hxxps://drive[.]google[.]com/drive/folders/1hljtWr52piwbXZfcvI9eC8LoALi5SHGi?usp=sharing

Analysis

max time kernel
877s
max time network
868s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20250314-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250314-enlocale:en-usos:windows10-ltsc_2021-x64system
submitted
03/04/2025, 20:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/drive/folders/1hljtWr52piwbXZfcvI9eC8LoALi5SHGi?usp=sharing

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
4552	msedge.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 14 IoCs

Web Service

T1102

flow	ioc
183	drive.google.com
209	drive.google.com
227	drive.google.com
228	drive.google.com
315	drive.google.com
316	drive.google.com
12	drive.google.com
21	drive.google.com
182	drive.google.com
210	drive.google.com
269	drive.google.com
270	drive.google.com
11	drive.google.com
38	drive.google.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_1435103164\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_1435103164\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_855825034\hyph-ml.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_1442313687\json\i18n-notification-shared\zh-Hans\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_1442313687\json\i18n-tokenized-card\it\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_1442313687\Mini-Wallet\miniwallet.bundle.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_1442313687\Notification\notification.bundle.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_1442313687\vendor.bundle.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_748719995\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_1435103164\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_1435103164\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_1435103164\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_1092842133\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_10709302\deny_full_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_855825034\hyph-de-1996.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_1442313687\json\i18n-ec\zh-Hant\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_855825034\hyph-es.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_1442313687\json\i18n-notification\sv\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_1442313687\json\i18n-notification-shared\sv\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_1442313687\json\i18n-shared-components\sv\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_1435103164\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_1435103164\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_978497410\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_1442313687\json\i18n-shared-components\de\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_855825034\hyph-nb.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_1442313687\bnpl\bnpl.bundle.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_1442313687\json\i18n-hub\pl\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_1442313687\wallet.bundle.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_1435103164\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_855825034\hyph-pa.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_855825034\hyph-ru.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_1396398539\Part-RU	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_459843560\edge_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_1442313687\Tokenized-Card\tokenized-card.bundle.js.LICENSE.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_1435103164\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_1435103164\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_1435103164\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_855825034\hyph-be.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_855825034\hyph-cy.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_459843560\edge_tracking_page_validator.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_1442313687\json\i18n-ec\fr\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_1435103164\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_855825034\hyph-da.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_855825034\hyph-it.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_855825034\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_1442313687\json\i18n-ec\fi\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_1442313687\json\i18n-ec\it\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_1442313687\json\i18n-shared-components\cs\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_1442313687\json\i18n-shared-components\fr-CA\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_1435103164\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_1728254404\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_1396398539\adblock_snippet.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_1442313687\json\i18n-mobile-hub\id\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_1442313687\json\i18n-tokenized-card\nl\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_1435103164\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_748719995\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_1826322266\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_459843560\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_1442313687\json\i18n-hub\fr\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_1442313687\json\i18n-hub\pt-BR\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_1442313687\json\i18n-hub\ru\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_1442313687\json\i18n-shared-components\da\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_1435103164\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_1055464854\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133881846011939095"	msedge.exe

