/f+G83uy3Ct7XBBKZJH7DXspU3if
TLSH
T16214531F1F753311CDBD817668E744A35D6DF03F8B532ACA686204B0DEE2652A06C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 334B
SHA256 5f83646d0f3267e2c1024422301d2ac34a60fb111540fdc34b6a2c274ea1c208
MD5 d3f6ac351845951a813d60ad8ac5ff0b
SHA1 70db0c4bb1e201b188236cd7ed83ef8de2c602cc
SHA512 e587b1572d7bfe7190f80cc4aae6f35392f3f3104252276c4950d6ddbb68349761acd88eb14f739e7867e3bcc81dfffd3d620b80b80efcad9630d64c2dc08fcc
TLSH
T1C1E0D8A554DEC61A55042087A3387B0ED7E0340FDA88AE011B04E841F505844B6D15D2
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 3193722afcecaefd24216efd470c7265be1a0db6c651b6b30f4fd21bee2e27f2
MD5 e8a84a78dd99fe5ef7db4625ee46b9cd
SHA1 fa5f9dc54de24ce77944b404a3c3540f6c6f7bac
SHA512 7471e371a3f47a52adf2051c4ba34146690319d466354978de062bc36f7bb04142daf519659870bdbfbc8737c534666bb26daeecb0016036952fde76e8c6c152
TLSH
T1C4419EF3C6E5862EC90116F4BB146E1BCE1E051A622C3D1AC9D4EFABE3E2072D50164F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 072b1cec9137be4d9c3f7bfc5b7cf546abd16e841349d5462391613e7ccfc418
MD5 c18b4bceb2701aa138d223e99b349c0d
SHA1 700f6b6754e747ef9055fe5509b248022d22f993
SHA512 1882da08d5f3343bb543d1cc012a7a8750d030574a654eafb16fe366689ec1f124e4f09d2623275b5a8b5da22a707c1ae62a14507df4aa9398a2c1bd37842026
SSDEEP 96:DMOShP+P/jzg1JaP0DJaGO50JGHzJiJK//bjxJGw1bJnHJl:DHShP+P/jUfaoa75KGNAK//bjjGq1npl
TLSH
T127B1AAF3C7E9866DC90156F0AA146F1BCE1E051A536C3D1A88E4AF5BA3F2471E10168F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 2670d19b8c6adb3045dc6489e144ac7717692436a2309cbe43eba721423bd893
MD5 63a905a2aeae2222f4c6b9c799cc1619
SHA1 869754e1d78874d1aab1315d25b1c03b29d8d66d
SHA512 6fd9de078de8867b144c78d0d2d51295cef5308d513d41fe70b5cb39bec8dd7ccf6b2afbfbe7e98f5823d6fc7d1d2c4512a7c822a4a4652f5c5cf0f432c12670
TLSH
T143419EF3C6E5862EC90116F4B7146E1BCE1E051A622C3D1AC9D4EFABE3E2072D50164F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
TLSH
T18DB01269E5507CFF074A83A41428B463C3FF0047421C8ABEEA3873AD42A21FE0828C57
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 85ba4d9be05ee5880ac6b4ba437f786c418bf2a0bc802074a776551c214df41f
MD5 aafd23e5762224f046e48432b57e813f
SHA1 07ce6ad7547ba7ca9bdbf3086c979bf2bd3b1ade
SHA512 5355fb8437a4d37d92e4c42d02a20c6a0b9e41a3d7ac9d3164188d42387f03e203241dc2eb1ca6586f335d99630e1fb431ea13af95adaa484539e6462f732e12
TLSH
T1CA216DA795BFB47F20385E7E0D067C4A167EA535518268F9CBAA827CF0C44F34A1602A
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 3ded7a449f083166076148806b90ac58e0a2b33bde95bc0b13e03bc630508c28
MD5 494904d467899f449d4b7c67c0e41310
SHA1 1d2cbc117e08ec5c5db45ab2e77bd82713d4ed35
SHA512 47d78b57575db0582ffc2f62c16717bc8bb6febcfccde1beb4b541ed13d1e325a9367a7f7f4d1e87920e0608488774000327c8bf73468910a2b5960cec6f6dec
SSDEEP 192:sxZjRpyM/jK1Ml8MWU/fZs8XIEdpsJHW6+WNLSp/YHnGYGIgrJ:sxZjLuU/fZs8XfUHbI/P9
TLSH
T15F42C612AA34A977CCCBD209F955BF53D6F50462A6900E58A9FCDA1C44E7AED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 a1fc3865b1a82b1530baf66c00de24dc59e8f1e209f9950e0aa68ed233b7f5c9
MD5 a15871f38154ed8e75fa2c2397ec61e4
SHA1 f9ea494d2f140b4bb19a8793f6175d9af2c439e0
SHA512 c6765efce9ae75e7f6a94859c6c1fe5b4662282ec38bf13db76ad85df63e74f69ae886d5dfb383cde5d994c3cfdc221d345b36f66028f890366ba57576c785b2
SSDEEP 192:sxZpQUn7RpyMkjK1hl8V9U/fZsi4WpVxXxO3bdCiodpmjNHW6+WNNyqje4AH6J/G:sxZhn7LGU/fZsi4WvxX24UHbG4AY/Fns
TLSH
T1C482E612A534597BDCDBC219F906BF63D6F85423A9904E5899FC9E1C00E7BED2203C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 d65e828f477c94a265fcc479420cbc532cd2981e29426fb0b88ef17d3f3bf84d
MD5 1e5e86a708e212393e53b337f7d742aa
SHA1 2029602e17f3a32854e720adce0030326476c80c
SHA512 88a413048858c0daf1d81e47c4882a2e05d5379236199271c108edd2d83ac095a6d116f8d918e8e0d6cc71eafa4eef634cc046c1d2b9237f5f33364b8033991e
SSDEEP 192:sxZjRpyM/jK1Ml8VWU/fZshWpVcXYIdpsJHW6+WNN/je4ZYnttQEIgbj7J:sxZjLLU/fZshWvcXpUHbM4Z2nN
TLSH
T15752C512A934697BCCDBD20DFA557F53D6F9042296901E58A9FCDA1C40E7BED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 c8cb27d4a804c59776081d6ec4af9d56578d5fc4a639d0acc472af3ffa6ab8a3
