lumma | hxxps://www[.]mediafire[.]com/file/mh6hciwokzzgmlv/De%255Ber%255D-Ma3g%255B2%255D[.]zip/file

Resubmissions

01/07/2025, 04:34

250701-e7gsvaar8t10

01/07/2025, 04:30

250701-e4yl7az1gw10

Analysis

max time kernel
168s
max time network
169s
platform
windows10-2004_x64
resource
win10v2004-20250610-en
resource tags

arch:x64arch:x86image:win10v2004-20250610-enlocale:en-usos:windows10-2004-x64system
submitted
01/07/2025, 04:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.mediafire.com/file/mh6hciwokzzgmlv/De%255Ber%255D-Ma3g%255B2%255D.zip/file
Sample250701-e7gsvaar8t

Score

10^/10

lumma discovery spyware stealer

Malware Config

Extracted

Family

lumma

https://rbmlh.xyz/lakd
https://pacwpw.xyz/qwpr
https://comkxjs.xyz/taox
https://unurew.xyz/anhd
https://trsuv.xyz/gait
https://sqgzl.xyz/taoa
https://cexpxg.xyz/airq
https://urarfx.xyz/twox
https://liaxn.xyz/nbzh

Attributes

build_id
dcff3cc529769dc86bb8ff3a2161337dd6ff6f9bf6236c4a9c

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2376 set thread context of 5848	2376	Pla[3]r_1.exe	171

Drops file in Program Files directory 17 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2456_1325602730\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2456_1968440565\nav_config.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2456_1968440565\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2456_159686595\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2456_159686595\office_endpoints_list.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2456_1296607291\sets.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2456_1325602730\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2456_1968440565\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2456_1296607291\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2456_159686595\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2456_1296607291\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2456_846950790\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2456_846950790\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2456_1325602730\protocols.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2456_1296607291\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2456_1296607291\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2456_159686595\smart_switch_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133958181254451137"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2866795425-63786011-2927312124-1000\{6962E37C-A407-48FF-A7AD-B2689BAFA6BB}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2866795425-63786011-2927312124-1000\{02F006CB-90F5-4E8C-80FE-496BB5983F7D}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2866795425-63786011-2927312124-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2866795425-63786011-2927312124-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
5848	MSBuild.exe
5848	MSBuild.exe
5848	MSBuild.exe
5848	MSBuild.exe
5848	MSBuild.exe
5848	MSBuild.exe
5848	MSBuild.exe
5848	MSBuild.exe
2488	chrome.exe
2488	chrome.exe
6328	msedge.exe
6328	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
6552	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 26 IoCs

