acrstealer | f267d06b7b745fdc209ef20d3b4a52419da38f6f6850d90653d68e6c617b1d7d

Analysis

max time kernel
148s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 08:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f267d06b7b745fdc209ef20d3b4a52419da38f6f6850d90653d68e6c617b1d7d.bin.dll
Size 5.9MB
Sample260820-kfkcjscc58
SHA256 f267d06b7b745fdc209ef20d3b4a52419da38f6f6850d90653d68e6c617b1d7d
MD5 5d469732ea9e81acf99f0e7b46cdf543
SHA1 c912edf351df00b21fd10d110a3dd30b12285292
SHA512 9b547a7567f295c239eeac36c54032e76bf74f456e34d2f444702c0ed7285b22ca52825c64e266f97772049faa8a35fc8af275b42091f96d69c39e4d3bba621d
SSDEEP 49152:8BYvboJtjLjGofSOo8IVhPoCIEdowTrTn0zadrCnpg/oIFzJAcU3LoCIlHggcfai:o
TLSH
T1F35609124E5C24A7D1E5C1FD25DA76C8CD9E48289AE877972CD381FCA5CEC2508CA2F7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery acrstealer spyware stealer

Malware Config

Signatures

Family: ACR stealer,GrMsk
ACR stealer (aka GrMsk stealer) is an infostealer written in C++.
stealer acrstealer

Detects ACRStealer V4.x 1 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c548-6.dat	family_acrstealer_v3

Suspicious use of NtCreateProcessExOtherParentProcess 3 IoCs

description	pid	Process	procid_target
PID 2356 created 680	2356	explorer.exe	92
PID 2356 created 680	2356	explorer.exe	92
PID 2356 created 4956	2356	explorer.exe	112

Suspicious use of NtCreateUserProcessOtherParentProcess 3 IoCs

description	pid	Process	procid_target
PID 2356 created 1096	2356	explorer.exe	82
PID 2356 created 1096	2356	explorer.exe	82
PID 2356 created 1096	2356	explorer.exe	82

Loads dropped DLL 1 IoCs

pid	Process
2356	explorer.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2356	explorer.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3880 set thread context of 2356	3880	rundll32.exe	90

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5820	msedge.exe
4344	msedge.exe
3624	chrome.exe

Checks processor information in registry 2 TTPs 11 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134316884397774545"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{7D9DC838-E17E-41D4-9E26-A7A179C8EDB1}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{3E5C2C1F-EA57-4E06-B004-1591211A2F46}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2356	explorer.exe
2356	explorer.exe
2356	explorer.exe
2356	explorer.exe
2356	explorer.exe
2356	explorer.exe
2356	explorer.exe
2356	explorer.exe
2356	explorer.exe
2356	explorer.exe
2356	explorer.exe
2356	explorer.exe
2356	explorer.exe
2356	explorer.exe
2356	explorer.exe
2356	explorer.exe
2356	explorer.exe
2356	explorer.exe
2356	explorer.exe
2356	explorer.exe
2356	explorer.exe
2356	explorer.exe
2356	explorer.exe
2356	explorer.exe
2356	explorer.exe
2356	explorer.exe
2356	explorer.exe
2356	explorer.exe
2356	explorer.exe
2356	explorer.exe
2356	explorer.exe
2356	explorer.exe
2356	explorer.exe
2356	explorer.exe
2356	explorer.exe
2356	explorer.exe
2356	explorer.exe
2356	explorer.exe
2356	explorer.exe
2356	explorer.exe
2356	explorer.exe
2356	explorer.exe
2356	explorer.exe
2356	explorer.exe
2356	explorer.exe
2356	explorer.exe
2356	explorer.exe
2356	explorer.exe
2356	explorer.exe
2356	explorer.exe
2356	explorer.exe
2356	explorer.exe
2356	explorer.exe
2356	explorer.exe
2356	explorer.exe
2356	explorer.exe
2356	explorer.exe
2356	explorer.exe
2356	explorer.exe
2356	explorer.exe
2356	explorer.exe
2356	explorer.exe
2356	explorer.exe
2356	explorer.exe

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
2356	explorer.exe
2356	explorer.exe
2356	explorer.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4600	msedge.exe
4600	msedge.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeShutdownPrivilege	680	chrome.exe
Token: SeCreatePagefilePrivilege	680	chrome.exe
Token: SeShutdownPrivilege	680	chrome.exe
Token: SeCreatePagefilePrivilege	680	chrome.exe
Token: SeShutdownPrivilege	680	chrome.exe
Token: SeCreatePagefilePrivilege	680	chrome.exe
Token: SeShutdownPrivilege	680	chrome.exe
Token: SeCreatePagefilePrivilege	680	chrome.exe
Token: SeShutdownPrivilege	680	chrome.exe
Token: SeCreatePagefilePrivilege	680	chrome.exe
Token: SeShutdownPrivilege	680	chrome.exe
Token: SeCreatePagefilePrivilege	680	chrome.exe
Token: SeShutdownPrivilege	680	chrome.exe
Token: SeCreatePagefilePrivilege	680	chrome.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
4956	msedge.exe
4284	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 3880	2548	rundll32.exe	89
PID 3880 wrote to memory of 2356	3880	rundll32.exe	90
PID 2356 wrote to memory of 680	2356	explorer.exe	92
PID 680 wrote to memory of 824	680	chrome.exe	93
PID 680 wrote to memory of 3624	680	chrome.exe	94
PID 680 wrote to memory of 1552	680	chrome.exe	96
PID 680 wrote to memory of 1552	680	chrome.exe	96
PID 680 wrote to memory of 4228	680	chrome.exe	97
PID 680 wrote to memory of 4228	680	chrome.exe	97
PID 680 wrote to memory of 2668	680	chrome.exe	99
PID 680 wrote to memory of 2668	680	chrome.exe	99
PID 680 wrote to memory of 3652	680	chrome.exe	95
PID 680 wrote to memory of 3652	680	chrome.exe	95
PID 680 wrote to memory of 2340	680	chrome.exe	100
PID 680 wrote to memory of 2340	680	chrome.exe	100
PID 680 wrote to memory of 5020	680	chrome.exe	101
PID 680 wrote to memory of 5020	680	chrome.exe	101
PID 680 wrote to memory of 3196	680	chrome.exe	102
PID 680 wrote to memory of 3500	680	chrome.exe	104
PID 680 wrote to memory of 3500	680	chrome.exe	104
PID 680 wrote to memory of 1508	680	chrome.exe	105
PID 680 wrote to memory of 1508	680	chrome.exe	105
PID 680 wrote to memory of 4708	680	chrome.exe	109
PID 680 wrote to memory of 1412	680	chrome.exe	108
PID 680 wrote to memory of 4708	680	chrome.exe	109
PID 680 wrote to memory of 1412	680	chrome.exe	108
PID 680 wrote to memory of 4616	680	chrome.exe	110
PID 680 wrote to memory of 3292	680	chrome.exe	111
PID 680 wrote to memory of 4616	680	chrome.exe	110
PID 680 wrote to memory of 3292	680	chrome.exe	111
PID 2356 wrote to memory of 4956	2356	explorer.exe	112
PID 4956 wrote to memory of 5268	4956	msedge.exe	113
PID 4956 wrote to memory of 4216	4956	msedge.exe	114
PID 4956 wrote to memory of 5820	4956	msedge.exe	115
PID 4956 wrote to memory of 4216	4956	msedge.exe	114
PID 4956 wrote to memory of 4216	4956	msedge.exe	114
PID 4956 wrote to memory of 472	4956	msedge.exe	116
PID 4956 wrote to memory of 472	4956	msedge.exe	116
PID 4956 wrote to memory of 1212	4956	msedge.exe	118
PID 4956 wrote to memory of 5532	4956	msedge.exe	119
PID 4956 wrote to memory of 1212	4956	msedge.exe	118
PID 4956 wrote to memory of 1212	4956	msedge.exe	118
PID 4956 wrote to memory of 5532	4956	msedge.exe	119
PID 4956 wrote to memory of 5532	4956	msedge.exe	119
PID 4956 wrote to memory of 3724	4956	msedge.exe	120
PID 4956 wrote to memory of 3528	4956	msedge.exe	121
PID 4956 wrote to memory of 3724	4956	msedge.exe	120
PID 4956 wrote to memory of 3724	4956	msedge.exe	120
PID 4956 wrote to memory of 3528	4956	msedge.exe	121
PID 4956 wrote to memory of 3528	4956	msedge.exe	121
PID 4956 wrote to memory of 5780	4956	msedge.exe	122
PID 4956 wrote to memory of 5780	4956	msedge.exe	122
PID 4956 wrote to memory of 3692	4956	msedge.exe	123
PID 4956 wrote to memory of 3692	4956	msedge.exe	123
PID 4956 wrote to memory of 908	4956	msedge.exe	124
PID 4956 wrote to memory of 908	4956	msedge.exe	124
PID 4956 wrote to memory of 5972	4956	msedge.exe	126
PID 5512 wrote to memory of 4284	5512	firefox.exe	128
PID 5512 wrote to memory of 4284	5512	firefox.exe	128
PID 4284 wrote to memory of 3228	4284	firefox.exe	131
PID 4284 wrote to memory of 3228	4284	firefox.exe	131
PID 4284 wrote to memory of 3228	4284	firefox.exe	131
PID 4284 wrote to memory of 3228	4284	firefox.exe	131
PID 4600 wrote to memory of 4684	4600	msedge.exe	132