MD5 fd28c5fb18fa83d760348c8a38c72218
SHA1 f272e6005393708bd2a3543917ba18151edf1c0f
SHA512 7495ff32346460b9dd31049ea786df1f755f7b0e4dc736b6ecb58b9db556d901aa67435522b60e6572717446226eac26667c41ffcbf5e0e36fce8e1f1e443f73
SSDEEP 768:jKUZYTMWvg0Po8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOeLlPZ4RTroV00a:jKUZYTMWvg0Pou1ja7eLZmRgFa
TLSH
T16ED20A2B280CCB7E4F844E5DEC266F967ED801CB5A584D5447EA884C03CB2EF512B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\41587525-1d82-4d4b-9c66-0bde8fed8399\index-dir\the-real-index
Size 72B
SHA256 07628ae815867b19c700b63fdeb1c0082c7975f648a3f9df0dea102fb6d05a7b
MD5 30a5b3c453251509fd67b18f623580db
SHA1 b0431041a2bb648295bb8a2d448f6183342bf5b4
SHA512 3e6c11bdfd37000df70ef8f52eef042d077e96b38170fa7d3b9781d43f015237623e836e4cfd722bd329465793c274bae3a4b71e68ae660f94ab28f6e59f6f7f
TLSH
T176A0026003C08086C95256B12A6246821300CE141345930759910049CC524C08D8940E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\41587525-1d82-4d4b-9c66-0bde8fed8399\index-dir\the-real-index
Size 72B
SHA256 372497cc7226ca781c3ff0678b2ce863c0bf75ba86297df084f5ed87fc450d87
MD5 1780b3a8d439ddcb4c5093f0503fd4ef
SHA1 6c96400cecfbb49b9e8f8885cb7ec90c36ecf24a
SHA512 436cc2b1b3a9f106d8abb4d0a4a3762d70982a857e0ce6b4432db2ecded7d70f714b058103426302d05ca20ab5e75396bfb2cdbcc14075942ee0e56e7f969693
TLSH
T10DA0025402C48601C40726F025A7C18133E04E345305130E75D04898C8559C5854104C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\53f0f5bd-7408-47e8-b6a3-5aa7e69ac4b4\index-dir\the-real-index
Size 2KB
SHA256 cb0e80d8801269230b70d6bd2b5fdde8f55ffe378c33aee93e18e538e64303c1
MD5 40a9278391488c98279e515b2bf779b5
SHA1 587e2d8b6c7ebbffd5a51dd238a1c266afd7a48b
SHA512 c93df0d6bf256eaf026b078d3052ed62e1963111773789ebb930124a4ff92a83f84dd3d542b5285af42e4174a45d58f4671642e53bda9319559fdfc7726743f8
TLSH
T16D51E84F4E114E6FD8A842B714B264D037708CCD0B159A2318EC1233EE8322D2D0B3AE
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\53f0f5bd-7408-47e8-b6a3-5aa7e69ac4b4\index-dir\the-real-index
Size 3KB
SHA256 28cf8a01a70043bc940a05a247c3806a84424485174940b6a40a4613ab8f69d6
MD5 ae62caaf1ee064018337e4e278c23ae6
SHA1 a3a6b0f29c96c21fdabb1a4eace3136096198d42
SHA512 526e4b0d8ff5f1efe0d2a646bb9cf9c9f20c176ab8679ca6ce84c7a293828a4c4e653bbc68d49a64f54a435521505f8abe80121bb928c8c607a7cd0a4e33141d
TLSH
T1A651F80F8C426E2ACDDD11B318F61890377AA4CE92898F17A1DC6436BCC32692C69325
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59b617.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\53f0f5bd-7408-47e8-b6a3-5aa7e69ac4b4\index-dir\the-real-index~RFe59b617.TMP
Size 2KB
SHA256 38ab07b287c2656263377aa56bf648edfd3b7a3ed025dd7ca5cd59f077208a97
MD5 6ec24c569eb1bdeaa1301b8c3e00b920
SHA1 50e941c5302e486ffe09560e114ef27233655588
SHA512 fc0ab46d731c334ec96c6dfbe0359894c2c7001eb305796925c31c375f1bb324b78424a615bc248891d4788b0228150439ac3ed6d3c8eea51ebcbf5812e8cbfc
TLSH
T1C051959A4E828639E9C441770AE3A4F4373925008719BF5374FC9636ACD27AE3D1E2D9
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\952371c4-91e4-4ce3-80c5-da2c30068647\index-dir\the-real-index
Size 72B
SHA256 550166e5aa5876fddfa0ca2908977929209e99c4f7f056a7b7905f0949275e29
MD5 696835e379ca4bb5c55da373aa761fff
SHA1 a4037b0ca98da619dad112ef9514e7498f76cf9e
SHA512 dfed68b02e7b5e6328538f5e01cee0ba3ef465e1e19231fe73591aa697b64f59bd599580ab5fcebdcd3c4b109ed2f8e7b8f2acaebad007ceeb2188696d165ac8
TLSH
T101A0022945990389CD81077C159255642B61DD203581AB05409411559854298475B54C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a982a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\952371c4-91e4-4ce3-80c5-da2c30068647\index-dir\the-real-index~RFe5a982a.TMP
Size 48B
SHA256 2f0e0b0171ac61c2087c885598dfb6d32f965e4a10eac244371d47ac6458d552
MD5 c05a9732cff021ee2b3751b85bd60370
SHA1 35186d4a2f93aed96d2718cf745a005bbeff1157
SHA512 74a78994b01c0a65d4a78ece2511cf3eb23d42c2206536729ff8179976f1cce660fe8f899bc701a6f202a4e36df422d81f31138225dcbad4ba9135a748b08ea7
