hxxp://noescape[.]exe

max time kernel
1041s
max time network
991s
platform
windows11-21h2_x64
resource
win11-20250207-en
resource tags

arch:x64arch:x86image:win11-20250207-enlocale:en-usos:windows11-21h2-x64system
submitted
07-02-2025 20:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://noescape.exe

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
4296	msedge.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4296_703809288\json\i18n-mobile-hub\ar\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4296_703809288\Tokenized-Card\tokenized-card.bundle.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4296_703809288\Wallet-Checkout\load-ec-i18n.bundle.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4296_703809288\Wallet-Checkout\wallet-drawer.bundle.js.LICENSE.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4296_2025854739\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4296_1299118694\hyph-el.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4296_1299118694\hyph-fr.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4296_703809288\json\i18n-hub\ja\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4296_703809288\json\i18n-shared-components\id\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4296_703809288\json\i18n-tokenized-card\de\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4296_1299118694\hyph-la.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4296_1274769803\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4296_703809288\json\i18n-hub\sv\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4296_703809288\json\i18n-notification-shared\id\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4296_703809288\json\i18n-mobile-hub\zh-Hans\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4296_703809288\json\i18n-notification\sv\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4296_1545330848\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4296_1545330848\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4296_703809288\bnpl\bnpl.bundle.js.LICENSE.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4296_703809288\buynow_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4296_1299118694\hyph-sl.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4296_703809288\json\i18n-hub\nl\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4296_703809288\Notification\notification_fast.bundle.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4296_703809288\vendor.bundle.js.LICENSE.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4296_703809288\vendor.bundle.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4296_703809288\json\i18n-mobile-hub\en-GB\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4296_703809288\json\i18n-mobile-hub\pt-BR\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4296_703809288\json\i18n-shared-components\fi\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4296_703809288\json\wallet\wallet-stable.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4296_1299118694\hyph-or.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4296_703809288\json\i18n-notification\fi\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4296_1274769803\shopping.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4296_703809288\json\i18n-ec\es\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4296_703809288\Mini-Wallet\miniwallet.bundle.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4296_703809288\json\i18n-ec\ko\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4296_703809288\json\i18n-notification-shared\de\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4296_703809288\json\i18n-notification-shared\pt-BR\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4296_703809288\json\i18n-shared-components\pt-BR\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4296_1299118694\hyph-et.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4296_1274769803\edge_checkout_page_validator.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4296_703809288\hub-signature.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4296_703809288\json\i18n-ec\fi\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4296_703809288\wallet-webui-925.baa79171a74ad52b0a67.chunk.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4296_703809288\json\i18n-shared-components\sv\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4296_703809288\json\i18n-tokenized-card\ru\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4296_703809288\load-hub-i18n.bundle.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4296_1299118694\hyph-de-1901.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4296_1299118694\hyph-ta.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4296_290580263\Part-FR	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4296_703809288\json\i18n-mobile-hub\fr\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4296_703809288\json\i18n-shared-components\de\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4296_1415618585\edge_autofill_global_block_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4296_2084676667\well_known_domains.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4296_1299118694\hyph-eu.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4296_703809288\json\i18n-ec\th\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4296_717362407\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4296_703809288\json\i18n-shared-components\th\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4296_703809288\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4296_703809288\Tokenized-Card\tokenized-card.bundle.js.LICENSE.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4296_1299118694\hyph-und-ethi.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4296_290580263\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4296_703809288\json\i18n-mobile-hub\sv\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4296_703809288\json\i18n-shared-components\el\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4296_717362407\LICENSE	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2264884063-4143212895-593737147-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2264884063-4143212895-593737147-1000\{0EF8F44B-2E3B-4C82-8833-5F54FB7FFAC6}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2264884063-4143212895-593737147-1000\{D827F2EA-B8C4-46DA-9596-3BE3572C6883}	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4296	msedge.exe
4296	msedge.exe
2316	msedge.exe
2316	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4296	msedge.exe
4296	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2812	MiniSearchHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4296 wrote to memory of 4896	4296	msedge.exe	110
PID 4296 wrote to memory of 4896	4296	msedge.exe	110
PID 4296 wrote to memory of 1576	4296	msedge.exe	112
PID 4296 wrote to memory of 1576	4296	msedge.exe	112
PID 4296 wrote to memory of 4928	4296	msedge.exe	113
PID 4296 wrote to memory of 4928	4296	msedge.exe	113
PID 4296 wrote to memory of 4928	4296	msedge.exe	113
PID 4296 wrote to memory of 4928	4296	msedge.exe	113
PID 4296 wrote to memory of 4928	4296	msedge.exe	113
PID 4296 wrote to memory of 4928	4296	msedge.exe	113
PID 4296 wrote to memory of 4928	4296	msedge.exe	113
PID 4296 wrote to memory of 4928	4296	msedge.exe	113
PID 4296 wrote to memory of 4928	4296	msedge.exe	113
PID 4296 wrote to memory of 4928	4296	msedge.exe	113
PID 4296 wrote to memory of 4928	4296	msedge.exe	113
PID 4296 wrote to memory of 4928	4296	msedge.exe	113
PID 4296 wrote to memory of 4928	4296	msedge.exe	113
PID 4296 wrote to memory of 4928	4296	msedge.exe	113
PID 4296 wrote to memory of 4928	4296	msedge.exe	113
PID 4296 wrote to memory of 4928	4296	msedge.exe	113
PID 4296 wrote to memory of 4928	4296	msedge.exe	113
PID 4296 wrote to memory of 4928	4296	msedge.exe	113
PID 4296 wrote to memory of 4928	4296	msedge.exe	113
PID 4296 wrote to memory of 4928	4296	msedge.exe	113
PID 4296 wrote to memory of 4928	4296	msedge.exe	113
PID 4296 wrote to memory of 4928	4296	msedge.exe	113
PID 4296 wrote to memory of 4928	4296	msedge.exe	113
PID 4296 wrote to memory of 4928	4296	msedge.exe	113
PID 4296 wrote to memory of 4928	4296	msedge.exe	113
PID 4296 wrote to memory of 4928	4296	msedge.exe	113
PID 4296 wrote to memory of 4928	4296	msedge.exe	113
PID 4296 wrote to memory of 4928	4296	msedge.exe	113
PID 4296 wrote to memory of 4928	4296	msedge.exe	113
PID 4296 wrote to memory of 4928	4296	msedge.exe	113
PID 4296 wrote to memory of 4928	4296	msedge.exe	113
PID 4296 wrote to memory of 4928	4296	msedge.exe	113
PID 4296 wrote to memory of 4928	4296	msedge.exe	113
PID 4296 wrote to memory of 4928	4296	msedge.exe	113
PID 4296 wrote to memory of 4928	4296	msedge.exe	113
PID 4296 wrote to memory of 4928	4296	msedge.exe	113
PID 4296 wrote to memory of 4928	4296	msedge.exe	113
PID 4296 wrote to memory of 4928	4296	msedge.exe	113
PID 4296 wrote to memory of 4928	4296	msedge.exe	113
PID 4296 wrote to memory of 4928	4296	msedge.exe	113
PID 4296 wrote to memory of 4928	4296	msedge.exe	113
PID 4296 wrote to memory of 4928	4296	msedge.exe	113
PID 4296 wrote to memory of 4928	4296	msedge.exe	113
PID 4296 wrote to memory of 4928	4296	msedge.exe	113
PID 4296 wrote to memory of 4928	4296	msedge.exe	113
PID 4296 wrote to memory of 4928	4296	msedge.exe	113
PID 4296 wrote to memory of 4928	4296	msedge.exe	113
PID 4296 wrote to memory of 4928	4296	msedge.exe	113
PID 4296 wrote to memory of 4928	4296	msedge.exe	113
PID 4296 wrote to memory of 4928	4296	msedge.exe	113
PID 4296 wrote to memory of 4928	4296	msedge.exe	113
PID 4296 wrote to memory of 3784	4296	msedge.exe	114
PID 4296 wrote to memory of 3784	4296	msedge.exe	114
PID 4296 wrote to memory of 3784	4296	msedge.exe	114
PID 4296 wrote to memory of 3784	4296	msedge.exe	114
PID 4296 wrote to memory of 3784	4296	msedge.exe	114
PID 4296 wrote to memory of 3784	4296	msedge.exe	114
PID 4296 wrote to memory of 3784	4296	msedge.exe	114
PID 4296 wrote to memory of 3784	4296	msedge.exe	114
PID 4296 wrote to memory of 3784	4296	msedge.exe	114