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
PID:1096
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f267d06b7b745fdc209ef20d3b4a52419da38f6f6850d90653d68e6c617b1d7d.bin.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2548
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\f267d06b7b745fdc209ef20d3b4a52419da38f6f6850d90653d68e6c617b1d7d.bin.dll,#1
    3⤵
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3880
  - - C:\Windows\SysWOW64\explorer.exe
      "C:\Windows\SysWOW64\explorer.exe"
      4⤵
      Suspicious use of NtCreateProcessExOtherParentProcess
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Loads dropped DLL
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:2356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --no-default-browser-check
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:680
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffb77dbc728,0x7ffb77dbc734,0x7ffb77dbc740
    3⤵
    PID:824
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1448,i,9654201211203789717,638045845624291463,524288 --field-trial-handle=2052,i,12264359934831903766,10407704758673451115,262144 --variations-seed-version --mojo-platform-channel-handle=2080 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3624
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1648,i,12162034337983112073,16929087532234033262,262144 --field-trial-handle=2052,i,12264359934831903766,10407704758673451115,262144 --variations-seed-version --mojo-platform-channel-handle=2044 /prefetch:2
    3⤵
    PID:3652
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2264,i,621373542700650177,13684812284079077111,524288 --field-trial-handle=2052,i,12264359934831903766,10407704758673451115,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:13
    3⤵
    PID:1552
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2752,i,17932813648594644457,3464953048972073259,2097152 --field-trial-handle=2052,i,12264359934831903766,10407704758673451115,262144 --variations-seed-version --mojo-platform-channel-handle=3040 /prefetch:1
    3⤵
    PID:4228
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3024,i,17369215667551142446,17125866941910467030,2097152 --field-trial-handle=2052,i,12264359934831903766,10407704758673451115,262144 --variations-seed-version --mojo-platform-channel-handle=3060 /prefetch:1
    3⤵
    PID:2668
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4464,i,3443750422624675775,14318690553378807772,2097152 --field-trial-handle=2052,i,12264359934831903766,10407704758673451115,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:1
    3⤵
    PID:2340
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4744,i,8994027040799214271,8601386030174462783,524288 --field-trial-handle=2052,i,12264359934831903766,10407704758673451115,262144 --variations-seed-version --mojo-platform-channel-handle=4756 /prefetch:14
    3⤵
    PID:5020
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5272,i,913296755932616177,10570043741443445086,524288 --field-trial-handle=2052,i,12264359934831903766,10407704758673451115,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:14
    3⤵
    PID:3196
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5324,i,5613229064515813463,7834143943234988356,2097152 --field-trial-handle=2052,i,12264359934831903766,10407704758673451115,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:1
    3⤵
    PID:3500
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5364,i,6094639808272477289,6341189906654861763,2097152 --field-trial-handle=2052,i,12264359934831903766,10407704758673451115,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:1
    3⤵
    PID:1508
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5412,i,7632992742198689344,6862223287654489163,2097152 --field-trial-handle=2052,i,12264359934831903766,10407704758673451115,262144 --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:1
    3⤵
    PID:1412
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5356,i,11537596785588445280,8839764395294647846,2097152 --field-trial-handle=2052,i,12264359934831903766,10407704758673451115,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:1
    3⤵
    PID:4708
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6260,i,15282325421166459460,2488869337127559491,2097152 --field-trial-handle=2052,i,12264359934831903766,10407704758673451115,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:1
    3⤵
    PID:4616
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5276,i,3222186204385047289,2747034133291596260,2097152 --field-trial-handle=2052,i,12264359934831903766,10407704758673451115,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:1
    3⤵
    PID:3292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --no-default-browser-check
  2⤵
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x394,0x7ffb6f18c188,0x7ffb6f18c194,0x7ffb6f18c1a0
    3⤵
    PID:5268
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1596,i,18286724354345372821,1900074861333835381,262144 --field-trial-handle=2320,i,8449508798697679365,7569442080958737156,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:2
    3⤵
    PID:4216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1844,i,6017000281595637583,118915290351920426,524288 --field-trial-handle=2320,i,8449508798697679365,7569442080958737156,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2424,i,10899892428485782127,2330772407372442442,524288 --field-trial-handle=2320,i,8449508798697679365,7569442080958737156,262144 --variations-seed-version --mojo-platform-channel-handle=2972 /prefetch:13
    3⤵
    PID:472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3596,i,5767696378374390790,2706411335954525445,2097152 --field-trial-handle=2320,i,8449508798697679365,7569442080958737156,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:1
    3⤵
    PID:1212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3592,i,12661227734462266764,2330824705135155715,2097152 --field-trial-handle=2320,i,8449508798697679365,7569442080958737156,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:1
    3⤵
    PID:5532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4160,i,1944707659903669487,7268415178008887809,2097152 --field-trial-handle=2320,i,8449508798697679365,7569442080958737156,262144 --variations-seed-version --mojo-platform-channel-handle=4684 /prefetch:1
    3⤵
    PID:3724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4164,i,15906695889272103008,13840667391196757213,2097152 --field-trial-handle=2320,i,8449508798697679365,7569442080958737156,262144 --variations-seed-version --mojo-platform-channel-handle=4696 /prefetch:9
    3⤵
    PID:3528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4988,i,2239636089430245284,1888639175754509445,524288 --field-trial-handle=2320,i,8449508798697679365,7569442080958737156,262144 --variations-seed-version --mojo-platform-channel-handle=4820 /prefetch:14
    3⤵
    PID:5780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5220,i,13764366724450364463,8851993307427047576,524288 --field-trial-handle=2320,i,8449508798697679365,7569442080958737156,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:14
    3⤵
    PID:3692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5296,i,263385854070986572,11730865814207458933,524288 --field-trial-handle=2320,i,8449508798697679365,7569442080958737156,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:14
    3⤵
    PID:908
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6608,i,6207324010007881454,15963603428487615155,524288 --field-trial-handle=2320,i,8449508798697679365,7569442080958737156,262144 --variations-seed-version --mojo-platform-channel-handle=6636 /prefetch:14
    3⤵
    PID:4476
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6608,i,6207324010007881454,15963603428487615155,524288 --field-trial-handle=2320,i,8449508798697679365,7569442080958737156,262144 --variations-seed-version --mojo-platform-channel-handle=6636 /prefetch:14
    3⤵
    PID:5972
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -headless
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5512
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -headless
    3⤵
    - Checks processor information in registry
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4284
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2308 -prefsLen 27098 -prefMapHandle 2312 -prefMapSize 270315 -ipcHandle 2376 -initialChannelId {0c1b9660-35ac-4419-a2fc-f368e000fac7} -parentPid 4284 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4284" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 socket
      4⤵
      PID:3228
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3776 -prefsLen 27287 -prefMapHandle 3780 -prefMapSize 270315 -jsInitHandle 3784 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3740 -initialChannelId {a9634bea-558d-4dec-8324-73a50bbb00b4} -parentPid 4284 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4284" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 tab
      4⤵
      Checks processor information in registry
      PID:3216
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4008 -prefsLen 27287 -prefMapHandle 4012 -prefMapSize 270315 -ipcHandle 4076 -initialChannelId {03b79460-b943-4139-9eb4-31f54d6d60a3} -parentPid 4284 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4284" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 rdd
      4⤵
      PID:5924
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2768 -prefsLen 34786 -prefMapHandle 2976 -prefMapSize 270315 -jsInitHandle 2980 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3040 -initialChannelId {30bc7370-5756-4210-8d1b-8ff8f74ee70f} -parentPid 4284 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4284" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 tab
      4⤵
      Checks processor information in registry
      PID:5124