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d8b22c76-83d5-4ba5-a263-0cc9da1f9e0e\index-dir\the-real-index
Size 72B
SHA256 c6253add71a0b8504950cc3e14daf07dea6f4c1c5d77ff0b13327975eb43b98b
MD5 6f0209bd307dab83ce655e5391c8ad92
SHA1 8041b19e6e0ca6f625e07c6724df296688fea631
SHA512 1e4eb4486f1c4ff749c20c56b11d0b37396c6da3ac32e68db0e90ea3e7720bf1e55ae0be90364987d26f43a6c41329499436b3d395bf2fa6834d88738e778136
TLSH
T132A0022035D41271C40206BD555305A62F18DD29214A830588E30C5E9C9D5DC49811A5
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 481B
SHA256 3c503e4f297d117fd3ac5acac8e00f7b4933d8ccb771e1d94c2c1eeb6e78f2ea
MD5 6ed8bafe9b238226ed8c2bd43da52b0d
SHA1 1f3e0493ad9f9a579da1ea6a8ad466177340eae2
SHA512 3a9ce095c1a3b4b507bf5b3b0f590781152a0e770987ace34b7988b5a6c3932b5ec608fe819ba31a029e5cf85fbea578e09739260be3f8aebcf094d76cfff453
TLSH
T192F027B37FFB1C14BCAFC3D790B2B0A006557C788559ED4E055AB16390B1305140EC72
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 476B
SHA256 8de7c6a8d8b24d84d22fd0c6865094f287423437fa02018eca2e01b069e933ef
MD5 ac738064e0e95422cfe2aa0a88e7ab57
SHA1 19bead72ad148982549bd0b405455df482c548f1
SHA512 c14f1a1eccbf130f157c115043f109dc691f5b44aaebc13261b75e08ba5992d3db06512fbc218c9ad06f13b04fcdb0251ace83f8f676940aba9ab5306b6b001d
TLSH
T171F027B37FFB1C14BCAFC3D750B2B4A006567C788569ED4E055AB16390F1305141AC62
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 3662a7895a218d76e13f49d4ad3e18218da9ff325c35d42463cdf37bae4f73fd
MD5 13bf5748cc45cb633b4f930656a5b2df
SHA1 dd8cadcf602d72a0a6156dd4adfb39d252c3fe4d
SHA512 c9af0bd8e61e67b988e6456b6b76906b0f4331f26f635a2737135e7693893aea7618a985e407645304a70db9c4b8792869fe30108f300d6a8748a1f6aa96e9fc
TLSH
T19CE0C0F33EFB1C10AC7FC3D74471F4A405023CB8C64CAD8E00AAA2A310B2300280AC32
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 84d9f187c511b025df2ee8c6233fa66eff367e1f20bf38e5be6b667827f49226
MD5 a5e3d4e93bdfacbeb61f1f11e9b7d336
SHA1 044a3592932a04db6a5e523bf55a2a83d62e8da2
SHA512 d8a2d7ca3f139588d98ecd32863686808df76aaf4b80380b72e3e70c0f5b97e800e48373418405ffbb9fe214304d0982408e2d30680e12824a005ac5de8aab36
TLSH
T16BE0D87805C9C179701624931238974DD3DCB44FD7C87D029F04D880A68BE44F2A7551
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 0a64ae479ba8f180f7146cb8777a9147d98cf21486f0855d4fef25a707f45fb5
MD5 9ee9bdfe54b25b8e1ad40fe51ad65586
SHA1 c1f780270ec685e3eb3b0f704ad0fc22cf6b7407
SHA512 12822e5835f1dfb1af8770925c53fe981455206ac8a68544ffcb0f75128112d3f007b79034e810b797bb6a1e9182c2ee4959a36e1d00bf7afad522bf74eed264
TLSH
T1F7A00229CF6D9042E446537090B2019CAA54CDE84609231158ED1479C86B1808596174
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a0cc3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5a0cc3.TMP
Size 48B
SHA256 dedde18f7343f9399a92d6deb5b8cd03607071b56d1a0576f6bad84341386221
MD5 3cd168b8bb29204d978fe2abb5efb590
SHA1 4707f50cdd4b0da0e40adbb263e53b568f28cdca
SHA512 5d4386028cc7deb1ad3503bb05da0ad5fa0d388d9e88d38f2d4a04226223be9ffc73d1e09f75a3e5fad6a28a431a20546108375e7191f22bd2198dcc8dfb8e90
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log
Size 877B
SHA256 ebbeb18d98e43169dd9e6122439c07d0c034db76e99865751ea9dc56c74f1e6a
MD5 19733b990f31e13ecaec2f3523926ef6
SHA1 99a165a1268fcc07f79b2727dfd799360840983f
SHA512 a92e8199aa07b02ca8761a01215e5305916bfd5a173ac39035aaa5915b903b923cb7905f367bc326887376231f4b70a279660192b1e75fc3bb88be8d529a3b03
TLSH
T165116BF74F08947BCE7E82B04AA673B6A77BC2CC8684CCD3DA4DA38730022312951857
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG
Size 322B
SHA256 7dd235fe6c61aca62ffde2ce85c9bf4d3919406a1c31148bdbccf16532bbca0a
MD5 bdbd1e0bd5aa9305c756622a95920c0e
SHA1 1eb082a0ec629b168cb092f52a2c834f95eeaeef
SHA512 aa6ac674057f65c827834c07d7f9125f38831c82dc70edb96588bad6c955a8f508d7be0e187c74e2e65638964225638ba47163984b670eae95c66deaf3038109
TLSH
T146E026A824CEC66A51106497A334670FC2E0740FEBB8AD061705D454B701902B3E29A2
MD5 SHA1 SHA512 TLSH