Modifies registry class 12 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1709934376-1871646940-4254144759-1000_Classes\discord-712465656758665259\URL Protocol	yuzu.exe
Key created	\REGISTRY\USER\S-1-5-21-1709934376-1871646940-4254144759-1000_Classes\discord-712465656758665259\shell\open\command	yuzu.exe
Key created	\REGISTRY\USER\S-1-5-21-1709934376-1871646940-4254144759-1000_Classes\discord-712465656758665259\shell\open	yuzu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1709934376-1871646940-4254144759-1000_Classes\discord-712465656758665259\shell\open\command\ = "C:\\Users\\Admin\\Downloads\\ARCHIVE-20250403T201010Z-001\\ARCHIVE\\Uncompressed yuzu\\Yuzu for windows\\yuzu-windows-msvc\\yuzu.exe"	yuzu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1709934376-1871646940-4254144759-1000_Classes\discord-712465656758665259\ = "URL:Run game 712465656758665259 protocol"	yuzu.exe
Key created	\REGISTRY\USER\S-1-5-21-1709934376-1871646940-4254144759-1000_Classes\discord-712465656758665259\DefaultIcon	yuzu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1709934376-1871646940-4254144759-1000_Classes\discord-712465656758665259\DefaultIcon\ = "C:\\Users\\Admin\\Downloads\\ARCHIVE-20250403T201010Z-001\\ARCHIVE\\Uncompressed yuzu\\Yuzu for windows\\yuzu-windows-msvc\\yuzu.exe"	yuzu.exe
Key created	\REGISTRY\USER\S-1-5-21-1709934376-1871646940-4254144759-1000_Classes\discord-712465656758665259\shell	yuzu.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1709934376-1871646940-4254144759-1000\{2DB7182F-DBAB-435B-9248-0833F187CB58}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1709934376-1871646940-4254144759-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1709934376-1871646940-4254144759-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1709934376-1871646940-4254144759-1000_Classes\discord-712465656758665259	yuzu.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
2380	yuzu.exe
2380	yuzu.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5040	msedge.exe
5040	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2380	yuzu.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeRestorePrivilege	5152	7zG.exe
Token: 35	5152	7zG.exe
Token: SeSecurityPrivilege	5152	7zG.exe
Token: SeSecurityPrivilege	5152	7zG.exe
Token: 33	1220	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1220	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1968	OpenWith.exe
2380	yuzu.exe
2380	yuzu.exe
2380	yuzu.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4552 wrote to memory of 4080	4552	msedge.exe	81
PID 4552 wrote to memory of 4080	4552	msedge.exe	81
PID 4552 wrote to memory of 5260	4552	msedge.exe	82
PID 4552 wrote to memory of 5260	4552	msedge.exe	82
PID 4552 wrote to memory of 1468	4552	msedge.exe	83
PID 4552 wrote to memory of 1468	4552	msedge.exe	83
PID 4552 wrote to memory of 3220	4552	msedge.exe	84
PID 4552 wrote to memory of 3220	4552	msedge.exe	84
PID 4552 wrote to memory of 1468	4552	msedge.exe	83
PID 4552 wrote to memory of 1468	4552	msedge.exe	83
PID 4552 wrote to memory of 1468	4552	msedge.exe	83
PID 4552 wrote to memory of 1468	4552	msedge.exe	83
PID 4552 wrote to memory of 1468	4552	msedge.exe	83
PID 4552 wrote to memory of 1468	4552	msedge.exe	83
PID 4552 wrote to memory of 1468	4552	msedge.exe	83
PID 4552 wrote to memory of 1468	4552	msedge.exe	83
PID 4552 wrote to memory of 1468	4552	msedge.exe	83
PID 4552 wrote to memory of 1468	4552	msedge.exe	83
PID 4552 wrote to memory of 1468	4552	msedge.exe	83
PID 4552 wrote to memory of 1468	4552	msedge.exe	83
PID 4552 wrote to memory of 1468	4552	msedge.exe	83
PID 4552 wrote to memory of 1468	4552	msedge.exe	83
PID 4552 wrote to memory of 1468	4552	msedge.exe	83
PID 4552 wrote to memory of 1468	4552	msedge.exe	83
PID 4552 wrote to memory of 1468	4552	msedge.exe	83
PID 4552 wrote to memory of 1468	4552	msedge.exe	83
PID 4552 wrote to memory of 1468	4552	msedge.exe	83
PID 4552 wrote to memory of 1468	4552	msedge.exe	83
PID 4552 wrote to memory of 1468	4552	msedge.exe	83
PID 4552 wrote to memory of 1468	4552	msedge.exe	83
PID 4552 wrote to memory of 1468	4552	msedge.exe	83
PID 4552 wrote to memory of 1468	4552	msedge.exe	83
PID 4552 wrote to memory of 1468	4552	msedge.exe	83
PID 4552 wrote to memory of 1468	4552	msedge.exe	83
PID 4552 wrote to memory of 1468	4552	msedge.exe	83
PID 4552 wrote to memory of 1468	4552	msedge.exe	83
PID 4552 wrote to memory of 1468	4552	msedge.exe	83
PID 4552 wrote to memory of 1468	4552	msedge.exe	83
PID 4552 wrote to memory of 1468	4552	msedge.exe	83
PID 4552 wrote to memory of 1468	4552	msedge.exe	83
PID 4552 wrote to memory of 1468	4552	msedge.exe	83
PID 4552 wrote to memory of 1468	4552	msedge.exe	83
PID 4552 wrote to memory of 1468	4552	msedge.exe	83
PID 4552 wrote to memory of 1468	4552	msedge.exe	83
PID 4552 wrote to memory of 1468	4552	msedge.exe	83
PID 4552 wrote to memory of 1468	4552	msedge.exe	83
PID 4552 wrote to memory of 1468	4552	msedge.exe	83
PID 4552 wrote to memory of 1468	4552	msedge.exe	83
PID 4552 wrote to memory of 1468	4552	msedge.exe	83
PID 4552 wrote to memory of 1468	4552	msedge.exe	83
PID 4552 wrote to memory of 1468	4552	msedge.exe	83
PID 4552 wrote to memory of 1468	4552	msedge.exe	83
PID 4552 wrote to memory of 1468	4552	msedge.exe	83
PID 4552 wrote to memory of 1468	4552	msedge.exe	83
PID 4552 wrote to memory of 1468	4552	msedge.exe	83
PID 4552 wrote to memory of 1468	4552	msedge.exe	83
PID 4552 wrote to memory of 1468	4552	msedge.exe	83
PID 4552 wrote to memory of 3220	4552	msedge.exe	84
PID 4552 wrote to memory of 3220	4552	msedge.exe	84
PID 4552 wrote to memory of 3220	4552	msedge.exe	84
PID 4552 wrote to memory of 3220	4552	msedge.exe	84
PID 4552 wrote to memory of 3220	4552	msedge.exe	84
PID 4552 wrote to memory of 3220	4552	msedge.exe	84
PID 4552 wrote to memory of 3220	4552	msedge.exe	84