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument http://noescape.exe
1⤵
PID:5024

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=29 --always-read-main-dll --field-trial-handle=3772,i,7464307188933850489,15236699521480268900,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:1
1⤵
PID:4780

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=28 --always-read-main-dll --field-trial-handle=4060,i,7464307188933850489,15236699521480268900,262144 --variations-seed-version --mojo-platform-channel-handle=4036 /prefetch:1
1⤵
PID:1552

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=30 --always-read-main-dll --field-trial-handle=4916,i,7464307188933850489,15236699521480268900,262144 --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:1
1⤵
PID:728

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --string-annotations --always-read-main-dll --field-trial-handle=5748,i,7464307188933850489,15236699521480268900,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:14
1⤵
PID:3472

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --string-annotations --always-read-main-dll --field-trial-handle=4864,i,7464307188933850489,15236699521480268900,262144 --variations-seed-version --mojo-platform-channel-handle=5740 /prefetch:14
1⤵
PID:1280

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=33 --always-read-main-dll --field-trial-handle=6132,i,7464307188933850489,15236699521480268900,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:1
1⤵
PID:4768

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=34 --always-read-main-dll --field-trial-handle=5188,i,7464307188933850489,15236699521480268900,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:1
1⤵
PID:1344

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=35 --always-read-main-dll --field-trial-handle=5552,i,7464307188933850489,15236699521480268900,262144 --variations-seed-version --mojo-platform-channel-handle=4548 /prefetch:1
1⤵
PID:688

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=36 --always-read-main-dll --field-trial-handle=6612,i,7464307188933850489,15236699521480268900,262144 --variations-seed-version --mojo-platform-channel-handle=6548 /prefetch:1
1⤵
PID:1460

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2812

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=37 --always-read-main-dll --field-trial-handle=6420,i,7464307188933850489,15236699521480268900,262144 --variations-seed-version --mojo-platform-channel-handle=4032 /prefetch:1
1⤵
PID:3196

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --string-annotations --always-read-main-dll --field-trial-handle=6840,i,7464307188933850489,15236699521480268900,262144 --variations-seed-version --mojo-platform-channel-handle=6908 /prefetch:14
1⤵
PID:704

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=40 --always-read-main-dll --field-trial-handle=6904,i,7464307188933850489,15236699521480268900,262144 --variations-seed-version --mojo-platform-channel-handle=6900 /prefetch:1
1⤵
PID:1652

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=41 --always-read-main-dll --field-trial-handle=7204,i,7464307188933850489,15236699521480268900,262144 --variations-seed-version --mojo-platform-channel-handle=7192 /prefetch:1
1⤵
PID:4668

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=42 --always-read-main-dll --field-trial-handle=7368,i,7464307188933850489,15236699521480268900,262144 --variations-seed-version --mojo-platform-channel-handle=7380 /prefetch:1
1⤵
PID:1380

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=43 --always-read-main-dll --field-trial-handle=7276,i,7464307188933850489,15236699521480268900,262144 --variations-seed-version --mojo-platform-channel-handle=6772 /prefetch:1
1⤵
PID:2060

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=44 --always-read-main-dll --field-trial-handle=7336,i,7464307188933850489,15236699521480268900,262144 --variations-seed-version --mojo-platform-channel-handle=7284 /prefetch:1
1⤵
PID:2772