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5712

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4944

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:3640

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1044

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x28c,0x7ffb6f18c188,0x7ffb6f18c194,0x7ffb6f18c1a0
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1540,i,6252728843164950596,14572582606862778347,262144 --field-trial-handle=2304,i,11358134305756187415,3593275398089620720,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:2
  2⤵
  PID:3560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1672,i,14556619879953490684,9536801208826612851,524288 --field-trial-handle=2304,i,11358134305756187415,3593275398089620720,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2388,i,2669603816022861795,6045006544860440617,524288 --field-trial-handle=2304,i,11358134305756187415,3593275398089620720,262144 --variations-seed-version --mojo-platform-channel-handle=3028 /prefetch:13
  2⤵
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4232,i,2300547873668656537,3784122770653091463,524288 --field-trial-handle=2304,i,11358134305756187415,3593275398089620720,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:14
  2⤵
  PID:2976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4508,i,16342235075343466230,4214936568725377558,2097152 --field-trial-handle=2304,i,11358134305756187415,3593275398089620720,262144 --variations-seed-version --mojo-platform-channel-handle=4520 /prefetch:1
  2⤵
  PID:3684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4528,i,7587286264429164199,8099866984942611559,524288 --field-trial-handle=2304,i,11358134305756187415,3593275398089620720,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:14
  2⤵
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4532,i,18329770794187189190,10258823799333913513,524288 --field-trial-handle=2304,i,11358134305756187415,3593275398089620720,262144 --variations-seed-version --mojo-platform-channel-handle=4580 /prefetch:14
  2⤵
  PID:2768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5208,i,2857164631478233631,6077530318042160616,2097152 --field-trial-handle=2304,i,11358134305756187415,3593275398089620720,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:1
  2⤵
  PID:5588
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5516,i,5044109693665982848,6572982527259105655,524288 --field-trial-handle=2304,i,11358134305756187415,3593275398089620720,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:14
  2⤵
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5516,i,5044109693665982848,6572982527259105655,524288 --field-trial-handle=2304,i,11358134305756187415,3593275398089620720,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:14
  2⤵
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5820,i,16137623929846196482,17735321871932610514,524288 --field-trial-handle=2304,i,11358134305756187415,3593275398089620720,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:14
  2⤵
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6004,i,12180463173218977553,13112203952299513023,524288 --field-trial-handle=2304,i,11358134305756187415,3593275398089620720,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:14
  2⤵
  PID:1920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5612,i,9437664441572002817,10234373599162114579,524288 --field-trial-handle=2304,i,11358134305756187415,3593275398089620720,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:14
  2⤵
  PID:6128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6432,i,12425808177557508632,8211708952012706678,524288 --field-trial-handle=2304,i,11358134305756187415,3593275398089620720,262144 --variations-seed-version --mojo-platform-channel-handle=6388 /prefetch:14
  2⤵
  PID:2492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6416,i,16903544739601314081,14521121598221194231,524288 --field-trial-handle=2304,i,11358134305756187415,3593275398089620720,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:14
  2⤵
  PID:3916

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4740

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2232

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 a2318408309934faeb9f7304e298b2d80f2cc99d4acaddef0732b42ed1ca4338
MD5 32e4025809b3032615b924cd4a3367ff
SHA1 86c5c69b0ad9cf88711866ca76c0adcea69aaba2
SHA512 06920b31b4358d14a05191a52e0c4159114b4e063691177425f2949f3481a2ad74679b9bf061963024f1581e77ec7fb4a3b5991564b9c92820cfd1c9e05d1673
SSDEEP 96:5KC0d+oJm4V0FH+pqf+HBKyoytsRDotok5vHDeB6eGyvkon5eob1v4a:MC0HJm5FHuPgXDUDreW8nUobZ
TLSH
T1BBA12BB1A8B94CB759B7D345F8837A83DEE4A2276991EF80D9DD1E0C11F31D81341A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

47a88d49-e910-43f2-9c0a-b32ae2b9222d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\47a88d49-e910-43f2-9c0a-b32ae2b9222d.tmp
Size 38KB
SHA256 ab3fdcb08d8915861f9c4fd129229a1ad24db02f849aba56e02f5345a5bc3768
MD5 e53e9b414f789ee5bccbf51561d13ea9
SHA1 71177be1b3b74eebd54497ba32da1197edd58034
SHA512 88d5ff851fdcd70c27c72e18e7750df5e1fc74e671b4d38795de00245af157c5e020ea886ef5c413f8fff36785fc79daf3e1e41557b5d08111d20a29a98213f5
SSDEEP 768:Irv+4UNbdD38cfKNp8+p3bd66j+4BRv86aLIiI2bwCl1:Ibsbp3WL8+p3Z6n4yK0ww
TLSH
T1F503BE33E8A899739CF6C648B24677437FF851A396C10ED4E4DD2B4E419A19E630BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 44233a8169c5af8b7a94348b48ed8cdaf8f3d9bd394d7b9c60a62acf8f9ab025
MD5 2e2d82a1014816f3df7e2fe0333b44c0
SHA1 971925213dbe137ab0931d140444fea04ca212b6
SHA512 2e2ea64868938cb766a7445275909bb792c7b35a8d9273a727713ff61085d7f1b4ee596d7e31fb81b64e8b8a223e2f31c6d606922d176a4e77b4173c5bf9b1ee
TLSH
T101D023203628FDC1F001613204E03300B1250433745AD74A3110C01CCC7418213F3CDF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 45fa8035e7ddc320cc1674cc0706ea9e2f6f77a795b07960840f5eace97c4fd3
MD5 778f1c21e41ec6c306e90b04de9d4f98
SHA1 afe62b41b1c8ce8500ce1332ede3b04644da43be
SHA512 5b06de33b32c6a1840c829331d8d7cfad7ad8e57aa74ed8981c6a66068dd27b0098403acb4c9fc1d61cccded2c85886402c9cb035ad4c9c19a93ff5a9ff86210
TLSH
T1FDD0C0203308EC01D042A13218C03311B1220833785ED7052020D01CCC7A24153F74CF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ab51bfd434f5e9d4e8df0cf36bdde321925b5ce87d623bf98f98d6c01579200a
MD5 2cc95474df5d27b5873236b7e909e780
SHA1 75351288c253c29378e10901cdec043a1277ab48
SHA512 3872c7e9119e2a1d83b96504f4c3e30e003d6ca5adc30d5e2365b0b9cfb4f2cf7b3f1ad4a2dc4fa29feb8fc97e830e47f81f93d2e1ebb3169eaecb3f3bce8ee7
TLSH
T12DD0C0203308EC05D042A13218C03321B1120833345ED7052020C01CCC7A24153F64CF
MD5 SHA1 SHA512 TLSH