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://drive.google.com/drive/folders/1hljtWr52piwbXZfcvI9eC8LoALi5SHGi?usp=sharing
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x264,0x268,0x26c,0x260,0x28c,0x7ffeff0ff208,0x7ffeff0ff214,0x7ffeff0ff220
  2⤵
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1848,i,9647798067067778437,4277224744322080239,262144 --variations-seed-version --mojo-platform-channel-handle=2484 /prefetch:3
  2⤵
  PID:5260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2392,i,9647798067067778437,4277224744322080239,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:2
  2⤵
  PID:1468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2388,i,9647798067067778437,4277224744322080239,262144 --variations-seed-version --mojo-platform-channel-handle=2548 /prefetch:8
  2⤵
  PID:3220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3456,i,9647798067067778437,4277224744322080239,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:5752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3472,i,9647798067067778437,4277224744322080239,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:2544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=5040,i,9647798067067778437,4277224744322080239,262144 --variations-seed-version --mojo-platform-channel-handle=4856 /prefetch:1
  2⤵
  PID:5468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=5236,i,9647798067067778437,4277224744322080239,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:2
  2⤵
  PID:5512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5380,i,9647798067067778437,4277224744322080239,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:8
  2⤵
  PID:5196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3904,i,9647798067067778437,4277224744322080239,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:8
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5808,i,9647798067067778437,4277224744322080239,262144 --variations-seed-version --mojo-platform-channel-handle=3140 /prefetch:8
  2⤵
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6092,i,9647798067067778437,4277224744322080239,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:8
  2⤵
  PID:688
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6092,i,9647798067067778437,4277224744322080239,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:8
  2⤵
  PID:5356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6000,i,9647798067067778437,4277224744322080239,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:8
  2⤵
  PID:1336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6348,i,9647798067067778437,4277224744322080239,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:8
  2⤵
  PID:3752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6200,i,9647798067067778437,4277224744322080239,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:8
  2⤵
  PID:5988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6024,i,9647798067067778437,4277224744322080239,262144 --variations-seed-version --mojo-platform-channel-handle=5612 /prefetch:8
  2⤵
  PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5616,i,9647798067067778437,4277224744322080239,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:8
  2⤵
  PID:1192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5780,i,9647798067067778437,4277224744322080239,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:8
  2⤵
  PID:1212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5820,i,9647798067067778437,4277224744322080239,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:8
  2⤵
  PID:1144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5532,i,9647798067067778437,4277224744322080239,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:8
  2⤵
  PID:1904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6316,i,9647798067067778437,4277224744322080239,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:8
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=5856,i,9647798067067778437,4277224744322080239,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5740,i,9647798067067778437,4277224744322080239,262144 --variations-seed-version --mojo-platform-channel-handle=5636 /prefetch:8
  2⤵
  PID:1100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4864,i,9647798067067778437,4277224744322080239,262144 --variations-seed-version --mojo-platform-channel-handle=4784 /prefetch:8
  2⤵
  PID:5196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4916,i,9647798067067778437,4277224744322080239,262144 --variations-seed-version --mojo-platform-channel-handle=3900 /prefetch:8
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6620,i,9647798067067778437,4277224744322080239,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:8
  2⤵
  PID:3888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5264,i,9647798067067778437,4277224744322080239,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:8
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3768,i,9647798067067778437,4277224744322080239,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:8
  2⤵
  PID:5272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5948,i,9647798067067778437,4277224744322080239,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:8
  2⤵
  PID:6032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4260,i,9647798067067778437,4277224744322080239,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:8
  2⤵
  PID:2772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --field-trial-handle=6280,i,9647798067067778437,4277224744322080239,262144 --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:1
  2⤵
  PID:5896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4996,i,9647798067067778437,4277224744322080239,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:8
  2⤵
  PID:5344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --field-trial-handle=4972,i,9647798067067778437,4277224744322080239,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:1
  2⤵
  PID:1228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5296,i,9647798067067778437,4277224744322080239,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:8
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6232,i,9647798067067778437,4277224744322080239,262144 --variations-seed-version --mojo-platform-channel-handle=5640 /prefetch:8
  2⤵
  PID:3836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5008,i,9647798067067778437,4277224744322080239,262144 --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:8
  2⤵
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6012,i,9647798067067778437,4277224744322080239,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:8
  2⤵
  PID:5516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6364,i,9647798067067778437,4277224744322080239,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:8
  2⤵
  PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --field-trial-handle=5256,i,9647798067067778437,4277224744322080239,262144 --variations-seed-version --mojo-platform-channel-handle=6544 /prefetch:1
  2⤵
  PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6664,i,9647798067067778437,4277224744322080239,262144 --variations-seed-version --mojo-platform-channel-handle=1508 /prefetch:8
  2⤵
  PID:1048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5928,i,9647798067067778437,4277224744322080239,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  PID:1104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5624,i,9647798067067778437,4277224744322080239,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:8
  2⤵
  PID:5008

