3faf384802c7f218f14460ef614815bc87229e270426bfaf021baf58da7a7d5e

Analysis

user interaction
yes
max time kernel
150s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/08/2026, 18:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
NVSearchNG.application
Size 10KB
Sample260817-wp566awdkd
SHA256 3faf384802c7f218f14460ef614815bc87229e270426bfaf021baf58da7a7d5e
MD5 3bd6cb48f62d8c20ba564846890906b1
SHA1 9ec5cfdf254e200598b2f2cf38001910a87ae961
SHA512 bd4ebe1063191e9c493d68e3957e5ee315e8f35541bce94b48f2aa0836cc730bdb89502f087fdca05b885345a7acd394ae3e808bc6fbdc5bcc176ca13c6f6ab1
SSDEEP 192:oksVVCP/TkqzkrlMTkqTkxWERTmuEDh7BqWoUA:CJUERTmuM7Y7
TLSH
T150324C5DC9849C03D318E5307AE2D93256B8676384EC0A547EA5AD4EDB89FE142233D2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

adware discovery spyware

Malware Config

Signatures

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_1994727664\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_1994727664\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_1994727664\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_1994727664\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_1994727664\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_1994727664\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_1994727664\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_1994727664\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_1994727664\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_1994727664\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_1994727664\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_1994727664\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_1994727664\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_1994727664\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_1994727664\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_1994727664\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_1994727664\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_4740_1126720333\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_109_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_1994727664\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_1994727664\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_1994727664\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_1994727664\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_1994727664\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_1994727664\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_1994727664\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_1994727664\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_1994727664\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_1994727664\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_1994727664\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_1994727664\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_1994727664\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_1994727664\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_1994727664\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_1994727664\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_1994727664\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_1994727664\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_1994727664\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_1994727664\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_1994727664\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_1994727664\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_1994727664\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_1994727664\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_1994727664\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_1994727664\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_1994727664\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_1994727664\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_1994727664\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_1994727664\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_1994727664\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_1994727664\_locales\cs\messages.json	msedge.exe
File opened for modification	C:\Windows\Installer\{79D068F5-40E4-3614-A683-E351DF40BEBD}\icon.ico	explorer.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_1994727664\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_1994727664\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_1994727664\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_1994727664\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_1994727664\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_1994727664\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_1994727664\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_1994727664\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_1994727664\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_1994727664\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_1994727664\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_1994727664\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_1994727664\service_worker_bin_prod.js	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4560	msedge.exe
2120	msedge.exe
2496	chrome.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe

Modifies data under HKEY_USERS 11 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134314637477512277"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Software\Microsoft\Windows\CurrentVersion	dfsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\systemcpl.dll,-2#immutable1 = "View information about your computer, and change settings for hardware, performance, and remote connections."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{D674391B-52D9-4E07-834E-67C98610F39D}\FFlags = "18874433"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\telephon.cpl,-1#immutable1 = "Phone and Modem"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\LogicalViewMode = "3"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\SyncCenter.dll,-3001#immutable1 = "Sync files between your computer and network folders"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\Mode = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\WFlags = "0"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide	dfsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\autoplay.dll,-1#immutable1 = "AutoPlay"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\Rev = "0"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{D674391B-52D9-4E07-834E-67C98610F39D}\Rev = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{D674391B-52D9-4E07-834E-67C98610F39D}\Mode = "4"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Software\Microsoft\Windows	dfsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\ComponentStore_RandomString = "G1VXKCOTMDNVR5HMJA1L8K4J"	dfsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\DiagCpl.dll,-1#immutable1 = "Troubleshooting"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\fvecpl.dll,-1#immutable1 = "BitLocker Drive Encryption"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\NodeSlot = "4"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\usercpl.dll,-1#immutable1 = "User Accounts"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\usercpl.dll,-2#immutable1 = "Change user account settings and passwords for people who share this computer."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\inetcpl.cpl,-4312#immutable1 = "Internet Options"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\LogicalViewMode = "2"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\netcenter.dll,-2#immutable1 = "Check network status, change network settings and set preferences for sharing files and printers."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\ComponentStore_RandomString = "YKMVGN1ZW22ROQ7YQ75CK17V"	dfsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\fvecpl.dll,-2#immutable1 = "Protect your PC using BitLocker Drive Encryption."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\srchadmin.dll,-602#immutable1 = "Change how Windows indexes to search faster"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\Mode = "6"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{D674391B-52D9-4E07-834E-67C98610F39D}\LogicalViewMode = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Installations	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{D674391B-52D9-4E07-834E-67C98610F39D}\GroupByDirection = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Software\Microsoft	dfsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\StateStore_RandomString = "R28LQHNZJ7QYN84EV1EG5GP1"	dfsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\telephon.cpl,-2#immutable1 = "Configure your telephone dialing rules and modem settings."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\mmsys.cpl,-301#immutable1 = "Configure your audio devices or change the sound scheme for your computer."	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\GroupByKey:PID = "0"	explorer.exe
Key deleted	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0	dfsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\powercpl.dll,-1#immutable1 = "Power Options"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\DeviceCenter.dll,-2000#immutable1 = "View and manage devices, printers, and print jobs"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\timedate.cpl,-51#immutable1 = "Date and Time"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\FFlags = "18874385"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\sud.dll,-10#immutable1 = "Choose which programs you want Windows to use for activities like web browsing, editing photos, sending e-mail, and playing music."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\appwiz.cpl,-159#immutable1 = "Programs and Features"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\appwiz.cpl,-160#immutable1 = "Uninstall or change programs on your computer."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\DeviceCenter.dll,-1000#immutable1 = "Devices and Printers"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\RADCUI.dll,-15300#immutable1 = "RemoteApp and Desktop Connections"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\SyncCenter.dll,-3000#immutable1 = "Sync Center"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\IconSize = "48"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\main.cpl,-102#immutable1 = "Keyboard"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\GroupByDirection = "1"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-189034102-168398478-1159367937-1000\{1D9EE294-0E82-4EC1-8C1E-65522270216B}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\Vid = "{0057D0E0-3573-11CF-AE69-08002B2E1262}"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Software	dfsvc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\srchadmin.dll,-601#immutable1 = "Indexing Options"	explorer.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4308	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4460	chrome.exe
4460	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4308	explorer.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4936	dfsvc.exe
Token: SeShutdownPrivilege	4308	explorer.exe
Token: SeCreatePagefilePrivilege	4308	explorer.exe
Token: SeShutdownPrivilege	4460	chrome.exe
Token: SeCreatePagefilePrivilege	4460	chrome.exe
Token: SeShutdownPrivilege	4460	chrome.exe
Token: SeCreatePagefilePrivilege	4460	chrome.exe
Token: SeShutdownPrivilege	4460	chrome.exe
Token: SeCreatePagefilePrivilege	4460	chrome.exe
Token: SeShutdownPrivilege	4460	chrome.exe
Token: SeCreatePagefilePrivilege	4460	chrome.exe
Token: SeShutdownPrivilege	4460	chrome.exe
Token: SeCreatePagefilePrivilege	4460	chrome.exe
Token: SeShutdownPrivilege	4460	chrome.exe
Token: SeCreatePagefilePrivilege	4460	chrome.exe
Token: SeShutdownPrivilege	4460	chrome.exe
Token: SeCreatePagefilePrivilege	4460	chrome.exe
Token: SeShutdownPrivilege	4460	chrome.exe
Token: SeCreatePagefilePrivilege	4460	chrome.exe
Token: SeShutdownPrivilege	4460	chrome.exe
Token: SeCreatePagefilePrivilege	4460	chrome.exe
Token: SeShutdownPrivilege	4460	chrome.exe
Token: SeCreatePagefilePrivilege	4460	chrome.exe
Token: SeShutdownPrivilege	4460	chrome.exe
Token: SeCreatePagefilePrivilege	4460	chrome.exe
Token: SeShutdownPrivilege	4460	chrome.exe
Token: SeCreatePagefilePrivilege	4460	chrome.exe
Token: SeShutdownPrivilege	4460	chrome.exe
Token: SeCreatePagefilePrivilege	4460	chrome.exe
Token: SeShutdownPrivilege	4460	chrome.exe
Token: SeCreatePagefilePrivilege	4460	chrome.exe
Token: SeShutdownPrivilege	4460	chrome.exe
Token: SeCreatePagefilePrivilege	4460	chrome.exe
Token: SeShutdownPrivilege	4460	chrome.exe
Token: SeCreatePagefilePrivilege	4460	chrome.exe
Token: SeShutdownPrivilege	4460	chrome.exe
Token: SeCreatePagefilePrivilege	4460	chrome.exe
Token: SeShutdownPrivilege	4460	chrome.exe
Token: SeCreatePagefilePrivilege	4460	chrome.exe
Token: SeShutdownPrivilege	4460	chrome.exe
Token: SeCreatePagefilePrivilege	4460	chrome.exe
Token: SeShutdownPrivilege	4460	chrome.exe
Token: SeCreatePagefilePrivilege	4460	chrome.exe
Token: SeShutdownPrivilege	4460	chrome.exe
Token: SeCreatePagefilePrivilege	4460	chrome.exe
Token: SeShutdownPrivilege	4460	chrome.exe
Token: SeCreatePagefilePrivilege	4460	chrome.exe
Token: SeShutdownPrivilege	4460	chrome.exe
Token: SeCreatePagefilePrivilege	4460	chrome.exe
Token: SeShutdownPrivilege	4460	chrome.exe
Token: SeCreatePagefilePrivilege	4460	chrome.exe
Token: SeShutdownPrivilege	4460	chrome.exe
Token: SeCreatePagefilePrivilege	4460	chrome.exe
Token: SeShutdownPrivilege	4460	chrome.exe
Token: SeCreatePagefilePrivilege	4460	chrome.exe
Token: SeShutdownPrivilege	4460	chrome.exe
Token: SeCreatePagefilePrivilege	4460	chrome.exe
Token: SeShutdownPrivilege	4460	chrome.exe
Token: SeCreatePagefilePrivilege	4460	chrome.exe
Token: SeShutdownPrivilege	4460	chrome.exe
Token: SeCreatePagefilePrivilege	4460	chrome.exe
Token: SeShutdownPrivilege	4460	chrome.exe
Token: SeCreatePagefilePrivilege	4460	chrome.exe
Token: SeShutdownPrivilege	4460	chrome.exe