Submit Download

09444ba8-0780-4a14-9c31-5db138ab92f7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\09444ba8-0780-4a14-9c31-5db138ab92f7.tmp
Size 13KB
SHA256 568e98df3180ee40542433b92556de29052ce4725b5c4f545f0c6521beea2bdb
MD5 9b7cbd040ce22c24bf3889ed9b28e1b8
SHA1 ab13ec9c97f6d26c8d593c70d774183153e7c292
SHA512 cf99f27898960a7047bb7968170032879d3f71ba1b26061e3fbcfb967cccc6bdcfd54d7f191d44c71b7b43e1155d0d839cdfd13ab6cf94fc675a5816766528e2
SSDEEP 192:sxR10RjxQ/fwsx5CZV1bGToD8pJD/g6+WNP/0/YCtuOI+GsIgVkJ:sxR10zQ/fwsx5EVMn1/5k/xImO
TLSH
T1A052D7066D38683B9CC7D25CBA15BF53E7F91033A1D05E48E6FC8A1C14EA6DD221781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9cdedf01-2448-46a0-922c-29a5acf216fe.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9cdedf01-2448-46a0-922c-29a5acf216fe.tmp
Size 13KB
SHA256 dea69a98418eb3514a45f7a51c757b86db088ac980ee44e8fa2d5b14973a93e0
MD5 399269631d74986f6a297bea7a773435
SHA1 38ab622619695f5fc311d8d2a2c6f21c00c400db
SHA512 aa16d88af82d3ce161cd19cad643a6ccae091f6ba3f1e269f1cbe6a1b43d9ef77bb526b9c655edec710211dd6d4b02320352698b038cb7c8aa4dece59c435ad0
SSDEEP 192:sxRW0RjxQ/fwsAWDde5lSmbGudoD8pJk/g6+WNP/0/YCtuOyGsIgVsJ:sxRW0zQ/fwsAWc5l6kK/5k/xyq
TLSH
T13552C7066D38687B5CC7E25CBE15BF53E7F91032A5946E48E6FC8A0C14E6ACD221781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG
Size 331B
SHA256 8bb5cb39bfc21c4bcf3c9f29ccb237520cfa82933d9b9aeb64d87e27f912a1d1
MD5 e68db54a7868f50a53051379e3489cae
SHA1 330731671b8459e18f6aa5a4e6a309d1db62a286
SHA512 f69e982b6ee16e272520f99dd7729cb7eb468f171d7552f60d37196b1e51ad4530a00ed509ef5a69d8f8c7b18e79d1ee056e8cd50f9bc72c300903e5dc742763
TLSH
T14AE07DA54BCCC32EE754A687517C438CC2B1B74BD2C9EE0A3704848C7042084F2EE6E0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 0ea81e3ef9b021e53ad25a2f66beb6662f884dceaa3c870d671faf8c580f766f
MD5 fc60e124eceeb679dcead96d514b60f2
SHA1 e0ed3209e715922dbc9af06da756b6504a8d6c12
SHA512 7dd70aa70867172a06950437f1ae1117ba0daa03a40f13d6c39014ea7040542fc9cecb6626224e5b9f7ca569c6cba6a12bf6372f8735d56a8892ff1cfd41b080
TLSH
T1B05151D3132259CFD3E259B121F06468B2FEA87C81076E88417B2D75CA01F8A60E347B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 6b976ca14a626fbd60fa611c917c877660a0c4dec1fc1b119095f45bd767f8ea
MD5 684e9af6fa60f7c83d8ce7a0a8d98abc
SHA1 6ebab3e2b0520775ca88f4d10ccc60a8ba201bff
SHA512 9cfc006e87a94249c019295c27e2279494fd42406851a0a64d0985555f9b3613eaf606bb65795957ad42490db2553af889094080821fcf521d2dae26786e4503
SSDEEP 96:Pm5jbUaPsQEwgggEofjEFWG00hKY+9F4mBmZc9v46IT5rxIgsop:Pm5jQaPsQEwgggEofjEFWGnKY+9F4mBe
TLSH
T1D9A1A78B439A2C8FCF914CF024E15C2472FA90BD924B2BA761175E74E603FDA10F246B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5affce.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5affce.TMP
Size 4KB
SHA256 71cd9f044892c7d40f787137a5cf9b919716387374a29231a84d7ed200831708
MD5 a738b21a44ec6127edd4a30a937fad25
SHA1 10927cb97b6cbab02c851daf8ad1e7e8fe466126
SHA512 4bcc4060c57667f0ea70fa80c76a21abd0784f6b2ce572d23118d93b2888a4577d6b8419bf910e6ad549704caa19423147b38ad143d2605d8e5932748fb04d40
SSDEEP 96:iAC50eC7dUaCTb9sj8v8J/rggVewhE9Wss5K4JPWtDs7BmZc9cxO0kT5iqOWqZ7d:iAC50P7Wa4b9sj8v8J/rggVewhE9WsQK
TLSH
T124A1DC8B132D08CEDBE15C7121F1A76473FD92FE91431E84416B1DB8EB05F8AA1D246B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\index
Size 256KB
SHA256 a2eb3b9f82d02ca53f81b86ebbbcffb226267b8bd67137efddde17d22f137627
MD5 2e02687f38489f27fb31b19413899f28
SHA1 61a301286e8b60718754e6569e078545290e234c
SHA512 441b3e17ccd7ddae1e10547dcfe7d8a04796ebac88f472e7afbec5a8a402ea4e6a367b8e40c417ba12ac1412299127685e51e6863d2f3f9e89feb4b11c7adf9d
SSDEEP 3:LstlNllklkXlI7/:LsX3lPI7
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG
Size 347B
SHA256 44256ca15d18b8f8a5808525222f3236080621188d52394bd293f8415f940d9d
MD5 65837867a335ae00f184f60fe186c559
SHA1 5248b0546280d2013f2fceaef1cd8cbcc9dd9641
SHA512 4214e51749bee5f590f7bdd5e31b64599ef49f9a9a11be73cfd185e6b77abb621c9a34e040c58d3599b2fc3caf52d47b04ad99cee2cafdf4159349de0210c03f
TLSH
T1ACE026A056CEC26FBA2124C76328C70CC2F2370AE788FD163F0899847216188F393289
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 285B
SHA256 fff9c841af450dfefe7f284f645d4a26b048e6bd5709ad766b308172bc260a53
MD5 785c71b68bf89a0e9973e06d76434ab1
SHA1 2eb96ed892a724f5f223fe37abbd075d448d45e3
SHA512 a84d94a4b22d325a41b84c193a2e279bc3969085d87eda3fad0dc1032989bd26e67aba7cefa085838590e5aef8958c40e22a000d158fd80782b614dcdbc55030
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 322B
SHA256 01b3c605c8bed5e55c041195c25ffbbe0cf9391147696b6269b6c3361d8341a0
MD5 719813bc5185e6752bf9c4bbe6274162
SHA1 ec390b3874158d7d04746cdc6fd1ba6fbe37985b
SHA512 60267cd3eada9d0d55f0c5df83fd18f230a101d3cef1d9ca23eb255e33075727944df4350cf0841992afc3c11d43911afdf4ac187175810e48dc35fa5966ad74
TLSH
T1DBE0866404CDD22DD8256CD39778930C86F1BB57BB89FD02374D98557151B45F2D7290
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\index
Size 256KB
SHA256 626ef260f393f2fddb6735db62c86e5ad9d8cbc4a9ee3cead0e117c53be8aff8
MD5 e49090a6267988eb24c21b811764e613
SHA1 035ca6b391d9dc9b608d74fff83a36fb6f92a508
SHA512 1bfc504fd0e1ac4c0d64777c6ada60f6d4b0a7126d999fcddbd9055b373a643a5e345efee24330b5435fb516a07a9f114703b093b9a35c1b3468fc90cb45bd7f
SSDEEP 3:LstlNllklkXl5/:LsX3lP5
MD5 SHA1 SHA512 SSDEEP

