emotet | 3190f80b95d0a2679d8477b8ee7593e3b92e98d4ce95a6b328d42a61c60fe0c9

Analysis

max time kernel
134s
max time network
138s
platform
windows11-21h2_x64
resource
win11-20250410-en
resource tags

arch:x64arch:x86image:win11-20250410-enlocale:en-usos:windows11-21h2-x64system
submitted
19/04/2025, 03:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

wlanwin.exe
Size

92KB
MD5

3e11228f187c0f0a7a9bb7a3beae8e89
SHA1

6c218b3c8528e1a473e3519f042f1c60a188304b
SHA256

3190f80b95d0a2679d8477b8ee7593e3b92e98d4ce95a6b328d42a61c60fe0c9
SHA512

dc51f586260184c6f310c52ce38ac4385353c723878c7b25aab5b8dad978b4c1cb21630bff214ebd94fd3d9ed7772c814d64802dc9b520e4bd9283138fc371e2
SSDEEP

1536:ZZ50d92KsGOVln83oXWX1tZVJbnNeP3ZCjdJNNaXufs:Z/JK3OIYGrZVJLcP3ZidDcas

Score

10^/10

emotet banker discovery trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Emotet family
emotet

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	logapp.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	logapp.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	logapp.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	logapp.exe

Drops file in Windows directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3956_868657483\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3956_868657483\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3956_54829191\deny_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3956_54829191\deny_etld1_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3956_54829191\deny_full_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3956_54829191\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3956_54829191\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3956_868657483\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3956_868657483\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3956_868657483\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3956_1083836537\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3956_1083836537\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3956_1083836537\manifest.fingerprint	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wlanwin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wlanwin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	logapp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	logapp.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	logapp.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	logapp.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133895079828095305"	msedge.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	logapp.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-599783296-1627459723-2423478968-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-599783296-1627459723-2423478968-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-599783296-1627459723-2423478968-1000\{DEDD1BD5-3BF2-4F08-B904-9C9B65F00557}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-599783296-1627459723-2423478968-1000\{4C8E2878-511C-4897-AB26-206DAB1BBFCD}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-599783296-1627459723-2423478968-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\Moniker = "cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-599783296-1627459723-2423478968-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-599783296-1627459723-2423478968-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-599783296-1627459723-2423478968-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-599783296-1627459723-2423478968-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\DisplayName = "Chrome Sandbox"	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1544	logapp.exe
1544	logapp.exe
1544	logapp.exe
1544	logapp.exe
1544	logapp.exe
1544	logapp.exe
3328	msedge.exe
3328	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 45 IoCs