Submit Download

Tabs_13430754076222801

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13430754076222801
Size 4KB
SHA256 968579a472a0c6ed40d0996b325b7d7d98788c7872f134fa53f7c630eed821e1
MD5 9ec259ffd1ea840707f38940e60061f8
SHA1 67d0628aae53760fbab296c0280e1e1c5a6068ce
SHA512 be74ae792491a6acccf4aee8a4b8fa5287c59fe6e448fb19b80d02fa916e6718ea37f1b5ba9af913c94a3ceac93a4c8943833bf1ff96b1631eecdcb31a8f2e69
SSDEEP 48:35V3GllWr3oREw/ZPr9llz3JwlEla2lli531wvM38:3X3G9xPJKiXJvG8
TLSH
T16D81BE63DAF8053DE5BD033580FA10B2B673BC1139F98D0E4293521418627655BB5FEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 8e5622d85d5c56c3c5649204e5f76e553242daa0a4bdbee4dbd73a509fd5942c
MD5 2618fe5bd4aa4adf3af87a764f43d6ba
SHA1 588766f96b1a045cd1efdf7732aceb3b97ce0392
SHA512 3ba1cb6915e68d1daef7b5fbf8dcd92ba0a3efb42bb6fdd211d1ad5757a17e0bca66fd31f2312eaf0406146a43132e8dd027109ac0b77e4b675d0e8cd018f1cb
TLSH
T156B0124CB7489305D3CD053613645F81F310FC23A08909074C586F500C0F9947F858A2
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 a29a6fec4eb7ccdbad6f65eef0e4b4c95490b2dcfe0562d3c37d7e4e3aa4890b
MD5 6cf41565107ac6b6bc7bb7b6abde0fb6
SHA1 45cdd99137f57e9bd5f59311b9eac374d3b33719
SHA512 53263ab7421e066620f6c945e70b6ede92ff4b27158ed06864a947c0adfb519eba61592ae5eba5bc4030a9b37f4e4d70a6245f0b073d569ed3eed629a917a98d
TLSH
T10EE0D8742ACEC66E61876097A339E708C1F2B40BDFC8AD126B08E490B707540B2E3951
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 764823d2a471c95a9e38e024f6ef5dd950a678e74f7b9e215f32f44c720a9cb9
MD5 b8308dd893ba6858b7931211a4b67f50
SHA1 a21d3f67785b0d4469d6cca826a56e4eacc347e5
SHA512 5c28d5cb4ba3208f4627ae982b7544c3ba2f5f9cb6573ca5a44c00a9afaa95412c65d9b17d83e938fdffa526a003243d7f6322450f5379970a84c7a913347380
TLSH
T13EE026F855CEC639544B60979374AF0DC2F1B80FDFC8BE0A97089450F642550F2F6991
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 f5a3d3dd535127636a82f290a0de91be6ffd107b7c7f2aa50ecf1df0c2a6757a
MD5 c4facbdad8fbd54ee25b2c61fb93a563
SHA1 3a9954651a3dbc42b0515183c6188a8b1239324f
SHA512 e5483c9dd0698142016620e224978a5befec18d24485bedccc993a7b204f46f3c069173f3d64ed9dc41fba6ad31d525657488df828f6642225420bdeee113b66
SSDEEP 96:KA1eK2AwZiKCsKHuz6OMEE+OUpl8u+KkL84+gmuRox+UKDKuaG8KLaSfKDvtT:E0VFFjnE
TLSH
T190D1092672B602113C7D6B0C86D597AB8E8272637018646B7BED00B1DE67D21DEFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 60b2b5926ee05e983ec04bde1736e8ebf5a68b5be3ed5b47ed043479dec083c0
MD5 d8b5374af2bbca8f82bc63a7a6412089
SHA1 2248950d175194e1dbefdb1f42d2e293d88c7a9f
SHA512 11221cc276f5a028a864281445a6924934aefe62f8f2d231b771c5ca1d0d52cdbbcd85830920bf1f58cd7d99a3aaa6d3ee8b119d802f4066b666c4b4c95a96f4
SSDEEP 192:/+5WHMx8fT8w0QQnG2IMW1hPJubRd6vPtcdCewdbsc7V1VJ:W5KfQ9QQn7IMW1hPJuVd6vPkxW
TLSH
T10324630A7B747001EDE6D9725CB080771E3CB16ECF22A6915DB254698DB2853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