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:5532

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
  2⤵
  PID:968

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5576

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1968

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\ARCHIVE-20250403T201010Z-001\ARCHIVE\ryujinx-1.1.1403-win_x64\" -ad -an -ai#7zMap12247:182:7zEvent6181
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5152

C:\Users\Admin\Downloads\ARCHIVE-20250403T201010Z-001\ARCHIVE\Uncompressed yuzu\Yuzu for windows\yuzu-windows-msvc\yuzu.exe
"C:\Users\Admin\Downloads\ARCHIVE-20250403T201010Z-001\ARCHIVE\Uncompressed yuzu\Yuzu for windows\yuzu-windows-msvc\yuzu.exe"
1⤵
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2380
- C:\Users\Admin\Downloads\ARCHIVE-20250403T201010Z-001\ARCHIVE\Uncompressed yuzu\Yuzu for windows\yuzu-windows-msvc\yuzu.exe
  "C:\Users\Admin\Downloads\ARCHIVE-20250403T201010Z-001\ARCHIVE\Uncompressed yuzu\Yuzu for windows\yuzu-windows-msvc\yuzu.exe"
  2⤵
  PID:4904

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x170 0x4fc
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\41204c0c-8981-4e09-b4b8-613dd423938c.tmp

Filesize
40KB

MD5
87433057d98dc392af0d85fd9276e6c0

SHA1
1ce5e61a181853dc74cbb01576a1b4e64b528af2

SHA256
41b669943cd83c370715a892c2fca6f3042e31900228a97f25bbfad03c30647e

SHA512
fd9f4a4b63ef04f8de1d48ee184e21c7698cbeeff0a840282999a8a787e80554a91f45e14cadd885fb0e46b3ab65be1d3b98dec3785ff4968eb68f999106a67a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
a7537931e1af5340f125d6c9a59b043e

SHA1
4f331e4af4a74ac232905bce9464665a0976545a

SHA256
2b657fd65c9331a37e3b44f1a6ed1259d7a6137586ed1807ec8f748268764e41

SHA512
1b06341297d01c8cef10e4a6ec5bf3a859363416625fe4dfcb24bd4e454a2300bbca758489a47ec10f1182154f4f927d67e9347a7b077882508224a7f0d8090e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old

Filesize
352B

MD5
7a001c515e34ec805b776cc78ddfff1d

SHA1
03677debebb167043e2684fb0646c1c34bfb86f1

SHA256
d67a7b55aef12f7f73518f36a111464baba84f4247e38acaf7657b295047c5fd

SHA512
0e9985622f3c9b50a118f5ad70341184ff758229d0bacdf201cf03bcd8fbcde47aaddda731dd300934e792e7e6234ce9f781404e9da0d0ee7d1605090db748d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old

Filesize
7KB

MD5
02619c2b5d976fd795f80adc86ce3941

SHA1
cdba7d11c5c07f1ba0cbe21382aaecc494d68185

SHA256
b8ae8bbbdd61be97a4d5046ed792315c202716db27da3775df8a77815708749b

SHA512
88b75b52e0604c9bd8f0bdb7f511f0b7b85b2a3280b1e12f48ccf57739fab54fd245d6ce2f0708591ceb4f4a9d5e8d0cd74302f07f5606d43ade735ba6ae2680

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007e

Filesize
216KB

MD5
50a7159ff34dea151d624f07e6cb1664

SHA1
e13fe30db96dcee328efda5cc78757b6e5b9339c

SHA256
e990d9d31c4c7d57dd4795e43baea05501fb6ea8b7760f89001be660425dd01b

SHA512
a7768dd7e315b07754a305080e0fc023765e5a224b2c3824e8e10f29286df63bbdefef379e069941fd8cd9c7c3befce976779ae2efdfb6e7da697b09d7f07250

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
a22910a4825a6c6ef30c04cda140b82a

SHA1
ebd19ff88a0daf8989df9fa5681ee465e3e4f787

SHA256
deb1346a394179d9497c7d6d67b5ea27103faa55271174fe0e53a904a18cc8d8

SHA512
d70f5b80c25128d5635051098bbb49c9edfb34bed54edb0a674c218114f8d427661cc5d6a433d3758288f952d5d0a968e0a8cc620978e2aee61f42d9f9108be3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe57ea31.TMP