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 3KB
SHA256 0a7cbb8a83f61f73d6340d2f2c2aedd5330807e85ffbcc2c42b88284f8a6bc15
MD5 d78bb5153f6482d6a8753fb432a4043b
SHA1 5ad1f0d8bc4b67bfdc63970d3eeb60133e638496
SHA512 4fc29a672455d5a0f08e4959ed8c0e6d1f20b11d8b00052799da850216f510afebbced098d14278bfb86a9dc403da36f1370e5cebaafa162a14ecd143226317a
TLSH
T1DB7185FB681CC826C7CB80D88543BDA6C623657C9FEDFDCCD2BC65A761951747520026
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 aa4377c669588ffbdb0686b081ae15dca8be9f3fd81dbfe9781cb523587f73fa
MD5 e61c0cd2445ed56ecf6f303ba8e2acbb
SHA1 7e61c51c50c34cee0aaba2db04d3fffeff28c2ee
SHA512 645319553b39a04ae98d114a4099e96fc649be4de4a91f03107fb86689d8b55408ef349c55d261f2b4e721d92053235eb9eea46c41ad4f975b23789d8b28bd5b
TLSH
T142E0D87049DDC11E9614E4479614A70CC3B03707EBC9EF016B489845B942104E2811C1
MD5 SHA1 SHA512 TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL
Size 36KB
SHA256 62a01346bcd262fef5244926aa99b67ab2ff3684c728f73b9747675c5f19aae6
MD5 bd0aa4c9d8717a0591c521cd38145904
SHA1 6efb2c37b6ded422db46a5f29d4c2c35ecdc28e7
SHA512 e01408d934ad78c13b0b00f73a5e801782f88022ee32ab8482fd366ff09e9e1ae6a92cee10c3afc74f8cf00ee2eb06ae5ffefc878e69db5988d2abf4395859bf
SSDEEP 96:OIEumQv8m1ccnvSlRACsRYSf5nFXYwPK4g:OIEumQv8m1ccnvS3ACWpw
TLSH
T182F2EEFA07276506D98444B0A4005FCFAF16410B43B2B3DC7AD447E3F7A21E2B1B9796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 500d281a11ec02c6a0f767ed7e7b1ddd8a63f6ce77fb847dde773a383d968300
MD5 7db17eefb038c73452168d83a5887d40
SHA1 6ff336de759b6fb9093b537e422d539879b84bd7
SHA512 421cb4857f01aa2241eba4f7575b01378223687764a8c434bd3a3bd94b9e9d4ffc45f19775ee6446b6d33589663c84ba4c418ef7c586070b1142e091b50997a0
SSDEEP 192:sxR10RjxQ/fwsxBCZV1bGToD8pJD/g6+WNP/0/YCBuOI+GsIgvkJ:sxR10zQ/fwsxBEVMn1/5k/tImg
TLSH
T18A52D7066D38693B9CC7E25CBA15BF53E7F9103395905E48E6FCCA1C14E66DE220781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 179a9572db6d16469638797c2be32b564d3304b02b3257080a0b0c9d06f4ab8e
MD5 8e67428655079b17383b034ab6f71287
SHA1 99a0ba17554bcc54413a7987a5794d08abd7ab4a
SHA512 8ba44e8d2ac7ac330c8fd424c8610d22a708551252cfdc7d7dccfb1081cf0fda4e588d1ad2c5ae8d89827d757cb992c66020b02c094547e59523dad14d3ed1d0
SSDEEP 192:sxRW0RjxQ/fwsb5CZV1bGToD8pJD/g6+WNP/0/YCtuOI+GsIgVkJ:sxRW0zQ/fwsb5EVMn1/5k/xImO
TLSH
T1AF52D7066D38683B9CC7D25CBA15BF53E7F91033A5905E48E6FCCA1C14EA6DD220781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 9c5a3a0b4e639fd5285cd6f8a0304ef203d5bf0f797ef62663f2229e790c1cc7
MD5 3e18337a3b76e68c9ff70ecc2370202d
SHA1 d138f753dc22dc1fa58a65d8b1b6b5c7a5655cce
SHA512 e0d51050a3cb37f2af099167651c190f123c61cf7e74acff04911ad9cfa34d5546d6d966b5eea3c6919edd8fcbfdd21e925d527abe57b68d79c453b5783a5893
SSDEEP 768:jC+vwN7pLuL7JQWgQ+f4+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVKQqcTroZor:jC+vw7E7JQWgQ+f4+u1jatVcgw
TLSH
T17FC2FA7B640CCB7F4F804ADDEC197E9B6DA802CB5698CD8047FE941C02C6BEE52194DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d849b163-9d4f-47f8-b6cf-f901db5367e3\index-dir\the-real-index
Size 3KB
SHA256 1f3bb0cef87e9be5d19423286a4535375da2c7ae4d69192a9a9e1e8db6f098c7
MD5 c8634fc164e8a5e1668417e521cf9c9b
SHA1 781f31f879cada41452fd4fff71d3a2043c7150e
SHA512 98e1e0b83655267c18c543c89bc47a2e17263beca410385dc0ba8b17d6d81ea6cfa6f5af1d6559ab794e4bd90d046c5796d6c12ac4b678a6ea21d6755e8503f8
TLSH
T11A51D78F8C8E1D9ED96C09B358F7045133B869ED1B48C94329DCE671BDC336A2C08547
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d849b163-9d4f-47f8-b6cf-f901db5367e3\index-dir\the-real-index
Size 288B
SHA256 7c7214495e7a897efbdf7440d516dd828ef1b8a16f17ab93166caa24a9241c7e
MD5 d501fb555d6656003130cce4f8fed00a
SHA1 7016f9f56815c9b2ed39627e5b3233e923d201a6
SHA512 1f7b088ee7ad9087d113c886aeb7e6fbf98172de42ea3fbc8b2a95361df5c58b5b4a0375483b6055cc187d55036e5926f149bae5d2df3eaa685eb4081b9a3314
TLSH
T147D0A7CE9C629947CA2A61B505BB2419333706FD2112AD6A00FD183E5556A6D8545506
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d849b163-9d4f-47f8-b6cf-f901db5367e3\index-dir\the-real-index
Size 1KB
SHA256 a6f321edb545a50d59d2a56aa94e12048c926bb8785442649853041708d531dd
MD5 ceea5c0087d79561654411e525cc6609
SHA1 1bdfcb03e7ecb8a5561e28e83d149462879b6f2a
SHA512 7dc740a5e1d6a047d130e748da8578efdc1f47b9744824e6f31767e997c4487f9b95bbfbb2286f4167d7a1bc7b7725162cc11c18374fcf70578b1ac5fb39f9b6
TLSH
T1D321A54BCCD70D4BEA35593388770420337296EC2718D703205CF6356E4135BBC08987
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a5eea.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d849b163-9d4f-47f8-b6cf-f901db5367e3\index-dir\the-real-index~RFe5a5eea.TMP
Size 288B
SHA256 f5d7f560637d335631edbba2130542f1c3a505e1227d4fee81f542ff92418dac
MD5 523239548a3884c850792dbd48cdfac2
SHA1 b507720d0e20c2b287ea3cee8cb63a0aca14d9f4
SHA512 4c2621aa8b622b3eef8413bdb7c89d962d4b82e8d8a77f30632d7cab904ada141a9e0027219cdd5b7208821e7dfa8328e18589a1bb13ef4bc6d53a35b63983fc
TLSH
T185D023CB4D516966DB17157924835515333708342415EF3110FF0C6F497179C9D8110A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5aa01a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d849b163-9d4f-47f8-b6cf-f901db5367e3\index-dir\the-real-index~RFe5aa01a.TMP
Size 1KB