Suspicious use of FindShellTrayWindow 39 IoCs

pid	Process
4308	explorer.exe
4308	explorer.exe
4308	explorer.exe
4740	msedge.exe
4740	msedge.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4308	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4512 wrote to memory of 4936	4512	rundll32.exe	89
PID 4740 wrote to memory of 3200	4740	msedge.exe	95
PID 4740 wrote to memory of 4560	4740	msedge.exe	97
PID 4740 wrote to memory of 8	4740	msedge.exe	98
PID 4740 wrote to memory of 8	4740	msedge.exe	98
PID 4740 wrote to memory of 8	4740	msedge.exe	98
PID 4740 wrote to memory of 1756	4740	msedge.exe	99
PID 4740 wrote to memory of 1756	4740	msedge.exe	99
PID 4740 wrote to memory of 5760	4740	msedge.exe	100
PID 4740 wrote to memory of 5760	4740	msedge.exe	100
PID 4740 wrote to memory of 5760	4740	msedge.exe	100
PID 4740 wrote to memory of 4160	4740	msedge.exe	101
PID 4740 wrote to memory of 4160	4740	msedge.exe	101
PID 4740 wrote to memory of 4160	4740	msedge.exe	101
PID 4740 wrote to memory of 2244	4740	msedge.exe	102
PID 4740 wrote to memory of 2244	4740	msedge.exe	102
PID 4740 wrote to memory of 2244	4740	msedge.exe	102
PID 4740 wrote to memory of 1728	4740	msedge.exe	103
PID 4740 wrote to memory of 1728	4740	msedge.exe	103
PID 4740 wrote to memory of 1728	4740	msedge.exe	103
PID 4740 wrote to memory of 4368	4740	msedge.exe	105
PID 4740 wrote to memory of 4368	4740	msedge.exe	105
PID 4740 wrote to memory of 6072	4740	msedge.exe	106
PID 4740 wrote to memory of 6072	4740	msedge.exe	106
PID 4740 wrote to memory of 4084	4740	msedge.exe	107
PID 4740 wrote to memory of 4084	4740	msedge.exe	107
PID 4740 wrote to memory of 4152	4740	msedge.exe	109
PID 4740 wrote to memory of 5564	4740	msedge.exe	110
PID 4740 wrote to memory of 5564	4740	msedge.exe	110
PID 4740 wrote to memory of 4168	4740	msedge.exe	111
PID 4740 wrote to memory of 4168	4740	msedge.exe	111
PID 4740 wrote to memory of 5732	4740	msedge.exe	114
PID 4740 wrote to memory of 5732	4740	msedge.exe	114
PID 4740 wrote to memory of 2120	4740	msedge.exe	120
PID 4740 wrote to memory of 2120	4740	msedge.exe	120
PID 4740 wrote to memory of 5388	4740	msedge.exe	117
PID 5388 wrote to memory of 2572	5388	msedge.exe	118
PID 5388 wrote to memory of 2120	5388	msedge.exe	120
PID 5388 wrote to memory of 1812	5388	msedge.exe	121
PID 5388 wrote to memory of 1812	5388	msedge.exe	121
PID 5388 wrote to memory of 1812	5388	msedge.exe	121
PID 5388 wrote to memory of 3100	5388	msedge.exe	122
PID 5388 wrote to memory of 3100	5388	msedge.exe	122
PID 5388 wrote to memory of 2848	5388	msedge.exe	124
PID 4460 wrote to memory of 1888	4460	chrome.exe	126
PID 4460 wrote to memory of 2496	4460	chrome.exe	127
PID 4460 wrote to memory of 572	4460	chrome.exe	128
PID 4460 wrote to memory of 572	4460	chrome.exe	128
PID 4460 wrote to memory of 5540	4460	chrome.exe	130
PID 4460 wrote to memory of 5540	4460	chrome.exe	130
PID 4460 wrote to memory of 4592	4460	chrome.exe	131
PID 4460 wrote to memory of 4592	4460	chrome.exe	131
PID 4460 wrote to memory of 2576	4460	chrome.exe	132
PID 4460 wrote to memory of 2576	4460	chrome.exe	132
PID 4460 wrote to memory of 3972	4460	chrome.exe	133
PID 4460 wrote to memory of 3972	4460	chrome.exe	133
PID 4460 wrote to memory of 5520	4460	chrome.exe	134
PID 4460 wrote to memory of 5520	4460	chrome.exe	134
PID 4460 wrote to memory of 5496	4460	chrome.exe	135
PID 4460 wrote to memory of 3976	4460	chrome.exe	147
PID 4460 wrote to memory of 5056	4460	chrome.exe	137
PID 4460 wrote to memory of 3976	4460	chrome.exe	147
PID 4460 wrote to memory of 5056	4460	chrome.exe	137
PID 4460 wrote to memory of 4860	4460	chrome.exe	141

C:\Windows\System32\rundll32.exe
"C:\Windows\System32\rundll32.exe" "C:\Windows\System32\dfshim.dll",ShOpenVerbApplication C:\Users\Admin\AppData\Local\Temp\NVSearchNG.application
1⤵
- Suspicious use of WriteProcessMemory
PID:4512
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
  2⤵
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  PID:4936

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4308

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
- System Location Discovery: System Language Discovery
PID:3736

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
- System Location Discovery: System Language Discovery
PID:6008