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --string-annotations --always-read-main-dll --field-trial-handle=5996,i,7464307188933850489,15236699521480268900,262144 --variations-seed-version --mojo-platform-channel-handle=6780 /prefetch:14
1⤵
PID:2228

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=6356,i,7464307188933850489,15236699521480268900,262144 --variations-seed-version --mojo-platform-channel-handle=6712 /prefetch:14
1⤵
- Modifies registry class
PID:2088

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --string-annotations --always-read-main-dll --field-trial-handle=6664,i,7464307188933850489,15236699521480268900,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:12
1⤵
PID:4300

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=7748,i,7464307188933850489,15236699521480268900,262144 --variations-seed-version --mojo-platform-channel-handle=7708 /prefetch:14
1⤵
PID:492

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --string-annotations --always-read-main-dll --field-trial-handle=6804,i,7464307188933850489,15236699521480268900,262144 --variations-seed-version --mojo-platform-channel-handle=7568 /prefetch:14
1⤵
PID:2884

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=7516,i,7464307188933850489,15236699521480268900,262144 --variations-seed-version --mojo-platform-channel-handle=7628 /prefetch:14
1⤵
PID:2400

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.54 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.51 --initial-client-data=0x240,0x244,0x248,0x23c,0x250,0x7ffa2d7bf208,0x7ffa2d7bf214,0x7ffa2d7bf220
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1692,i,282055569974583329,10625635811750111544,262144 --variations-seed-version --mojo-platform-channel-handle=2520 /prefetch:11
  2⤵
  PID:1576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2536,i,282055569974583329,10625635811750111544,262144 --variations-seed-version --mojo-platform-channel-handle=2532 /prefetch:2
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2080,i,282055569974583329,10625635811750111544,262144 --variations-seed-version --mojo-platform-channel-handle=2692 /prefetch:13
  2⤵
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4364,i,282055569974583329,10625635811750111544,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:14
  2⤵
  PID:2600
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.51\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.51\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4252,i,282055569974583329,10625635811750111544,262144 --variations-seed-version --mojo-platform-channel-handle=4584 /prefetch:14
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.51\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.51\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4252,i,282055569974583329,10625635811750111544,262144 --variations-seed-version --mojo-platform-channel-handle=4584 /prefetch:14
  2⤵
  PID:2772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=4808,i,282055569974583329,10625635811750111544,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:1
  2⤵
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4732,i,282055569974583329,10625635811750111544,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:14
  2⤵
  PID:1292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5140,i,282055569974583329,10625635811750111544,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:14
  2⤵
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=5524,i,282055569974583329,10625635811750111544,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:3988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6060,i,282055569974583329,10625635811750111544,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:14
  2⤵
  PID:780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6032,i,282055569974583329,10625635811750111544,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:14
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6092,i,282055569974583329,10625635811750111544,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:14
  2⤵
  PID:740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6024,i,282055569974583329,10625635811750111544,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:14
  2⤵
  PID:3148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5336,i,282055569974583329,10625635811750111544,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:14
  2⤵
  PID:2772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=788,i,282055569974583329,10625635811750111544,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:14
  2⤵
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=784,i,282055569974583329,10625635811750111544,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=976,i,282055569974583329,10625635811750111544,262144 --variations-seed-version --mojo-platform-channel-handle=3284 /prefetch:14
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3852,i,282055569974583329,10625635811750111544,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:14
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3236,i,282055569974583329,10625635811750111544,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:14
  2⤵
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3876,i,282055569974583329,10625635811750111544,262144 --variations-seed-version --mojo-platform-channel-handle=3004 /prefetch:14
  2⤵
  PID:800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4464,i,282055569974583329,10625635811750111544,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:14
  2⤵
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5276,i,282055569974583329,10625635811750111544,262144 --variations-seed-version --mojo-platform-channel-handle=3208 /prefetch:14
  2⤵
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6108,i,282055569974583329,10625635811750111544,262144 --variations-seed-version --mojo-platform-channel-handle=3836 /prefetch:14
  2⤵
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6028,i,282055569974583329,10625635811750111544,262144 --variations-seed-version --mojo-platform-channel-handle=3812 /prefetch:14
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4072,i,282055569974583329,10625635811750111544,262144 --variations-seed-version --mojo-platform-channel-handle=3020 /prefetch:14
  2⤵
  PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5152,i,282055569974583329,10625635811750111544,262144 --variations-seed-version --mojo-platform-channel-handle=4124 /prefetch:14
  2⤵
  PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3164,i,282055569974583329,10625635811750111544,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:14
  2⤵
  PID:3360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6016,i,282055569974583329,10625635811750111544,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:14
  2⤵
  PID:568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4068,i,282055569974583329,10625635811750111544,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:14
  2⤵
  PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3928,i,282055569974583329,10625635811750111544,262144 --variations-seed-version --mojo-platform-channel-handle=4084 /prefetch:14
  2⤵
  PID:3168

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.51\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.51\elevation_service.exe"
1⤵
PID:3868

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /c
1⤵
- System Location Discovery: System Language Discovery
PID:3760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.11\autofill_bypass_cache_forms.json

Filesize
127B

MD5
22e4cc4c0eb6444f7cae2aa35a707227

SHA1
86fd42f17be0b1fa10b170cfe18d49930ed35044

SHA256
e409a4f42c50d8fc80facaad15b807779658fc97b01c871d0820577dd8f334b7

SHA512
a3e41584d8d2dab323a4846321658f759573ba694e877a8e4abb7ec08d30213db509a64bdf1b561491faf9aed5cb31be2481d505f4ef56838e5df6e1e6c820d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.11\edge_autofill_global_block_list.json

Filesize
4KB

MD5
ba6dff9e296c4dab26f3f61893502cbb

SHA1
02b6bb7ef39485c2aac70038c1555d09632e8414

SHA256
4576e2d9e040c1dba48610bb4b41c117aa1858c3de0ad26cdcd3700323b168f4

SHA512
8e72310fe5bf20c3716bb6dcfd119e2904ca0eb0d12e67669e656aedf023f078d897b5db577023068d2f0222168f2c99d64acefb1ec1e8e9116fa78e9e2e9c7b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.11\v1FieldTypes.json

