hxxps://chromewebstore[.]google[.]com/detail/spotify-ad-blocker-blocki/nfmlkliedggdodlbgghmmchhgckjoaml

Resubmissions

09/08/2026, 18:46

260809-xe2xescj4t5

09/08/2026, 18:09

260809-wrqt9awvgs5

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 18:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://chromewebstore.google.com/detail/spotify-ad-blocker-blocki/nfmlkliedggdodlbgghmmchhgckjoaml
Sample260809-xe2xescj4t

Score

5^/10

spotify discovery phishing

Malware Config

Signatures

Detected potential entity reuse from brand SPOTIFY. 1 IoCs

phishing spotify

flow	pid	Process
281	5076	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5076	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307748178706551"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{B9ECA3C8-5CEC-479C-B09E-A632F26C1F3A}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
8	msedge.exe
8	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe

Suspicious use of FindShellTrayWindow 46 IoCs

pid	Process
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe

Suspicious use of SendNotifyMessage 36 IoCs

pid	Process
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5012 wrote to memory of 1916	5012	msedge.exe	85
PID 5012 wrote to memory of 5076	5012	msedge.exe	86
PID 5012 wrote to memory of 4588	5012	msedge.exe	87
PID 5012 wrote to memory of 4588	5012	msedge.exe	87
PID 5012 wrote to memory of 4588	5012	msedge.exe	87
PID 5012 wrote to memory of 3492	5012	msedge.exe	88
PID 5012 wrote to memory of 3492	5012	msedge.exe	88
PID 5012 wrote to memory of 2472	5012	msedge.exe	89
PID 5012 wrote to memory of 2472	5012	msedge.exe	89
PID 5012 wrote to memory of 2472	5012	msedge.exe	89
PID 5012 wrote to memory of 1696	5012	msedge.exe	90
PID 5012 wrote to memory of 1696	5012	msedge.exe	90
PID 5012 wrote to memory of 1696	5012	msedge.exe	90
PID 5012 wrote to memory of 2488	5012	msedge.exe	91
PID 5012 wrote to memory of 2488	5012	msedge.exe	91
PID 5012 wrote to memory of 2488	5012	msedge.exe	91
PID 5012 wrote to memory of 4352	5012	msedge.exe	92
PID 5012 wrote to memory of 4352	5012	msedge.exe	92
PID 5012 wrote to memory of 4352	5012	msedge.exe	92
PID 5012 wrote to memory of 3540	5012	msedge.exe	96
PID 5012 wrote to memory of 3540	5012	msedge.exe	96
PID 5012 wrote to memory of 3540	5012	msedge.exe	96
PID 5012 wrote to memory of 3900	5012	msedge.exe	98
PID 5012 wrote to memory of 1224	5012	msedge.exe	99
PID 5012 wrote to memory of 3900	5012	msedge.exe	98
PID 5012 wrote to memory of 1224	5012	msedge.exe	99
PID 5012 wrote to memory of 4248	5012	msedge.exe	101
PID 5012 wrote to memory of 3532	5012	msedge.exe	116
PID 5012 wrote to memory of 1308	5012	msedge.exe	117
PID 5012 wrote to memory of 3584	5012	msedge.exe	118
PID 5012 wrote to memory of 456	5012	msedge.exe	121
PID 5012 wrote to memory of 456	5012	msedge.exe	121
PID 5012 wrote to memory of 1308	5012	msedge.exe	126
PID 5012 wrote to memory of 1308	5012	msedge.exe	126
PID 5012 wrote to memory of 176	5012	msedge.exe	127
PID 5012 wrote to memory of 176	5012	msedge.exe	127
PID 5012 wrote to memory of 176	5012	msedge.exe	127
PID 5012 wrote to memory of 4500	5012	msedge.exe	128
PID 5012 wrote to memory of 4500	5012	msedge.exe	128
PID 5012 wrote to memory of 1672	5012	msedge.exe	129
PID 5012 wrote to memory of 1672	5012	msedge.exe	129
PID 5012 wrote to memory of 3412	5012	msedge.exe	130
PID 5012 wrote to memory of 4468	5012	msedge.exe	131
PID 5012 wrote to memory of 4468	5012	msedge.exe	131
PID 5012 wrote to memory of 2676	5012	msedge.exe	132
PID 5012 wrote to memory of 2676	5012	msedge.exe	132
PID 5012 wrote to memory of 4916	5012	msedge.exe	133
PID 5012 wrote to memory of 4916	5012	msedge.exe	133
PID 5012 wrote to memory of 5264	5012	msedge.exe	135
PID 5012 wrote to memory of 5264	5012	msedge.exe	135
PID 5012 wrote to memory of 5264	5012	msedge.exe	135
PID 5012 wrote to memory of 5444	5012	msedge.exe	137
PID 5012 wrote to memory of 5676	5012	msedge.exe	139
PID 5012 wrote to memory of 5676	5012	msedge.exe	139
PID 5012 wrote to memory of 5676	5012	msedge.exe	139
PID 5012 wrote to memory of 5712	5012	msedge.exe	140
PID 5012 wrote to memory of 5712	5012	msedge.exe	140
PID 5012 wrote to memory of 5712	5012	msedge.exe	140
PID 5012 wrote to memory of 3660	5012	msedge.exe	141
PID 5012 wrote to memory of 3660	5012	msedge.exe	141
PID 5012 wrote to memory of 3660	5012	msedge.exe	141
PID 5012 wrote to memory of 8	5012	msedge.exe	143
PID 5012 wrote to memory of 5272	5012	msedge.exe	145
PID 5012 wrote to memory of 5272	5012	msedge.exe	145