Filesize
3KB

MD5
918261d96ac2b58c6ca89610f7c9dd65

SHA1
fc5bebc96fee221b4d3ab2c92484f01943c802b8

SHA256
2df38f6f7d5642dc8c9ea03356b76a6852e198466dfb3a3d4b86e529b9115c86

SHA512
79b6ce1073283a029321a9c7652dc5b1bb0362cdf4e56247c3b053ed7f9818d7c379d3fb349db6bacf8740203f0ef1c295ed91de32215a85247fd659b57f5a55

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
2b66d93c82a06797cdfd9df96a09e74a

SHA1
5f7eb526ee8a0c519b5d86c845fea8afd15b0c28

SHA256
d4c064db769b3c109da2ed80a53fbab00987c17421a47921e41e213781d67954

SHA512
95e45c0aea0e704be5f512dffaae377d4abef78da99b3bca769264d69be20f2570daf2f47905645217e1b2696e42b101f26149219f148b4d6dd97a6c2868b6f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
6KB

MD5
aab6be88fabd3959a95ebc687df54647

SHA1
3f86a57fd3ff44c609bf36bba67f3c7a0622f819

SHA256
003e94402de966385a59ddc5e175d58f8dfe5ed39931dfed4467b9899fa8a6bc

SHA512
4865720e67c7bcb189e495ada0a7ce6c4b7a0b85aaed991b9b9607fb9525e444f889f132b4a031297c6b3524855bb8ae41a66d1207c022efc2f3b9ad73f99653

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
6KB

MD5
91d6b61f9a3a8daf7657e2278a163691

SHA1
3a6c50ff85f9d45646a5cf78098caf90b68f7906

SHA256
775133d89851665593aec1633e9a7228344e3d39c2c21d366e62f3919984db92

SHA512
000982139983f0207f63e4149dd0f404d90dcd897acaa9079185f7cbac26394017f87b3b2d1cacacc33138c67d6f7189b5559fa873a7a6f91951871747863352

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
6KB

MD5
86bc7719da979eeda6bbe649ab5a92aa

SHA1
2a61523ab707f35321808aa5c9d9b68abbf1f020

SHA256
9c9bb8360fc802c6c5e0cbd041de41f552d8c785c6c2f07da62850044dd71925

SHA512
153cb953d317b7925709e2cc2624a8f9523832b70726806804af9dffabef58531462d92676499d0866be5dffb94fd501498ac1d4aa8f6511b5ee13f056f96963

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Platform Notifications\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
93121ae556e4f0dab1ba666f817a79c7

SHA1
e7b7de64125131fae1670f1742095b9aa05ee331

SHA256
08401416d5b968a06a2b22d3309b8de6a738f13a5d5a98ea8f40f4f7829a56cb

SHA512
d2dc1834fde47818958d6d80853611d0675004648f288a44b5033f6f7b5ef0f41f37fbe526f021bfc65ef696fd9e200202287b98928b1cadde6045a2f5b654a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
17KB

MD5
6338a943327432e844f154e16036eb65

SHA1
f3a9a132279dbcc990e05a55278123bef76d6494

SHA256
40e911e69db1939173f27d4c110289dbd05c14132028a23faa80893e06b07a6f

SHA512
c1365ac1a29236ba4ecb4bc08671b422bb54d64951d3de7da66ad0e380a0e61b5f4ae74fd96efe54000bedba1018ba2160b8d1627f9c00a39b45332d68467478

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
39KB

MD5
edf88f4d91f2893c9b431e83e0cf5c93

SHA1
4f1850ce0036e9a1988eb8464b48ef06a67fe0f6

SHA256
d81aec13f12b0d2d16ce96e2b918b930bb4f3e7572d343626e35e4a0d3ac4c1b

SHA512
7508819d0741a79423241dbbc5b4a2e3b4a73796ae46903c4cfa497ba312def6872298edd5a8dbad09551dd2ff656f6ceb2f0bef142112ba9178c254f022511a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\810c3d84-3b46-4420-94ac-bba223051863\index-dir\the-real-index

Filesize
1KB

MD5
78e8afe636689cf24ad5f710ca94d00d

SHA1
132ec2fefb993c03d97e61b57e6aa4f0b97acf23

SHA256
4cb9fb974a64a15173f3acd15e728a7522bb8913c6db0c056fe5dee172b0227b

SHA512
7b902da846e1282851ae76aed9cc3eb393de966b912ad7563ff5b7485dd548a52974cf0e6b81eccc89ab6c01c146b9cb844cb8435af7d7934b4eb66587b66dae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\810c3d84-3b46-4420-94ac-bba223051863\index-dir\the-real-index~RFe5bfccb.TMP

Filesize
1KB

MD5
7ea43ef9e7ce3511d47bfb0660c2080d

SHA1
72de0bc73b081708b530ad11ebc033408af018da

SHA256
8f06b8958310b3226004741751238c01bda39285b75b5edcf8859dc9770dce7b

SHA512
5d4f69b95f9e690c49563e30740fc4fc4260855478ce55348cb7de2f3bb5a0241c26341cf89245122e77d273d95fbb6f48ed98fde85383880571f047786bdbcb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt

Filesize
253B

MD5
e6d98010a98b6b0d63451216e93c862f

SHA1
488d407926d643fbb1f9277c5ec2d14a269c201e

SHA256
415a06ae1b2d5b8a6406e9603843a6c0a614b9c9db610968a14b080d82d15203

SHA512
7c73d2a4cd43b0d8d8f0d5588321d22fc0be64fa73f9d4b592e5dcaf4bc3af378575635e760a9b631fdd1a0ed4e99685ae89e5c6367d0117730c52a1e8ae80e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
48B

MD5
d781ee0ce6ddf24a670bb105fb8ffe57

SHA1
33ee3b41d7af3a0694f28a91fa3874b855069b15

SHA256
b794055632552602fb1273eaa2f31afc2d874e09701f6c24868ae3803b2b7806

SHA512
7f3d85c3c58d1c16df0669fe0ae8d5786f91036ab453b262ba4ef99e0224d291eb93b7a8f280060f54e311f83fbcfa1498af31adfc63356ab5212e718afb6647

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
f0d1ab48f9ef62a0ced0f1dd0b1d53b8

SHA1
169e502f827b6ce503f00d19d8d91495d339a4bb

SHA256
9a73d5a40bd0e75fbd24c52f7ce93f0c5e916e3ceb5ad11d8a321c8ce6c502ca

SHA512
52269bb9241f5d112527832de10ea2bba5f7756a3e48b81bf7ebadbf50b9bfcf20f795b700ff21311f840cf2d2f05239c60ad6c4cfc8344885f9ee85c7f29a69

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57b9ab.TMP

Filesize
48B

MD5
f544cc5e221a498355a5cd13388e4137

SHA1
7bb6bbbc91ad21b91224b25e026d33516b5c533b

SHA256
fc87a6d0164283d224dc5004c827e29a634f5d5e8cc4085e62188c1b7bb6e0c5

SHA512
18a670860ad84475aa21a819c8202c0dc8b416c517e775e0ef9a15e4687f48d1f6e9d6224c90172cd30058a23d3bc7a01982b1e229bc1d1b1fdec6f304b834d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
ebe78ed49bc613911a0dfea61911ee98

SHA1
f48bd8948befb70e120d261d324d8e9e3863afef

SHA256
88553c6012dd99dadc17f9a3605019c1ee536029b690b00e6dd7b34700cb0419

SHA512
4f7ea32baa358b13ed62c4fa8ccb085a44dc6651e5e9a393b28a3f9cc6750dc6138880cc2d7ea1ad20009d0ea525e79b75b0710d0854d6c3154e5f343155e7a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\623cee9d-40bd-4b52-a9dc-6b823100b690.tmp

Filesize
467B

MD5
4a83bab2a8521bc3ecfd38c12c90c74d

SHA1
52f90093c13a3f3569b192b2613eee95243eca36

SHA256
9b6d6d53c202675a2b6e47a5b212a50c27a566627798d27bfea42fd111bf3a3c

SHA512
eabaece743cb541a26e40ab4dc302f3d9bf991fabd22f5c6cbf7c32c28040231a65589e5e8707e5db7231336bc080feafad3749e04d01b60c20cba767beb7812

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
23KB

MD5
0acdd329f78193bc10d82d19e465abd0

SHA1
ba00d5b5d907e775f6c9de092855eeccb567efc0

SHA256
0871374c3ba71643028591eb22d14c0761882eb4be8f12ed8bd089a7726dcd5a

SHA512
1a72653f2f2da9b86460b3121616b395d1110656759079679d36c25d4cf80e38950e8ff9a5192c9de8fe1ceb52c7ea3175e1635c12c7af973f462d6c1848089a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
900B

MD5
98514260b7c337711a296ebadfe4b8f5

SHA1
755f1bb118563488ae8c96981d021a74577b65b8

SHA256
97bad6ec1abd0af874a427a279dc541a5eacb29e5240c9283173c71af4291a11

SHA512
eeb11f8994d89f5933d7e5e79f80745ec9524fdf18862afea372cc2c5e4e27b9d25b0622328431684d5575d949be44bd2220ec3292ce5ebce41beab7df3ffbd7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
19KB

MD5
41c1930548d8b99ff1dbb64ba7fecb3d

SHA1
d8acfeaf7c74e2b289be37687f886f50c01d4f2f

SHA256
16cee17a989167242dd7ee2755721e357dd23bcfcb61f5789cc19deafe7ca502

SHA512
a684d61324c71ac15f3a907788ab2150f61e7e2b2bf13ca08c14e9822b22336d0d45d9ff2a2a145aa7321d28d6b71408f9515131f8a1bd9f4927b105e6471b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
910143bb2fa07813d71dde63e2a93406