pid	Process
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
5740	wlanwin.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3956	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 5740	2860	wlanwin.exe	78
PID 2860 wrote to memory of 5740	2860	wlanwin.exe	78
PID 2860 wrote to memory of 5740	2860	wlanwin.exe	78
PID 1740 wrote to memory of 1544	1740	logapp.exe	80
PID 1740 wrote to memory of 1544	1740	logapp.exe	80
PID 1740 wrote to memory of 1544	1740	logapp.exe	80
PID 3956 wrote to memory of 4796	3956	msedge.exe	84
PID 3956 wrote to memory of 4796	3956	msedge.exe	84
PID 3956 wrote to memory of 5508	3956	msedge.exe	85
PID 3956 wrote to memory of 5508	3956	msedge.exe	85
PID 3956 wrote to memory of 4952	3956	msedge.exe	86
PID 3956 wrote to memory of 4952	3956	msedge.exe	86
PID 3956 wrote to memory of 4952	3956	msedge.exe	86
PID 3956 wrote to memory of 4952	3956	msedge.exe	86
PID 3956 wrote to memory of 4952	3956	msedge.exe	86
PID 3956 wrote to memory of 4952	3956	msedge.exe	86
PID 3956 wrote to memory of 4952	3956	msedge.exe	86
PID 3956 wrote to memory of 4952	3956	msedge.exe	86
PID 3956 wrote to memory of 4952	3956	msedge.exe	86
PID 3956 wrote to memory of 4952	3956	msedge.exe	86
PID 3956 wrote to memory of 4952	3956	msedge.exe	86
PID 3956 wrote to memory of 4952	3956	msedge.exe	86
PID 3956 wrote to memory of 4952	3956	msedge.exe	86
PID 3956 wrote to memory of 4952	3956	msedge.exe	86
PID 3956 wrote to memory of 4952	3956	msedge.exe	86
PID 3956 wrote to memory of 4952	3956	msedge.exe	86
PID 3956 wrote to memory of 4952	3956	msedge.exe	86
PID 3956 wrote to memory of 4952	3956	msedge.exe	86
PID 3956 wrote to memory of 4952	3956	msedge.exe	86
PID 3956 wrote to memory of 4952	3956	msedge.exe	86
PID 3956 wrote to memory of 4952	3956	msedge.exe	86
PID 3956 wrote to memory of 4952	3956	msedge.exe	86
PID 3956 wrote to memory of 4952	3956	msedge.exe	86
PID 3956 wrote to memory of 4952	3956	msedge.exe	86
PID 3956 wrote to memory of 4952	3956	msedge.exe	86
PID 3956 wrote to memory of 4952	3956	msedge.exe	86
PID 3956 wrote to memory of 4952	3956	msedge.exe	86
PID 3956 wrote to memory of 4952	3956	msedge.exe	86
PID 3956 wrote to memory of 4952	3956	msedge.exe	86
PID 3956 wrote to memory of 4952	3956	msedge.exe	86
PID 3956 wrote to memory of 4952	3956	msedge.exe	86
PID 3956 wrote to memory of 4952	3956	msedge.exe	86
PID 3956 wrote to memory of 4952	3956	msedge.exe	86
PID 3956 wrote to memory of 4952	3956	msedge.exe	86
PID 3956 wrote to memory of 4952	3956	msedge.exe	86
PID 3956 wrote to memory of 4952	3956	msedge.exe	86
PID 3956 wrote to memory of 4952	3956	msedge.exe	86
PID 3956 wrote to memory of 4952	3956	msedge.exe	86
PID 3956 wrote to memory of 4952	3956	msedge.exe	86
PID 3956 wrote to memory of 4952	3956	msedge.exe	86
PID 3956 wrote to memory of 4952	3956	msedge.exe	86
PID 3956 wrote to memory of 4952	3956	msedge.exe	86
PID 3956 wrote to memory of 4952	3956	msedge.exe	86
PID 3956 wrote to memory of 4952	3956	msedge.exe	86
PID 3956 wrote to memory of 4952	3956	msedge.exe	86
PID 3956 wrote to memory of 4952	3956	msedge.exe	86
PID 3956 wrote to memory of 4952	3956	msedge.exe	86
PID 3956 wrote to memory of 4952	3956	msedge.exe	86
PID 3956 wrote to memory of 4952	3956	msedge.exe	86
PID 3956 wrote to memory of 4952	3956	msedge.exe	86
PID 3956 wrote to memory of 4952	3956	msedge.exe	86
PID 3956 wrote to memory of 2460	3956	msedge.exe	87
PID 3956 wrote to memory of 2460	3956	msedge.exe	87
PID 3956 wrote to memory of 2460	3956	msedge.exe	87

C:\Users\Admin\AppData\Local\Temp\wlanwin.exe
"C:\Users\Admin\AppData\Local\Temp\wlanwin.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Users\Admin\AppData\Local\Temp\wlanwin.exe
  "C:\Users\Admin\AppData\Local\Temp\wlanwin.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: RenamesItself
  PID:5740

C:\Windows\SysWOW64\logapp.exe
C:\Windows\SysWOW64\logapp.exe
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1740
- C:\Windows\SysWOW64\logapp.exe
  "C:\Windows\SysWOW64\logapp.exe"
  2⤵
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:1544