load_statistics.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db
Size 112KB
SHA256 dc33df3a60b60b33817b848c74b6f34ef66fbba675f88d3d1730be88857f5b45
MD5 95350e3abe9dcf054e73348982b9591c
SHA1 134b9d3f18dec46098bfe71b4a609652f9f1c882
SHA512 42d8e7c568999850353f22a702b79bea461c031c3e446be872064ae79fbeb954ae684775f45f61e36385c55a4c0138bd128915a8f7260b90bb1438091eb9c849
SSDEEP 768:9EkjUbA7rHDCR+Dg0GDYXc6Wdba+nxcpDM/YvPAJP3vlERctGqzflr7HggEoOkCI:40rpi9E0J/EMQfNzh1ERmk+5Ne
TLSH
T183B31FF76C09D1A6CDCD91B8D41BEF44507323228621D9E5AA3C08C73B7DA0ABDB55C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 12KB
SHA256 50a9bd729220d2e3577fa070a4690cd24dfba45ebbeae9d6225565ce75d64991
MD5 e26bff3130ae298f1e0d6d249e6c2fd2
SHA1 9916589bf2bd3a93d994e08c0c0657178bd8e041
SHA512 8103c31d0ea1dc01b7281857313f134917e8563f684269abce90998e808bb867a24d32273bfd5e7b3a859aa2b43ce4f5750b92ebe9dee42987ac18d841dc8e4a
SSDEEP 192:qQXIIImbGMIMslYcYzMoOAKRAselrhBus+dodazd34:qQXIIImbGMIMuBCMAKSs8Ks
TLSH
T1F942822E2A153B7BC19E9F7B1252C5C85AD888824878212D35A12C4F8DF3F9797C56F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 322B
SHA256 7cee15dfd9e622acf4bd9c702271bf4709b58d39714409c46a9d57435a40604b
MD5 76dd3dab42d08d809e03001145024d2e
SHA1 47c647b36a53c383146d6e9a3a155e29a78aa455
SHA512 1c5952393f896b068b12f7d6827d6f78c8c6c8b09773088588cf68f319bf01920b361ad52a9fa378b4c1f950690ba512691dd90a6e2796b78ca3bb313ccf3f86
TLSH
T1B1E02695B8CEC16FA42A308B33355B09C2C2380FFE88BD4A2F00C444F641910B2E6592
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 585123eaea876f6e82ca433a2abcc0e54c5ceed0b3166841c04e55e39b52a432
MD5 596842c47bd6a93a2ecd9f38c89a4b3c
SHA1 75b815104aaf87c481048a2bc99602768a0010ba
SHA512 cb63c6de9c18be98393667aa6212d8b74528d41d90beeca7ceb16df18f647bcc6bfff2fa9b145fa79d1e91d7d81f263721f04d06a1dec6e45cdf5d664f194528
TLSH
T1A0212456F334C119D2894A3E647E97161338D8069FFCEC1F15B620642EB3E410D8B2EA
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 340B
SHA256 71590e4457497b6767276d4661d273073d8c12e8eb1bca30a89d720c1f5de1f4
MD5 39ab581b62a1ccf1f87530cb08672847
SHA1 b376b59524e2fc5e4f1fd3d53d2192cd8fae7a7e
SHA512 4cea24e2d3ecceb45a4b7162840724972676a0908d68862e5d52b920112668f85e0aad70c48bbc787e96fb1473f3acfb4f1c4310375ce00ddcb111a3bfe1d849
TLSH
T1EDE0205474CDC25F501E308732749B4DC2D2380FEEC46E855F04CC44F641A4172D7652
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 194287914c580688567c62cb61905fcf87380b6b63921be3ca6a555ef9fd6281
MD5 5ecc67bc057de39c5eeecdfc988f6284
SHA1 a96359f926f632e7a8bc32df3a8a1056558baea4
SHA512 12fa991ca8261f25aedb447acc1bff1fddea7fd8b996dcedf59102a5b2f3322ef385654c3e6a67323f1490a5a8158566931e587874defc1fb8e1b69c002ea8e0
SSDEEP 3:MsEllllkEthXllkl2zEkl7SKllt:/M/xT02znlllt
TLSH
T1744404047FC05D05CD103031C031C3500370DCD04513574334550C535CC55404D01040