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://chromewebstore.google.com/detail/spotify-ad-blocker-blocki/nfmlkliedggdodlbgghmmchhgckjoaml
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x248,0x24c,0x250,0x244,0x270,0x7ffb7b9dc188,0x7ffb7b9dc194,0x7ffb7b9dc1a0
  2⤵
  PID:1916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1820,i,9796418142572936646,9947786681466329832,524288 --field-trial-handle=2200,i,5639865736514299466,1986624737348389315,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:3
  2⤵
  - Detected potential entity reuse from brand SPOTIFY.
  - System Time Discovery
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,7409383304384434560,6875200131845021206,262144 --field-trial-handle=2200,i,5639865736514299466,1986624737348389315,262144 --variations-seed-version --mojo-platform-channel-handle=2196 /prefetch:2
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2596,i,7176718499565426809,7648099472000820068,524288 --field-trial-handle=2200,i,5639865736514299466,1986624737348389315,262144 --variations-seed-version --mojo-platform-channel-handle=2728 /prefetch:8
  2⤵
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3400,i,4082983475190215503,16230156574385447434,2097152 --field-trial-handle=2200,i,5639865736514299466,1986624737348389315,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:2472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3420,i,1326915697716834786,13006087685213972227,2097152 --field-trial-handle=2200,i,5639865736514299466,1986624737348389315,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:1696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4168,i,8499576691376312175,4694470646202102523,2097152 --field-trial-handle=2200,i,5639865736514299466,1986624737348389315,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:1
  2⤵
  PID:2488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4180,i,15967791195635090903,888578084719128097,2097152 --field-trial-handle=2200,i,5639865736514299466,1986624737348389315,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:2
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4980,i,2959071099495716962,9719103836415292498,2097152 --field-trial-handle=2200,i,5639865736514299466,1986624737348389315,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
  2⤵
  PID:3540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3488,i,13223692654590020174,9338466887063815560,524288 --field-trial-handle=2200,i,5639865736514299466,1986624737348389315,262144 --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:8
  2⤵
  PID:3900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3696,i,11894417458014263772,17388620236117060430,524288 --field-trial-handle=2200,i,5639865736514299466,1986624737348389315,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:8
  2⤵
  PID:1224
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,10131227953561259781,15873867241805989034,524288 --field-trial-handle=2200,i,5639865736514299466,1986624737348389315,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,10131227953561259781,15873867241805989034,524288 --field-trial-handle=2200,i,5639865736514299466,1986624737348389315,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4936,i,9272256230071281268,912606505235975204,524288 --field-trial-handle=2200,i,5639865736514299466,1986624737348389315,262144 --variations-seed-version --mojo-platform-channel-handle=4556 /prefetch:8
  2⤵
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3584,i,10373008644092195135,13220048372375022009,524288 --field-trial-handle=2200,i,5639865736514299466,1986624737348389315,262144 --variations-seed-version --mojo-platform-channel-handle=4632 /prefetch:8
  2⤵
  PID:1308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=120,i,18004323955090850330,3482613436023802076,524288 --field-trial-handle=2200,i,5639865736514299466,1986624737348389315,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  PID:3584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5444,i,4321432014902209821,14311054051210141600,524288 --field-trial-handle=2200,i,5639865736514299466,1986624737348389315,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:8
  2⤵
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=120,i,7746291485767789316,13388787217685861819,524288 --field-trial-handle=2200,i,5639865736514299466,1986624737348389315,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:8
  2⤵
  PID:1308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6164,i,3743848259867655340,7948121378304605844,2097152 --field-trial-handle=2200,i,5639865736514299466,1986624737348389315,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:1
  2⤵
  PID:176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4184,i,17180708468848542442,4714877258798851883,524288 --field-trial-handle=2200,i,5639865736514299466,1986624737348389315,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:8
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6360,i,11213298210908934281,10550606209035292831,524288 --field-trial-handle=2200,i,5639865736514299466,1986624737348389315,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:8
  2⤵
  PID:1672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6124,i,1157514093630532130,4327023747442637795,524288 --field-trial-handle=2200,i,5639865736514299466,1986624737348389315,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:8
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6468,i,5746656725218511004,14017430714271991549,524288 --field-trial-handle=2200,i,5639865736514299466,1986624737348389315,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:8
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6532,i,15891221810944644077,6634167853804714600,524288 --field-trial-handle=2200,i,5639865736514299466,1986624737348389315,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:8
  2⤵
  PID:2676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4404,i,14924887229349232863,15386337212827454810,524288 --field-trial-handle=2200,i,5639865736514299466,1986624737348389315,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:8
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=6616,i,8108532486304434461,1010394863376710732,2097152 --field-trial-handle=2200,i,5639865736514299466,1986624737348389315,262144 --variations-seed-version --mojo-platform-channel-handle=6628 /prefetch:2
  2⤵
  PID:5264
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6736,i,15969043131889656751,2883708174842299667,524288 --field-trial-handle=2200,i,5639865736514299466,1986624737348389315,262144 --variations-seed-version --mojo-platform-channel-handle=6708 /prefetch:8
  2⤵
  PID:5428
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6736,i,15969043131889656751,2883708174842299667,524288 --field-trial-handle=2200,i,5639865736514299466,1986624737348389315,262144 --variations-seed-version --mojo-platform-channel-handle=6708 /prefetch:8
  2⤵
  PID:5444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=6560,i,8126901795606997587,1901328577154557648,2097152 --field-trial-handle=2200,i,5639865736514299466,1986624737348389315,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:1
  2⤵
  PID:5676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=3932,i,9351862406476592326,4873353900816714738,2097152 --field-trial-handle=2200,i,5639865736514299466,1986624737348389315,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:1
  2⤵
  PID:5712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=6976,i,8854629779547438662,1673274779359605094,2097152 --field-trial-handle=2200,i,5639865736514299466,1986624737348389315,262144 --variations-seed-version --mojo-platform-channel-handle=6996 /prefetch:1
  2⤵
  PID:3660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6932,i,14911015654677992451,409769464176098067,262144 --field-trial-handle=2200,i,5639865736514299466,1986624737348389315,262144 --variations-seed-version --mojo-platform-channel-handle=6868 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=6932,i,8753078334585581264,5167808846065112007,2097152 --field-trial-handle=2200,i,5639865736514299466,1986624737348389315,262144 --variations-seed-version --mojo-platform-channel-handle=7072 /prefetch:1
  2⤵
  PID:5272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=756,i,1766518956934972842,12816909177666164315,2097152 --field-trial-handle=2200,i,5639865736514299466,1986624737348389315,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:1
  2⤵
  PID:5252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4336,i,5288452886916783438,17331530677111788837,524288 --field-trial-handle=2200,i,5639865736514299466,1986624737348389315,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:8
  2⤵
  PID:5228