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\ImportSearch.mht
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2e0,0x2f4,0x7ff9d7def208,0x7ff9d7def214,0x7ff9d7def220
  2⤵
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1800,i,7732209772087420412,9502606629261652302,262144 --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:11
  2⤵
  PID:5508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2152,i,7732209772087420412,9502606629261652302,262144 --variations-seed-version --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2512,i,7732209772087420412,9502606629261652302,262144 --variations-seed-version --mojo-platform-channel-handle=2544 /prefetch:13
  2⤵
  PID:2460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3384,i,7732209772087420412,9502606629261652302,262144 --variations-seed-version --mojo-platform-channel-handle=3436 /prefetch:1
  2⤵
  PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3440,i,7732209772087420412,9502606629261652302,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4508,i,7732209772087420412,9502606629261652302,262144 --variations-seed-version --mojo-platform-channel-handle=4556 /prefetch:1
  2⤵
  PID:1788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4864,i,7732209772087420412,9502606629261652302,262144 --variations-seed-version --mojo-platform-channel-handle=3788 /prefetch:14
  2⤵
  PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4312,i,7732209772087420412,9502606629261652302,262144 --variations-seed-version --mojo-platform-channel-handle=3760 /prefetch:14
  2⤵
  PID:5736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5292,i,7732209772087420412,9502606629261652302,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:14
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5612,i,7732209772087420412,9502606629261652302,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:14
  2⤵
  PID:5904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5676,i,7732209772087420412,9502606629261652302,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:14
  2⤵
  PID:3588
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1140
    3⤵
    PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5612,i,7732209772087420412,9502606629261652302,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:14
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5876,i,7732209772087420412,9502606629261652302,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:14
  2⤵
  PID:2332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=6280,i,7732209772087420412,9502606629261652302,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:1
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --field-trial-handle=5872,i,7732209772087420412,9502606629261652302,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:1
  2⤵
  PID:972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --field-trial-handle=6620,i,7732209772087420412,9502606629261652302,262144 --variations-seed-version --mojo-platform-channel-handle=6664 /prefetch:1
  2⤵
  PID:5952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --field-trial-handle=4604,i,7732209772087420412,9502606629261652302,262144 --variations-seed-version --mojo-platform-channel-handle=3804 /prefetch:1
  2⤵
  PID:1716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=1648,i,7732209772087420412,9502606629261652302,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:14
  2⤵
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3452,i,7732209772087420412,9502606629261652302,262144 --variations-seed-version --mojo-platform-channel-handle=732 /prefetch:14
  2⤵
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6248,i,7732209772087420412,9502606629261652302,262144 --variations-seed-version --mojo-platform-channel-handle=4628 /prefetch:14
  2⤵
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --field-trial-handle=5044,i,7732209772087420412,9502606629261652302,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:1
  2⤵
  PID:404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --field-trial-handle=6520,i,7732209772087420412,9502606629261652302,262144 --variations-seed-version --mojo-platform-channel-handle=4540 /prefetch:1
  2⤵
  PID:1280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --field-trial-handle=6644,i,7732209772087420412,9502606629261652302,262144 --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:1
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --field-trial-handle=6324,i,7732209772087420412,9502606629261652302,262144 --variations-seed-version --mojo-platform-channel-handle=6920 /prefetch:1
  2⤵
  PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --field-trial-handle=6352,i,7732209772087420412,9502606629261652302,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:1
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --field-trial-handle=3704,i,7732209772087420412,9502606629261652302,262144 --variations-seed-version --mojo-platform-channel-handle=7140 /prefetch:1
  2⤵
  PID:5136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --field-trial-handle=6244,i,7732209772087420412,9502606629261652302,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:1
  2⤵
  PID:5836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --field-trial-handle=7248,i,7732209772087420412,9502606629261652302,262144 --variations-seed-version --mojo-platform-channel-handle=7264 /prefetch:1
  2⤵
  PID:6004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --field-trial-handle=7400,i,7732209772087420412,9502606629261652302,262144 --variations-seed-version --mojo-platform-channel-handle=7416 /prefetch:1
  2⤵
  PID:2672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --field-trial-handle=7608,i,7732209772087420412,9502606629261652302,262144 --variations-seed-version --mojo-platform-channel-handle=7632 /prefetch:1
  2⤵
  PID:4092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=media.mojom.MediaFoundationServiceBroker --lang=en-US --service-sandbox-type=mf_cdm --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=2032,i,7732209772087420412,9502606629261652302,262144 --variations-seed-version --mojo-platform-channel-handle=7564 /prefetch:14
  2⤵
  PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --field-trial-handle=7384,i,7732209772087420412,9502606629261652302,262144 --variations-seed-version --mojo-platform-channel-handle=7916 /prefetch:1
  2⤵
  PID:5256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --field-trial-handle=8124,i,7732209772087420412,9502606629261652302,262144 --variations-seed-version --mojo-platform-channel-handle=8160 /prefetch:1
  2⤵
  PID:1756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --field-trial-handle=8276,i,7732209772087420412,9502606629261652302,262144 --variations-seed-version --mojo-platform-channel-handle=8304 /prefetch:1