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 2c7c8391cfef4d0d15f9cf6199c7c866ffc083a54bc08c32a064b7bccc21b297
MD5 fa500384ee56756a9c29dd9463162f9a
SHA1 86a2835d61db3f11295f4614584a1735700311ee
SHA512 0bdc8b7e3fc3957dbeb45e876cddb1d7dfb9cefdd2e01f20712e39c6bbe71786dc87bc3fa2a2652b6ea890622e46db8b84ca03bee22543a1c0d94bb64f7f7812
SSDEEP 384:nZcIhsNme9zhEndzX5od+V8ykVVX9tJrOwJHAStR3/o6Ph9YlfnTKwBODNZOCg0K:Phq8VOD1/hOw2Swi9afnewBKZO90K
TLSH
T1F2C26BB0D8685CE748E1E5C5A946F1131EBC0173D9985E5CE2F9BB3C309F5B81726C22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 187152a42c999b4b35c06a025030d3378698ab04bde166c91add59535fc10b83
MD5 78e20dc8d808b2f2ab6c8f95e5522ba9
SHA1 4aafb82f8e1127edc7c931f4a662837a40f30d50
SHA512 85771dde32453834a7da1f6a33f8be5237c61abb761db6e79845cbe5a2a9d00bc126ec136f824b619ac3ec0eb9693ecfeafc50d9cebe47df89a3f2b8950924ec
SSDEEP 384:nvZcIB3sNSKT5zhKydzX5od+V8ykVVX9tJrOWfTnTKwBODNZOCg0OHx/7IzS:nB3sbVOD1/hOWfTnewBKZO90o
TLSH
T136A27D746928ACB74DE6B106FA5A36539EF82073E9D41F98D6FCAF2D004165D270FC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b298fb549082a7dd7a70e0c1c4be6975d8530dc254ee53816093cc603e5ae135
MD5 9c9efb4d1ec49766d3684a39fa892b7e
SHA1 f0b70361fd88396bc2f643052da398204f51d553
SHA512 f4d06063d3e583b77e3896b61a15cbca256f450fef2ae0616ef9f8767d5d1bdfd7900f97e34d11dcf604621f9a20ae2ede5170c949eae274332883290bbf96d0
SSDEEP 192:yONL61VWQmiUyvagGX5Obd+j1jzorykaoX/ad315U6:yONL6WzgGX5od+V8ykVCv5U6
TLSH
T19A02D935A8686CA78EE2BE4AB48737135F95106BEA652F84D6FC1B1C00D769C2307C37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 d558fab72526352513087684d784a4167d6d67289adae365be4ec25689232ec2
MD5 461604c45eab78d3c47a67605b69f00d
SHA1 111723b7efe8ad199557576ffe43a93e77a6e4a2
SHA512 245b993edf8edfe45ce17911e1ba1f6fe3c4717f082cb47cf755d94448306552f964eaabe6537a4ad155b626fc81789d71e82f5d75e4246ab939d3d9ccc5ac03
SSDEEP 384:VZcIhsNz/9zhEudzX5od+V8ykVVX9tJrOw3nTKwBODNZOCg0K:thYpVOD1/hOw3newBKZO90K
TLSH
T13C927D316938AC775EE2B645F84A31138EB85163EAD52F98D6FDBF2C009655C031BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 e7287d53d10e853e9bbd8b64fcb999e94ef80bf4a67235c91ffee59d2d91b9ce
MD5 8b8afbe7e68a9206db21e14d732bfc65
SHA1 f9180fd223056878a44a908b77bf7d3729fd6cf3
SHA512 1c568662fc397b18389a046ce5b71569a5497ee6ad42e55d5fed9834058d27b23b17a69ba6101d475c1c69675876283d3fd2436dae7c0331a3eab121f3472a4e
SSDEEP 384:nvZcIJ3sNSKT5zh7ydzX5od+V8ykVVX9tJrOLfTnTKwBODNZOCg0OHx/7IzS:nJ3swVOD1/hOLfTnewBKZO90o
TLSH
T136A27D746928ACB74DE6B106FA9A36539EF82073E9D41F58D6FCAF2D004165D270FC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 4be8fe1e10ecf819cabcd5ec94a36b8f40c56530dc262678b7f553920d88189f
MD5 2df069aa866322894c605768663d76ca
SHA1 3b26490047eb019a510e5431e042cfceeb03a974