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1308

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5540

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 6130c8553b6b7a2db7b2e45115438707d58889218f67855fd135e735b457363a
MD5 12be8df10fec41dbf27a25c1c279b0c1
SHA1 33b90875d0895cce19bba03a50342a2ac338b0cf
SHA512 048871038871b434c649aecafc4bbbe60a8a78f34616d97c98e037db9c3622825294e8f24d0f7f5626a5b30b862451ae61f9803a791c84140586e516e5f58d6d
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7C:fwUQC5VwBIiElEd2K57P7C
TLSH
T136B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 fde3b41a5711362d7f3df7d71563d5eb6cc679bae7f80f74afcdf81dbc09eafd
MD5 3406d3b708dcef0116bffd8eaa181ad4
SHA1 3df64b48bff2b9d4160d900e91a7670046a24340
SHA512 d22d05c221bd19bc3b07e9a5ed722fbf8fbf75d695302fe8ec441d6d1e653bd63b3751a9608b344cc859feb79c5869aaeedd08bf846dc01a522b3a0dbb1637d9
SSDEEP 12:sUXhV0xosU8xCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:fRqxosU8xWMk8xVZ4YWI30otWn
TLSH
T18F727886B34494FFC8C35A7189BE27902374F6DE5F02836B6A3A7A0E2E271C44F44220
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85da5d101c008762046da9670ca95944217bbb1829e60a748f367ee4f9926b13
MD5 ef105d8d3e87a813544857290c28833d
SHA1 bfe7010cf80fb8cbcb9eeb5e0d0b551ece0b3134
SHA512 ae71c302652e2de890fca25723381f403f4f9ee51e2da6583977318de3e7ff00defb73b202e17a287def3ff618de86c0af96c0fca7729ef3efe0a4ba3cfdfc63
TLSH
T16FD0803377C9A100F6567375F413C7412F27057415868613A168C45CDC784C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 98eae6fcc56d922689f3a45ab65635857e6510c437555d4eae3a6cd68dff3acb
MD5 338a3c92e96cad1510815c958fc76de7
SHA1 e1234ace09aad728f9bde0798e2fb22ee82583de
SHA512 e29c9087bb4c9c94c8525a95c307117f14827336de29aa01f837bd02b05b3aecd1c1771970519a60972a1495e05b4f68ab34cf5e4ec9d7060f6383ac019c2ed7
TLSH
T17DD0803337C9A500F6567375F412C7412F2705741586C713A168C45CDC794C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_0000c2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c2
Size 331KB
SHA256 db4ffbf0ec662620013dc14bc1268bdad6256d19d7d511ec7eff8446887e6900
MD5 05ef8155cf66131654d3bb9c9cba5853
SHA1 e79d53fcb604921222dd1dbc2f1c10c631ff6075
SHA512 ee38793245d91683ddb1f847e5b56a09864fd32ec059055459b3ebe101abed79683ee59c80f30b8f6249d2bbd83fbf7bca83dafb4ef2b634ceff6969c80fed23
SSDEEP 6144:FljUD58FLTW53eaLkNv+Ps0dj1fpqaGjYf0NIcB3bM1rJZ24:FDm5uaLcv+PFj7ajJNImbM1rD
TLSH
T1247423A9B50E3C8AC94F9473827EAFD2A4356FF38D47BAA3634241F401874342E4676D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 a1d8465fde72d5343b23d2e838c09fd33168489fdb7663dc4211d70ab2160483
MD5 c5263da4d68467c868ea9436ec2fac34
SHA1 a360a425852d093d72fd6bc675d1773e81bf6bf1
SHA512 2a131adfacf5ec2f45c63b8e4eaf927b45aef26734074c740c4a1d783d3bffa275ce37a91302d7ca661fab2d5201543145ff309e4b9057935b002cbb666a9a88
TLSH
T112713B3E424213D1E764217BFDD906017A798BD90A434D6E1160983FA92DBF4BC3790B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58ff6a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58ff6a.TMP
Size 3KB
SHA256 287fc6eaa9488e5624bbc4fae1889dc782b7b9bdb6fb4187fa2685bada8b4b8b
MD5 82e355476dd7eed913bab63433c17a27
SHA1 80006841964561a07bb0f15dceb45cba0a46428b
SHA512 ceff10d234a8cf1bb714a1c489ca08f5c86af77cc38ffe01a3180397d8b8ec00e5e8cd97a33a537e1ec1197ac838b471330f471ab1bac5a48a8a6aefdf84f54e
TLSH
T1D171283E024213D1E7652177FDD90A053B7D8BE809024EAE11A0983FA90EBF8BD3750B
MD5 SHA1 SHA512 TLSH

Submit Download

rules.fbs

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DNR Extension Rules\nfmlkliedggdodlbgghmmchhgckjoaml\rules.fbs
Size 1KB
SHA256 b04898b87592bb7a73bead3723d6419e2251480bd94031faf9379b8717626d94
MD5 5cdccbd6d3b182ce1cb5d3d015df7ff4
SHA1 e1455b2c5433b259f27db9665c1f822ebd3a7d5c
SHA512 8a5fe674218c507d7cda0259f8693bb0f63964ee799c11ded705a5623ec7fc0ce05e881fb8e8802ae03d09c786e64287cf582a3c832647c5cf36226f31ee5744
TLSH
T185313681F960C7BAD0A892368CE7C110C5997BC01BD5714F3684E30E39895B18BA2FE7
MD5 SHA1 SHA512 TLSH

Submit Download

rules.fbs

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DNR Extension Rules\nfmlkliedggdodlbgghmmchhgckjoaml\rules.fbs
Size 1KB
SHA256 58048dc39defe0a68413901c97f122ab57f5297e8f7a4871e35aeeef0d5ec40a
MD5 aca4d5c6ac9705bb335fe873d7b5416b
SHA1 fb96373c6b60a3c1b7347ac60a6ae0ddf7c0f443
SHA512 afeae60ce3a038740003167fbfa550ff8b35e45f665875f089884939e4bb7f2d6408de489c3c63c9473ddbbea6f4e1fd9e5bcbc601b98789e004974fd18f2189
TLSH
T1FB314581F564C77AD0AC5236CCEBC250D19876C016E5B14F7684E31E3D859B14BA2FE2
MD5 SHA1 SHA512 TLSH

Submit Download

rules.fbs

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DNR Extension Rules\nfmlkliedggdodlbgghmmchhgckjoaml\rules.fbs
Size 511B
SHA256 807068a0a6bd1deb740ebfe9435700a238a3392b80fa477773f17da6262641c7
MD5 90be4f56a8261e9f2a8cf467da894c38
SHA1 d3ebd189d1d987d0007116b2fe946d950fa2b86a
SHA512 bcccaec07540e3acfad56b9162aaf332e29621616a392368d9a18bbf82298f6a4f88196aa33d38ee0772601a91f9fb05f907f4219f576f47132522b574666cf5
TLSH
T1CCF00902FC009B7EC07DA33489FF8062C0883F840BE2640D2410A30D32409B087BAFEA
MD5 SHA1 SHA512 TLSH

Submit Download

rules.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DNR Extension Rules\nfmlkliedggdodlbgghmmchhgckjoaml\rules.json
Size 1KB
SHA256 2796e0ce1d41d9b3e7a2a9d7cfae0ae88ecc0a488740b30e262a02b52a861cc5
MD5 708d3ae5c12933ff94a51d326b52a488
SHA1 ae07510cd1c10b1181001bb658b99e71160b921c
SHA512 46349d416ec33d3fa64cf7252b66c6cbc03249f9e608521a5e9bf732c3a0f647d38f3a3baf2fc6ecc13c5ee165f2c5c7c85e3beadce1294ab7e2c1ce4304608e
TLSH
T1B421B63314185E6BD7D6E314F442BA050A30371462CCDBB27E90C4286BE708EE506BAF
MD5 SHA1 SHA512 TLSH

Submit Download

rules.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DNR Extension Rules\nfmlkliedggdodlbgghmmchhgckjoaml\rules.json
Size 1KB
SHA256 116c4625dec69c971c02ffac9cf9268c606f49072c3c2b29362997f9888ba189
MD5 103120940fb090365f0ae95576e9d91c
SHA1 c5fb5f65dae41ffc60550afbb5d9a20fe81da8d6
SHA512 2409fbf9b105f50ee70e5166025c5e414079d09ccb19b020f299a9fe82d950d75e259beab0695a60e06047d0d6501141372f95e0bb614e169c2df5296e6bc92a
TLSH
T1E421813714185E6BD7D6E314E542BA054A30371462CCDBB27ED4C4286BE709AE506BAF
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\nfmlkliedggdodlbgghmmchhgckjoaml\1.9.5_0\_locales\en\messages.json
Size 327B
SHA256 ff36a4309896eec63a8baf9bf1eb8b8b384bd4ef2697cf4a6f5167f531468e1d
MD5 b69f4e6656787c8288a4ae4fe67245f2
SHA1 16bc5d29d4420b5cf6d2581481e312df4c86b602
SHA512 a540c5fcc08c4ab19ef181c355231ef9f94c1695795a22aa57ea916c3e7e3d4c47a770c9cc6834401de336b2b470d788ba0651b7e8f2baf651338f26b63c718f
TLSH
T1B3E086064C30FD9A81FA8759ADA4B54CF73643BA170154497E7EA08C5BF97E384A1B44
MD5 SHA1 SHA512 TLSH