pid	Process
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2488	chrome.exe
2488	chrome.exe
2488	chrome.exe
2488	chrome.exe
2488	chrome.exe
2488	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeImpersonatePrivilege	5848	MSBuild.exe
Token: SeImpersonatePrivilege	5848	MSBuild.exe
Token: SeShutdownPrivilege	2488	chrome.exe
Token: SeCreatePagefilePrivilege	2488	chrome.exe
Token: SeShutdownPrivilege	2488	chrome.exe
Token: SeCreatePagefilePrivilege	2488	chrome.exe
Token: SeShutdownPrivilege	2488	chrome.exe
Token: SeCreatePagefilePrivilege	2488	chrome.exe
Token: SeShutdownPrivilege	2488	chrome.exe
Token: SeCreatePagefilePrivilege	2488	chrome.exe
Token: SeShutdownPrivilege	2488	chrome.exe
Token: SeCreatePagefilePrivilege	2488	chrome.exe
Token: SeShutdownPrivilege	2488	chrome.exe
Token: SeCreatePagefilePrivilege	2488	chrome.exe
Token: SeShutdownPrivilege	2488	chrome.exe
Token: SeCreatePagefilePrivilege	2488	chrome.exe
Token: SeShutdownPrivilege	2488	chrome.exe
Token: SeCreatePagefilePrivilege	2488	chrome.exe
Token: SeShutdownPrivilege	2488	chrome.exe
Token: SeCreatePagefilePrivilege	2488	chrome.exe
Token: SeShutdownPrivilege	2488	chrome.exe
Token: SeCreatePagefilePrivilege	2488	chrome.exe
Token: SeShutdownPrivilege	2488	chrome.exe
Token: SeCreatePagefilePrivilege	2488	chrome.exe
Token: SeShutdownPrivilege	2488	chrome.exe
Token: SeCreatePagefilePrivilege	2488	chrome.exe
Token: SeShutdownPrivilege	2488	chrome.exe
Token: SeCreatePagefilePrivilege	2488	chrome.exe
Token: SeShutdownPrivilege	2488	chrome.exe
Token: SeCreatePagefilePrivilege	2488	chrome.exe
Token: SeShutdownPrivilege	2488	chrome.exe
Token: SeCreatePagefilePrivilege	2488	chrome.exe
Token: SeShutdownPrivilege	2488	chrome.exe
Token: SeCreatePagefilePrivilege	2488	chrome.exe
Token: SeShutdownPrivilege	2488	chrome.exe
Token: SeCreatePagefilePrivilege	2488	chrome.exe
Token: SeShutdownPrivilege	2488	chrome.exe
Token: SeCreatePagefilePrivilege	2488	chrome.exe
Token: SeShutdownPrivilege	2488	chrome.exe
Token: SeCreatePagefilePrivilege	2488	chrome.exe
Token: SeShutdownPrivilege	2488	chrome.exe
Token: SeCreatePagefilePrivilege	2488	chrome.exe
Token: SeShutdownPrivilege	2488	chrome.exe
Token: SeCreatePagefilePrivilege	2488	chrome.exe
Token: SeShutdownPrivilege	2488	chrome.exe
Token: SeCreatePagefilePrivilege	2488	chrome.exe
Token: SeShutdownPrivilege	2488	chrome.exe
Token: SeCreatePagefilePrivilege	2488	chrome.exe
Token: SeShutdownPrivilege	2488	chrome.exe
Token: SeCreatePagefilePrivilege	2488	chrome.exe
Token: SeShutdownPrivilege	2488	chrome.exe
Token: SeCreatePagefilePrivilege	2488	chrome.exe
Token: SeShutdownPrivilege	2488	chrome.exe
Token: SeCreatePagefilePrivilege	2488	chrome.exe
Token: SeShutdownPrivilege	2488	chrome.exe
Token: SeCreatePagefilePrivilege	2488	chrome.exe
Token: SeShutdownPrivilege	2488	chrome.exe
Token: SeCreatePagefilePrivilege	2488	chrome.exe
Token: SeShutdownPrivilege	2488	chrome.exe
Token: SeCreatePagefilePrivilege	2488	chrome.exe
Token: SeShutdownPrivilege	2488	chrome.exe
Token: SeCreatePagefilePrivilege	2488	chrome.exe
Token: SeShutdownPrivilege	2488	chrome.exe
Token: SeCreatePagefilePrivilege	2488	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2488	chrome.exe
2488	chrome.exe
2488	chrome.exe
2488	chrome.exe
2488	chrome.exe
2488	chrome.exe
2488	chrome.exe
2488	chrome.exe
2488	chrome.exe
2488	chrome.exe
2488	chrome.exe
2488	chrome.exe
2488	chrome.exe
2488	chrome.exe
2488	chrome.exe
2488	chrome.exe
2488	chrome.exe
2488	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2488	chrome.exe
2488	chrome.exe
2488	chrome.exe
2488	chrome.exe
2488	chrome.exe
2488	chrome.exe
2488	chrome.exe
2488	chrome.exe
2488	chrome.exe
2488	chrome.exe
2488	chrome.exe
2488	chrome.exe
2488	chrome.exe
2488	chrome.exe
2488	chrome.exe
2488	chrome.exe
2488	chrome.exe
2488	chrome.exe
2488	chrome.exe
2488	chrome.exe
2488	chrome.exe
2488	chrome.exe
2488	chrome.exe
2488	chrome.exe