Filesize
508KB

MD5
cd06b9c4c48d11822b3da15dd9013e00

SHA1
a8d5d806934910a16b182c733e970eb659815e92

SHA256
115809f84bb33369cbecb8ac91b38dadfc387b1c350b4fbdc4497dba0979005e

SHA512
5c79e4077995aed7138d53e38953d3dca1f2ca5de5b50a0d5d5925b5517f3fcbcfc5affbd07ee875a8a3f39485f3f43ee4a4ce38736daa973882b903f2d45deb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Filesize
331B

MD5
1a8544e4f3a52d3a27575414ffef52bb

SHA1
91c1cc9456311d9a905d1118b5e3e4eddb71425b

SHA256
21f88811e530d7e98a4e22d97eee42dbb5fbf367d4cc09cc2211d27b689776f0

SHA512
a74a8ccac5d2186b372f235abc32fa00b567ac937de991bd6854db96e24c8509ed0bde7c7fe4eac4c94b5d342a70b89fb3c62eb3d013a08ec3852d2c47bc573e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old

Filesize
334B

MD5
00e96d09117155656bc5c177a218e94c

SHA1
d92155c478a1ff74eb95d55e137d6dde40944b17

SHA256
d04eecca9e8e6de0969da2e489987c95f845ccec08e44fc10ab247f1332b55be

SHA512
5b40ebf26e95a5c4d123ad058ab3a9272db672caf3017277650a47020f8c2d08e6b0e76a40a318e8dd74d4577d87878905f6c4dc842db58c43eba6653efb78eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old

Filesize
331B

MD5
411cceaf9dbd44ec0743f55869e0fcdb

SHA1
1be70ed887976d4dad3b758f53a9d51efaef84e6

SHA256
0a1c96dc9ff94a3aa482f2df3db70fd63b5eb70fb2dac71593bd318f7a9ce0d7

SHA512
4d62dc4b8b33a0acb8047fb6a474fd8030cf869fb281070407c1d71192213b3888ecd123cbf53a3c993eb1be7f8bc33db7666e07ccdee8eff3e47c47fd166aaf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
9KB

MD5
c05a7b2193d5cc93ec7b435ba5486921

SHA1
21fb937c159eda2cd92696c105d57eb4b094de6e

SHA256
5bef1aec4728abc5029340206db72ffc47d5d1e5ed9e480ae8c4c8cf9005a08a

SHA512
779616ddf26124fe44daae3d241418ea78906485656c0b732d18c7e334ed488917e967bf8894c3296481e1de9b3ea7fb54d2dddfd54c41eb6cad9e5da80d5444

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\MANIFEST-000001

Filesize
23B

MD5
3fd11ff447c1ee23538dc4d9724427a3

SHA1
1335e6f71cc4e3cf7025233523b4760f8893e9c9

SHA256
720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed

SHA512
10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
10KB

MD5
a545c5a34bcaa9535dd92f17b7bde331

SHA1
6d80f0c605a26b8591aa7d2ba487da5bd4e02dac

SHA256
4570b0a439b946e718780b69f6c966a65958e7155ecca57b9cdd94c4ed336fbe

SHA512
c3f3df6c70ff5fea9830069e2aca67da2b11ff59dad221ff7c08ad8e71468c372eda2c920260c7d2c39c477856f5d6100acb97f3ad743ef32e3ef79663176233

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
211B

MD5
3f56cd69dc0a29eb54a0d1f8d3973592

SHA1
e1acbe39d2642df425e7ddb3ba528402acbe7f5e

SHA256
339b4f8b77d5752e54a08f505dc09a1404c4dea3e88ee57fbf2727cea4bf8f32

SHA512
437ef9a0d83ba0487c3e3bb9c2c1425d2caa4ed92a1d0fc310bc655acc7e8485709bffe6a1443ff7ae03a834fc3d7687b6819b0105553f814cb44ea9dcdfb240

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity

Filesize
6KB

MD5
83ef2abc08a296037ba95c7c972ea31b

SHA1
a0d963a230ace311215a9179dd717e62b8a509e1

SHA256
b255415781330e47dc734adfe1c72832926a4b53a3ce7effb5a1609b74c839eb

SHA512
95e2833739ff87099bf6055bcaf1be55e8e9d5d5afd82051c7664b2e4ad1dc98544019df86f81cd8ed5f553202555378aef5dd792725592adaece136c988be0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
19KB

MD5
30497263363bc2eaaaec618c1b8d7454

SHA1
5cc60d22392a82201ce96a7e2edc18275b3a4830

SHA256
1aaaa6313f2781727c113352a9d5657322067942260386360ba6580680c7402e

SHA512
90d6fac5621a7866c1f33fced1c9eeb9764def5f5a1edb237ecaab5b9b2039306cda2bbd978b9001e2eed496cadf824d484d206d719a1a930913132979e0b6f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
37KB

MD5
b2cc91fa91b472cb9587ddc7462bb03d

SHA1
f36002da19ae9f0b38188dcb46257ebc17e85cf4

SHA256
7bdff34601cffeafeee499bc466f0d1d3665dc43d6e3b6332ab45abee8398437

SHA512
b2f0c68c6a3d4295207f7778be3afbe743704b7b04192218b4a582b88d96e274ef4115d545647647f92caf8539bb9a8cc2adf2b51036f8d5498e64249012f994

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\37c736a3-f7ab-4910-a1ec-ec1f42458e82\index-dir\the-real-index

Filesize
72B

MD5
d8ea57b7f62dc6099b077fe2d0d63f2c

SHA1
60b606beca2eafefc7b6d1e8ad8275adda4835bb

SHA256
af4428ad48a6b0773ac903f199caed28ece93ef2121aa4cc2a38d3cc1575e4e5

SHA512
214103684e3f9aac8208856bc6ba2f94c49cf737c2398580460114b623bc892cb4feaa6d1802d164f184a55ea3958f98a976b1393491c1ff8c4ce51da697e65d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\37c736a3-f7ab-4910-a1ec-ec1f42458e82\index-dir\the-real-index~RFe5c74ca.TMP