Submit Download

background.js

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\nfmlkliedggdodlbgghmmchhgckjoaml\1.9.5_0\background.js
Size 6KB
SHA256 d50c3ea9f6af488f4f848f770869603ed6ca24d5a7676ec16a59b6f3964f4c42
MD5 d222bd95184a88aed1c732b6f4b4a096
SHA1 a221c7557adab24e51e08c2ec9a0c4190a9e5610
SHA512 2ebd5ed8a77bfd40e60b5a0e1e659fdcb76ab59fcd8d452a9aefc61b93f4a4f07b7d940aa43f3a9a02abdc1daa900a5ce06ee3ffbcd86521ecaa3baf1be98f2d
SSDEEP 96:lDWPq+VRGURS3HeIsiJFBFO0lPnR5+eQS6ryV71d:b+/GUR8HMinBFOoPnR5+eQS6ryV71d
TLSH
T123E195086CF1242A1093B635F36FB0416579C2871828FD19BE9D87E95FC865C8D6EBCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_script.js

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\nfmlkliedggdodlbgghmmchhgckjoaml\1.9.5_0\content_script.js
Size 20KB
SHA256 0d5d1e41897f512bd7cafc3d0125bb639d592eac5542b640d8174d0ee0f842ed
MD5 15a00e1d0e1a9002043a7cfd570856a7
SHA1 f276a2d92634e5804636284d73ea6d8f814667be
SHA512 dffb932ed420f73b0e832cd3540cf43d46d404d8625d56cc55e7ab0b148687d703ee715a07a0654fc14ec7590592cef3759c9cfab438176d44a78103838ce255
SSDEEP 384:ZothT0kNKN122Th03dl4OjRyYpq0i2cCJv:ZothT0/N122e3/4Oj9v
TLSH
T1B492E756DA2EE0BB49662068AD6F5485723C8033564C8C67BD0F804D7F8863E81BFB9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

css.js

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\nfmlkliedggdodlbgghmmchhgckjoaml\1.9.5_0\css.js
Size 11KB
SHA256 d892c7539f64a12141221acdfb7348f420817760d129053e2c5a7d0a76f033d6
MD5 1b7200765d4087f2b122456d45ff3808
SHA1 e91e4b2f809ddf7bc3da8a9927c18279dea3970f
SHA512 e7084e1a7504ff45185067bbaeeb72043d5a86945756e7de6419d044ca622690924cb6c0f9fc53df7cf39f50ce919593b01bee9a7e7a79a4c9ee2436618588d5
SSDEEP 192:f7gzw5vV6ayK+aCiTGwu5bRNfgoN6yaHEyHQQIXA4QhzLNTwhIqPI39j7r5faR1v:f7b3Tu53qH9z+ANYggAFC9sDBo
TLSH
T11442626944E20C221A97347ADA5B01C2B7358503720DDC6D7EAEB2448F8D52453FAFE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

easylist.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\nfmlkliedggdodlbgghmmchhgckjoaml\1.9.5_0\filters\easylist.json
Size 1.5MB
SHA256 a577d9c8019050b342a480d6676396be75c0996807b6b47c62f23aa16de59ef2
MD5 d975bb07076ebf23074230bf4ddc78b9
SHA1 01751b5653c8227413d5e45fdb01b060ff9187ce
SHA512 86fc76674f3d29663eb90948b810f92e935582b750bb673328cab9ed47719250847061cf0a0d22e113c07f7a12af45565a5b7e7e0d284fc89b911d6399cb7f4b
SSDEEP 24576:xu7ChMGHkKia5YbeHoubfn5bpId/iYa+E:I7pGEKJ5o85bku
TLSH
T14D659627481C4E3BCAD913887986BD05453C0609870EC5F1ADD6D53CA6AE7CE325BBEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

easyprivacy.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\nfmlkliedggdodlbgghmmchhgckjoaml\1.9.5_0\filters\easyprivacy.json
Size 2.0MB
SHA256 6fc003f2bd2c5fe6410399a27e0914b050dc885bfaae40ca04461fdecd81eac3
MD5 3161c922d01170dea834bf25a5c4575e
SHA1 1bbd7b7ee26a4d23dbf5ce32ce1a0e55002675ac
SHA512 dfc37425c7b1eb729eed21bf5c2293c4e13fe7ef72c318b7c9a239b3c50fb33b3f381019bf5063cf284b0b64023b6dd43b9b87a2276550cecd52feccaa361ac3
SSDEEP 12288:dJTDGht5PhVPh3xu+zkeiOq60MsqufTkZndME84MBt7BEoNTZyi6n:LgNhVJcei5fwGEvMP36n
TLSH
T1C7A5ED26181C563B468A1358A9867D02943C0F14434DD6F26ED1D47C9AEABDE332FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pgl.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\nfmlkliedggdodlbgghmmchhgckjoaml\1.9.5_0\filters\pgl.json
Size 75KB
SHA256 9f3d383708678ebf804d40c52a08583343e8fedb873435b0b83c10d324fd3765
MD5 dd419588f6336733bd975029bae2d107
SHA1 1676f870edb9fc8a5d91c290e65e66207a9d717d
SHA512 de39e588e9fd139b2c8dfc9de967738ff9121786c1cff3ed461cf6cb719cff49944a28de26d211497b5c603ed55ceca872b15c6b57678ecf8913e29354bfc571
SSDEEP 1536:wmqtg+83GiRpMRopE+34urarlj0Bo7Yaj2/3S:wS+bOpMRIEUCC3S
TLSH
T19E73B6A58D2516650FA0018E58BA290A59BC93030F55F5F97B68C2CADE0E4DF30F6BFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ublock-filters.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\nfmlkliedggdodlbgghmmchhgckjoaml\1.9.5_0\filters\ublock-filters.json
Size 1003KB
SHA256 5d0db4819f219c45e77693972eb73ff27dfcf4a60fcbbccd7b18b72266a0cc8d
MD5 2a3e54407fbb032459351fa8bae4169c
SHA1 ee669301be13b22800a4d132fd646aedd5b08e0e
SHA512 cfbe44e6937c6f0f67e6da22f259cadb02e3492ef7c9bccde223e391025d54a7c52967dd00c592d447da782f12dbc10533bc73260307ea78162f378afffa9e0b
SSDEEP 6144:6kOThqWoVzo3FkZWoz4IRaBv2ES073ZyLSqJy7aTPHtb7iq82pI2THo6:6k/Wwzo3FkNz4I62I7Zyeqs7oPH142pV
TLSH
T16F25BF371808A637CF9A5348B582FD0205344A005B4C86A5BDE2D47DA6EF6CF7357BAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