Suspicious use of SetWindowsHookEx 17 IoCs

pid	Process
6552	OpenWith.exe
6552	OpenWith.exe
6552	OpenWith.exe
6552	OpenWith.exe
6552	OpenWith.exe
6552	OpenWith.exe
6552	OpenWith.exe
6552	OpenWith.exe
6552	OpenWith.exe
6552	OpenWith.exe
6552	OpenWith.exe
6552	OpenWith.exe
6552	OpenWith.exe
6552	OpenWith.exe
6552	OpenWith.exe
6552	OpenWith.exe
6552	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2456 wrote to memory of 2088	2456	msedge.exe	88
PID 2456 wrote to memory of 2088	2456	msedge.exe	88
PID 2456 wrote to memory of 2580	2456	msedge.exe	89
PID 2456 wrote to memory of 2580	2456	msedge.exe	89
PID 2456 wrote to memory of 2156	2456	msedge.exe	91
PID 2456 wrote to memory of 2156	2456	msedge.exe	91
PID 2456 wrote to memory of 2156	2456	msedge.exe	91
PID 2456 wrote to memory of 2156	2456	msedge.exe	91
PID 2456 wrote to memory of 2156	2456	msedge.exe	91
PID 2456 wrote to memory of 2156	2456	msedge.exe	91
PID 2456 wrote to memory of 2156	2456	msedge.exe	91
PID 2456 wrote to memory of 2156	2456	msedge.exe	91
PID 2456 wrote to memory of 2156	2456	msedge.exe	91
PID 2456 wrote to memory of 2156	2456	msedge.exe	91
PID 2456 wrote to memory of 2156	2456	msedge.exe	91
PID 2456 wrote to memory of 2156	2456	msedge.exe	91
PID 2456 wrote to memory of 2156	2456	msedge.exe	91
PID 2456 wrote to memory of 2156	2456	msedge.exe	91
PID 2456 wrote to memory of 2156	2456	msedge.exe	91
PID 2456 wrote to memory of 2156	2456	msedge.exe	91
PID 2456 wrote to memory of 2156	2456	msedge.exe	91
PID 2456 wrote to memory of 2156	2456	msedge.exe	91
PID 2456 wrote to memory of 2156	2456	msedge.exe	91
PID 2456 wrote to memory of 2156	2456	msedge.exe	91
PID 2456 wrote to memory of 2156	2456	msedge.exe	91
PID 2456 wrote to memory of 2156	2456	msedge.exe	91
PID 2456 wrote to memory of 2156	2456	msedge.exe	91
PID 2456 wrote to memory of 2156	2456	msedge.exe	91
PID 2456 wrote to memory of 2156	2456	msedge.exe	91
PID 2456 wrote to memory of 2156	2456	msedge.exe	91
PID 2456 wrote to memory of 2156	2456	msedge.exe	91
PID 2456 wrote to memory of 2156	2456	msedge.exe	91
PID 2456 wrote to memory of 2156	2456	msedge.exe	91
PID 2456 wrote to memory of 2156	2456	msedge.exe	91
PID 2456 wrote to memory of 2156	2456	msedge.exe	91
PID 2456 wrote to memory of 2156	2456	msedge.exe	91
PID 2456 wrote to memory of 2156	2456	msedge.exe	91
PID 2456 wrote to memory of 2156	2456	msedge.exe	91
PID 2456 wrote to memory of 2156	2456	msedge.exe	91
PID 2456 wrote to memory of 2156	2456	msedge.exe	91
PID 2456 wrote to memory of 2156	2456	msedge.exe	91
PID 2456 wrote to memory of 2156	2456	msedge.exe	91
PID 2456 wrote to memory of 2156	2456	msedge.exe	91
PID 2456 wrote to memory of 2156	2456	msedge.exe	91
PID 2456 wrote to memory of 2156	2456	msedge.exe	91
PID 2456 wrote to memory of 2156	2456	msedge.exe	91
PID 2456 wrote to memory of 2156	2456	msedge.exe	91
PID 2456 wrote to memory of 2156	2456	msedge.exe	91
PID 2456 wrote to memory of 2156	2456	msedge.exe	91
PID 2456 wrote to memory of 2156	2456	msedge.exe	91
PID 2456 wrote to memory of 2156	2456	msedge.exe	91
PID 2456 wrote to memory of 2156	2456	msedge.exe	91
PID 2456 wrote to memory of 2156	2456	msedge.exe	91
PID 2456 wrote to memory of 2156	2456	msedge.exe	91
PID 2456 wrote to memory of 2156	2456	msedge.exe	91
PID 2456 wrote to memory of 2156	2456	msedge.exe	91
PID 2456 wrote to memory of 2156	2456	msedge.exe	91
PID 2456 wrote to memory of 2156	2456	msedge.exe	91
PID 2456 wrote to memory of 2156	2456	msedge.exe	91
PID 2456 wrote to memory of 4272	2456	msedge.exe	90
PID 2456 wrote to memory of 4272	2456	msedge.exe	90
PID 2456 wrote to memory of 4272	2456	msedge.exe	90
PID 2456 wrote to memory of 4272	2456	msedge.exe	90
PID 2456 wrote to memory of 4272	2456	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.mediafire.com/file/mh6hciwokzzgmlv/De%255Ber%255D-Ma3g%255B2%255D.zip/file
1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2c8,0x2cc,0x2d0,0x2c4,0x2e4,0x7ff8012bf208,0x7ff8012bf214,0x7ff8012bf220
  2⤵
  PID:2088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1748,i,4631127969678760763,8965091788581176366,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  PID:2580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2192,i,4631127969678760763,8965091788581176366,262144 --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:2
  2⤵
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=1924,i,4631127969678760763,8965091788581176366,262144 --variations-seed-version --mojo-platform-channel-handle=2468 /prefetch:8
  2⤵
  PID:2156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3492,i,4631127969678760763,8965091788581176366,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3448,i,4631127969678760763,8965091788581176366,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:1124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4216,i,4631127969678760763,8965091788581176366,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:1
  2⤵
  PID:3596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=4268,i,4631127969678760763,8965091788581176366,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:2
  2⤵
  PID:3876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5196,i,4631127969678760763,8965091788581176366,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  PID:1896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5372,i,4631127969678760763,8965091788581176366,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:8
  2⤵
  PID:2528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5104,i,4631127969678760763,8965091788581176366,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:8
  2⤵
  PID:1984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5388,i,4631127969678760763,8965091788581176366,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:8
  2⤵
  PID:988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --field-trial-handle=5392,i,4631127969678760763,8965091788581176366,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:1
  2⤵
  PID:812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=5264,i,4631127969678760763,8965091788581176366,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:1
  2⤵
  PID:4156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=5916,i,4631127969678760763,8965091788581176366,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:1
  2⤵
  PID:2228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=6744,i,4631127969678760763,8965091788581176366,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:1
  2⤵
  PID:692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --field-trial-handle=6360,i,4631127969678760763,8965091788581176366,262144 --variations-seed-version --mojo-platform-channel-handle=6812 /prefetch:1