SHA256 1861b28cf7affe6dc2b5563c776b4d45a0c9c838e64154df037d6384d7446b86
MD5 622a67b3755e36fa1d5859972fac1e61
SHA1 2adf6d140db0ac5e79e00e4a97c5f68b94a9cc2d
SHA512 0c57b6f2a4d1934f020a8bccda0f202e8c9d460318b0d954261e45592bf8df9fb7b2903a29c93743d600763d33577f32ef7adc050ce181707b15e389c78fa4bf
TLSH
T132215443D4E60C5BFD222573D427001073B9A4242775D7073A1CE67A2E813AAEC2C587
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 55048869fb838c1d8283c53c0c0eea54454af4ec9c9d230f517e9451f1f011f3
MD5 22b9c8504b725efd61b21320f05f6fbd
SHA1 0f7ad4ae084e34f74c98332a1679ef6d75e19341
SHA512 27b233e7770a16144b18fbef4774feacc1ea70468ebf08619094cd03a9a94ccb66116c232bdabc86f459ddddb5a0ed477777832f0d41665da7c95096cfbf48eb
TLSH
T1F5E068F63DFB1A10FA6BC3EA14B2249401063814C598BD8F142AD29700B23152411C12
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log
Size 320B
SHA256 398b22aee56aefbaef0dfe229f3b6250018874ce4a4a06b7040c2e7a09bee3ba
MD5 4b29af3d42fa1044ca7c93e51d717321
SHA1 485d94f03a1c4f4efff9a52be7f53e54a53b1d16
SHA512 6f1e3384ff4e79e736b14ee4328d1bc63fb83eba13679eb21617b84b5c30a24d357b7d4b480fba9f976cacd6b4535867179d6445606384a922f81bb3ae15242f
TLSH
T13FE0174A0B180323E84612F7689A32D91BE4C80C87EFAACB964FB07D9FD8A482405280
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 338B
SHA256 9555e9919efec4e411b6271f1eec20afd993ba7d912e847b0c806b311dd078e0
MD5 334c4dc73fd9c44521d3a3108d11da1f
SHA1 32520e8feebd86c7f7decee98be87227b58cf814
SHA512 df6d47dc039a666e10f558624305909673e9570ff272397a09fbbad0913d0ff6745954d7b7af144b7021e6e83e21894b87a2beb515ab97cac844dfa114dd6c65
TLSH
T143E0262005CCC17DA02AB45706E4870C82F4B787EBC8FD0A3F81C8447143706F292182
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 48B
SHA256 90d9a12e43a94dfd405e0b8eab9d3455c5f261dfe90711173098ada543beb0a4
MD5 eb73a08584c9fb91bf89aefe24a05d86
SHA1 5e019e9b9014c7ffdd92732017dc615b8bd3ffba
SHA512 3561483904016596e0154567b483f51588b833d16f6f2a00494c523f35b079558e11bab8d26f8078da0449ef9ba627af817c0c5d7c3a710d4df97652a8d81cd2
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 8b5cf3abba6bc0129fd0b9ce1373e26086f74ae2cb011d6299dc3eb82aba4ad2
MD5 698185366f49d9d401d3e16b4e5e83e1
SHA1 e19a4543f21fb8931669a3deba36bcf739c8abd4
SHA512 1ccc3deba4469666fdccb024927ed2501e35ad8bf9b66f47b107945eeee682ae0956ed77fb0f854a37c8a6f045e261054e0f32e4b34a4bbd74ec49bc0a9bae4c
TLSH
T1E8A002168D55D046C46203B090AA4184271088DC06F9263260BD40589A55B4145FE004
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log
Size 1KB
SHA256 e84f4b31a153b609c7db8e8eec01d5a38b31806ba8c7bec2914406c59f498695
MD5 83a0468b3566748adb9421b2735f6c4a
SHA1 126e2b1d3388845941a3259469a2d729c62ad3cf
SHA512 ba9cc35508af16caca7671c2291e489372fc693bf310cf827e812ea72dfa6709c48d153fbffcdd73f547db63d8ed5663a88bd29a8c16c56e1421990bb2688e11
TLSH
T1DE1138F3098C9425EEEE82F45D9627A4E7B6D1CE5BC68ECBD79946CB14023263815443
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG
Size 319B
SHA256 1c15180faeb7a52929253b58a91eab54c274c4ae277cd6e3e85eb3406ddc1b5d
MD5 f95113da1e0fcc593fbfd4a60e7da5e8
SHA1 412fc11f634e690ddcb752e952b4ed5d705ed07d
SHA512 9751d9c36d5521d4808903de00fbd59752f3b8262dda86add99de867df9a74c8c7d2378107bd544ec70431c534542e40bdded73098c37b632493f176d07f09e6
TLSH
T1EBE086780DCDC12ED62469675678A70C83F17746FB89ED023749C844B602259F392191
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 7c94a1d3cad0b048423ff399f3c97745e5d6c2970eeff95c32002c099fec40f5
MD5 2d1835e071a50945577eb3493df94832
SHA1 16d03c66733085be4b5a95761cfc39b2801f01bf
SHA512 c2918c15e486b084aff1d89f7f35f6346a5ace319d58dfb4ec48942c6b50b036df4b1fd52abaec03dec206b21692baac1d968f53db24cf95bf3ea22343d71146
TLSH
T17AE0D83415CEC22AA15974875268E30C92B3B702EBC9ED153B48D844730A240F253540
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 3a21277f013bd7f237416fac01612b2475ee74b427f4944517bde157f14e4b8d
MD5 81e7d29987fa6433a9b6a21b5a79dd70
SHA1 ce39e15d169f6957515d353f6917bdb2a7867b5b
SHA512 70da5d91f56debdda0509f2f486c2ae32853918efe4280179281f7fc8152261eb5e28ef0587e86779b1ee3d89229ec3150505e807dbdcde9b8039db1a5dc1dfd
TLSH
T1B5E086B445CDD2399455758346A8A71DC2F1FB0BEBCDFE5677484488B242284F2E6581
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 6090c475f305985ca6fc62e70890d88f6e5fe072834f80b7c1641c9e508236ab
MD5 41f65e2904cb061a473b3b5cef676d2e
SHA1 eb923c95115ed9005713c3b0c644efeab30d3325
SHA512 592697eb433e43053a39a1c07197b73777c1db7fe850eb8e84a012380556f05ee6d2a38a46c3e84696c0a8f5005d7a4f5c970d2776d184bd7a58e7b83b104b97
SSDEEP 96:KRbEBVj5J1WdSIg91K4EgT1c7j6dJOmNyKm4aZ+lCewYI2mYH9Ie2KATIk202+/y:CbEBVj5JAdSp9/EgTK7j6dJOtxZ+lCeH
TLSH
T173912E4132BE52107C7E680C81A8987B66D273A23515E52B7BAC406B0FE6F42DDFD9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 ef5141f9cc9c12e58bcd0e2b0ffe249b1b6a3f4b95ef5ae29da22044457f26ef
MD5 e417539fb8c2a4ce66b6b6c967a241d4
SHA1 885506ed68ee648fdbb3915d11252e01fbb44768
SHA512 1d7cef16d6c144a795449e3bd2a6e591c76d5cf71f25ec0e469ad417a74a1839a883bd58ea16af2cddbb399c4c41d0d67fbf4858f7834d8d5cdb5d165da2a0d8
SSDEEP 384:DNrRZyCSDnxTICrDWMEhIKyll7svbFKfk7:xFZJSDnimyI1l7svbF9
TLSH
T10544840A7B747001EDE6DD725CB080771E3C716D8F22A6916DA254698EB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