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\StepDismount.htm
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffc7d44c188,0x7ffc7d44c194,0x7ffc7d44c1a0
  2⤵
  PID:3200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2156,i,11291248986314981235,9995007879398366304,524288 --field-trial-handle=2324,i,16517196789267431654,16483342119236965330,262144 --variations-seed-version --mojo-platform-channel-handle=2444 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1980,i,3690878956111994718,15356470257466472226,262144 --field-trial-handle=2324,i,16517196789267431654,16483342119236965330,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:2
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2640,i,5303426746280460899,8501631251804566181,524288 --field-trial-handle=2324,i,16517196789267431654,16483342119236965330,262144 --variations-seed-version --mojo-platform-channel-handle=2924 /prefetch:13
  2⤵
  PID:1756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3588,i,2069731390264100604,8316462454765563818,2097152 --field-trial-handle=2324,i,16517196789267431654,16483342119236965330,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:1
  2⤵
  PID:5760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3592,i,15550428542936130411,5927274188346712,2097152 --field-trial-handle=2324,i,16517196789267431654,16483342119236965330,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:1
  2⤵
  PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4260,i,11032251638798081278,3096462201651076406,2097152 --field-trial-handle=2324,i,16517196789267431654,16483342119236965330,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
  2⤵
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4272,i,6176426445665398697,14271808171614208438,2097152 --field-trial-handle=2324,i,16517196789267431654,16483342119236965330,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:9
  2⤵
  PID:1728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3900,i,8034431444222719207,1903411887941791247,524288 --field-trial-handle=2324,i,16517196789267431654,16483342119236965330,262144 --variations-seed-version --mojo-platform-channel-handle=3936 /prefetch:14
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5352,i,16087043627150078375,1782651002719049614,524288 --field-trial-handle=2324,i,16517196789267431654,16483342119236965330,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:14
  2⤵
  PID:6072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5368,i,7121956509555612267,5100023074102978058,524288 --field-trial-handle=2324,i,16517196789267431654,16483342119236965330,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:14
  2⤵
  PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6136,i,7104828579458830138,17699128969482636854,524288 --field-trial-handle=2324,i,16517196789267431654,16483342119236965330,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:14
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6136,i,7104828579458830138,17699128969482636854,524288 --field-trial-handle=2324,i,16517196789267431654,16483342119236965330,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:14
  2⤵
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6328,i,4694745964884250277,12935006752524985065,524288 --field-trial-handle=2324,i,16517196789267431654,16483342119236965330,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:14
  2⤵
  PID:5564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6476,i,3526736698943640818,10953870841989279507,524288 --field-trial-handle=2324,i,16517196789267431654,16483342119236965330,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:14
  2⤵
  PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6568,i,15442077616735196620,11001292312191456240,524288 --field-trial-handle=2324,i,16517196789267431654,16483342119236965330,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:14
  2⤵
  PID:5732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6536,i,15828999168133670322,785208066882302564,524288 --field-trial-handle=2324,i,16517196789267431654,16483342119236965330,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:14
  2⤵
  PID:2120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:5388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x244,0x328,0x7ffc7d44c188,0x7ffc7d44c194,0x7ffc7d44c1a0
    3⤵
    PID:2572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2124,i,2250428011023211278,1897095900789962322,524288 --field-trial-handle=2732,i,14401670263942137019,17376986427241385451,262144 --variations-seed-version --mojo-platform-channel-handle=2764 /prefetch:11
    3⤵
    - System Time Discovery
    PID:2120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1908,i,18216323363434299727,11694111435384239882,262144 --field-trial-handle=2732,i,14401670263942137019,17376986427241385451,262144 --variations-seed-version --mojo-platform-channel-handle=2728 /prefetch:2
    3⤵
    PID:1812
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2440,i,5417951244809964748,4937089398297883121,524288 --field-trial-handle=2732,i,14401670263942137019,17376986427241385451,262144 --variations-seed-version --mojo-platform-channel-handle=2840 /prefetch:13
    3⤵
    PID:3100
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4292,i,11760675531296064176,9352004610612288708,524288 --field-trial-handle=2732,i,14401670263942137019,17376986427241385451,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:14
    3⤵
    PID:5892
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4292,i,11760675531296064176,9352004610612288708,524288 --field-trial-handle=2732,i,14401670263942137019,17376986427241385451,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:14
    3⤵
    PID:2848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1084,i,333441139496782752,1111655871598107178,524288 --field-trial-handle=2732,i,14401670263942137019,17376986427241385451,262144 --variations-seed-version --mojo-platform-channel-handle=1344 /prefetch:14
    3⤵
    PID:1784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1224,i,3804728973765819440,9981671729960900793,524288 --field-trial-handle=2732,i,14401670263942137019,17376986427241385451,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:14
    3⤵
    PID:2816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1220,i,12199754722657841840,13564646749828249670,524288 --field-trial-handle=2732,i,14401670263942137019,17376986427241385451,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:14
    3⤵
    PID:2108

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4968

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3944

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2280

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5316

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffc7d0ac728,0x7ffc7d0ac734,0x7ffc7d0ac740
  2⤵
  PID:1888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1492,i,12031340938553909870,7088702283494155227,524288 --field-trial-handle=1992,i,15263524054808839141,15598257218555573705,262144 --variations-seed-version --mojo-platform-channel-handle=2136 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1624,i,11887196060178632746,2395767641825220985,262144 --field-trial-handle=1992,i,15263524054808839141,15598257218555573705,262144 --variations-seed-version --mojo-platform-channel-handle=1988 /prefetch:2
  2⤵
  PID:572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2336,i,10222028861961150080,15646919380987100118,524288 --field-trial-handle=1992,i,15263524054808839141,15598257218555573705,262144 --variations-seed-version --mojo-platform-channel-handle=2516 /prefetch:13
  2⤵
  PID:5540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3080,i,4670087158728963480,15906593914266296495,2097152 --field-trial-handle=1992,i,15263524054808839141,15598257218555573705,262144 --variations-seed-version --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:4592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3120,i,675269168220358648,8915034021753861263,2097152 --field-trial-handle=1992,i,15263524054808839141,15598257218555573705,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:2576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4700,i,17178198791275080752,1181269120037954104,2097152 --field-trial-handle=1992,i,15263524054808839141,15598257218555573705,262144 --variations-seed-version --mojo-platform-channel-handle=4720 /prefetch:1
  2⤵
  PID:3972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4744,i,3932669742943026470,7179547367079097922,524288 --field-trial-handle=1992,i,15263524054808839141,15598257218555573705,262144 --variations-seed-version --mojo-platform-channel-handle=4856 /prefetch:14
  2⤵
  PID:5520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4972,i,7774082663523950699,11980891240844917867,524288 --field-trial-handle=1992,i,15263524054808839141,15598257218555573705,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:14
  2⤵
  PID:5496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5376,i,18057616891489586143,8092173986201131314,2097152 --field-trial-handle=1992,i,15263524054808839141,15598257218555573705,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:3976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5488,i,16132096052572854660,13485340053134751410,2097152 --field-trial-handle=1992,i,15263524054808839141,15598257218555573705,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:5056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5796,i,13470250670551348672,14260743297944613547,2097152 --field-trial-handle=1992,i,15263524054808839141,15598257218555573705,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:1
  2⤵
  PID:4860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5948,i,17098953042755392103,11040919947127937319,2097152 --field-trial-handle=1992,i,15263524054808839141,15598257218555573705,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:4248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5868,i,14348178033264205204,7911762350320940909,524288 --field-trial-handle=1992,i,15263524054808839141,15598257218555573705,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:14
  2⤵
  PID:1184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6108,i,14246212335672448248,9193803003330502622,2097152 --field-trial-handle=1992,i,15263524054808839141,15598257218555573705,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:1
  2⤵
  PID:1540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6112,i,267420994324189715,9239401553383400260,2097152 --field-trial-handle=1992,i,15263524054808839141,15598257218555573705,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:1
  2⤵
  PID:6004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5760,i,8140878853883831201,7333889623034328223,524288 --field-trial-handle=1992,i,15263524054808839141,15598257218555573705,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:14
  2⤵
  PID:1664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5772,i,7535304747441417611,5271413391148508504,2097152 --field-trial-handle=1992,i,15263524054808839141,15598257218555573705,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:1
  2⤵
  PID:3976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5520,i,18007968469885387851,13089326044360259759,524288 --field-trial-handle=1992,i,15263524054808839141,15598257218555573705,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:14
  2⤵
  PID:1992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6080,i,7300232806270669188,15479996138677999411,2097152 --field-trial-handle=1992,i,15263524054808839141,15598257218555573705,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:1
  2⤵
  PID:5132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6216,i,14387383241022149184,16677536772789599066,2097152 --field-trial-handle=1992,i,15263524054808839141,15598257218555573705,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:1
  2⤵
  PID:1428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6324,i,11106356283267858761,1035483444135700993,2097152 --field-trial-handle=1992,i,15263524054808839141,15598257218555573705,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:9
  2⤵
  PID:3016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6112,i,5139896372104518863,16246248397946878173,524288 --field-trial-handle=1992,i,15263524054808839141,15598257218555573705,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:14
  2⤵
  PID:1540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6160,i,10234666932241043537,15275623160729031295,524288 --field-trial-handle=1992,i,15263524054808839141,15598257218555573705,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:14
  2⤵
  PID:4364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6124,i,14543381272563853034,2543800112776790162,524288 --field-trial-handle=1992,i,15263524054808839141,15598257218555573705,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:14
  2⤵
  PID:3652