Filesize
48B

MD5
bd3c6de6eed5b9d42d7d6b159bd4d9bf

SHA1
84044b5c3ffec79e13aa358a6eb30fb5dd4f6cab

SHA256
c3d7648eae66dbfc63e98d6692161e38cbd811c41e58c1fac8cbb5e24d46a054

SHA512
fcaf349f9b4a26450cb74cc4be3d67020e09b0a6089a6809ca3c24aa00da414685d880ae7d0940e7fed41805c61e554959e72573f68c29f7e4991cc62b314efd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\adcdac53-cc38-4d68-bfbc-9c8658539f6e\index-dir\the-real-index

Filesize
72B

MD5
06ec2c406a0305eebbc58b15ec5ee6e1

SHA1
7987443e3eb14ad42c11cfa578966839e181cdb1

SHA256
17d107ea3feed08ffecbae51fa51ef2160a61c0357a188d77c504d488719ca61

SHA512
6d999b371b354bfcfc61bcd11d48acec37316789359a023b1431af6de3418e003cfd99806930242ca4287183ec634f6a6040150fe42d0e3f6a75788d2bbff612

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt

Filesize
322B

MD5
a1a55a72818d0e06e8202881ddd57679

SHA1
8b7fbebf7f8fd37e2f91466f07a951a9a1b4d775

SHA256
00fe29b9dab41d76683eb0a92493e0b17e2061d56bacd00c3255ee5808c02035

SHA512
a1d7e379490269e8a468bf2afc77f5d04f243803924c6e2c16d2d6d01f4d59e62c1932e23f36570ebdd3466ddb734268fc4801db769a0e4e61263f5037256c86

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt

Filesize
327B

MD5
31da25bc56e769b78d189f8ec53c14ed

SHA1
c16b72dc4c70d4992319bfeb8c1da6b3891343eb

SHA256
7c7e9fabf1de48798e1cdcdfc930a71412db56524a777d725b3f13d217a5d8d2

SHA512
b0904a09bbcd0cf9bf49fc00350a8f7bcd6c31e80daa41355dbe0f3be63bd7d173b09972bf48c4d618c5e18e367565d3e5efd4a704c80b6c97de5c0c8f387a4d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
5KB

MD5
564d08ecea930976734cddd1d8237a55

SHA1
a24384974d61953c99622ce01ea9f32255429eee

SHA256
0c5d98847cf248ab350a58c30d4f4e262df086ba3fb20db7f65bc20e9831a257

SHA512
c2ac29e7cc673e06556039f2529b5247cfa9766273308e5dfef9ef8f5daf3204b77d8a3efac8be1ea3c88b36508a7799095c7a235b8cd9d987699087046d7813

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.3.7\data.txt

Filesize
111KB

MD5
05c4968bfc69b92c33c8eb47ca6f59c2

SHA1
26c96b098018e7580db319d986ca23f0474456c1

SHA256
af2410513c196d701846439ea132710f5cb20116d83e2155c81c856a489707c4

SHA512
010456c3d0f336edb6bf78ca12bf4bb25662f1dcad3e7c699020db34a93e39aba4ba25b5a621e45a0448b7ce4526715e79d6f42375961820f368c1d69db57942

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
460B

MD5
0ec5858df2459df6a7c8ba8d4a02f9f6

SHA1
601b4b9856607625f9c526e096c387d36caf0510

SHA256
2f6188694cd3a92502fcf42d797ff646b592c91ef8fe8f9c95adf1a4ef9177dd

SHA512
ca9a7a2b619d54bbfa35cb944556272dcdb2c18be0a270461a891ae2abc12649bccbbc149ce476d7255b48343b3e7682edb45636811ec1e27775d618bdd98c89

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18315.18303.1\json\wallet\wallet-checkout-eligible-sites.json

Filesize
23KB

MD5
16d41ebc643fd34addf3704a3be1acdd

SHA1
b7fadc8afa56fbf4026b8c176112632c63be58a0

SHA256
b962497993e2cd24039474bc84be430f8f6e6ab0f52010e90351dc3ff259336c

SHA512
8d58aa30613a2376ccc729278d166a9b3ec87eca95544b9dec1ee9300e7dd987326ea42d05dca3f1cc08186685f2fdaf53c24fd2b756c1ed9f2b46436689dc74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18315.18303.1\json\wallet\wallet-notification-config.json

Filesize
804B

MD5
4cdefd9eb040c2755db20aa8ea5ee8f7

SHA1
f649fcd1c12c26fb90906c4c2ec0a9127af275f4

SHA256
bb26ce6fe9416918e9f92fcc4a6fe8a641eceea54985356637991cf6d768f9fd

SHA512
7e23b91eab88c472eec664f7254c5513fc5de78e2e0151b0bcc86c3cd0bf2cb5d8bb0345d27afdd9f8fcb10be96feaa753f09e301fa92b8d76f4300600577209

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18315.18303.1\json\wallet\wallet-stable.json

Filesize
81KB

MD5
2e7d07dadfdac9adcabe5600fe21e3be

SHA1
d4601f65c6aa995132f4fce7b3854add5e7996a7

SHA256
56090563e8867339f38c025eafb152ffe40b9cfa53f2560c6f8d455511a2346a

SHA512
5cd1c818253e75cc02fccec46aeb34aeff95ea202aa48d4de527f4558c00e69e4cfd74d5cacfcf1bcd705fe6ff5287a74612ee69b5cc75f9428acfbdb4010593

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18315.18303.1\json\wallet\wallet-tokenization-config.json