load_statistics.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db
Size 84KB
SHA256 91c62bb7d9db4dcd45321cfed0f8d9f42555621db2146c5126906af1995bdd83
MD5 297a4fbc237f6e470070a67b60826ad7
SHA1 5610e0f18cc927d51ec6e5841147d2e80d5b7c80
SHA512 69eab30a5f9d4b4993917107ce71bf1ec0adcf9996069a5acfc671a0fdcddeb4aa19fc07074979d3d1990636c927f8299fdb6de1fae9df1261db5fdfcffe4907
SSDEEP 768:GDF2oJVSav8tpCCGDcafmP7TFoZcXtsiErp0sIChAk1ra3jpykbIvNKZaBqNvZ8q:GDcowtpCA7TFOcT0GjOcBNb
TLSH
T1EC83DAF7AC0A91A6C9CDA1B8A40BEF8454738621C624D8E9FD7C48D33B7D6023D79685
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

load_statistics.db-wal

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal
Size 3.9MB
SHA256 47c2451d5a3dba8cc8801e06b0eec4d89152a16a580a298f3856a75908ba120f
MD5 5626197337d3673d1387c3eb4930b595
SHA1 5fa4ff62ec87896f5dcfe6bb00b4a6fa5fd65bca
SHA512 36d349fc0c8508755c57464f14858b7b3de56aafc177f7ab690c26911292830ce527c66dd2e2442af4bcc4874acd193483c7d47bba639796f61f0a20473e4305
SSDEEP 6144:e9hqgmzmts3zEORt1W3hoP2Pe/toSQ8UZZr7F/XIOzJb0u6M3zhaeY:WOZ48UZZr7JXs
TLSH
T18816B8F36D1A91AAD9CD9178A90BFEC49073C6218620C9E5BD3D88D37B3C9023E759C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 497B
SHA256 b96d4f9fa061cad8b95fd90c56a632c702daeed0f4f4daf827d0375ef0699dc6
MD5 b79f5eb5783f49873bb6f7d2246e6f3f
SHA1 392e4c40f1a10ce5abb6a3630d4a95495ccaf263
SHA512 28c3819894645fff46ae473c15b26b3931159b9645ca87996773b231edff67d53eca79add47c8550167906c67511f9cf9ddc0e32819cc16fd8cb567a37e362ca
TLSH
T1F0F0C2C76E021977CC12547150336783FF6189CB0424B46743CD246B5A2D2F1C9CC0D2
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 319B
SHA256 1ce481efdeb6c593d8f22b6bb548217131529b7122a3cfe9dec72158773bc75a
MD5 cc144a58ad343a7ed8f58bf879b51632
SHA1 cd6e008afa990fcd3dfe11f148a94bd2e0417b1b
SHA512 402782f630842f320069b1cdd14b1a3df3f8a9f08f4cd0d5e73ff20c44e160d8a10940476b2065eb366ba754aa80b584e1583f4a5730a2e5a49092608557a9db
TLSH
T16CE02620A9CCC26FE93425875128430C92E4BB4BFF88ED467F20CC88B001705F686182
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 8213d620e47aa2704849c5f5bb859d0bc95ab691a5b8cd8108471d70d8e4f1c6
MD5 c2b370abfecacf011ac63ff74a28e5b8
SHA1 9151342b961e1a33e234855b6b1826d57672a96b
SHA512 e167a23833d4492d51671c92545be9d1071f4463eb2a39c674f3a7b40413bb43bf69736107ccb22ba7765ae05a8504c43d624d3e480cc5a6515a82c9c6432db3
TLSH
T1B5219256F330C004E25D867E506F9B351738E8528FBCED0F857920646E76A180E4B6E4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 337B
SHA256 2229302cfb4063b455cf73e574970d13fc4795dc4eea4916d9dfeab0170a0719
MD5 6d30dbc83c8187cc6b0955f34c8642e0
SHA1 d98b4e475b93ba656078e717e3dfd61bfd132a97
SHA512 fc6ef8e63c4502e4e1b1c0f2f65ab2f1ea8b3f5fa337afae7c401bb75a2c7a33a5bb64e4135a634ce344bc71d88dae12893d71f2971d303db092d4a050715adb
TLSH
T15FE026A0A8CCC2BFD06825C30174934C83A13B1BFF88EE0BAF00CC48B101741F68A2D1
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\index
Size 256KB
SHA256 deb1ef39ee01f05c723d396fb933b287e1d869b242d01de724aef5f25b723841
MD5 97d2ce30d5c18489d3622bb0ec4a3a5e
SHA1 48192e7747d40c4d0a0980e8fb42b11c9c731a8e
SHA512 7b9748661fb485d25cae2c2e82e88fec75ff5da2be54a12bb50e87a95fb48de703590ca51b91569e10db9496c2e3ab6e736b9062b48206e7fa0081c72fb50baa
SSDEEP 3:LstlNllklkXled+t:LsX3lPC
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\index
Size 256KB
SHA256 8257c19eef2aa1d7657fb6f6e03494d4613676647ace1e55c426f4ea789798dd
MD5 a4e23fe624840c145cff63185926dc2b
SHA1 eb98f7522a0709c8fa978a8899622310ee1b076e
SHA512 588351ccceb95bf8a53e3e93da7ee0b8f8191a9f806321b76f13c5f2061ca44febe51ad60694ade001602262f3208562f8b98f28e8f78e3fce20ba561ec8e140
SSDEEP 3:LstlNllklkXlsR//:LsX3lPsR/
MD5 SHA1 SHA512 SSDEEP