SHA1
491d3e3f599bd7bde56628d574f2afc6807a9ca0

SHA256
7aa3d199f75a974e73b7ce185dd89b118f6cad81fb65e46a326d8499cdbcceb2

SHA512
1e82d8b902b30412a374d0faf941e5b19916215490c311039180b1f3cf81c8a34f2ca5e6a35146c93ca97163e86c6bf7fe60dbdaa6ed9c254b03a76467077e13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
55KB

MD5
c4690eb6b9e8adaaff7396d2efeab3f0

SHA1
6288a35e817ddefd3d41e8371a80aad11b94757b

SHA256
8ffaddc044df7089fd198767d01d1b59faf3d73eac345c8467b16265028313a2

SHA512
8fc16a14f3857f0bc55e1548a32dc64b170d168551d00c2e0ecffb834af00cd61c5f3785479ef3b603fc4bf03dbcde45a945103ddba85af51dabbcb8c25781f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
55KB

MD5
7d74c46377c92a841426fa22fcaa4fe6

SHA1
37bf9315d11c4c51bf3aea807daffe4b60e15d1a

SHA256
d1fcaf09cfff2a402c0a993fffff7029b01205502c219b8c8f45dfa3981c5523

SHA512
2fb0297b719dffa2aae0a80eeda880ebee0d614e7859d6c116a75d04a6c499ead0ef767f7fc22f961f3c6947996c4917884f7c4fcb8486293888692507c1906f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Well Known Domains\1.2.0.0\well_known_domains.dll

Filesize
572KB

MD5
f5f5b37fd514776f455864502c852773

SHA1
8d5ed434173fd77feb33cb6cb0fad5e2388d97c6

SHA256
2778063e5ded354d852004e80492edb3a0f731b838bb27ba3a233bc937592f6e

SHA512
b0931f1cae171190e6ec8880f4d560cc7b3d5bffe1db11525bd133eaf51e2e0b3c920ea194d6c7577f95e7b4b4380f7845c82eb2898ad1f5c35d4550f93a14b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ghbmnnjooekpmoecnnnilnnbdlolhkhi_1.fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72

Filesize
152KB

MD5
dd9bf8448d3ddcfd067967f01e8bf6d7

SHA1
d7829475b2bd6a3baa8fabfaf39af57c6439b35e

SHA256
fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72

SHA512
65347df34378c2bbb34417e2cccfb3251a0b2412422cc190eed9df525b6e0a9948e0295ea3c33b3ad873ce81e369e89a138ac41d6eb7229546c3269107e661de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
390c5891aaa7b2f4b248548169d10b77

SHA1
ea3c28780af2f0fbaed18491898ea54fe8d472e8

SHA256
1c9a1c7720d4d9cf3c4906efb50e83f2919b649d3fe6e8a4c76ef934fc934749

SHA512
0c1b50f860376fad99707cc024504bdf8bcb378a9f8ed7b3ebd3655fd88f020b501ad503ccb47cae8f76465bdfe339df7dbd29076092d1f2a08e0812eb484d5a

Download Submit
C:\Users\Admin\AppData\Roaming\yuzu\config\qt-config.ini

Filesize
64KB

MD5
70cbb9247907485718598fc238a509da

SHA1
9cd6bc7633b3c624e01c1d6c1d5e192e4451fcf2

SHA256
aeaf3067d9c96bba4baf5829336bcdd877582a47936075cea80e7d8dfa2a808d

SHA512
24a6c0882c607de3b129bb145c2b0789350c632645fa0d3fcef6262867ed967d2eae62ab29c1c8bdfef46e00fa8baa77c6dbba4072a00431c1dec99650bf8bfd

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_1092842133\LICENSE

Filesize
1KB

MD5
ee002cb9e51bb8dfa89640a406a1090a

SHA1
49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2

SHA256
3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b

SHA512
d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_1442313687\Mini-Wallet\miniwallet.bundle.js.LICENSE.txt

Filesize
551B

MD5
7bf61e84e614585030a26b0b148f4d79

SHA1
c4ffbc5c6aa599e578d3f5524a59a99228eea400

SHA256
38ed54eb53300fdb6e997c39c9fc83a224a1fd9fa06a0b6d200aa12ea278c179

SHA512
ca5f2d3a4f200371927c265b9fb91b8bcd0fbad711559f796f77b695b9038638f763a040024ed185e67be3a7b58fab22a6f8114e73fdbd1cccdda6ef94ff88f3

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_1442313687\Notification\notification.bundle.js.LICENSE.txt

Filesize
1KB

MD5
8595bdd96ab7d24cc60eb749ce1b8b82

SHA1
3b612cc3d05e372c5ac91124f3756bbf099b378d

SHA256
363f376ab7893c808866a830fafbcd96ae6be93ec7a85fabf52246273cf56831

SHA512
555c0c384b6fcfc2311b47c0b07f8e34243de528cf1891e74546b6f4cda338d75c2e2392827372dc39e668ed4c2fd1a02112d8136d2364f9cab9ee4fa1bd87f5