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1992

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5668

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:1164

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 adc99c5e369a6801460514e6948770e2ff39fc9934a97a4fbd45ea5df39d06b6
MD5 0af3f5a45a14dc397d71b811aa7f0162
SHA1 5094566383599f163da7ced18b1e0569c092f332
SHA512 1e8a9be38552079de7ad64e85e71139739b096bf4f7fb38f222abcbc58e00e21a3b9b67794728d291451912aaa57a96dbb40070af8c5c52d868ae70b132cb3bf
SSDEEP 192:cRCYoO3v7/APRp2W9UHsb+WNnMa0QLBg06qVyIsnAUge:cRCYpfmXlGwd02Re
TLSH
T1D342D66EAE10697B6CCBD22AFD217B93D7F5112135D42E84E6FC8A2C24E75CC2227007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 a5fd26a9c3f3e4d1886affe02cee713d1b50c75ec5ae3337cac6e0b48a710c4a
MD5 0810c5824cab1fb8ef7a6ed4afd28454
SHA1 dea05f5959dd31e0ed340afd7263927a70462766
SHA512 bc726929071a0af7e31ad7eae43d6adc04e26a7dd6981bb7e7cbc8eb3037a6c50ab0bf1d7d3356da285ffe95601c7dd0c56d20d2611ba590951b5dd84ff63aed
SSDEEP 384:oKj8P7KxkXqKf/pUZNCgVLH2HfgslxbXOD8T+ErU3xxHGPIbp:oa8P7KxkXqKf/pUZNCgVLH2HfgsfDOwY
TLSH
T101520A67684D9A3B0FD8D64CD8177F4FACB1015676B8482896FA9C0803A57CF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 67e786938762e5b2f71122404cdecf3ac7b1ea09cd0b2029eb60dae9f68f465c
MD5 f504825db33c7af24d0428aca7530a4f
SHA1 9ce69adcb1294b42fa5b0f42eefb719925423664
SHA512 b00f4cf4a973d6794025ef593a13cde24cd2be08736ef533a46fb10eab40d5b25d73b8f0b3bc9711e23454ee1b46474cf96fb7fb58fa46db65931403c85a91b5
TLSH
T12EA0021145C45455DE428371F2628553275758191D51434354D30D5CC97B2E94615100
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5b6ca1.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe5b6ca1.TMP
Size 48B
SHA256 34eb052d83526193f24115c217657437d246c60aeb80bc95268e841255012594
MD5 cc74e40b211c6da4bcea9fc00851cd5d
SHA1 f7d523eea7c5a64eaae1baeee625ea534189d694
SHA512 0870978297f554c827a9915568b9c8ea2c6b6bfc7c828803096f1e5e215ab5cf66717df543ccd6c76abd6cad29c8f60ae07a3935297ad4f169ea890a2c7b2582
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 127KB
SHA256 e318ed8e3a3edf8ac578621588dae54e191ed79a9b88837687e62659de859202
MD5 e004235f2be6f9c40d96db45c872da74
SHA1 244059d70bab63296a2f76d9e706aaddcf534934
SHA512 ea19f126180470daa16d06c741adccea2539c6cf8a1f82f354619983f82928eda76f83526baf6a24e3f2c99d23bbd8f425931c373312c65934bc7e94b406273f
SSDEEP 3072:+SAdX3633S2w6PNLYqMfm3cdUlErqHhRe5QfDKSKH3eaVYQ:+Sa1ULym3cGlC+DGQ2SRQ
TLSH
T124D312D2BCFB2F6B08FA2700A00727175F24E0978F91772064DA4B7EA5D366C5F0A865
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 550dda9765cbf6494b5a66b22cc13170c1a29c4cc6606b918677c0185d86e0f3
MD5 11bfb2cc414f5c1bec90b90820a956e8
SHA1 70dbf9e0a03a3b2381c82b8ccdfb5698bd8fa0b2
SHA512 3beed5c4d01e6f10691fc2d2ef3d10079d82b8a6f74f9433146f7dd14d2c2eee1e030ea2ff863efd3406dbfbdd242f2af774199bb1121e6b787982685d8dd473
SSDEEP 96:gC0d+qKJku7fby2f2eaPphrn3RDotok5A3DBB6AGyvODqLN/bjv4a:gC0AJr7fbyVlFDUDe3kFqLN/bH
TLSH
T144A11972F4669C3B5DB7D448B6122A03CFA4B2A77962AF64D9DD1F0C00EB0E81742517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 0ac4c2f08eef0430676370559bcdcdc5fc5a0a6933182d8bd324f1353fb1c00a
MD5 fb98916903ef9b1921ee296aa3eed049
SHA1 ecd8f09389669656b6a14b2994b5a228a9639076
SHA512 743e5ff4c823259fad1103cbe9e8d4d2222eb6ca173a7d363ff1c70e1dacbb82f84f64cc8b5a1a4c28842357c171271439880f1494e4618b2f35e993c7935118
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7U:fwUQC5VwBIiElEd2K57P7U
TLSH
T127B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ffe13798c5910685872d371e84c30baa9eefaaa5db1419603eb30d473d7b2e37
MD5 03c111f9396889c77f6d9883c5df333f
SHA1 be65300843096dba92c5695fd35e2dffcbb7eb0a
SHA512 a77dfe3b48fcb72648f1adfafbf0d0fcd4d88690dcf41609a03e1d6b645d1336b6e322931b2205673283b920d20ed0225c6aa320a83a2d3a410771f18d120c19
TLSH
T1B1D09BD079145D78C4C1353231A773155A516435865C46481151F3BACD65141667E59D
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6fb1480ad12b08150f9b3ac124b733d8b2ac0bf9ed197c5f88e07cab78b86522
MD5 384a8c1042d427c714ffe16fa52e91c7
SHA1 7a932055d18c874c97c0b79eb358ec465858df92
SHA512 22a166b0d57153347b7fc6a5052a4e2e6cf1e3676148f4e06de17bd2224d5b80c8801cdd82f838aa262888191a3401946d43ad110e8b83824c41680e77363d7a
TLSH
T15CD097603D08B9E4C084203121A013006A211062AA69430C2010E51ECC34082B3AE9DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 10730e4e9837826c811f2088e19df33ba0602603593040f462ac595726fac721
MD5 367145713f3a5e93806e0453aff329e8
SHA1 5836aec32c6c68bbe2a5b7f1bcc4611dfdc32c91
SHA512 5d6ea21265328e29e2e915d5f69d30152db37d9af101d750221e04dff4712ef63f366e898c2bab29408df5c5885a568124f9bc641efbfcb265c71c39d27bf2da
TLSH
T1CBD023603C08A519C4C1203270C31300373300307DBC8E09A0E5F21ECD6004073EE0BF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7add6572365d752d8c3a090b9a256c43e3c5ff716f29ed7aa3c53dc57a08ba60
MD5 0da70f521ac5aee3489abf6e3eb4e375
SHA1 0f3cd9919820116ecc86bab93f4712c08485dc56
SHA512 a9cddd04863b2ac842fe4f91265c19a41d8b7442be8f07a91747705beca52c1e1d563e3c46cf68e1b73606695624f13ca69a8246653c2535d0684ced42c37d33
TLSH
T182D09BD479045D78C4C1353231A673155A616435DA5C46481051F3AACD65141667F5AD
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsSiteData

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsSiteData
Size 28KB
SHA256 6bd856d68d3a2de856e64d766e2b9baacbe909d793087e84880050cb36bab1e1
MD5 faa1297eb819d33082266d374c1d492d
SHA1 91a6155f8d8c05c277e8460a7268de023f8ceec5
SHA512 120a94377078e09c960d070f09a417479708753b708a3bb148c118fa48faf12d85352317712b9d95b59d15cf5c90f1c0490f703ee4524c6bcd7f1c427e499ef3
SSDEEP 12:TLiqiw5xT5SmKT5Si8wT5SislpXUUfzBW8ybwaW2b8wAs76uvsUkHZ6HFxOUwa52:TLiq5byqkiXBzlRr6hkc6UwccI5fBG
TLSH
T149D29B8A5F32E951CAE0D63BB0C0866A9B34A2198BC26D531B1110328FC3401983B47D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 7c411f050c6218150c78306b135a7dc8e15cf9e8ca6d9e431f2dd07a743294be
MD5 05e917d980b0b0939bcc00c801f302e8
SHA1 a968b68a4c32f9232ea00e6e7ba74a59aab54776
SHA512 80f6c7ba5977e47a9d8dc1048299f7de632ac36038dac10b3d11e5f39170a1612ac1c2d5096e9797d43301edb5b6ac01602186644303a9b2d6cd582e6a67bb28
TLSH
T159E02BA9C861ED2768FD075D61540B8BEB64131B2F90884F3A3C820D4FB0A3B49C682C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 d476ea96143d86e20023205eb375e082743bfc97e071b0e24b7be7a21776da80
MD5 2a9d63ddfe8796e00208c09251041d17
SHA1 bd12be5daa1ee329434dbe40454945270bb07a10
SHA512 9ed7cced2f33fba1e970f131e9bb1c00923ec8fcbe96c028d6c8c3840e834aa116e6c21e7d6b842b326d936cdd6694315be90d036a99e3220f862d3a4e033db2
SSDEEP 384:fZLDOpNXxqLSwTLTTTq2ObQ6gLYYKqhSX:tDOpZiliuL7Kqhq
TLSH
T1F4136EFDB2122D0BC2DB443C8043CB792733D159D2C19A6B123A765F1A22F246EDE24B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 92fdbd0aeede3b8c163481bbfd5e65192afa683b7964778a11ad1ba59ad34671
MD5 58414451ad0b08a156f37b630744566a
SHA1 63574aa680d2a1217a6879c9936a87b92b9a9fa2
SHA512 0d466239d83f403b2cc53508da71ab18cf3c38798a9372a340c6ca1e4e76e482a8819e0249c93894d98c1d5355c2f4078ce95d5fed428b09e4a5affa816c0077
SSDEEP 1536:HfNL/jbL/x2HM2BXDjkBNymAIlvQo0ouDT9P8Y27f:H1L/XL/wsLmozq27
TLSH
T102445FF71961641BCBA852F5E6033E3ED177451E3CD2F8E9E1784C852825F22B6BCA84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 e7ea9877a30deb8d34eb3bcd423cc3b7e9f5822b2aba9b1e5bbe958fa72dae9e
MD5 379a3f4d7ef7f262434b383f1acbec5f
SHA1 d4aeee1f848a297ba1dae25d1e8de8bf4f797baf
SHA512 44685e50321f2d2b944df2df6c628fe3e7764b9c5fc7ebcf2001e607008e2260e8376453cd0a3a5d3bd09c2d3a931f2d3e4005d8219add46eb6ba3495f915b52
SSDEEP 24576:WHquupeVgowZelx8RFPzJs7hZ22VXc6qJ:WKVp6goWqsFPzqHQJ
TLSH
T1F7167DEDC97898C3CD639A30B4F0E9477C7413C3F995C1D68898C584026BBC5BFAA669
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 a094b5a286143ff12fb6724e26f9c73876cc7657fb80cb8b6a3b589ffe35e0f2
MD5 b33f90c0d71eab2f73a3efbb18c805cd
SHA1 c36229ddd7407f341103feed89ae10a057c81c36
SHA512 3d0b30233287f35fc560d39d7b46391612e0a6bbb7a1206aa274396e9a0796af5bffe5cc6b310ac39ec06c35b52a7adc761f2078443999a6180ab545155c0852
TLSH
T1C56186FB63311DD3DFA247B963E1C699B6F78C9101E79E2054425E3E0E02F0515E099B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5ae9a6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5ae9a6.TMP
Size 3KB
SHA256 758a0c8d3dfff1c3f522ed0962dba80a7959ea55df3009cc86ce7da0a980057c
MD5 70d11d05e666860fd52e09407c9db9aa
SHA1 fa8e22f40f51f9b33e0cdbaededebcfc3ba6d90b
SHA512 f80b071c062a37d9327257fc8935eecabf7e99a77f1a9752a0e59054b6ca59e074afd113395865905b7e54af384a94a6798aaba9d76659e3be39cd30a1aeba39
TLSH
T1C06184FB63311DD3DFA287B963E1C6A9B2F78C9101E79E2054425E3E4E02F0525E099B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 346B
SHA256 88cf97980f88584b9a1586a9bfba741392a934eca04b567a871e0760b581cd11
MD5 fdd3416612f4d0e612681baeb551906e
SHA1 c4ac6d3487c8d6e431c83fd1ff647a27de203169
SHA512 457852310766809c6a578599c224083bef961ce7fb927b59e67666784851aeba4847a3c204a8e4489bb099c1570e20d357d43c41fc17cdb4f22342ba8ba5c703
TLSH
T129E0D8E474C6C13D7E50349771256748C2803846D786FE036704DCC0BB43801B753786
MD5 SHA1 SHA512 TLSH

Submit Download

EdgeHubAppUsageSQLite.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db
Size 32KB
SHA256 6cd12a8fe182a0ab95bc79eee5e9de48cd26e4000cde8750336d7198e0c8639c
MD5 cdde50b738c0839a82358dc2e60407db
SHA1 39cfa3c2a7d17a854e174f23edfe19e3033a0d1b
SHA512 40e53c213b78071b6e8d729bb5d89513b16a36409a910b44029ec153c006ac1dde0e39a23c75a51718b57819334f59d7546f6daddcefe7311242cbdffd4235e9
SSDEEP 24:TLZHDDNzWjJ0npnyX7yNUs9vb7OkIbzXagfj2ZQN:TdD4jJ/0UC+lf5KY
TLSH
T11AE2A04C3E21F511C4ED733CA0D2C5D09EBC647C478DB67142386CA68D52AA2F49E55E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 399B
SHA256 55f8fa21c3f0d42c973aedf538f1ade32563ae4a1e7107c939ab82b4a4d7859a
MD5 a15ac2782bb6b4407d11979316f678fd
SHA1 b64eaf0810e180d99b83bba8e366b2e3416c5881
SHA512 370b43c7e434c6cc9328d266c1c9db327621e2c95ad13d953c4d63457a141fbf2be0b35072de96becc29048224d3646535a149229fc2ba367c7903d3e3e79bdb
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 319B
SHA256 472da6866f9c1e0c8c590d20b683b96301efc5b93c1f4d67cddb9402d7ef2795
MD5 d25eb14a2a681756179e6536b40a1585
SHA1 49ac3b8779fafa77c218ba2a2474dc0fc807075f
SHA512 f25bb7acf1415b363ee8147d337bc4820a707cd9b3698f234cc3a085e0fd1ddafc3056a468366cccdccf4fa111d230289e066f141ca51e58db26b6fc639c5189
TLSH
T15DE026A808C8C12DE8D678A793A9A708D3D03803A388BA0627888C847202E81F2C7380
MD5 SHA1 SHA512 TLSH

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.109.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

computed_hashes.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json
Size 429B
SHA256 b829b0df7e3f2391bfba70090eb4ce2ba6a978ccd665eebf1073849bdd4b8fb9
MD5 5d1d9020ccefd76ca661902e0c229087
SHA1 dcf2aa4a1c626ec7ffd9abd284d29b269d78fcb6
SHA512 5f6e72720e64a7ac19f191f0179992745d5136d41dcdc13c5c3c2e35a71eb227570bd47c7b376658ef670b75929abeebd8ef470d1e24b595a11d320ec1479e3c
TLSH
T10AE055170A1A50B79BB8DB90EE525CA2E8A0A6B1C50438D63E608234B68A11F738347D
MD5 SHA1 SHA512 TLSH