  2⤵
  PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --field-trial-handle=7012,i,4631127969678760763,8965091788581176366,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:1
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --field-trial-handle=6452,i,4631127969678760763,8965091788581176366,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:1
  2⤵
  PID:1400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6472,i,4631127969678760763,8965091788581176366,262144 --variations-seed-version --mojo-platform-channel-handle=7036 /prefetch:8
  2⤵
  PID:688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --field-trial-handle=7484,i,4631127969678760763,8965091788581176366,262144 --variations-seed-version --mojo-platform-channel-handle=7504 /prefetch:1
  2⤵
  PID:3540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --field-trial-handle=7908,i,4631127969678760763,8965091788581176366,262144 --variations-seed-version --mojo-platform-channel-handle=7928 /prefetch:1
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --field-trial-handle=5952,i,4631127969678760763,8965091788581176366,262144 --variations-seed-version --mojo-platform-channel-handle=7788 /prefetch:1
  2⤵
  PID:320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --field-trial-handle=8188,i,4631127969678760763,8965091788581176366,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:1
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --field-trial-handle=3564,i,4631127969678760763,8965091788581176366,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:1
  2⤵
  PID:5308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=8444,i,4631127969678760763,8965091788581176366,262144 --variations-seed-version --mojo-platform-channel-handle=8480 /prefetch:8
  2⤵
  - Modifies registry class
  PID:5612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=8436,i,4631127969678760763,8965091788581176366,262144 --variations-seed-version --mojo-platform-channel-handle=8456 /prefetch:8
  2⤵
  PID:5620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --field-trial-handle=8664,i,4631127969678760763,8965091788581176366,262144 --variations-seed-version --mojo-platform-channel-handle=8648 /prefetch:1
  2⤵
  PID:5648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7432,i,4631127969678760763,8965091788581176366,262144 --variations-seed-version --mojo-platform-channel-handle=9104 /prefetch:8
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=8076,i,4631127969678760763,8965091788581176366,262144 --variations-seed-version --mojo-platform-channel-handle=9264 /prefetch:8
  2⤵
  PID:5932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=8004,i,4631127969678760763,8965091788581176366,262144 --variations-seed-version --mojo-platform-channel-handle=8044 /prefetch:8
  2⤵
  PID:3584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7968,i,4631127969678760763,8965091788581176366,262144 --variations-seed-version --mojo-platform-channel-handle=7900 /prefetch:8
  2⤵
  PID:5220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7956,i,4631127969678760763,8965091788581176366,262144 --variations-seed-version --mojo-platform-channel-handle=7988 /prefetch:8
  2⤵
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=8076,i,4631127969678760763,8965091788581176366,262144 --variations-seed-version --mojo-platform-channel-handle=9264 /prefetch:8
  2⤵
  PID:6080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --field-trial-handle=6672,i,4631127969678760763,8965091788581176366,262144 --variations-seed-version --mojo-platform-channel-handle=6708 /prefetch:1
  2⤵
  PID:5832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=9092,i,4631127969678760763,8965091788581176366,262144 --variations-seed-version --mojo-platform-channel-handle=9064 /prefetch:8
  2⤵
  PID:2552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6504,i,4631127969678760763,8965091788581176366,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:8
  2⤵
  PID:1948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7832,i,4631127969678760763,8965091788581176366,262144 --variations-seed-version --mojo-platform-channel-handle=7816 /prefetch:8
  2⤵
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7884,i,4631127969678760763,8965091788581176366,262144 --variations-seed-version --mojo-platform-channel-handle=9372 /prefetch:8
  2⤵
  PID:5336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6432,i,4631127969678760763,8965091788581176366,262144 --variations-seed-version --mojo-platform-channel-handle=8684 /prefetch:8
  2⤵
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=8160,i,4631127969678760763,8965091788581176366,262144 --variations-seed-version --mojo-platform-channel-handle=7076 /prefetch:8
  2⤵
  PID:6092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=8236,i,4631127969678760763,8965091788581176366,262144 --variations-seed-version --mojo-platform-channel-handle=7532 /prefetch:8
  2⤵
  PID:5580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7252,i,4631127969678760763,8965091788581176366,262144 --variations-seed-version --mojo-platform-channel-handle=8080 /prefetch:8
  2⤵
  PID:5412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --field-trial-handle=7536,i,4631127969678760763,8965091788581176366,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:1
  2⤵
  PID:320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5680,i,4631127969678760763,8965091788581176366,262144 --variations-seed-version --mojo-platform-channel-handle=5712 /prefetch:8
  2⤵
  PID:2204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=9356,i,4631127969678760763,8965091788581176366,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:8
  2⤵
  PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7888,i,4631127969678760763,8965091788581176366,262144 --variations-seed-version --mojo-platform-channel-handle=7676 /prefetch:8
  2⤵
  PID:1924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5940,i,4631127969678760763,8965091788581176366,262144 --variations-seed-version --mojo-platform-channel-handle=872 /prefetch:8
  2⤵
  PID:5768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3996,i,4631127969678760763,8965091788581176366,262144 --variations-seed-version --mojo-platform-channel-handle=7708 /prefetch:8
  2⤵
  PID:6544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1660,i,4631127969678760763,8965091788581176366,262144 --variations-seed-version --mojo-platform-channel-handle=7700 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=9064,i,4631127969678760763,8965091788581176366,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:8
  2⤵
  PID:6628