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_1442313687\json\i18n-tokenized-card\fr\strings.json

Filesize
2KB

MD5
cd247582beb274ca64f720aa588ffbc0

SHA1
4aaeef0905e67b490d4a9508ed5d4a406263ed9c

SHA256
c67b555372582b07df86a6ce3329a854e349ba9525d7be0672517bab0ac14db5

SHA512
bf8fa4bd7c84038fae9eddb483ae4a31d847d5d47b408b3ea84d46d564f15dfc2bae6256eac4a852dd1c4ad8e58bc542e3df30396be05f30ed07e489ebe52895

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_459843560\edge_checkout_page_validator.js

Filesize
1.1MB

MD5
0e3ea2aa2bc4484c8aebb7e348d8e680

SHA1
55f802e1a00a6988236882ae02f455648ab54114

SHA256
25ffb085e470aa7214bf40777794de05bf2bb53254244a4c3a3025f40ce4cef7

SHA512
45b31d42be032766f5c275568723a170bb6bbf522f123a5fdc47e0c6f76933d2d3e14487668e772488847096c5e6a1f33920f1ee97bc586319a9005bacd65428

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_855825034\hyph-bn.hyb

Filesize
703B

MD5
8961fdd3db036dd43002659a4e4a7365

SHA1
7b2fa321d50d5417e6c8d48145e86d15b7ff8321

SHA256
c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe

SHA512
531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_855825034\hyph-mr.hyb

Filesize
687B

MD5
0807cf29fc4c5d7d87c1689eb2e0baaa

SHA1
d0914fb069469d47a36d339ca70164253fccf022

SHA256
f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42

SHA512
5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_855825034\hyph-nn.hyb

Filesize
141KB

MD5
f2d8fe158d5361fc1d4b794a7255835a

SHA1
6c8744fa70651f629ed887cb76b6bc1bed304af9

SHA256
5bcbb58eaf65f13f6d039244d942f37c127344e3a0a2e6c32d08236945132809

SHA512
946f4e41be624458b5e842a6241d43cd40369b2e0abc2cacf67d892b5f3d8a863a0e37e8120e11375b0bacb4651eedb8d324271d9a0c37527d4d54dd4905afab

Download Submit
memory/2380-2533-0x00007FFF08150000-0x00007FFF081F6000-memory.dmp

Filesize
664KB

Download
memory/2380-2503-0x00007FFEE8290000-0x00007FFEE8688000-memory.dmp

Filesize
4.0MB

Download
memory/2380-2501-0x00007FFEE7D40000-0x00007FFEE8281000-memory.dmp

Filesize
5.3MB

Download
memory/2380-2502-0x00007FF6F70B0000-0x00007FF6F8C4C000-memory.dmp

Filesize
27.6MB

Download
memory/2380-2536-0x00007FFEEB360000-0x00007FFEEB6A1000-memory.dmp

Filesize
3.3MB

Download
memory/2380-2537-0x00007FFF09D20000-0x00007FFF09D37000-memory.dmp

Filesize
92KB

Download
memory/2380-2535-0x00007FFEEAB40000-0x00007FFEEAD47000-memory.dmp

Filesize
2.0MB

Download
memory/2380-2534-0x00007FFF08330000-0x00007FFF08368000-memory.dmp

Filesize
224KB

Download
memory/2380-2504-0x00007FFEE8290000-0x00007FFEE8688000-memory.dmp

Filesize
4.0MB

Download
memory/4904-2521-0x00007FFEEB360000-0x00007FFEEB6A1000-memory.dmp

Filesize
3.3MB

Download
memory/4904-2518-0x00007FFF08150000-0x00007FFF081F6000-memory.dmp

Filesize
664KB

Download
memory/4904-2522-0x00007FFF09D20000-0x00007FFF09D37000-memory.dmp

Filesize
92KB

Download
memory/4904-2510-0x00007FF6F70B0000-0x00007FF6F8C4C000-memory.dmp

Filesize
27.6MB

Download
memory/4904-2519-0x00007FFF08330000-0x00007FFF08368000-memory.dmp

Filesize
224KB

Download
memory/4904-2520-0x00007FFEEAB40000-0x00007FFEEAD47000-memory.dmp

Filesize
2.0MB

Download
memory/4904-2508-0x00007FFEE7D40000-0x00007FFEE8281000-memory.dmp

Filesize
5.3MB

Download
memory/4904-2509-0x00007FFEE8290000-0x00007FFEE8688000-memory.dmp

Filesize
4.0MB

Download
memory/4904-2511-0x00007FFEE8290000-0x00007FFEE8688000-memory.dmp

Filesize
4.0MB

Download