SHA512 82d4be585c89209afea8a6ccf5ddc78451e0d1a0cd2a1ac375ca812f7565893cd63e4e7b2c9d25bf9c2946084fc4987b461200428003dbfe1ff3007ce042237f
SSDEEP 384:TZcIhsNze9zhEmdzX5od+V8ykVVX9tJrOw3nTKwBODNZOCg0K:LhlzVOD1/hOw3newBKZO90K
TLSH
T1E5927E3169386C775EE2B645F84631138FF89163EAD42F98D6FDAF2C009A55C131BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 5b35d4bad2c33fb96bc1e36cecc46a68bfce5b96ab5444704267c4a8a925357f
MD5 d9d19452436603a17946d4f2482d4942
SHA1 79f780ae00ffc838a49a1e74d8212ae05ad27959
SHA512 a7649a2a76187dc7a5192ee0557ca91a9618ac18b1c6d445f63bfb42b8b8cd76876c0c6c36715b74c2f837fc32b832d1538e7fe71f0f0987ca5a016298d79880
SSDEEP 384:nZcIhsNme9zhE2dzX5od+V8ykVVX9tJrOwJHAStR3/o6Ph9YlfnTKwBODNZOCg0K:PhqJVOD1/hOw2Swi9afnewBKZO90K
TLSH
T1E6C26BB0D8685CE748E1E1C5A946F1131EBC0173D9985E5CE2F9BB3C309F5B81726C22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f673d5d982ac7b584b0922db8431522d5127034048383e64fadf11bc5da10ded
MD5 764d3b89120b8ffe94c817946721be96
SHA1 b54f34fd15c3c9646ce00ef0478fd43c8b4f2d05
SHA512 5bcb9e5e8fd1660957680d5c3805fda348171612f120bd858da5d8db7ae0d95073643c8c0479a2b1c6528337ec789129efb226966e7f6734e277f897bddb1837
SSDEEP 192:1ONW61cWQmiUyXa/GX5Obd+j1jzorykaoVX9ySJrO5jJJqmU6:1ONW6p5/GX5od+V8ykVVX9tJrO73U6
TLSH
T1B5120932A468AC6B5ED2B585F48731139EA55127EA496FC4D6FC2F1C01EB6AC130AC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 c5a1ce5c4c0a19386d679999bbc1be35ef07336b53c6e253cfc1299f75ee411e
MD5 ea87a424d01611b2947b8267160832ed
SHA1 8f12119461c12b2eb9e4b695c62988d781832fa0
SHA512 1d49054888bd1a5d98bfd243b2e0d5dcbe8ca69b92a94665ba85915e55ef302667e3c46d21d97887f77f9d8316c1ea7892d47e062172d43737e5d332676769aa
SSDEEP 384:nvZcI93sNS6T5zh9ydzX5od+V8ykVVX9tJrOLfTnTKwBODNZOCg0OHx/7IzS:n93MSVOD1/hOLfTnewBKZO90o
TLSH
T1A9A27D756928ACB74DE6B106FA8A36139EF82073E9D41F98D6FCAF2D004165D171FC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 08fb2fe53efb381537cfd3be53eb65a03056ebd9f180201ab90b3c08128f709f
MD5 355cee698b01977d51dac935194664f9
SHA1 3f0ad4ac8262032f17a1e5dd329a0203508ae46b
SHA512 eeb78ef27492a14a3a098d2edb123891a8e0fa905efc59bb36f9219c81a65ceddf8c4c5fd9f97bfa10321db89db7d00d58d934d37b015641ecff750d9d617a13
SSDEEP 768:7P3sHVOD1/hOWFTRSVgKJCqtnewBKZO90o:7P3s4mvVgKAqtnevZyX
TLSH
T1D9D26BB0D4A86CE708D5E1C9AA46F6132DF81177D9885E0CD2F9BB3D309F4B92717822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 0654d5d4d5c39207aef489860b2e5d2c904fc49297d983495d4f7380b25868b7
MD5 bfaf553ac35216fdf4d1df162f373987
SHA1 85d7f5d1ef50119a8e06311d17e40071e29bc163
SHA512 b2ac8bcf84f95bb159dabeb18f326a9c953c49caefa69a4fe708f13591eff153ceabbf9cf5c884c9b2f13e5f5cac8c5867dc0a30a0c68b89f0583bb44c1a0971
SSDEEP 3:MsEllllkEthXllkl2zEkl5Kr:/M/xT02zn6
TLSH
T1C04404047FD00D05CD0350314071C3540371D4D00513574334514CF3DCC55500C05104
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