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:3188

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4632

C:\Users\Admin\Documents\De[er]-Ma3g[1]\Pla[3]r_1.exe
"C:\Users\Admin\Documents\De[er]-Ma3g[1]\Pla[3]r_1.exe"
1⤵
- Suspicious use of SetThreadContext
PID:2376
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5848

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffffc7bdcf8,0x7ffffc7bdd04,0x7ffffc7bdd10
  2⤵
  PID:5540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1976,i,7738590390499705637,9648895547020653014,262144 --variations-seed-version=20250610-050053.594000 --mojo-platform-channel-handle=1972 /prefetch:2
  2⤵
  PID:2844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1588,i,7738590390499705637,9648895547020653014,262144 --variations-seed-version=20250610-050053.594000 --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  PID:5920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2316,i,7738590390499705637,9648895547020653014,262144 --variations-seed-version=20250610-050053.594000 --mojo-platform-channel-handle=2512 /prefetch:8
  2⤵
  PID:5008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3152,i,7738590390499705637,9648895547020653014,262144 --variations-seed-version=20250610-050053.594000 --mojo-platform-channel-handle=3164 /prefetch:1
  2⤵
  PID:5420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3176,i,7738590390499705637,9648895547020653014,262144 --variations-seed-version=20250610-050053.594000 --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:4744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4376,i,7738590390499705637,9648895547020653014,262144 --variations-seed-version=20250610-050053.594000 --mojo-platform-channel-handle=4420 /prefetch:2
  2⤵
  PID:5716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4712,i,7738590390499705637,9648895547020653014,262144 --variations-seed-version=20250610-050053.594000 --mojo-platform-channel-handle=4728 /prefetch:1
  2⤵
  PID:3064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5352,i,7738590390499705637,9648895547020653014,262144 --variations-seed-version=20250610-050053.594000 --mojo-platform-channel-handle=5348 /prefetch:8
  2⤵
  PID:6288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5568,i,7738590390499705637,9648895547020653014,262144 --variations-seed-version=20250610-050053.594000 --mojo-platform-channel-handle=5360 /prefetch:8
  2⤵
  PID:6332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5652,i,7738590390499705637,9648895547020653014,262144 --variations-seed-version=20250610-050053.594000 --mojo-platform-channel-handle=5660 /prefetch:8
  2⤵
  PID:6496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5376,i,7738590390499705637,9648895547020653014,262144 --variations-seed-version=20250610-050053.594000 --mojo-platform-channel-handle=5424 /prefetch:8
  2⤵
  PID:6552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5760,i,7738590390499705637,9648895547020653014,262144 --variations-seed-version=20250610-050053.594000 --mojo-platform-channel-handle=5460 /prefetch:8
  2⤵
  PID:6604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5880,i,7738590390499705637,9648895547020653014,262144 --variations-seed-version=20250610-050053.594000 --mojo-platform-channel-handle=5464 /prefetch:8
  2⤵
  PID:6980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=5748,i,7738590390499705637,9648895547020653014,262144 --variations-seed-version=20250610-050053.594000 --mojo-platform-channel-handle=5784 /prefetch:1
  2⤵
  PID:1232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=240,i,7738590390499705637,9648895547020653014,262144 --variations-seed-version=20250610-050053.594000 --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:6728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5780,i,7738590390499705637,9648895547020653014,262144 --variations-seed-version=20250610-050053.594000 --mojo-platform-channel-handle=5768 /prefetch:8
  2⤵
  PID:6736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5936,i,7738590390499705637,9648895547020653014,262144 --variations-seed-version=20250610-050053.594000 --mojo-platform-channel-handle=5664 /prefetch:8
  2⤵
  PID:6600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=3224,i,7738590390499705637,9648895547020653014,262144 --variations-seed-version=20250610-050053.594000 --mojo-platform-channel-handle=4392 /prefetch:2
  2⤵
  PID:6544