  2⤵
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --field-trial-handle=8320,i,7732209772087420412,9502606629261652302,262144 --variations-seed-version --mojo-platform-channel-handle=8484 /prefetch:1
  2⤵
  PID:5972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --field-trial-handle=8544,i,7732209772087420412,9502606629261652302,262144 --variations-seed-version --mojo-platform-channel-handle=8552 /prefetch:1
  2⤵
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --field-trial-handle=8856,i,7732209772087420412,9502606629261652302,262144 --variations-seed-version --mojo-platform-channel-handle=8944 /prefetch:1
  2⤵
  PID:5536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --field-trial-handle=8768,i,7732209772087420412,9502606629261652302,262144 --variations-seed-version --mojo-platform-channel-handle=8948 /prefetch:1
  2⤵
  PID:916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --field-trial-handle=8904,i,7732209772087420412,9502606629261652302,262144 --variations-seed-version --mojo-platform-channel-handle=8972 /prefetch:1
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --field-trial-handle=8884,i,7732209772087420412,9502606629261652302,262144 --variations-seed-version --mojo-platform-channel-handle=8960 /prefetch:1
  2⤵
  PID:2768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --field-trial-handle=8836,i,7732209772087420412,9502606629261652302,262144 --variations-seed-version --mojo-platform-channel-handle=9636 /prefetch:1
  2⤵
  PID:1288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --field-trial-handle=9784,i,7732209772087420412,9502606629261652302,262144 --variations-seed-version --mojo-platform-channel-handle=9796 /prefetch:1
  2⤵
  PID:3168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --field-trial-handle=9948,i,7732209772087420412,9502606629261652302,262144 --variations-seed-version --mojo-platform-channel-handle=9960 /prefetch:1
  2⤵
  PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --field-trial-handle=10012,i,7732209772087420412,9502606629261652302,262144 --variations-seed-version --mojo-platform-channel-handle=10108 /prefetch:1
  2⤵
  PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --field-trial-handle=10280,i,7732209772087420412,9502606629261652302,262144 --variations-seed-version --mojo-platform-channel-handle=10296 /prefetch:1
  2⤵
  PID:3272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --field-trial-handle=10452,i,7732209772087420412,9502606629261652302,262144 --variations-seed-version --mojo-platform-channel-handle=10432 /prefetch:1
  2⤵
  PID:5500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --field-trial-handle=10476,i,7732209772087420412,9502606629261652302,262144 --variations-seed-version --mojo-platform-channel-handle=10624 /prefetch:1
  2⤵
  PID:3576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --field-trial-handle=10640,i,7732209772087420412,9502606629261652302,262144 --variations-seed-version --mojo-platform-channel-handle=10800 /prefetch:1
  2⤵
  PID:5288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --field-trial-handle=10956,i,7732209772087420412,9502606629261652302,262144 --variations-seed-version --mojo-platform-channel-handle=10972 /prefetch:1
  2⤵
  PID:3868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=10772,i,7732209772087420412,9502606629261652302,262144 --variations-seed-version --mojo-platform-channel-handle=8500 /prefetch:12
  2⤵
  PID:5800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --field-trial-handle=10296,i,7732209772087420412,9502606629261652302,262144 --variations-seed-version --mojo-platform-channel-handle=10020 /prefetch:1
  2⤵
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --field-trial-handle=10736,i,7732209772087420412,9502606629261652302,262144 --variations-seed-version --mojo-platform-channel-handle=10024 /prefetch:1
  2⤵
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --always-read-main-dll --field-trial-handle=10752,i,7732209772087420412,9502606629261652302,262144 --variations-seed-version --mojo-platform-channel-handle=10696 /prefetch:1
  2⤵
  PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --field-trial-handle=11156,i,7732209772087420412,9502606629261652302,262144 --variations-seed-version --mojo-platform-channel-handle=11168 /prefetch:1
  2⤵
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --always-read-main-dll --field-trial-handle=11196,i,7732209772087420412,9502606629261652302,262144 --variations-seed-version --mojo-platform-channel-handle=11228 /prefetch:1
  2⤵
  PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --always-read-main-dll --field-trial-handle=10724,i,7732209772087420412,9502606629261652302,262144 --variations-seed-version --mojo-platform-channel-handle=10888 /prefetch:1
  2⤵
  PID:1744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --always-read-main-dll --field-trial-handle=11180,i,7732209772087420412,9502606629261652302,262144 --variations-seed-version --mojo-platform-channel-handle=9984 /prefetch:1
  2⤵
  PID:5288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --always-read-main-dll --field-trial-handle=2892,i,7732209772087420412,9502606629261652302,262144 --variations-seed-version --mojo-platform-channel-handle=9996 /prefetch:1
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=9952,i,7732209772087420412,9502606629261652302,262144 --variations-seed-version --mojo-platform-channel-handle=10340 /prefetch:14
  2⤵
  PID:6276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --always-read-main-dll --field-trial-handle=10360,i,7732209772087420412,9502606629261652302,262144 --variations-seed-version --mojo-platform-channel-handle=10364 /prefetch:1
  2⤵
  PID:6716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=11300,i,7732209772087420412,9502606629261652302,262144 --variations-seed-version --mojo-platform-channel-handle=11308 /prefetch:14
  2⤵
  - Modifies registry class
  PID:6864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=11396,i,7732209772087420412,9502606629261652302,262144 --variations-seed-version --mojo-platform-channel-handle=11420 /prefetch:14
  2⤵
  PID:7084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5156,i,7732209772087420412,9502606629261652302,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:14
  2⤵
  PID:6248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=10864,i,7732209772087420412,9502606629261652302,262144 --variations-seed-version --mojo-platform-channel-handle=11280 /prefetch:14
  2⤵
  PID:6808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=10980,i,7732209772087420412,9502606629261652302,262144 --variations-seed-version --mojo-platform-channel-handle=10856 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3328