urlhaus-full.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\nfmlkliedggdodlbgghmmchhgckjoaml\1.9.5_0\filters\urlhaus-full.json
Size 532KB
SHA256 b9d98d4e0d124474f2a51540f7ec905ee9eeb9fdfc22b3bde805cdd8b3a0f4dd
MD5 58e240c4fed8b6c7a951b98a70b59bfe
SHA1 3edfc5ff871367b7a350a178347e43068e9d1f19
SHA512 6b84eecc76eb9549b473daf08831f416363ebbd8289bda5a749f53536a36b7fdce36c86ca663c723a560be20157de536adb5e27f9de467ed805cc40de0ecd962
SSDEEP 6144:u9xsF5EEtOeZriej8jK/WRJFDBKfKRZI2FuqQeQhvqSzFp062TPZx07dLfJ:u9xH0OeJ6K/aJFDBKCRkVjvxpb2Tm
TLSH
T141C44D5999250AA10DD835CE5CAB0F4BEE68C0478E01B5EDA756C2C8DDDF82F70B726C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

frames.js

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\nfmlkliedggdodlbgghmmchhgckjoaml\1.9.5_0\frames.js
Size 18KB
SHA256 06d91ba2b4aca45a28f5914b4740035f6fe5f09cda45dd4910b947b01e0b3e5b
MD5 f6459ca6c227a21550c398acf4ec948a
SHA1 b1d69b3b9db4cf7fd2c53d3f136f57934438cb24
SHA512 328cc25721e3358f3bedc37e964379ffd921b414f34a1e39ae24301124300a1d19b9223059cd634ea627248903540fc8cfbe4f71feb49507e6a250b4f85d5b22
SSDEEP 192:vHeyXKsGVxqaiqt7ryagywSh6aUqwD9kOtEUgEU+ELpKGYBfqnNmxMJa1aX14maS:vTVPwaapUrrb7JqrrQ7zCqsj
TLSH
T14482A61E68F201382CAB14382F7BA25939356117224DEC257D9ECBD44F81F5299EFB9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hulu_cs.js

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\nfmlkliedggdodlbgghmmchhgckjoaml\1.9.5_0\hulu_cs.js
Size 2KB
SHA256 f75f99536769bc3e79672f6d43bb1f40d6a97d5a09ceb6def9a153230e0b67c8
MD5 73bab4b86a3c0b5312fdf5cd8883b7b0
SHA1 4ef959b005646532ebcef12d79bfdaded19123fe
SHA512 8c141d4236da220d24ea48b532da9f3e20344352bfb6727e0f37c8525d95737d9f206fe8a99bce83c1e4ebb5f067d8833a26bc972ab46ce71075aff2b66a619b
TLSH
T19151A611DF1CF11A52CA4045CD264483A61CCE361695B062BB0FC43C2F8CB7F925E92E
MD5 SHA1 SHA512 TLSH

Submit Download

32.png

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\nfmlkliedggdodlbgghmmchhgckjoaml\1.9.5_0\images\32.png
Size 2KB
SHA256 e112a619ecad9854aac921dbfc710c1498a6c694738e7c17fec0beae4ab1c5a9
MD5 2425dcb7a31854e2f6331463e260688d
SHA1 9c3864fd8f8546990bc096a743b4401ca41da1d8
SHA512 05401fe332e9643be59d5e270fc2678302a3602ba889370d6df933ae3f5569c0187e56303f0fbe84d5ffc651ed9f07cacb428048fb13e12069407ef424f5549f
TLSH
T1A5514D83B1AB3024ED91CEA59198B43870359491D479701A8812DEF89E43595BAC33DA
MD5 SHA1 SHA512 TLSH

Submit Download

48.png

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\nfmlkliedggdodlbgghmmchhgckjoaml\1.9.5_0\images\48.png
Size 4KB
SHA256 5185b704fc9df8e173034964810e8671867ed96501e92713901c1011f7366d72
MD5 97ccf1ab083df3497a3b5d2414a6144b
SHA1 85b7bb2d8a090ad64249a2586e9dbf4f1c204886
SHA512 03931b4c575675b97bbc21d0f8859967d80509554aaf554c1e0275b3d346268ae3bf16cd2ed6eb592146dad060dcddd21e3067670b9cd79861068983bb85a159
SSDEEP 96:gyqPSNkS/cknYqrLwS8qEcQmjYJzcvCznoJ319/2q0mWVO9H+gyc:4SN9rLw+ZyLznoJl9/2q0mSOlXv
TLSH
T122A18D22015E1A93D432B2BA58A9D414BC479C2F7461B0D7E9CA8F98DACF1C273E6D46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

inject_yt_blocking_script.js

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\nfmlkliedggdodlbgghmmchhgckjoaml\1.9.5_0\inject_yt_blocking_script.js
Size 94KB
SHA256 25d4574a39a614b70eb00444889903c1c2801490a11dc6a04d507a82b9344433
MD5 04ef1973805404099cefe3a6a508d8ff
SHA1 024ca175f28d0e832ad155e09f5f00d55f2f6f15
SHA512 75c578bf087d8347542686f7eff81b9ab22a5baa93522d481edee9186756a91d1378d2ed4a6c8c36ef83b8dc3ce5072d07790308645123040c1c5062940e88ce
SSDEEP 1536:Ihq7Zhq7Lhq7jhq7/hq7RWcfDFWyQvWItWhGBM:AcrgfKhGy
TLSH
T11C931CC6FF82B0A1C5D611D460EF660AF1BF7E1464B0E1C0E656A5807C6485FA26FE3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notifyonads.js

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\nfmlkliedggdodlbgghmmchhgckjoaml\1.9.5_0\notifyonads.js
Size 3KB
SHA256 181a82d0a1a117f54b1e99eea71b5adfcc4052e4095ffc53f1dfca2d734b93cd
MD5 a699863dfe3c61b7773b9cc0989d926f
SHA1 c67019a086ee26d681d040a4542e91d5e36b290a
SHA512 be7c4f625eefd9234d1efbf1a7c768b456e4095abdc93a43d26a88aba7240bce24d1e98d2d69dc88e07cbb84fff3e1bfc9ab512806ad99cd2f4b8ab24b87c139
TLSH
T1537160ACB8F351BA492BB0394FAFA0097931D02B1009DD217D5DC244AF9813999BFBD5
MD5 SHA1 SHA512 TLSH

Submit Download

yt_autocomment.js

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\nfmlkliedggdodlbgghmmchhgckjoaml\1.9.5_0\opt\yt_autocomment.js
Size 47KB
SHA256 91a9b48565d129372656253bfc300c64046f451075cbc878dbf230df92a98fde
MD5 3283a3cf184dffaac13bc62e202a6bd0
SHA1 b09b46dcfb16112dfde64a178bd8805b644ea29d
SHA512 c287af81f42646c778ffd3f68b3bd5b87891202c944825f539a91cd5237472120ea3e4e8080fbdb2f703b9f6117426ab7b13448bd8d660524d95963dd9ec753a
SSDEEP 768:IQ/Fc9aWTq7jiFL1MK1ksHjDmwoR44/FsGfxiQyeSz+Fh2Ndh++Ai3HifVqS6Rx:376VYn3d1fxiQCdE+AiXUVqPx
TLSH
T1F923634F24F31125456370BE6F8F6295B239A21B3208CA583D5EC7642F89F399272BDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

popup.html

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\nfmlkliedggdodlbgghmmchhgckjoaml\1.9.5_0\popup.html
Size 3KB
SHA256 082e1b7f523c3c04fedcc241eb22717acf5ffed974ab349069383f72efcac254
MD5 b72c6ce451e83e0f5976fa1609703c0f
SHA1 0e7be2933c3bb95ceaa710eabef215687d8fe361
SHA512 79042895d30f8b5d78ed1918614de52c0e570329e5f35f2a8aea60828025072025312ad65363efd4f5d85e7aaf9ee706cefc8fa71bfbe69fe26cf8f3df0dc010
TLSH
T12A71CD6200F85437819284C66FF2AA267E96870FCB9D0A0072ED8B905FCBD47DC87138
MD5 SHA1 SHA512 TLSH