Submit Download

verified_contents.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\verified_contents.json
Size 1KB
SHA256 d23b2ba94ba22bbb681e6362ae5870acd8a3280fa9e7241b86a9e12982968947
MD5 738e757b92939b24cdbbd0efc2601315
SHA1 77058cbafa625aafbea867052136c11ad3332143
SHA512 dca3e12dd5a9f1802db6d11b009fce2b787e79b9f730094367c9f26d1d87af1ea072ff5b10888648fb1231dd83475cf45594bb0c9915b655ee363a3127a5ffc2
TLSH
T12B317466C8683D56267A63348E2D0602EB57C2BB0050640EB5AC558D4F7115FE242FAF
MD5 SHA1 SHA512 TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 224KB
SHA256 d78c7ad7e71e4fde01e22bcb7ac3347cfa4aa5818202da4306926ff332556ae2
MD5 39e18e7a757c8569b99d6541ead51a76
SHA1 ebc97a8e9f50d6e222f1f59ba806b10c785cdc88
SHA512 6e1528a4c1a239431c73bdba4647df384c0c05b45d769932906a33b7a8a650567fb8bbcb083e9794ed1c8af3efed9bdfe5c359a8e795d3f058de81dcb71a31f4
SSDEEP 96:r7sNRtejzH+bF+UIYysX0fxQp97oEHt/DfLjLqL/ZNbbEOVpZf24JkMfXSFR+CFq:r7sN2H+bF+UI3iWGVoWN3qL/LVVV63
TLSH
T10324014E5F352722CDBD913668E744A35C7DF03F8B1326DA6C6114B5CEE2652A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 d897f96a03f06a430bd07a6d911a523b8b2ded7302db9b11babad65c5346da00
MD5 955a295ea8ccac5db8951a3ea3f89ed0
SHA1 6af175cbf4e3ea096ba7706fbe3e5623d9fb6732
SHA512 3185596d0485d719ef404c06633d6c386f51006c95bb7fc87a9b550c286e2ce6a40090e111e409f52539fbf461b66c1f6a98840def1bed440ea6d8e9807cea66
TLSH
T14DE026F045DDC22E7E44329B926D770DD3B03806E788BF422B889C80BA02848A7C33C2
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 24KB
SHA256 f079da6f290680d4fc6400984d98eb11dbf0ffb50340ede5325f7922525fe4d4
MD5 e448e427f8a8993672e56f1b1911b281
SHA1 787e371469ee03c8fd148ed2b0ba0b0c91d6bf16
SHA512 aca9821e0f1c77e620f23104d0fca4171dd7086e767d854ae012cdf6b54bda1cd7d61705ec6be5296685717ab7bec6b8ddd6c9ba50ff23187a9db74218ca54a7
SSDEEP 48:Txk/LopFMaty423w/a9NUuTjAw7omwFkJWQ:qDeMatha9RAiitQ
TLSH
T1AFB26E4D1F343221D1F44B7AE9D285672E7C100DA3B336999D0820F2CE932ABF60A07B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 ffee8ca3a0d0a9338ddd9f11f832494b5a353932e8ef52ffec58938035cf2848
MD5 6a02927bccf31a32e860465d637e869d
SHA1 6154dc515749bd5266ae3d6efd90dcc1a80b12d3
SHA512 03cf94e6deb779393572720ae09a04a4371c7bc229841a1126e91908a43c60c897e285eec8ad82bd5cf6f2f8cc9de7cfdadbadc61cdc4b7d1bbd005c534719a2
TLSH
T17041CEF7C3E8856E8E0156F0AA14AE1BCE2D0515432C7C5AC9E4AE2B93F3471E141D9F
MD5 SHA1 SHA512 TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL
Size 36KB
SHA256 0da560548c16a2cbf7d5efc261ac787041f605c0ac5a379959479d2861902858
MD5 25a5e69813527316e4e62d8e00ab3bd0
SHA1 6c2c821efdac3e41e778a1e1c1fb2a9e0e6e684d
SHA512 a59350420e197f2eea8b2e963116cdc265debe8d38461b4f8ecc81a30ec6c9f38c51f3c3d84c53773438be810e2b05b4d38e628771160b83e10cf0917f1a2ce9
SSDEEP 48:TKIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSBklh:eIEumQv8m1ccnvS6h6sGcf6CnFGAL+4g
TLSH
T155F2CBFE07276206C99484B0E4009F8EAF1A010B47B6B6DC76D447E3F7A20E2B57875A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 188B
SHA256 49bbd49c420830f36485e9b69ea36640827a0e8084a26ea6f83446792259c5f7
MD5 155d0df359bbdcd0063e6de898e441a1
SHA1 db1e35af67b67fd4f6f86b43fed4ad1573683fff
SHA512 02f94ddb66f562771a7ec0860498458247b4b79597bbc27c3af5af38ba2089d2b2d10c26ca3932c1381fb653ef9468f6281ada75723d538fce900a23dbf0d865
TLSH
T10BC02262C0BAE0B300748A7A0985AC826A7CD038064044A0CF9982BCB0911B75A0503D
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 919c5a1fa62c9905f250d296a9fda72179afddde6e8b636a215a251c14b1e697
MD5 44a3a5a68ea9b98695ee1cb0f5a867d1
SHA1 6ebf914abc81d1755957d1ace261f037029502e0
SHA512 3c865d85db6e9ec952aee14e25a80563203077addc095c3d64702d6f5e465f9d9f6cf8bdc9f4b029d2c17536e9d54cb82daf40f1437562e03226b4bbbfb28b01
SSDEEP 192:sxROR1Cp/fsswTWpVz2BZwPNMJzoA8p4s/g6+WNIYJZZQiWJG/IgVNtSJ:sxROep/fssQWvz2PuMUl/5IyWKY
TLSH
T17F42C715AD28A93B9CC7E21DFB557F53D7F9503261941E48AAFC8A1C01EB6DE220380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 7b176497faf6c70cddefbd44a2a07941eb025bbca0c981fdd9f5e7cab28e0f93
MD5 d1278b2da39e6d43d7bc5ac2a338b8c7
SHA1 1cbb5b3f249e6af2422551a9b158bfa2d71beb9a
SHA512 6baea2ba6eed772d53a7a3c9a158c5e2e5a60f4711032dbca91c616c804cf7a3a181ced2c5e183bb64676832b83434fe21c37faf501a37be258ccd214f8469c7
SSDEEP 192:sxRVR1Cp/fssGWpVTKBZwPNMJzoA8p4s/g6+WNIYJZZQiWQg/IgVNtSJ:sxRVep/fssGWvTKPuMUl/5IyWpY
TLSH
T17742C715AD28A93B9CC7E21DFB557F53D7F9503261941E48AAFC8A1C00EB6DD220380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 95adc2303d694440a8ae94689cfbcdc2a29c1e56d2ca166d6d6520e05d844a74
MD5 7bef7f46e963ea6b37bee1748674263e
SHA1 aadfdf70505f27143652fda37d0366572caf42ca
SHA512 47751bf58ebd93f86177b45cc438404560bf8048f95fd68850b1a2de9c0e4901905928f6b4dae85b18ca7b1114df3fd2f8697bca788d3a02aa496c1351da60f3
SSDEEP 192:sxROR1Cp/fsswTWpVzjBZwPNepfeaJJzoA8p4s/g6+WNIYJDZ0iWJG/IgvNt8rJ:sxROep/fssQWvzjPueQaJUl/5IuWKU9
TLSH
T16A52C655A929A93B9CC7E21DFB557F13D7F8503361941E48AAFCCA1C01EB6DE220381B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 16eef83e80d3b1df32710a536b189587f186bf875188738a74b2c26c8566b8d1
MD5 2feb73b116ec71e92599a0c3341f78e3
SHA1 2d300aa6ffb6998e5d433951f22ff401afdbd75d
SHA512 10958d989588296ef7e26e7e60b2537769157697936011a53daf7dda4aa67f76b8a0be6e4b44a4b0ecc1c9fa996c9ca533ee6ae6653bedc1951c061408a8a321
SSDEEP 192:sxRVR1Cp/fssUTWpVz2BZwPNMJzoA8p4s/g6+WNIYJZZQiWJG/IgVNtSJ:sxRVep/fsscWvz2PuMUl/5IyWKY
TLSH
T12942C715AD29A93B9CC7E21DFB557F53D7F9503261951E48EAFC8A1C00EB6DE220380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 b248ad71d75330dd3f7341f61d17d58cf01fc77aff2c42a8f99c6384e9a669c0
MD5 d7f388e40d92bfdfbfca314ff6383fd1
SHA1 b884f755157863763be787676bc69014464bfcf7
SHA512 c473d47b129359be5a533ae631ec7eb8b20cf2103fabcdd2251d7bad9de15442307953842431bd8d56783ca4ac15d7525d41fb0322c44a92214689b47592f851
SSDEEP 768:dofArG7pLuLzKxWgg+fJJ8F1+UoAYDCx9Tuqh0VfUC9xbog/OV5zN131ero8qR:dofArmEzKxWgg+fJJu1jaazNl111R
TLSH
T17DD2CA7B640DCA7E4F804ADDEC19BA9F6DA802CB9698C94047FD941C03C6BEB511A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 338B
SHA256 11ee7351cb41d0e768760efd1f59faafe78588fb97d258fb87fff49fe2a20039
MD5 5791dc784951787a95f16076ae76ca69
SHA1 ffc9df005cbbc9ba0c5530e788f8b18df6e6c9dd
SHA512 fa66ecb30803f9db539719773e2858e0e8b220f3f900c94b11fa66b094037832d9eec8a10574e3486dbf1ce49735e3ebb9a9e79fb38747ed96ab5d401a9bd564
TLSH
T1A1E04F7445C9D67E799A3583426DA308E2E47817D7C8BB063FC68DC16B43E84B597381
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 4b6319f90f10e944a6cbd4a68c68f3c90af5a4ae5224015c11a62c333809e81a
MD5 cdbdb8e310001ee650c8ba429d72de34
SHA1 2071a533da51e95a3da1ed21fbc9df7e694ce609
SHA512 141599eb4423943aca3bd37a0687f88409687cd4c34afbad245894ddac4999989f6af9554f22421eb5e460aedf9da51ff4125358b5ef8866c1492cdf6b0b6eb6
TLSH
T1A6E0D83815C9C72EB59534CB5339F30981E2B806D7CCBA513F8A9C807307A407653341
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 6f981b5c2bd5bb1969ea0baaf46fcb91a23ea874a9efe4be8556a29b7e08ea3b
MD5 c9a775a146bc3d5c587249645887b0ff
SHA1 4f143374c68ce63a39aad517fa273a9103372e5e
SHA512 fd400754819a99dbe684dda41fbf1161eb416cf42988e349c19ecda4d89c552e6fb8640a62ac4258f5c507e189eb8d96d34b211b42cc5ef96a2ec62af58e541b
TLSH
T1AFE0267455C8C63E7940B58782ADA70DC2F07C4793C8BB0267494CC6BA02A04B2AB380
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 3KB
SHA256 a146d8749754963ff67a01d35d0f4e99fc476c0cd3234135d794ece4004925f2
MD5 db67ea77663370b48bea6150f95ebeb8
SHA1 77fe511c493b6264d3fb214b1d8cf245c8b6c453
SHA512 a957bb2bad90e0b19fd47f8bbbb48adb28c1ad286cdc2141c877ef1d4843883e0f62828a855a583d6fa70777f6a55b90170188c2c64ea27290415479dcc17d78
TLSH
T1C871C0553EBA02503CBF3A1D805AC7178242387B3318A92BB7E944E61EE7E054DFD9D9
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 51244d79eaf2e7f1a1b733bd5a9619e33a6dd2e5fe93a82a12bb4ca565535885
MD5 dfd8fae97ae14dd8af14845e10244c07
SHA1 521c621f808ecc4ef2642fbf29b6dfba6472ca64
SHA512 1d3988253005cd886b24b5b0bcd8496add424a61d5096ec91ce7facc17d577cd298ec280b5073a2a58b4f14270ba4d3b85971a2d97f12c3548b1d139f877d609
SSDEEP 48:KYvIhK8osDyBMInKBGU1/IJKwosny8MtQsiqq+s6DlIBM+KKLS2+O0uLbt:KYvSK8oSyMwKBGS/uKwo++feKgQM
TLSH
T1BBB1C5553EB603803CBF3A1D816A87578242347B3314A92BB7E944E61EE7E054DFD8D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 de6d82526774b042df0abc802ecd8b620f96e8de152dd44d30285c5baa78730c
MD5 72d56346cbe0c1eb17fc4acabb2cfb52
SHA1 c5069594c0f431dd9c50c4479fbed00d0c37eca4
SHA512 2539d5f896fe1eed168fa1aa8eebbdcc10eb2ddca1d66cf550b51e38f15da62fa9859b2a976678def485bb471638b530518592e5100ff95d63d4d71c33d13262
SSDEEP 384:DNrRZyCSDnxTIC9sMEhIKyll7svbFKfk7:xFZJSDni2NyI1l7svbF9
TLSH
T1D044740A7B747001EDE6DD725CB080771E3CB16E8F22A6916DA254694DB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebAssistDatabase

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebAssistDatabase
Size 14KB
SHA256 99b45c0e9019884b44853d0b047c6dd4304471e996c5658ba39d0ac5ad9e2c64
MD5 d66fb76c347171149f1f2035e41e9e96
SHA1 61be9e65bac5cbf61fcd843bdd12af84f9d212bf
SHA512 357bbb7944752e1bb52c2e9efe8eb5425ac5a4772108926074093f999bfa8278ef8dad2dcd18058b7924dc42e32b19a9b999054cf675fbbbd1d3f15f6713f676
SSDEEP 24:LL0OGxhK3thdkSI5QjUsEGcGBXp22iSBgm+xGt:zEK3tjkSI5IUltGhp22iSBgm+xW
TLSH
T1A452579BEE743212DCEA83319AD001E17E7A903D8FC1EB0255D610115FB5691A71E59E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 337B
SHA256 5daada76a005dabc4d29dcc4f8bf61bf23efd2cbe668f684d0ed96729b942321
MD5 b7158113d5e40e9d5b62a80e707e9517
SHA1 8ed48e0f8c1f94427e84cb4ae3a6ae4fcd7a5240
SHA512 8d575069231e6c6ee4718eeb463f4316d26420d5f8716b84dd1f72786e9e7fc24ebfe0e4a393f498c879a4d6d3d5959144c9898a2e6f32075e89081fe64d5911
TLSH
T155E04F811FA928907ECAAA48C10E6B03E0847D7A370D4471B3DB45D44FC58080A2EA32
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 12KB
SHA256 7e3ac17b6560b0de6a7e33079b7a66755e58b355568b316f8fd392e1941102ac
MD5 255e10b388750679a382b4046b306f16
SHA1 70256365fdcde806202ce35144b53bdbc86b1438
SHA512 537a3a44c41527d28711ac0f037c923a50bf589820582ce0fce36fc1defe3e8a261ca0e2488da830d367f117f423945d8eb30945dd41239927b0efaf77da56a3
SSDEEP 192:3QQ3dIII0b0MIMufYcY1bdOtUAsllrMECsEwqgvJ:AQNIII0b0MIMqB5tds/gs
TLSH
T13442855A26052BB7C15E5FB6936282559BECC8C31072252D71932D0F8EF3F9B82C52F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 319B
SHA256 518cd359e150c92e8684ec38d70c09e4af7a40b23778b29455b4f680ea6b2f3b
MD5 52b260820f38903c3c70368c1011a747
SHA1 1627593d9b19b02b66033e83779bcde7913a052c
SHA512 f65440e12e5fc827eee7b3b338e39f43553c6b4e503f4ab0484d929e363e482a23468310ba1d30ddfdb57ffc992b7a816b35463a9507211f58f309808d9693d4
TLSH
T179E0206054CCC25E789630871319A708C3C43C07EB8C7A492F40C498F502900F647241
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 045c824f7f1369764f8ee5f5dde0f508b9837e25cf91efc72f490fe6725be1a1
MD5 7d5887451a40065b3c3dfcb82f4916e2
SHA1 2777bc60f636dbafdbab8a58480ae906815487c0
SHA512 9473c6248f518bc41d50b265ac027869008d783879bbda12ff6c70a15a1c39f9dd100b062156ef143fb883575a3f13699b3aba9b6ca4f0ad81891b2d6e0814a4
TLSH
T16F21D655F330C109E15D827DA47E9B391738D8528FB8ED0F84BA20346E72B040E4B6E9
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 337B
SHA256 9abbf320d4dc9675d2f7788cd9055cb23b0f18c964423aded82cb1a3b292fba4
MD5 edfe505f714081ba36ebfb6978ac9ef5
SHA1 e1fd3c218f0ab52715e7ba39fd07286d6c7421b2
SHA512 cf5e873b16a631e6692f513c71825c5dc04cb5d8e64d3b9e4e592826cff85bb4e160d4ef0c37cc0f1479fafba843e7fc3a7bd3eaebaaa8c35438fcb669c20234
TLSH
T16BE0202064C4C1DFE49235870269F748F2D13C03EB847F05AF42CC887682A41FA47351
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 2155e3b49638b9a9b2856c52d0234f6b32c5c6ca43d448cf17f919f6c8b0bca5
MD5 f814d9b5df5a8c0d4c11ef667d661763
SHA1 fc6e9f6d49dc7f6485d3cf692dc87a77f6a33a51
SHA512 4017674ffa5016cde03f983e98d8efb3bfd44b23f7c4f7ba5e9fd2f9b411115ad03ecd365e709d920558f57bb3b74a81f6cdad1d3bc3f22a87a192c467213c26
SSDEEP 3:MsEllllkEthXllkl2zEflUrhRa/:/M/xT02z5rH
TLSH
T152440404FFC0140DC54110304151C7D01370D4100731574374D144335CC7D400F1C000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 96bd5827da2ae4db926891387a651ba436acdcd160659b2412ea2cf6979de004
MD5 41fec80ac86f2edb51360af50079589d
SHA1 5c26344d817200625fec217a0620ceaef659a64d
SHA512 0d13b10c4e8acfadc21f8585fd82ecaf4f9c807a7627b3e82b2c56b54d5e42d6cc20ad40331ece5a6d058def59a10ba83c279c8925089c84be2ea4b5d89dcac5
SSDEEP 3:MsEllllkEthXllkl2zEfl+3M/:/M/xT02zp
TLSH
T14A4404457FC0041DCD0010304051C3501370D4140557775334D554335DCFD400D40010
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser
Size 120B
SHA256 9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4
MD5 a397e5983d4a1619e36143b4d804b870
SHA1 aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4
SHA512 4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816
TLSH
T1E0B012203BF9062CF3F74D00AA73AA3428BFF4080A14811D505102080C33E19C478FA3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 7ce39af24b130fd212856a75a6baf6516b1eb50ad072b376e75c611933ae6be2
MD5 f03a7b11f97f7e7423a53090887fc4a7
SHA1 17ec456ec90e8810e7e97c90a5c42cba3e7efca7
SHA512 f1d36fb3a0531105c02ecd4bb919861496d90c504db7d1411842df74b7ae7f45d6145b2a2a80291de2e6ed30dae88c5f3807d98f58c18e8dee8879da5057b1b9
SSDEEP 384:nGZcI038NPNLf6OEkvlzRfY9bYz44cjLQPlLJQXmIkdP9IimIMWEfMbc+0GPOPr6:U03BSdiJU44ecNHXmTWTbc+0GPi9Pr0
TLSH
T16CF2BFB19CA99A27ADFADEC5A50A6B077FF40263A1D81948CDDCEB0D118355E0347C3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 09b34b21bc124bdf4c21efc0799086871e5f8f31799a9b8fd800aadd5ff59299
MD5 67969edad90222d9a47fb7914b94412d
SHA1 715930b66a816de0fde9b5ce7e5c2875db93b0f3
SHA512 5cbd1fda042ab683b854dc0178e016ff5a62594423131b0affd1e641087ef77b426c3671d8f4373a0a09726a8e623c7e671f3a8fc8e50b46a0c371cd34fdc1f2
SSDEEP 384:nHZcI038NPILf6OEkvlzRfY9bYz44cjLQPlLJQXmIkdP9IimIMWEfMbc+0GPOPr6:v03uSdiJU44ecNHXmTWTbc+0GPi9Pr0
TLSH
T1E9F2BF719CA99A27ADFADEC5A50A6B077FF40263A1D81948CDDCAB0D118355E0347C3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 987bd3077beb85d420cfd57a29a928fa5db0a5e485fb5bc96325001ce878855b
MD5 1cf4102d1798dfe97c23369f7ba137d8
SHA1 1d7b948e71045997d5afc915079a839d5829a1d2
SHA512 ee7c63902d7500f3e86096f513fb76dcf1ea74b3790337020a16d1d93b8cb91241e4b18b6211f81229f59ad85431c3640a2831a14ca8e368c650dcb5dda39fa2
SSDEEP 768:arv+4UNbdM3AVziJU41NHXmTWTbc+/5eVH1SvyZ:absb+38P4DeWn1REH1dZ
TLSH
T1BA03CF31DCA9CE37ADF69A88754BBA573EF8116385C40A84C8C96F4E428754D034BD3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 da40696148ed61a129497e4355d26e75b7972445149413efbd6660a9c09a9b13
MD5 cffb7ffa747f2ff5b7a09140884ede5f
SHA1 ad8970f9f527cfec52db0aa172cd204edba39bfd
SHA512 a2c7579ea905ccb1bfbbc730c87242e6c6e91143e4db330297d2733decb861261108e0480fc95f730111129077527f7db60f65f29c8ad49e2bf893f1327b622b
SSDEEP 768:Srv+4UNbd03y/uQdiJU44e/NHXmTWTbc+HOanI:Sbsba3ydP4LeWn1uaI
TLSH
T14003CF71ECA9AA33AEF69AD8B40F7A037FF8016345C40A54CDC96B4D019759E134BD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 33d23624f549279920da8d45e969d0a580efe8f935126cfa72d32d37dedc081e
MD5 e1c1008de59877aa9cda153c75d6ec87
SHA1 d5f89d4bfff2a8b08c5292269d86488d85063312
SHA512 6d71ce6988a515608bc0656bbe353b9933a3689b0b5a6b702e5c1672162ec7630b5d55889978e1ebf3508f80ce9ff030f37f835253127a0162cebc5a3e0e084c
SSDEEP 768:zrv+4UNbdM3D8viJU44enNHXmTWTbc+eOeVH1SvyZ:zbsb+34P4reWn1hEH1dZ
TLSH
T18403BF719CA99A37AEF69EC8B44BBA077FB8116385C40A94CCD96F4D019748D034BD3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 45KB
SHA256 a962ffb47f915c1b862fbdf6372a27a53d0e17bdf3a11990e4e0258c89f1331d
MD5 9e8e2e3ce2112a8b95811222366076db
SHA1 e8f04d984ed883ac5576bf0302dec608d560e04a
SHA512 89e1176051618d400ec8bcc72378412e1a1ca03d7f768dde9d5bc4a7e27d2282efc5be9718c0c7ba5033f54b59fd1c56ddc29248fd1296d6773151bb222b423e
SSDEEP 768:5rv+4UNbdX3y/uMdiJU44e9NHXmTWTbc+HHXKRqcyPi9Prpq:5bsbZ3yhP45eWn1nXK0cyP8q
TLSH
T16023AE799C999A3F5CEEB788610E29177EA80273D0F40558CBC86B4CD1BB49AF307917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 889aed2dc507a07518f83eedd883c422417567a00d6ef02bf9c2a9e41a7e0bbf
MD5 c355cba6733235d8bc67278a664fd5be
SHA1 c28bdad4c20c6edf6f1fd98b9a3f229cfe58240c
SHA512 5a1f7e2aec7854636e45ad806b97cd29bee04d3c134de86ff7b2fada9f6fb51b51efe61e0662b1dc563940f2fd2b3a58c8e0995e400a878fd3ddf6e493c460a5
SSDEEP 3:MsEllllkEthXllkl2zEflPK:/M/xT02ze
TLSH
T17744041C7FC1040DC50010304051C3501374D4100511F75334D1C533DCC7D400F04040
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 85B
SHA256 b26da4f8c7e283aa74386da0229d66af14a37986b8ca828e054fc932f68dd557
MD5 bc6142469cd7dadf107be9ad87ea4753
SHA1 72a9aa05003fab742b0e4dc4c5d9eda6b9f7565c
SHA512 47d1a67a16f5dc6d50556c5296e65918f0a2fcad0e8cee5795b100fe8cd89eaf5e1fd67691e8a57af3677883a5d8f104723b1901d11845b286474c8ac56f6182
TLSH
T1F2A0120384738407E4144051C45C1341287C84570119C0012068931304240CB039643A
MD5 SHA1 SHA512 TLSH