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:5196

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:6376

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:6552
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Windows\Temp\_BDF31029-967F-457F-A0E4-13C7C266D589\WindowsUpdate.20250701.043520.687.1.etl
  2⤵
  PID:4436

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2456_1296607291\manifest.json
Size 84B
SHA256 2e9e6138305d702f3c9b89d6e9dc4931b548c69bb86db64e585fa2e37b8ef654
MD5 e0909520982fc48e47a6451443b11741
SHA1 0e46425274933c153ebf5a03f25e693267a8cea2
SHA512 3fdf504cb0bf39a807fa15a8ec31a6efd8083888692935ec31d70b4ef6eef89b8527c6a75a46bf7ae3efeeaa507ac3c7cccda5246a2f073ac603a7ffa10d20a8
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2456_159686595\manifest.json
Size 160B
SHA256 2a7fe18a087d8e8be847d9569420b6e8907917ff6ca0fa42be15d4e3653c8747
MD5 a24a1941bbb8d90784f5ef76712002f5
SHA1 5c2b6323c7ed8913b5d0d65a4d21062c96df24eb
SHA512 fd7dfec3d46b2af0bddb5aaeae79467507e0c29bab814007a39ea61231e76123659f18a453ed3feb25f16652a0c63c33545e2a0d419fafea89f563fca6a07ce2
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2456_1968440565\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2456_846950790\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 e86194a79c6f9963865ab72937766823849ff1afd99542fdeae74b222fd8319a
MD5 d2df88bf96756299e8fcc5f8e2fc9764
SHA1 6e388a9799066e2df4b62c3657004fbeec905e48
SHA512 1f23207addb54fdf7903d37e367b38c2e3ac7210eea33c82d6c57e7431ce63300aaeb13bbd342207cc7412a3bc793f335ee8c6d72f680ea07d655118d9a6a127
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 120B
SHA256 f197a470170488cbf68a3a6010ff8b1d0691e6064e80e2309a2fff76ec2b0273
MD5 987650ebdfad8ae6bab7813157617fe9
SHA1 e1129043bc0fe08b4004e91fc21a8a8aba36c960
SHA512 bcd81378b12523e0a650954a30ac23523ff89bcd9484ee4275ca6e3a33a8307fea79e85d232b8367c574dc10ffc1e2c64e3b1d7aa0dcd8651b157dbbb5d60d46
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.93.1_0\_locales\en\messages.json
Size 851B
SHA256 6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c
MD5 07ffbe5f24ca348723ff8c6c488abfb8
SHA1 6dc2851e39b2ee38f88cf5c35a90171dbea5b690
SHA512 7ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.93.1_0\_locales\en_US\messages.json
Size 1KB
SHA256 102b586b197ea7d6edfeb874b97f95b05d229ea6a92780ea8544c4ff1e6bc5b1
MD5 578215fbb8c12cb7e6cd73fbd16ec994
SHA1 9471d71fa6d82ce1863b74e24237ad4fd9477187
SHA512 e698b1a6a6ed6963182f7d25ac12c6de06c45d14499ddc91e81bdb35474e7ec9071cfebd869b7d129cb2cd127bc1442c75e408e21eb8e5e6906a607a3982b212
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.93.1_0\manifest.json
Size 2KB
SHA256 68d34f7e7c31f5b1470899153a5ed2eb041dcc847f3d891be865d7a6d7baabbd
MD5 173fa1cdfd63e5b8e31f4424cbd35e55
SHA1 4b0ff2fda24d130fd1530b410820ac86928a56ea
SHA512 616b4c6dbc45714a33e5ff3057c65492cdaf5cadb579e9acf74e04ac694ed1b4a25efdaab864c0515c81815a99a200c4fe51cee145baa124b83dc05ac27a65fa
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Platform Notifications\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 e5caf0c306812feb91a9fce78d4a6325ff595ed19e43374e007d495deca6034e
MD5 597a1124c0a75af8f6808f18258919e5
SHA1 cc59770a9ea90e5b3d85384d82b2e3f3b4fa4be4
SHA512 62a414758d47841ae93ba95724620281b6254a595711f499828a797249feeea40cb278ac7cff802337b1c6569cf6d2360092f81f3c8d75d22351ecb6a93c4b61