Filesize
34KB

MD5
ae3bd0f89f8a8cdeb1ea6eea1636cbdd

SHA1
1801bc211e260ba8f8099727ea820ecf636c684a

SHA256
0088d5ebd8360ad66bd7bcc80b9754939775d4118cb7605fc1f514c707f0e20d

SHA512
69aff97091813d9d400bb332426c36e6b133a4b571b521e8fb6ad1a2b8124a3c5da8f3a9c52b8840152cf7adbd2ac653102aa2210632aa64b129cf7704d5b4fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
51KB

MD5
7dbac9b61cbaca6a3217cd1fa037406a

SHA1
75ca5598ff809e74b37a514156057967ebc86fdf

SHA256
5e0cd2ea1c0827da662b47500d4963d11fcd5d732485e3a7f3743da243771cdf

SHA512
abd090e46e0802caf976c0333d4621a7a65577859ff4649ad8c27f247b23546423d6f748a4c005461913108ac79b78a868cded6c659d8af64c6354c0d1f34618

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
112KB

MD5
7664a7cd6e8143cc5e0c11c32539e1d9

SHA1
463cfc87918ade14006aa52f6f9d94948e875a41

SHA256
c280f4b725ac607983ff885e8e1e28f0749f43f193430299cd65430cac7a2900

SHA512
c90d15f7fc46352c52869e5fa872f076cb194ff044b32cc034fe7ee6c8ad3a14d2fe969e0414d453ad97e0ce95bc57aa51d0cf40f49406abf05ee9ff2ee0604d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\21.0.0.0\crs.pb

Filesize
289KB

MD5
24a3775317d74ceea8fba6f0cfbce562

SHA1
fed5009eb51938d0894a9bb7aee8a97873d9b6f3

SHA256
192b206ad6f649f6c8767f6a3b11d9c5354710602bf0aeb4157eea08d7461ef7

SHA512
245951359283bff026aad50f7768a9aa59c1926ca7aa441c8f6a3715be34925332eeef4115a442a7841429400105d59d13937ee3aa9b80e83f1982893aefaa8e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\21.0.0.0\ct_config.pb

Filesize
10KB

MD5
09b6469de61db3473bdfe04951f08529

SHA1
d64b455ae9c65d8d8629a128a9f3505ef3df3555

SHA256
1c435f4448dcf1784637fa9470546d12d7db2420a11cf8b5d6343439dd401c60

SHA512
049d3c0e05aa3ab1d4d51cc5bd72603f47aa33141bf771cb86baedc19b8973911445ce74256ff1118483175cf4a104262a22ae9431a6366cbd1f7d28553fcbb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\21.0.0.0\kp_pinslist.pb

Filesize
11KB

MD5
2d8bcb7c4b2dc669429bd40f7048f62a

SHA1
43a332c99105dcfb67893ea167879c3ce6bac8db

SHA256
7a0866cdd7bd21b8b08d166edb3f6adf8c859b47988b9b3ba3f0eaafabe10ff2

SHA512
15d3c7c6df2c3c75daf7ea9165687c5a6f8acac3dfe83573e20aa1bd425dde8fc659fc2c1b050b3e8ddb28358a96b9e0c083e61fa5d63ae34fa4b0bb63db8a76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SafetyTips\3057\safety_tips.pb

Filesize
163KB

MD5
bd6846ffa7f4cf897b5323e4a5dcd551

SHA1
a6596cdc8de199492791faa39ce6096cf39295cd

SHA256
854b7eb22303ec3c920966732bc29f58140a82e1101dffe2702252af0f185666

SHA512
aa19b278f7211ffaf16b14b59d509ce6b80708e2bb5af87d98848747de4cba13b6626135dd3ec7aabd51b4c2cfb46ed96800a520d2dae8af8105054b6cd40e0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SafetyTips\3057\typosquatting_list.pb

Filesize
3KB

MD5
17c10dbe88d84b9309e6d151923ce116

SHA1
9ad2553c061ddcc07e6f66ce4f9e30290c056bdf

SHA256
3ad368c74c9bb5da4d4750866f16d361b0675a6b6dc4e06e2edd72488663450e

SHA512
ad8ed3797941c9cad21ae2af03b77ce06a23931d9c059fe880935e2b07c08f85fc628e39873fb352c07714b4e44328799b264f4adb3513975add4e6b67e4a63c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.57\Filtering Rules

Filesize
1.8MB

MD5
d7c9c6d2e1d9ae242d68a8316f41198c

SHA1
8d2ddccc88a10468e5bffad1bd377be82d053357

SHA256
f215127185b2ee6b01e12b6ca75d3e5c4e454598dd4aed36124ae13d59afd547

SHA512
7fd14824e9200dd99e1fd2cee402656dc0cfc3d0a60058c5eb05c68e9e65b7f0b47e550fb4d6c2b59eba204dbf3ef9e69dc9723b43a9b3ccd5412d6b77715fc3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.57\LICENSE

Filesize
24KB

MD5
aad9405766b20014ab3beb08b99536de

SHA1
486a379bdfeecdc99ed3f4617f35ae65babe9d47

SHA256
ed0f972d56566a96fb2f128a7b58091dfbf32dc365b975bc9318c9701677f44d

SHA512
bd9bf257306fdaff3f1e3e1fccb1f0d6a3181d436035124bd4953679d1af2cd5b4cc053b0e2ef17745ae44ae919cd8fd9663fbc0cd9ed36607e9b2472c206852

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2025.2.7.1\typosquatting_list.pb

Filesize
636KB

MD5
25bfe370f5efb2bde147623efb00d829

SHA1
b80e7712cef21ba9d6a54bd8b7548a81b28c70c0

SHA256
9af4896edd5d0a6f25d090ea694ccf70180c881bdd2f357dded1021860730ba9

SHA512
f793e016bf4e76fefc6660ae4a6514c654b74c0307839d36cc22d1eacff564e79d08239185913f2489e0698922b1aa856b6cd9316cfac957819550aaab826e04

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Well Known Domains\1.1.0.0\well_known_domains.dll