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:3656

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
  2⤵
  PID:3896

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004C0 0x00000000000004D4
1⤵
PID:3596

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
1781354d27507643c155a786707c38a7

SHA1
2640329f5fa81556f623a621d593cf34ac7c4aec

SHA256
53facdb807aa83e6148a7c9aa06da7783307ee5012b638eb05210554f85cde80

SHA512
abfe8088d4714d74d0011578f8964a74c7d79362cb5b54e1742ac5b0b5cfae4d108d8a11843121bcb4d96f3c693c02a7c02164edf5157f21e51355e23721c37c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ab

Filesize
20KB

MD5
835d854cd924f18b4914e833f4de3e4a

SHA1
07d41cdb6a955681b7b539dbddb03b38d9770167

SHA256
dc1e9e098085a2786141aa0aaa32e6d8f984dca6c472b4f2ab918a7266b8cdac

SHA512
430d76ab38d08f1bddf3b94a810b48bcd953660330438ea76c426ef049ef155207f49a0a581a0b35fb084b2a9afdf2ec7b689f1132d22ec150c5d52a4e3011cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
6KB

MD5
d712e3d6b13d1ab7db06801d102d0e49

SHA1
dab667d574d4cf79614c938a643c970fcb4f52a9

SHA256
39a38cf3cf9f2f52f34e901a8d29f874ef975189a3eed175892baa22c084eab6

SHA512
388fbe50eee1f9644386fb9683ab4b611e9cf3827dda1c8005177d2a834d4d819cae6ce9759fe16ff542a4720e79240dbfab7044d601aa0408ec92302ce7585d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
6KB

MD5
d6d306c3ee077747a88e156bfee8f828

SHA1
5983ea35ef9b5ee53a877dedab5cbee0660d73c8

SHA256
83b8f3927092e9b8c6fee9715c34abe29f5060708083b5216ef289fe7c4c3497

SHA512
51eb66ddda7d276bb1bd1ba1e883237a9762282ad02d64db79d79f3276de6e7faa2b07c03bd75a9ec87282893e847e42f59e67c4ec60c31f22a2f9f2502108f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58efe9.TMP

Filesize
4KB

MD5
4adae9d4a278c85f49c4be57e215a402

SHA1
2e7a56c10882ac892041b6c5bfd5c6b3c5fc229c

SHA256
8ee6fc7afe42dc1d4e69c87418eab9c8221c041cd42feddf674b8667fea8524d

SHA512
d55344ea9e8d6d8ec5e549a5fe9f9bd592257661818447f8cefc53f22bb4aba4a8974c8e715a9c037db885bd10696676a3bec6a057386de64dafe24ab5383298

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
2b66d93c82a06797cdfd9df96a09e74a

SHA1
5f7eb526ee8a0c519b5d86c845fea8afd15b0c28

SHA256
d4c064db769b3c109da2ed80a53fbab00987c17421a47921e41e213781d67954

SHA512
95e45c0aea0e704be5f512dffaae377d4abef78da99b3bca769264d69be20f2570daf2f47905645217e1b2696e42b101f26149219f148b4d6dd97a6c2868b6f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_uk.yahoo.com_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
23KB