SSDEEP 192:2YqcBzxgbGM5Z8PRpWQ6HS+WN18XJ+ULgkwxM1ipQyIsnA/g4:2YqmzxhX3Ocm5+XrZ4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 5d8321ce6b287156569a37fcb075d4749d9907e59e248a8db0f034c32b0edb79
MD5 0eefe92696b99461360e81210bccdaa0
SHA1 d2c0113a7b6f3b6b10c9c8a7fa1ac82140f97487
SHA512 3822602a6ffafa13710558ec7ea1b05a7f48e387706eac869da46022ae536d6ebc0055873546698a72942c4c1c01310d32b9b625c9244958be0645fa8f2391d6
SSDEEP 192:2YqxgbGsN5Z8PRpW96HS+WNNAoJLgkwxM1ipQyIsnA/g4:2YqxFXoOcOoyrZ4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 18KB
SHA256 5ccc6b177a63b6d42b817454f3294cda63f8cef96611247cf34f3929b7d6b29c
MD5 8ed6b4ca40d4751379d6857163f9bab4
SHA1 5a0eb92e05ce7e983343cfe223c2dcf4b2f0a709
SHA512 b1e8f6246d59afc3f7711c78bb082505178ab1fc52bfb317b99ee1db11c32ee824d103e54a90a7e2e7ca39a2af9038b366c0ac9cedfda8466ea8d965e4fc2e7e
SSDEEP 384:OS/S7pLuLcnV7pLuLcgh2TXQtPkXqKf/pUZNCgVLH2Hf1CzrURQHGB7YyLPnN:O8S7pLuLIV7pLuLps7QtPkXqKf/pUZNi
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 15KB
SHA256 67ec664ec810351cea0f0b4f9434a9c71d246bfd561ccca02b54d0a36d18361c
MD5 5fb9f0adeac5e4ebfc7b0b95b30e0c30
SHA1 e6de83e6d61a536d0609b28a5d1ab24277d42db4
SHA512 7d746077c8b78082351086ae2078bd4961653b9a53fa2e0f45b3677431b58dbd183ceb7de0abfee8b930c981f368869e497e160be5cb8e994eafd38b0576fad3
SSDEEP 384:OSSd7pLuLcei2TXQtPkXqKf/pUZNCgVLH2Hf1CzrURQHGT77YyLPn7:O1d7pLuL7X7QtPkXqKf/pUZNCgVLH2HV
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 6696200795e698872a575f4cff383febde612647529c87ae65b4b1c4778d433f
MD5 6f041cbf1c0a3aa7b346ddffb2d00a9e
SHA1 746cbb2f8f94c8f8ba2ce5f1738c157c2e621ad5
SHA512 30a95eacafc7136effe458764ec23ed0be1f0f61e0c8f4f146832097f9c5f1fa46c176cf91aa55ed519da9abef9c5bd81b8786c98298ff9253d90f36546313a2
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 a6c51cbc2846ef9e13c269da74eae91d1bb3fe728652533d6e5bb91ad2f75c36
MD5 94f1a241d198cbb3e0c1f0896a36d3fb
SHA1 49b18ffbbe90fe9280ad7c38afaebe05c216b79d
SHA512 9aec2d6f6fbfb8a5962772adf75378cf1fd7044ebfb735fffda9261267992d26cffe91013f7e74197b9be8002b5f2860e267e4aafcb734c6bf0423572b33dbbd
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe59b6f2.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59b6f2.TMP
Size 48B
SHA256 2693164aa6fe1afe8a8442b285f7cc1eb60e6517bfd6a8962796f147c10a32a4
MD5 b83e4529f266611e5e42f5a1095f15b7
SHA1 9ccd818fc31c4a01ffa791fdbfa2eae093752d3f
SHA512 5ca4d28f5e63773c2934e1d9ff0665e888ae0df2ff83c2ed81044296f9beab5b10b368b99df7cbb6f41e8eec110aa5bbe746984b3052a20abf18895396caac6d
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 82KB
SHA256 a76c527c2b7fecdf42c7a0f34e4bac3ff2ba7d913784c2ecf946d9db512783e2
MD5 550a093f961eda411b02353668513d92
SHA1 d6643144235d32fe770376cc9cf5315b3069f0be
SHA512 81c4e92cc8a8f0b780585ef14a8873b5d55928958b56b6547041d3a29fade1cfaebfc0a4e861b4178d2b512a2975dcede08464f776a9748572b7fd7f004cee1c
SSDEEP 1536:7Vz0HcJMa/1EtZ4ldRrbfOGZifihNaJyXpk7Y/iv9t45jlt611bxow+96uQJN5:Bp1KZ4lDvNZ3hNpk8iv9t45ji11bin9W
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 163KB
SHA256 3d9b81b6701d8a9413c13a3e541832955ee6e793a4ccc856440795590dd26ead
MD5 3a34124b2c0a64c4fa10cdc4cf605be8
SHA1 dd94a734362923dc850972c2b31178d3476c7d30