Filesize
556KB

MD5
26da22c7706cdcd809c380207c7b2246

SHA1
96ce397cc80b5a39319c34cadcf19e36e6a90b77

SHA256
87b9a43450a28f41a933817d10f064401d4c58ec2dbd85d8b1d843685d46c29c

SHA512
22d7a38f558f0069b17fabcb33ffae288470b93f31180d728629206838f6f0ac0dfe916d70ce6fc7697bc9fabe1d9c515716abacd3231aed83d3cfc42bd265e7

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
24KB

MD5
0d5902a7e82334ae80277e9fb0951c33

SHA1
7b6309243e0690660162b017eae8473935807f33

SHA256
afbb24d5d447c96d17f9acd2ec5b5db389141f32cb7490bd09f16dbb38dd8714

SHA512
acb2281af6760b9a8d6c30cea9d9508eacdc793d4b8e3792ddce2ddd1e25d885dd5cb03a78467de381f1d9c2b69d74fa7288718c5661ee4834ef8bd207f4e376

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
24KB

MD5
b909a595c670ab8cbdf5ba23aab40312

SHA1
03a9deee55008aca2022649edb92543742f32f56

SHA256
3c7fa051ea1aa518d28dde2459b3c2ccc4b78bcd55fcabb642d0b584b806c3fc

SHA512
c5a1679cf3acdfdd4722abe3bd725741c2ca7cb3faeac4201633aebf73610774167d175ec16ac1954f73d61ba2f14eafdda9c5d0e53158969c093b64439ba19c

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4296_1262425453\manifest.json

Filesize
117B

MD5
e48c4f77b37f13dff9d2eaa4ee1c7489

SHA1
d39ef4c4ec13c3dbda21ff5c49dc5fa31938d2d6

SHA256
e9d16eef9dfead62668fcc18d4c6c3ac245232103976cb71e0775840fa595284

SHA512
b742e4c16347fdaed34911ac9770fc209fd32f6682a7eb928edae751982fcda2446926a2eed4f9d2ca3c93346b05d2d0d3dd4dffdc72a588ce60d545b172a5df

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4296_1274769803\manifest.json

Filesize
144B

MD5
e06f2c2efc96df683011cdb15aaa1732

SHA1
9efa7fea72424217ad9913ed248fdf80a68005cd

SHA256
d22a0ed37d657f2f464a40b008dd71490c1677ef741f75264cc7bfb739e74f5e

SHA512
9bcce229fd228f0db6d1044352cfcd8fd6d84b71a021d77aeb888a195deeb5474820e62ad0ac82c26eb0fe5769b5c5b9090714a0bdcf6fc0c1c00a8273a43e22

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4296_1299118694\hyph-as.hyb

Filesize
703B

MD5
8961fdd3db036dd43002659a4e4a7365

SHA1
7b2fa321d50d5417e6c8d48145e86d15b7ff8321

SHA256
c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe

SHA512
531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4296_1299118694\hyph-hi.hyb

Filesize
687B

MD5
0807cf29fc4c5d7d87c1689eb2e0baaa

SHA1
d0914fb069469d47a36d339ca70164253fccf022

SHA256
f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42

SHA512
5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4296_1299118694\hyph-nb.hyb

Filesize
141KB

MD5
677edd1a17d50f0bd11783f58725d0e7

SHA1
98fedc5862c78f3b03daed1ff9efbe5e31c205ee

SHA256
c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0

SHA512
c368f6687fa8a2ef110fcb2b65df13f6a67feac7106014bd9ea9315f16e4d7f5cbc8b4a67ba2169c6909d49642d88ae2a0a9cd3f1eb889af326f29b379cfd3ff

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4296_1299118694\manifest.json

Filesize
82B

MD5
2617c38bed67a4190fc499142b6f2867

SHA1
a37f0251cd6be0a6983d9a04193b773f86d31da1

SHA256
d571ef33b0e707571f10bb37b99a607d6f43afe33f53d15b4395b16ef3fda665

SHA512
b08053050692765f172142bad7afbcd038235275c923f3cd089d556251482b1081e53c4ad7367a1fb11ca927f2ad183dc63d31ccfbf85b0160cf76a31343a6d0

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4296_1415618585\manifest.json

Filesize
119B

MD5
3b8fa87dfecb85a606d197067eb99971

SHA1
f92f885aa8efbe54b8c2f852e28de7d1fead0b89

SHA256
c1ee1af4d64a32ab3fb74eb02d1bbe642226df693a66231a7caf03c4475c356c

SHA512
be6e229c0b49d0dbf5c3b85b03b91690e83cb46e867b639a626fab3a23e7af263b588c0ee4e2ae92e9013942409a08f721a614fda29efb267f0dc107085aee33

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4296_1545330848\manifest.json

Filesize
72B

MD5
a30b19bb414d78fff00fc7855d6ed5fd

SHA1
2a6408f2829e964c578751bf29ec4f702412c11e

SHA256
9811cd3e1fbf80feb6a52ad2141fc1096165a100c2d5846dd48f9ed612c6fc9f

SHA512
66b6db60e9e6f3059d1a47db14f05d35587aa2019bc06e6cf352dfbb237d9dfe6dce7cb21c9127320a7fdca5b9d3eb21e799abe6a926ae51b5f62cf646c30490

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4296_1742048487\manifest.json

Filesize
102B

MD5
2c2e90b63e0f7e54ffc271312a3d4490

SHA1
4eb9d97e1efc368420691acb2e6df1c61c75f7e4

SHA256
72dbb7d6b647b664ef64b6a14771c2549c979b9c57712f3f712966edb02d7b2e

SHA512
9ec9e8a34cc56a694ac845a4344600b479d11347ec5279d955ab4cf55590440f3491e0a1b635ddb9db821630885e5fd63c269fc2a5d1abd0a0d0062ae21dea8b

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4296_2025854739\manifest.json