Submit Download

e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 a0b1a35a86cbd2e671521525fc6903162d450e3b301948d913d05ef458794c20
MD5 22215f69c4a5231b8c568620e783d7fe
SHA1 c64663b6efe0023ca5978374d785f1202d924d1b
SHA512 9e38513132672de4a65c01a6eca3c8c3a878cc6e11e2c0d2235798b78e3338c9a13a15d261c4b4fc6c60657f42407b98c8435aa4352366d1809843ddda068e22
TLSH
T1A5C02B79481924CC2B00043C6004012B19B0560023C413F48C1B8D80007537CD30817F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json~RFe5ae9b5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json~RFe5ae9b5.TMP
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

9b234fdf-09cb-4632-8d36-5ef587dda8cd.tmp

Path C:\Users\Admin\AppData\Local\Temp\9b234fdf-09cb-4632-8d36-5ef587dda8cd.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4460_44583086\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4740_455216690\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4936-13-0x00007FFC82630000-0x00007FFC82FD4000-memory.dmp

Download

memory/4936-9-0x00007FFC82630000-0x00007FFC82FD4000-memory.dmp

Download

memory/4936-16-0x00007FFC82630000-0x00007FFC82FD4000-memory.dmp

Download

memory/4936-15-0x00007FFC82630000-0x00007FFC82FD4000-memory.dmp

Download

memory/4936-1-0x00007FFC827BF000-0x00007FFC827C0000-memory.dmp

Download

memory/4936-10-0x000001E0B5080000-0x000001E0B50D0000-memory.dmp

Download

memory/4936-11-0x00007FFC82630000-0x00007FFC82FD4000-memory.dmp

Download

memory/4936-18-0x000001E0CE6E0000-0x000001E0CE8AA000-memory.dmp

Download

memory/4936-7-0x00007FFC82630000-0x00007FFC82FD4000-memory.dmp

Download

memory/4936-5-0x00007FFC82630000-0x00007FFC82FD4000-memory.dmp

Download

memory/4936-4-0x00007FFC82630000-0x00007FFC82FD4000-memory.dmp

Download

memory/4936-3-0x00007FFC82630000-0x00007FFC82FD4000-memory.dmp

Download

memory/4936-0-0x000001E0B31A0000-0x000001E0B31A8000-memory.dmp

Download

memory/4936-2-0x000001E0CD940000-0x000001E0CDAC8000-memory.dmp

Download

memory/4936-19-0x00007FFC82630000-0x00007FFC82FD4000-memory.dmp

Download