MD5
05dde0e186791798de0eed1afa894042

SHA1
5c82dce051ae583807598f2192928e94131f1265

SHA256
bf6f37c2c24d0b74f596156ccb43c72867bcf72842a83c98474e56b7ff77262c

SHA512
9e07e00f4b7151a6ac0080169429d07c9e897d3929b4e76736fa7d3dcb0c8ea4f727588a97f3ba4ed7c7c9c34f726986723806c92c57db0933745df5b7bfe910

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
28KB

MD5
75f59c5c89f99ebe2fa8568b6fa79b8a

SHA1
e80a7b4aa9db2bc85c296ed51e61a3ab8715caa1

SHA256
ad6d63dd0986ce1faf45f4bfdfc77ebfc6b724228dd8c99065886b2c638b7503

SHA512
84d37c1cc288c2c55b15c7df0b14bc4554ab34f1f3cef41bd25a44cbd7d0cbbaaf5bd7cba038d6b9391457bf19147462318109c2cfd83759e33d759f258187fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
15KB

MD5
c497dfb098c3e91a979dfa02ec742de4

SHA1
dd0cf81fcb60902d24b28be73a509cdfcd6a2590

SHA256
2b5e00a8468ca9500b876e4245fd79bd8edc3d5d5c28ba3645b7543eea9c9c56

SHA512
7d71af0e62d6f0579c24f556f2c0173af98dee3406391b3852c508e86795e35efe3dfae54eb6cb66432b43e803d48e4d52ecfb499bf4eeb61b29d6a7a4085691

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
37KB

MD5
f8c2171b3dfb932c6fac253c1de4b532

SHA1
43929fe255b9ee4f7a0ffb70dbbe6833e749812c

SHA256
7eb74db2dec3d25b0b6b0cfef4467f55d1d23e3433426206a1711f4dbb74148f

SHA512
04161f5773cb44ee1580e8f5da79e152fca36b8f94f30deb1e6ec183cee087163a9f96e74b791d23cf0c9fe99241efbf0194fa0b46250266c316f51bcfe50a1e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
95e2737873a58b1de491b78d965d1b8e

SHA1
7ae7b2dc9557962b33c3ea02997b54f88cf99d80

SHA256
f81310b84da3f3826860155ab322503f674045cc0eb98006e4571cd674a61faf

SHA512
04b4cc3fd6b657d0ba05f9333303bf06658a95f757b4a8e0ccd1a18a281548f72d6894cb14cc28176285487530cb7c22b118a50545c836531ba876f777bad837

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe588c3d.TMP

Filesize
48B

MD5
19c039f86b2088b0683f4a82e48583f4

SHA1
8adfd944bf266e9f069a1ea64fb240110c872a1e

SHA256
ccd908653660def8158499f6ed8677451153547530b9a7989e0d7df606e6cc08

SHA512
beef40f8e976de4c72dcc91ca842ebe00cdf0b379f07a4d2981fa009919c01e150de9adca3e8346a4319c6b6869452b1f105e3869e5f6c37e79280a31a04030c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
1facac2dd1e75e60f34ccaba6ea4c463

SHA1
3c1dcae678864c9a57290a702dee9963148e943b

SHA256
9517a70fdf3b88b8520cfa99d7520e0922c62c1e3797aa7216ff118416b62069

SHA512
427c8958ee752778448f223bcfa1c651114d3f17b50bedaf39d3458972af3a85ffcee435a0565577d00f1b2915796dcfdc26b8650317a397625b63e60ff14756

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\IndexedDB\indexeddb.leveldb\MANIFEST-000001

Filesize
23B

MD5
3fd11ff447c1ee23538dc4d9724427a3

SHA1
1335e6f71cc4e3cf7025233523b4760f8893e9c9

SHA256
720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed

SHA512
10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
467B

MD5
18ee4d83a615525ce7e539fb88bda41a

SHA1
066a637b2fadd49f1dd31ec7e2d805ae47abd5af

SHA256
5f6a33802947cd2dd0679fd2a36c29120edc4a919f9893a12003bae180f2ec1d

SHA512
6e1ba2f8294651d9e6b266aad83ef92637e630e36eab8031dbf5a0466c146ac7ee78d7fe1fa4893b73bd06b1c433becbdbb5077e93f26f82c4092b58a4d5bd37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
900B