Submit Download

rules.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\nfmlkliedggdodlbgghmmchhgckjoaml\1.9.5_0\rules.json
Size 2KB
SHA256 5b7efe8959b456d6c812221d19d622bb7acd7ef1d3768d2fd28665cffcb950ce
MD5 24aa3162dab03939dc8a72046c8eba59
SHA1 646f7df8e7dc0a48a2329530bc040a50a38bb5c5
SHA512 1fbced0ffe2769d77b49922080b55005d3c7e7f921aac025a79a541d976e61f99ef3e989407f127a0ecb648470d09e5c342e7904aaf56c995903be4faa385da1
TLSH
T1CE515B56C9B55CA3D18E7238657A6900B07463432EEC7C1B7F8C40BC5F8E0799AB93CA
MD5 SHA1 SHA512 TLSH

Submit Download

sharebx.js

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\nfmlkliedggdodlbgghmmchhgckjoaml\1.9.5_0\sharebx.js
Size 4KB
SHA256 85afc07f2cecdce3929105ac3d76dc8f8396879f3408a9fa8ceb61cce88d5f19
MD5 e9a94a668bf31b039fa9746dd460bed5
SHA1 9539c68070339765f818ed1415940e584397cc84
SHA512 297ec6eb23051c3f9c0d0f047126d0f6d57f3c881a6210184249390039d7d81ff74814026a46a56b3e4a67fa65c7150ef3f793f084fb919a0874c6c699953ab4
SSDEEP 96:S41VMwekNqFDEUc+iEUOELgelKGveU6fanNmxMJaiWMyaJyF6:/1VhNqEUqEUOELDKG2BfanNmxMJa1aG6
TLSH
T17FA12F1D98B24158FC6B81387F6B795E2D346207918ECC39BE8F96840F87502999F39D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

styles.css

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\nfmlkliedggdodlbgghmmchhgckjoaml\1.9.5_0\styles.css
Size 2KB
SHA256 6012683478006534547940fc5c5063558b9bd91a819dba02dab40221810f0426
MD5 02e5739def10b8cbdd5626ec11255820
SHA1 2af0960ebae7048987342fd46b1e1977a7aa5838
SHA512 6ac01d6b75a886397a612686cea16009908ea7d3648305e1206a8d2b9e0d518219b22bbab36399fd228d18abbb45514bde852b1fe23fa8cf302e65be0c315384
TLSH
T1035179132EC3221195068372136FF7786FBF149E97CAA9D8399D5A148FC67817040A74
MD5 SHA1 SHA512 TLSH

Submit Download

twitch_cs.js

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\nfmlkliedggdodlbgghmmchhgckjoaml\1.9.5_0\twitch_cs.js
Size 2KB
SHA256 5813262382ebac0d0e4ff342922e994a850aa787d88dd44a5b0b63f80ab0638b
MD5 3f9a59dc498c6b86f1107d5c93593a0a
SHA1 861c87f836c754efa5c4e16f1cf1b9d8a3f4d2cc
SHA512 cb6eda168ea1094b91cddc1edffe5e078d3d66ee01614033333e47786c574d1df8e72d6e4e79874c8805ec82d096a8e78243cf9a7653cecba67d8f4598717be0
TLSH
T11C51BD360CB2A1115AA36085DE1F5403B6248A37521CE5057E9FC12CCFAD7BC9B6ABED
MD5 SHA1 SHA512 TLSH

Submit Download

yt.css

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\nfmlkliedggdodlbgghmmchhgckjoaml\1.9.5_0\yt.css
Size 133B
SHA256 a17c955a6cad6cb4a4b1d26e48c20ada0bf695dfbffa96b2a506d8dbb0a2d1b0
MD5 807b40a2da9de5aa4b8858f684b77b41
SHA1 1cbef8e69ef83357cf4e3187f9e79de7ae53382e
SHA512 e2a98a3d937cbaada24dc231dc4294fe4b5be94a4b6c09820b7794489218e39edab7c53bf4320c1e9fe81e77a65be446f9dce38c455522f145e2272012f75140
TLSH
T19BC02B0CC1C08302483803015465273504162103ECA82595990C33DC0302748EC69E20
MD5 SHA1 SHA512 TLSH