Filesize
52B

MD5
6239ae2395a0e4693b83b55a9ea7e4cb

SHA1
3e8ee140eac2a4c186a383f0cc18e93ab4305481

SHA256
972dcc1255535bb40d6750f0055a0c9634e24e7c583e4d3eea32a8838b66509c

SHA512
ecc75e6e2fcfb6f2fa5cda218d23060bffc84baa9e6bafc97b38f8e36ba310edf8eb4f4b6e00cfa4da8a0e42f53de2a57565444aca64bd9d936ec1f130bb4829

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4296_2084676667\manifest.json

Filesize
141B

MD5
7fc35acd7d8d39e1fb4f00505457ad51

SHA1
a1eba8dd6af26ca1ecf3cef206d25ac5820b12e1

SHA256
5836b1580379a2bfcd6f9cce977fb57c321f5762e5f08ec8ae3604db0226af6e

SHA512
f49b651d47a618761cf713c5a0ada20c57e7740ed5a83aa58235d7d1e5bf730fa62986443e5b16592739b32b800a24b21aea3c07c3910e14ae37b3d28a7283a0

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4296_281403465\manifest.json

Filesize
76B

MD5
ba25fcf816a017558d3434583e9746b8

SHA1
be05c87f7adf6b21273a4e94b3592618b6a4a624

SHA256
0d664bc422a696452111b9a48e7da9043c03786c8d5401282cff9d77bcc34b11

SHA512
3763bd77675221e323faa5502023dc677c08911a673db038e4108a2d4d71b1a6c0727a65128898bb5dfab275e399f4b7ed19ca2194a8a286e8f9171b3536546f

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4296_290580263\manifest.json

Filesize
116B

MD5
2188c7ec4e86e29013803d6b85b0d5bb

SHA1
5a9b4a91c63e0013f661dfc472edb01385d0e3ce

SHA256
ac47cc331bb96271da2140941926a8accc6cb7599a6f3c17bd31c78f46709a62

SHA512
37c21eaff24a54c2c7571e480ff4f349267e4404111508f241f54a41542ce06bcde4c830c6e195fc48d1bf831ed1fe78da361d1e43416cfd6c02afa8188af656

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4296_702687439\crl-set

Filesize
21KB

MD5
846feb52bd6829102a780ec0da74ab04

SHA1
dd98409b49f0cd1f9d0028962d7276860579fb54

SHA256
124b7eeba31f0e3d9b842a62f3441204beb13fade81da38b854aecba0e03a5b4

SHA512
c8759e675506ccc6aa9807798252c7e7c48a0ab31674609738617dc105cee38bce69d4d41d6b95e16731466880b386d35483cbeea6275773f7041ba6e305fae9

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4296_702687439\manifest.json

Filesize
114B

MD5
e6cd92ad3b3ab9cb3d325f3c4b7559aa

SHA1
0704d57b52cf55674524a5278ed4f7ba1e19ca0c

SHA256
63dfb8d99ce83b3ca282eb697dc76b17b4a48e4065fc7efafb77724739074a9d

SHA512
172d5dc107757bb591b9a8ed7f2b48f22b5184d6537572d375801113e294febfbe39077c408e3a04c44e6072427cbe443c6614d205a5a4aa290101722e18f5e8

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4296_703809288\Notification\notification_fast.bundle.js.LICENSE.txt

Filesize
551B

MD5
7bf61e84e614585030a26b0b148f4d79

SHA1
c4ffbc5c6aa599e578d3f5524a59a99228eea400

SHA256
38ed54eb53300fdb6e997c39c9fc83a224a1fd9fa06a0b6d200aa12ea278c179

SHA512
ca5f2d3a4f200371927c265b9fb91b8bcd0fbad711559f796f77b695b9038638f763a040024ed185e67be3a7b58fab22a6f8114e73fdbd1cccdda6ef94ff88f3

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4296_703809288\Tokenized-Card\tokenized-card.bundle.js.LICENSE.txt

Filesize
1KB

MD5
8595bdd96ab7d24cc60eb749ce1b8b82

SHA1
3b612cc3d05e372c5ac91124f3756bbf099b378d

SHA256
363f376ab7893c808866a830fafbcd96ae6be93ec7a85fabf52246273cf56831

SHA512
555c0c384b6fcfc2311b47c0b07f8e34243de528cf1891e74546b6f4cda338d75c2e2392827372dc39e668ed4c2fd1a02112d8136d2364f9cab9ee4fa1bd87f5

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4296_703809288\json\i18n-tokenized-card\fr-CA\strings.json

Filesize
2KB

MD5
cd247582beb274ca64f720aa588ffbc0

SHA1
4aaeef0905e67b490d4a9508ed5d4a406263ed9c

SHA256
c67b555372582b07df86a6ce3329a854e349ba9525d7be0672517bab0ac14db5

SHA512
bf8fa4bd7c84038fae9eddb483ae4a31d847d5d47b408b3ea84d46d564f15dfc2bae6256eac4a852dd1c4ad8e58bc542e3df30396be05f30ed07e489ebe52895

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4296_703809288\manifest.json

Filesize
121B

MD5
329a59de8d95eee302c1c28aacf4e1fe

SHA1
9f9504aa0ac8d32668c0c825662ec82b93d19f47

SHA256
2912fd71a8be8d44b12962b42d5e08015f22333419a0707f1a918f5650347c30

SHA512
83744125c835293caab50a061aebe9d479e8bc231c3dac3e963ae48a07d3003452aa9e83ffa65e5ca3cdf67a623d0d3f9c29f8df4e24e40ce5a5d0e7646012d9

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4296_732375723\manifest.json

Filesize
238B

MD5
15b69964f6f79654cbf54953aad0513f

SHA1
013fb9737790b034195cdeddaa620049484c53a7

SHA256
1bdda4a8fc3e2b965fbb52c9b23a9a34871bc345abfb332a87ea878f4472efbd

SHA512
7eeee58e06bba59b1ef874436035202416079617b7953593abf6d9af42a55088ab37f45fdee394166344f0186c0cb7092f55ed201c213737bb5d5318e9f47908

Download Submit