MD5
ba23f1aa0435752903126c9c41c8f358

SHA1
e16c161b5b5a96fcda2a9078ef5fe2851fbb4d49

SHA256
7cdc122bae9cf68fd6ad732979c25b1f6b2a96fc8635c23c26c117a6b8496fe1

SHA512
ea5e3046e18f47e09af873a6df44259ebcf3db0963d79ebd166c190ca666bc6ec129e024e4c03e50af50edb9afab65263fdac9ee3b1fd8c5345478aa6789a51f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
20KB

MD5
52bee438d64434b61427c7da602c15e9

SHA1
df898eea5775125bfe95ee22dbe8b6d310eb317a

SHA256
d4fde593996f34f4e8838bad2f1ae37341ec1cd5df59497038368c47e781a182

SHA512
75281842fe45eab7a8ea0b247cfcb971e663b8f8a8a5779ebbd1623363abed06ba4be612f05ce415dc20cf09af1f0ede5fa354c2f3f0a4b9413b62d7f5f9f582

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
22KB

MD5
3f8927c365639daa9b2c270898e3cf9d

SHA1
c8da31c97c56671c910d28010f754319f1d90fa6

SHA256
fc80d48a732def35ab6168d8fd957a6f13f3c912d7f9baf960c17249e4a9a1f2

SHA512
d75b93f30989428883cb5e76f6125b09f565414cf45d59053527db48c6cf2ac7f54ed9e8f6a713c855cd5d89531145592ef27048cf1c0f63d7434cfb669dbd72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
3aa33149483ec14876e0e5f593c14417

SHA1
21b1afb6518ba7f74c951e1eafcbdd0788ce5781

SHA256
64b0886e9e7df07f9f31b65e1dc4bb58488323bf6f972bbcc1bc811311291b48

SHA512
41df4305a2b7441c08d8bf46b437d4f0fcf3b14abfa85a3982708bcd14465f723ba71e6492ead5312d3b506635603836fde4c659e6e3da86d823d81f9a0b03dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
55KB

MD5
cef626f4a6746513a8a06a262de1e685

SHA1
7f2f74146e201a31d2e427a1677cb93c1fc82062

SHA256
a5f5e7139c5667d2a1882646a7108de3e627020391ac6c951996b9938ce4ccc7

SHA512
db247cee668555f5308ffd0efad87dce7c5035c333e130cf62bd5532b5e7036cb40155d78f1d548cbff309f0ac3a2bf6a50b384217694f0f52bd7f0185f8a1d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
41KB

MD5
739c9dc4a2d0d21123a48d477384e483

SHA1
dbc749f8b09b8f7c009341b01711675b3061c97b

SHA256
e292a50c012351fef82007a0b1046f5cc96d14b04a8a44edddc9c8611a1881e8

SHA512
a48945aff144d990d6ceee4dce5e417c758505c17a47df1e2f09af036ad6f5ed671eb5d68f03a08b5af2bb938a1f38173424763885c95ab882c1f2874c37ad0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
49KB

MD5
0552bafe9b93b1e31ab80d9cd8cbcb72

SHA1
5a59bf00959888554c61728e14b77139c43b2e45

SHA256
331f8d1e5f86749faf663eb19cd9aa9a7c357e129e5355cca755c9fbe3c9cff4

SHA512
25049877a04fe882ab7173b3f5f4f9826460882a0c748889ed86a2722d7802afc4410cf4ebe03638c3b5669f096a46e88e318e2c23513b19392899cae287c4ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
55KB

MD5
8d80bf8f42977d3edc03ee4b5b7a431e

SHA1
c013ced92c2544b2702b8b9962c1590fff18e110

SHA256
ddabbd035ddaa0fc32a9e007a3ba3396321433f3e830a30abf25dbc4bf93f508

SHA512
053cdda3b800ab1a5ac4259593986993a978b2ac6948d218e6b5468335414a36664181b5dd9c6c14de7ff605b8b6e93693c0f30f569a5837c4b1acb1fe53e212

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
beecaf1d316e791f7f839dada35c5408

SHA1
281ef9c2367e638fc0ad2e87a93ccdc1f527b236

SHA256
9f4a73d6297077006b43d1a8df6c18854b6b954f1eabf609e873faff3aebe7a1

SHA512
7e579150407f41fd641b650fc13a0efcf7770fc714cdeb25e4ac5e0a5403f07588870455f249d6624cfba89ea51c2374bb871732f09c0e376b3eb9fb5c86ddf5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5821fa.TMP