Submit Download

yt_sw_update.js

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\nfmlkliedggdodlbgghmmchhgckjoaml\1.9.5_0\yt_sw_update.js
Size 969B
SHA256 4ad21c7052e68fd0791e3e84a9dfa8f1fc56aea97cee321500e22c1ba732b521
MD5 24690c72daf4e8ac45a606eebd6013e9
SHA1 b36550b0d1a8b204bc6af592c303a0bedbe5d1b0
SHA512 8c226c9406660045b2a84e28100ff1254c8671934c5d4edab166d4e439183305676a8581a26bd11f73244c43f4a23d8ce5a5b20a84d94b74902ac08a14afdbaa
TLSH
T1C81189361CFA6516CA7330DD4E1F840A35259837916CDE0179AFC194DF756B03CA57C6
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 5aaf4073e1052e3ec673b2ea45fbfc4da988f4f4d1fc7192ec05e4345955e5b0
MD5 5445705833dead9acc149dcd856af820
SHA1 d1559e4c8f3637ba57673c9465af96917cb39a06
SHA512 b4acd4e57c7264f1b4a78d74c211de48e3effba2c6135c79a28718ea90ce90fb25daf60489da2def3891e42ac9dcddeb14077b339e8e13b0a2d6045452037d8a
TLSH
T102518AB7C7D9822D8C4156F4A725AF2ECE1E0A1843283C26C8D8EE6BD3E2471D11565F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 5c3d67db502773bd23dfe26d77d57f08dcd16df9acad682931044c9b3f44f7ea
MD5 a2258be4280a0926f20910d4867deafa
SHA1 53c6826ada470bf80dccd74f14ade647b115f6b2
SHA512 d5c993e5bea70448213330cec1510932a14a9f7b3910652ad67675f15e659c22901566985b6e3f94b981511e58bcc379a46cb4e9d3a19a9b6aefd81f0f47324a
SSDEEP 192:sxZVRayM/jK1Ml8MkR/fAs7NBIdpCPRAHW6+WN8X8/Y4nJInIgrJ:sxZVQMR/fAs7Nq5HbX/C9
TLSH
T12A52F9126A345A77CCDBD209F951BF53D6F40476E2900E98AAFCDA1C04E7AED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 13e6f3d957d0bf9c558a22883641fe323a4f02114eb09149af44f9bf7ebfa0e5
MD5 be62930095f0b340ab43ba6e0987a69a
SHA1 2d18e54c45e0313e14451f65bc62e239a46ee42a
SHA512 638a43cc8bc2c5256e16d4f743912f87ded8ead394f54a7e735628978e8d7007b494010663086b5d922ba2cc70b6be24b7ab08b1a4a547214ba4ea12a776ec56
SSDEEP 192:sxZVRayM/jK1Ml8MkR/fAsAfs/ai2lR9IIdpIe/QHW6+WN5ba24XY4aGInIg5yJ:sxZVQMR/fAsAfs/aiYRX6HbN4XsQ
TLSH
T15F62D6026A345A77CCDBD209F941BF53D6F90476E2901E54AAFCDA1C05E7BED220382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 fe7e32a465f5e5e91ebc110d2be61b80586a1e59790d7f4f1e3a346c373828b3
MD5 12582dadbde42958d3faaaccac2ea48a
SHA1 c9830e612a5bada240be3410145dd77b41f03595
SHA512 41a98bd983ce6bb5a7b202910d481f8350517dc5229872fa5cd7bad6a58bf4b4b0671d500b59f99c52822ca987180220aa701b61f0127b4a95874293dc30392f
SSDEEP 192:sxZ5RayM/jK1Ml8UQakR/fAsAfs/ai2lR9IIdpEt9Oe/QHW6+WN5eon4da24XY4m:sxZ5QqpR/fAsAfs/aiYRXrHb4VN4XPQ
TLSH
T15962E6026A345AB7CCDBD209F941BB63E6F50466D5901E54AAFCDA1C04E7BED220382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 bd53d3fad5a76a3b3e3b0d4176341e2b1175e9de2a9996220e7cca90b149b5be
MD5 a5930babdd184c19b85130978313273a
SHA1 1123b448cfec5fd9635b54cb399d223bb7909e57
SHA512 f4396803284126e9d528ec24d063c60731e866dc72ed72c34cd1d6684f8d875ade5fc98ce3361140c813413e27981664a7266840b7ec9fdc83986ae66512a0ee
SSDEEP 192:sxZBRayM/jK1Ml8UQakR/fAsAfs/ai2lR9IIdpEt9Oe/QHW6+WN5eon4da24XY4m:sxZBQqpR/fAsAfs/aiYRXrHb4VN4XPQ
TLSH
T18562E6026A345AB7CCDBD209F941BB63E6F50476D5901E54AAFCDA1C04E7BED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 59f5207a3aeb1d7599de049d58c503d53e2c974a240f437da6d49916915c6fd0
MD5 d89c46bf235807f37b8b277b61eabb88
SHA1 001a85123cdf5a8358e718ee6753fd8c7117cfd3
SHA512 21c4bc568e341402ed65e78345812398b2d3a7a643c3bd8424a10eff48e0e9e71bfb3856010d71a11e310c621360a5ee62ea08f9d2da6bbd6ba7ed8a02a3967b
SSDEEP 768:4K8iJPNWvx76r8F1+UoAYDCx9Tuqh0VfUC9xbog/OVsALl6opdHro1kXUn9:4K8iJPNWvx76ru1jahALocdUGU9
TLSH
T126D2FB3B680CCB7E4F844E9CEC266F966ED801CB5B948D5447FA884C03C76EA51279DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 192B
SHA256 cca47596d3e1f53d30eba7294fef6ad6568b4caf91f77abfac5bba1ef61b7eee
MD5 5f0673184c2152579b1f7893c6e836f9
SHA1 a4f734947e4b2bd13b28efc09780a570f6a89caf
SHA512 3e3a448b0f9435b350515d3fba9a51a413e2d66fdaf92573bd315563e9aa06877fb6b3762c381bbdaa652084ee17271b1e4ad52295f3a006313ae890fd75cfa5
TLSH
T1BCC02BE701400082C2E803364407D0D8232C64B0C60C33D40074301F5C792114015207
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5ace8c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5ace8c.TMP
Size 48B
SHA256 7a62fc74b58bd458a3e377b487912528ba2c3e4c5396e2caa786fd9486ec3667
MD5 9b224a3d3240b0669ba8d0a8e4ed931c
SHA1 37b4d99491bff8b12f17fcb5159681a770e94217
SHA512 200bf8d6014223a4d3b67167553f24d0a01c490c6767aba130da9aaa0cf755b421d58123464b719670591b7f4f84fa75775976be8689e7fe62cd88dc30c72726
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 db3657e657ad4ed449770389a410c97d9237c49068ddfc04f603589a42fab03a
MD5 b120845cfa09375099ac1e0cd878461b
SHA1 c819258b16d757e39b7a42967e0e0bacd458c7d1
SHA512 61167249d725e052540b23e87ef6b3983c82d89e5e785bd16aeeee77881a445d871f6f13a25b98b508ad1ebf93bac8a00b216aaad35699eb7c36c337d9a08e46
SSDEEP 96:KKIAKhKWSwAKdGhNib/NLrhYf48a3hKiIaNhOFdw3Lih:47T4Nib/NLr+f473BIaNgFdw3Lih
TLSH
T11391551630BF12813C3E658C96A68A1B874171633129B42F7BAA40B50F6BE355DFDCDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\nfmlkliedggdodlbgghmmchhgckjoaml\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59be07.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59be07.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 d712334bfa8dc387e1a9129c4ab2822d525a48d19064a3f7b92c0fbcad1a64b0
MD5 89347c0da574175c6fb0990bfc5b4718
SHA1 c2f13e4b7a78922abc35e230f5a4014e580ca598
SHA512 58dc32468231da34bc96f606b504c626e4db224c515093cb4139465727245e14b11a39826b238ded0a85f6ee9bd91c69ee87a22762d5a4eea91fc2e9806400ec
SSDEEP 384:EFiZcIezsN98TUNTUlIlKGWPj8vkREcJnTKwBODNZOCS5x:EFQ+8wgDRKJnewBKZO1x
TLSH
T1EAC207F148EB583AD9AE9B47A77D2E034EBCC067F5846A90B3D8550CCC961BFC30A911
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 12558209a87b467f2ad18e72e99fa048840152b37acee86fbdb11bf87264063a
MD5 968e008fbbb33d672876ce2c17afe3d3
SHA1 7cbd0763a03704076d2734bad6951d264cc9664e
SHA512 d3216b5ed2c43c048cf2115b0a0a7a6d40abcae9c2b02eac57636c273c6333ed4c9a18f287859b58a42ce9a4fd09d0f68b45e9a8be6a17772ba38c5adbd57ba0
SSDEEP 384:8iFiZcIezsN98TUNTUlIlKGWPj8vkRETJnTKwBODNZOCS5x:nFQ+8wgDRNJnewBKZO1x
TLSH
T13FD207F248EB583AD9AE5B47A77D2E034EBCC067F5846A90B3D8550CCC961BFD30A911
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 72cdb339d7759f79f323bfa59717d148b7ef895a3ae3946c2fa51379d573f6d1
MD5 8c709aca7bd3095c9b8e2f75bf31a041
SHA1 b92e365257709335b85f44ddd21d4803fe097293
SHA512 0a9f4c01e1c458dbdc00aa4c57547234e78fb07beeb2b5a0d125f77000bc25ee81fd3b041a06ae990cc23e37a9d780b4dd678a84d20c33ce9e3e851b845aebcb
SSDEEP 384:VZcIhsNjvGWPjevkREVJnTKwBODNZOCS5x:thnbfJnewBKZO1x
TLSH
T140928D31587C2C7A9EE3B545F88637174EF4812BE6D82F94D5EDAB1C00EA298130BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 2487d89e13b5c48f7f446d1ad9e78054d3f9b4a782dd12f3b51f473ea89c1601
MD5 83430144c1347e0d295bdaa216c095f5
SHA1 7b3d6f3056fd0407efeee8afb3414664ffebf6d5
SHA512 a81c508a716334b24a9b0b697e21c92edd86df988ca89e829320095ec21a1c71f61a7640b54e2ed38abc987b3ddce8fcf7b3ce9017777d8fe15eb1772b1c9439
SSDEEP 384:5ZcIhsNjKGWPjevkREVJnTKwBODNZOCS5x:RhubfJnewBKZO1x
TLSH
T19D928D71587C2C7A9EE3B545F88637174EF4812BE6D82F94D5EDAB1C00EB298130BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7312fa2466d8f4ca9bb9061d1c0246ba1cf8023f7b660d9ed25d8c743f104d35
MD5 8859a4b3a9a2969070a518cc44ffc1af
SHA1 3d4c512fa8fec1068db28fa93dcf8834fd25859b
SHA512 a93a80a1adb7c69702c2d3e1147bc09eba8b5c7bc3235c449a33098b00f062d47e52ae7ecde33f1ee0d36b225da9b7628d63bbd6ab8528eb11c6e485901e1051
SSDEEP 96:ZqONkdQsjpfmUTmDK5ih/cIPURHl8h4otop5Fa5DsBhPwivh50xy0SFYK+AxrgCx:gONx6kDfQmiUyFkgZ903etnQiDpU6
TLSH
T10B02D83968782CBB8EF3AE49F48737275FA5112BEA952F81D9E81A1C40D765C1303937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c9c7c11dd387e98d2db45335e78e00806c4d8626b03f32b1ac8640a129ce7532
MD5 58afd15a45dbec923eb875dcf85c66cd
SHA1 1a83fd7429eac750fbdf5f1c08202419d7fc497f
SHA512 1f4377451022d617524a92c6cf77261e04002f4bad013451ed7d6dbbd4758a3389efb959695332bbd6d3148b56b66a9fb9f27ab8ae5b511de9d9d2b2bedf584a
SSDEEP 96:aqONkqQsjpfmUTEK5ih/cIPURHl8h4otop5FawDsBtPwivh50xy0SFYK+AxrgCMp:xONO6klQmiUyFngt903etLE4cRrqGU6
TLSH
T1FD121935A8B8686A5EE3A845B48737175FA4422BEBC97FD1D4DC2A1C00DF26C130B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 c273e3d5bf224c0ee93ac71b6aead4680e895bdbb42f14cd7ffaf4f3fe86f0b9
MD5 883b5ecbcbc9b79c9f7ef1ae11086c6c
SHA1 3e14183afd51e88593e3e5382cbdfb94db0bb407
SHA512 33cb8ed814172b5d68f037e803beaa11cebd0bf3360cbfd4c322c6eb65ae54af6eff082906169dc7433d50e7ed0a3509ade800d94c610a13256c227eae17d38d
TLSH
T1E2E00215F30100A5C199037840871F181ED1901101B112454B30019C3C333063D24B80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5a72a1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5a72a1.TMP
Size 392B
SHA256 94fa2effed3e10f614c86c85c5e072f5a431b1e0ad66327397462d07e66f951c
MD5 077381ddb429e8b7ba31da3032bcfa04
SHA1 d433b128e7fb4002ab29cb15a046f24412fcf5f1
SHA512 28c3ca029f8a85370d6f27536372bef79a641ac42a58c34ae6007717c77b85021932ebaede7095b449f1ff3f273b9574e427015fe6aa64c3e6083719857d0d98
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 8a71390159f4dd834749ce6099ba03d8f07423a1b1e9d54e84d13daa481e4ddd
MD5 f762392a155ad2ac399c87427ba05f68
SHA1 4a92ec66a84c4836619ebaffd038bfe491131b62
SHA512 31d46ffeb9913a4dd4538c8fc4b06711e6d303de0ed609cd8ed8f80bd8740389727b0d938511446f60d3d3ea6164fc7a52e7ca249ef609a444d5443c7eff4b3d
TLSH
T1F841265CBAEA1108B3B7AF5AABF6A46D547EB8372E07D55E00110D4F0622B44C8B1737
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5012_304416383\CRX_INSTALL\_locales\en\messages.json
Size 326B
SHA256 03dcf2476f0fda4e513302655ada9f330eb0d86de581ff9d9e6e32b1c0a05844
MD5 e9a6862b02505dcc9a2a2e585708522f
SHA1 2dd9ea9850328b8d986c70583eb4bb679520f529
SHA512 e8214ca90e85ceb966755c42d445a48c3d71b82f7fcf0d6dd3c0fc3bf87f0ee293a0389539726c43a012113c406b5c6dc4cde7f5fcb44b6d0c85a17b663bd5ec
TLSH
T1A6E086058C30BD9780AF92595DA4B54CE335435B1A012C187F9E604C1BDD7E684B1384
MD5 SHA1 SHA512 TLSH