068bcc2c-ca94-4409-be25-9a084aaa1e64.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\068bcc2c-ca94-4409-be25-9a084aaa1e64.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 997f5732a17dd28a02387bbd7fc7ccc37a7d6b43d51d1d2e56db169ce8a6374f
MD5 9cb124846d3e875fee90338c3645b187
SHA1 601885b9068ea83587cab342d4c022fa1891d2c1
SHA512 69b51c9e1750d478e81c97587d3719cb0955bf6c5bb60d038be1c3fffae24baf5179b0f0d18ee1cb9ed8410583f4756d25bb524bddf5320f92d94404052d7058
TLSH
T131410A98B6F91108B3B76F5A9BFAA96D447FBC772E06C46E00510D4F0926B44C971733
MD5 SHA1 SHA512 TLSH

Submit Download

a23aba27-8d95-4e22-9828-96c9dd0b4390.tmp

Path C:\Users\Admin\AppData\Local\Temp\a23aba27-8d95-4e22-9828-96c9dd0b4390.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

affd892f-996a-45ca-a854-070bcab6b2a3.tmp

Path C:\Users\Admin\AppData\Local\Temp\affd892f-996a-45ca-a854-070bcab6b2a3.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

9e915e9a-0c7c-4438-957c-f2cc83f1d842.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir792_1446704244\9e915e9a-0c7c-4438-957c-f2cc83f1d842.tmp
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir792_594182701\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1720-2012-0x000001EE08010000-0x000001EE08011000-memory.dmp

Download

memory/2120-2036-0x0000019A29020000-0x0000019A29021000-memory.dmp

Download

memory/5084-1562-0x000001AE040A0000-0x000001AE040A1000-memory.dmp

Download

memory/5404-1620-0x0000020F8B340000-0x0000020F8B341000-memory.dmp

Download