Filesize
392B

MD5
b819048200220b06314e6528e100fea6

SHA1
c3ba56362f7d89627d0c1403391aa5aa59375aad

SHA256
3f388807b36aaa36a4c9534b0ec35df34de446370ce759513a0d3b1c980c18e6

SHA512
b43287ab929f9c85a44b6c11d7d2f3bf21543db51773de2dc772f58efcdbac0578b5aceee7e6ef604817c30cecc4b6b00ca84a5fa0b4234e8d36358c572a7453

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2025.4.18.1\typosquatting_list.pb

Filesize
623KB

MD5
9cc0b895391b57b727aa33c9726290fc

SHA1
5d0e6946979b7cae22fd9a02e1df69e1fdb73624

SHA256
ee177ed63dc6421b74f786428dce7ab84f06e2d565399f96fc8c5a2186f6a9ef

SHA512
af3137e5b62e207616c441425cdfa22d5bcb9e195ab2d59dba43b39f857e8ecd85b30aec9e45f5a7b6dc6470f073c1e0c2203dc8e3b384eebdeaf44d84f2e8d3

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3956_1083836537\manifest.json

Filesize
118B

MD5
95be3969ec6c6f9649430a301555a1f7

SHA1
49e369ec2e3b392879d6fbeaaa6752705044bf50

SHA256
e00d423af4689db6f1b2efbd5e338f260bf1ed6799746855471e6006464a2216

SHA512
ccf958beaf2890e878aa927ceec5dc78a680317662398c7e450f707b7f6403f44eaf1dc757692c02f09c590d5800c33c6963f60c3bfa02ae7844d66080418e29

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3956_54829191\deny_domains.list

Filesize
12B

MD5
085a334bdb7c8e27b7d925a596bfc19a

SHA1
1e4ad53dc335af5c6a8da2e4b4a175f37fafe2f2

SHA256
f51a7acfffec56d6751561966d947d3fd199b74528c07dabdcf5fcb33d5b2e85

SHA512
c883cb43c97a136825c6fd143f539210c234c66f9b76dfd8431f6ff014094e20b9410d7462aadee2344df8ca158def6b9a807e7cadbdfa947f6f8592e7283e34

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3956_54829191\manifest.json

Filesize
176B

MD5
6607494855f7b5c0348eecd49ef7ce46

SHA1
2c844dd9ea648efec08776757bc376b5a6f9eb71

SHA256
37c30639ea04878b9407aecbcea4848b033e4548d5023ce5105ea79cab2c68dd

SHA512
8cb60725d958291b9a78c293992768cb03ff53ab942637e62eb6f17d80e0864c56a9c8ccafbc28246e9ce1fdb248e8d071d76764bcaf0243397d0f0a62b4d09a

Download Submit
memory/1544-19-0x0000000000520000-0x000000000052D000-memory.dmp

Filesize
52KB

Download
memory/1544-28-0x0000000000520000-0x000000000052D000-memory.dmp

Filesize
52KB

Download
memory/1740-25-0x0000000000A70000-0x0000000000A7D000-memory.dmp

Filesize
52KB

Download
memory/1740-13-0x0000000000A70000-0x0000000000A7D000-memory.dmp

Filesize
52KB

Download
memory/1740-14-0x0000000000A80000-0x0000000000A8D000-memory.dmp

Filesize
52KB

Download
memory/1740-18-0x0000000000A80000-0x0000000000A8D000-memory.dmp

Filesize
52KB

Download
memory/2860-0-0x0000000000660000-0x000000000066D000-memory.dmp

Filesize
52KB

Download
memory/2860-12-0x0000000000660000-0x000000000066D000-memory.dmp

Filesize
52KB

Download
memory/2860-1-0x0000000000C80000-0x0000000000C8D000-memory.dmp

Filesize
52KB

Download
memory/2860-5-0x0000000000C80000-0x0000000000C8D000-memory.dmp

Filesize
52KB

Download
memory/5740-6-0x0000000000550000-0x000000000055D000-memory.dmp

Filesize
52KB

Download
memory/5740-26-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/5740-11-0x00000000009B0000-0x00000000009BD000-memory.dmp

Filesize
52KB

Download
memory/5740-27-0x0000000000550000-0x000000000055D000-memory.dmp

Filesize
52KB

Download
memory/5740-7-0x00000000009B0000-0x00000000009BD000-memory.dmp

Filesize
52KB

Download