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5012_304416383\CRX_INSTALL\images\128.png
Size 21KB
SHA256 6f307413a59b870c613489f1f90d1e670c77fc792a8bde56a933817cc7009788
MD5 22ece196278160c947445ef7af054a43
SHA1 8d776bb88a0df5790a0083f2943694ac9c9738c3
SHA512 8f5c00003c872d4b9ebe1f7e371566c6d8f89f0cbfbe44d1640ac033c9517a28846d2ee49d7ae7a9cf13cd32467333bba5975b07b5801c0f2eeb1df2340bbdb0
SSDEEP 384:oHwPYSG8J+IjZ1+EYsIQcdrjGc9UhXbwV1chwYX4OB2+GJqf+d:75Gg+ltsIuc9URb0UP4OKU2d
TLSH
T171A2F13CDB094D88BB908F8C2C6C6CE0835E77A1BA397813D354521E0D994E389F9D9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nfmlkliedggdodlbgghmmchhgckjoaml_41048.crx

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5012_304416383\nfmlkliedggdodlbgghmmchhgckjoaml_41048.crx
Size 1.7MB
SHA256 d7c4e1504e7fabdbf2e12e92f40e9e6e7e238e6c1b9db8cf0d60ffd4391f3328
MD5 31b1f789bbe8c2dcd40dff63562b6b38
SHA1 694ec4de625bfb132ac8bc2f6f258121cb3b4ce1
SHA512 19022b39c8dd5a7144d18dd0316f30e7c4bec69994b2a41ec2abe969d7f727c5a2f6ee7df3d606c8c5c8d64d7ce667593b6781ccb75d813e952248283d204d33
SSDEEP 24576:uevzk7GdSffoX9ABttMbIzd+x9GuXDEUHKC3WKf8ClSFwvLcJNFV+ePqY:DIygnoXmUcAi0DEClmjMSWvLONFV+cN
TLSH
T1AF85332D6F93D8CFCB438F344ADCB973009E0EE0797B72075A016BAE14758651725AEA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download