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 0c6262e264ad8834b4663573d26b57b36af9d32cc8ddd9b7902a84a2794052ad
MD5 60253c16ccc4fede2bdefda839b6a68c
SHA1 46204123072deb3c1c51f94d2c16ef6312e1b2df
SHA512 51f8a22502330301da3189a58d2b9cfb8e6743fe8789b4b04c42dfd2c12b4414651d8706bceff9690c60c5066e8989df1d16e17d338e51bdc65ac8a3e08c61e3
SSDEEP 768:KPrv+4UNbdD3MywCf+iNp8+p3bd66j+4BRv86aLIW22BJ:KPbsbp3LVL8+p3Z6n4ykAJ
TLSH
T1C203BF72F8B99D739CF6C644B24637837FB4106399C00EE4E8D96B4D459619E270F827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 b22fb50c72991b81e9a4a88029952d1b1d156b540a659ec171d23531e5d49751
MD5 0bb7aca7728f1eac9e8755bacba874a5
SHA1 a792a95df886e1af0486375b168fcbd0c92a9a10
SHA512 16ef4a665b2266b8248416d9a04dcbe8d31df640d3b01360a0e05d1535b158433f03d64c80e94c254a95953b6ac35e9c9d11eaeb59ae55949b5e30684213f503
SSDEEP 768:elc3RyECf+Onp8+p3bd66j+4BRv86aLIF7fjS:elc3cxp8+p3Z6n4yofjS
TLSH
T188F2AE71E8B89C739CF9CB48B24677436FB5106396C41ED4E8DDAB1E109719E270B83A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 57681a5abe2f71965eaa1c08044df5f16c470f17fced35867b6d9ebf57a08f8a
MD5 71d067f9714907faca27dd93f7c2fd76
SHA1 a7e1b1b9daed9de52d8bae9bd37a70112d95e934
SHA512 5f51d4395d5f39bb1b76e8deaaaa0ccbb10a2b0601459215310c930cc6331359499d5ff3dba96b35895ed87e9b71ef0aa90ad31895a139f2fadf0eca66a4a1a2
SSDEEP 768:xrv+4UNbdD3mwf+iNp8+p3bd66j+4BRv86aLIT22bwCl1:xbsbp3lL8+p3Z6n4yn0ww
TLSH
T18403BE72E4A89D739CF6C644B24677837FB811A399C10ED4E8D96B4E015A19E370F837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 c5131009b0c74182fcccc4efaa739824fd89e8287cb054e00ef98e2e3230edfa
MD5 9de2b56ca59a86e732013e0da4f2d3bd
SHA1 bf19c6f1d043aeebdb77582028f43044167d4cf5
SHA512 be54e697d4f12a774808da3ecb1d77269c9f23dc5665198b1028a0315553b72aba14041f28ef0dd9b6aa48d6f734693902ee17087e4746890382815824e327a5
SSDEEP 768:jlc3YyECf+Onp8+p3bd66j+4BRv86aLIF7fjS:jlc3Xxp8+p3Z6n4yofjS
TLSH
T120F2AE71ECB89C738CF9CB48B24677436FB5106396C41ED4E8D9AB1E109719E270B83A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

campaign_history

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history
Size 20KB
SHA256 359662de1c4521a66ef93607b75edff23cd3b9d84dc3e124c88094fd22064e3c
MD5 9f7f65bbab4f5aaaa250c85d2e956397
SHA1 aadb75af7cf0e633260df5fa66386363d224ceea
SHA512 9c54f2fade67a8d3c930deea603fbdce57c5c1ebcf6b9f561016c1ed0b27aaa235bb6c0721ece394e8f3918e707f1a14eb702afaafcf60cf03e40033fbe0a366
SSDEEP 12:TLJYJiEZXiDiIF8izX4fhhdWeci2oesJahvGFUxOUDaa1i3isZQQtyduqzQdQU9B:TL+j0afDdWec9sJVUOYXjy
TLSH
T18492DC266D352033E8DB4B3AB89389E00EBC12ADC9A779549DD409710E61BC2A2492FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\index
Size 256KB
SHA256 5a5c638d4515ad0455b9f179d89197c3b1ef020b462f6b999c30eb4c80e62822
MD5 84ca64aeed782c00a8550eb7a4c75084
SHA1 13b2d0db6ceb2f81e9a1478a687ebea7cc36c8cb
SHA512 5cd5dbaab21413610ccb8bf4f3639ba9589a92d26803622803701c8599a44e2f3e4cf38217f7da7691cb279f3998f4400a997cf0f27350592a4a99fb0fcb15ef
SSDEEP 3:LstlNllklkXlgDt:LsX3lPgD
MD5 SHA1 SHA512 SSDEEP

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 3dc9043838386f5363ac96a01477cf3163b5118b80191576a11b32ce9894314c
MD5 cdddc745a8c954dc438c931889999bdb
SHA1 7908f975b6815460caa2bc3438efbd8fc8d36211
SHA512 3d2d4852aa2ac6cb0b9b6cbca9f04366afd48d362d869be877ef324c16d72ff119b5842891baa2b6b99df2de2db8d3be5c23f0f97f8943bd74195996bcb66a0a
TLSH
T159A02407C473C00FF4144051C45C034114F4C047011DD0115070D33714D40CF03F5C35
MD5 SHA1 SHA512 TLSH

Submit Download

13af4ff2-bd80-49a8-9a65-f43b5202efbc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\13af4ff2-bd80-49a8-9a65-f43b5202efbc.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

213c817b-5642-472f-befe-79542586446a.tmp

Path C:\Users\Admin\AppData\Local\Temp\213c817b-5642-472f-befe-79542586446a.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fa1ec602-e6c2-47a3-8aed-fc120881ab6c.tmp

Path C:\Users\Admin\AppData\Local\Temp\fa1ec602-e6c2-47a3-8aed-fc120881ab6c.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4600_1026630591\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\prefs-1.js
Size 6KB
SHA256 3a9b62b9d49913ebe5bd354a74892016d15ea22e0bfbf63a86db09a027d09cab
MD5 c5a30e8acf77b00e3db42324912c9338
SHA1 ef84278a9fe3297d5ec841fee9b2151c318f8974
SHA512 4aed0a95b0c4eaf6d6d22d58ef5d7d168b0c98933154b60291620358dbe1658162499fe85dc6068d1a968954c6f749b9255142b2f7e6200c40f849346e8bb846
SSDEEP 96:xH+UTUQqGqsfcBl1zSaySSlvdv9j95nAHdA0ScSqBw88u8L4cnEVgR:ArRsfcBl3ySS7sdA0ScDBw88e+
TLSH
T1D6E130789108CB7F64B6777CAC6888316AB2413B7BBF68D650B554C4014CF3842F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

~DFFF0BB5B7FD245D19.tmp

Path C:\Windows\Temp\~DFFF0BB5B7FD245D19.tmp
Size 589KB
SHA256 36f61265af7ef12dbbe86c482d80936855306bf6d8a6feeb6396da348339a419
MD5 8c360c8804116cbcb1a7322267dffc93
SHA1 14c11b9a78c9f9986db211676661349e12489c6e
SHA512 087acd0241a36d687bb741fc199c4b2815892d97cef0cabff8200981764a0795bc37759c51684f6673e93a804005704f48e5e370355e4e21a9aa92abbb383e51
SSDEEP 12288:XxgK6wQU7amMm1MdyLtzaC6EWNLWUUPg3DQyhoe3Ifp5cTrOsFI:XxgK6wQU7amMm1MdStuC6EWNkuvie3w1
TLSH
T126D4AF45EAC380F1ED436871326FF33F6B72AE16C871C9DAE7E19952AD63360161B181
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2356-9-0x00000000009D0000-0x00000000009D7000-memory.dmp

Download

memory/3880-0-0x00000000374F0000-0x00000000375CA000-memory.dmp

Download

memory/3880-1-0x00000000374F0000-0x00000000375CA000-memory.dmp

Download