SHA512 8fc9d5c2ffd7c70dd4e7774c94ab783731d5fc80e33411007beb448409baa8f213b9ea9ae5bf238ff812ac1908d2e358b8d3988e756ae30569d71d1853c0b17e
SSDEEP 3072:AwA+bDkpMHJ8XPGufJXOXNCsCmqmgKIu1KZ4lDvNZ3hNpk8iv9t45ji11bin96ul:A4b4pkanyFlgI02DlZ3Nk7t45u1eQTs
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a31c31deb75a4035a90889eeaabbe9ffff368b2085b2d629f382c48240177a1e
MD5 ee4716cfeb5c6fc8c889380fd64ef491
SHA1 20fe543b6f5d223ac3ed2aea0770ef2970b69fd8
SHA512 cfc43209921da873017e10c382db4ab62a0fa4aa23bd3153a9a3ed716ea2cca009deb1516060be8a21c8d73d91bda21efef31fe65122ae2a289b23170fd5b760
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d542d504cbb257433a63d6eb868681aa57d9357d2cfaa6c2124ba7fbbbf64147
MD5 ac4a6823c44d68abf467163503bfe0c6
SHA1 bb25bab63abd87c8768324ebc032e4e589c629ad
SHA512 780fad2d1793d7313948bbd13b266a197f13236e180c498e2fec7214f774b604c81ec7f5457c03afe7b05d0e46159a579bd5bdc5404c984e1110a7aea60cc5ed
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2aa2d3efb086d88b06b640e49aaa37eca46fd2ab53c636c393d0175e222677d4
MD5 ed9ede2d7825c67ca21802f89806aa25
SHA1 3d6c75b37811c27e2e93acb1b6572d9c547fa5d3
SHA512 b49f1950efaf857f9e658511a2e41dae51c97880851700b0f6d212645863469bb56b3078ac7242cb9d6760b7682acb09624c1c87088d8260a046d704d7a0972d
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 72e270c097dd7e1adf98d99b91bacabe7851874f1338cd37bd4d495538be2802
MD5 a617686cd2fc28948113b49020d6e87e
SHA1 87497e0224fc84b63a1fa75949333eec7fae3f62
SHA512 2aba168a1a22f8238f10e7fab71c0bdc670d16651538263562eecf42c052f0bc8befdf823cbef635d3c11fd14a680857f9a788a41a189b59e81b91a3eefb79ed
SSDEEP 96:B+1iGFNVrGqWwnAeu3i0JREgLWzgqf8TcXyga7EQ:B+1iGRrGqWveu/REgqzt9awQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index~RFe58773e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58773e.TMP
Size 3KB
SHA256 5689c842420acd4ea3fad9988ea428ff4d23ff61db5d865a7b08573ce4b792aa
MD5 03acd698b01c91f8ce52593f1302a4b6
SHA1 28803a3167eee860758935e8dcc951128fe745f0
SHA512 c753a2a3154a7e823e4b2bd12d895a204655b095b289db7770a87b59bd6c1c7573a2c8d54abd78da27cdadfc054ffede5cc28489fb086c9e944bd7eedd16d4d2
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 69KB
SHA256 b305e470fb9f8b69a8cd53b5a8ffb88538c9f6a9c7c2c194a226e8f6c9b53c17
MD5 164a788f50529fc93a6077e50675c617
SHA1 c53f6cd0531fd98d6abbd2a9e5fbb4319b221f48
SHA512 ec7d173b55283f3e59a468a0037921dc4e1bf3fab1c693330b9d8e5826273c917b374c4b802f3234bbb5e5e210d55e52351426867e0eb8c9f6fba1a053cb05d4
SSDEEP 1536:hAlMWz7vLDtDSVlXXwpFlorgLUxF+i2IFXaH5EoVDRnaXW:hvuWAUxFhFpoaXW
MD5 SHA1 SHA512 SSDEEP

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5 SHA1 SHA512 SSDEEP

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 224KB
SHA256 9717b7702bad38b161cbb2bd795755973994470fe4e1da1bb254db9533996a04
MD5 84a4b716ba022fe646fe56ba076e050a
SHA1 a63f2c4be0e242fdef2f5570e6839032aff8b924
SHA512 d69441895ba5499064961573fdc49af8887d0f04920e4bff4a5f309928f097b6252997652f4e60720e710252c2f2102d121d4e0ebcd351ba04cb0a0828ae716e
SSDEEP 768:iFVZH1FDBjuftNF1FXra8tcxFwmhZJZhZ/hZ2ZhZ/hZnZhZ:iFpF+F1FW8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 36KB
SHA256 9972a2170e1983a75f2288fe4b08f642c23ee7b228d13eab30fd2696bffd6ba7
MD5 33a8ba4057c09a9b4b44481e310b353a
SHA1 15adb56d1ad9c9435f6cf91fcf3fb9c261ab3e04
SHA512 9f76f86ead89f4b0fc5f1e21ccb814bc0868a9ee09bd75224ffc6c3bc8f260101c7f931d44e1b1f0e42dab1c28e8e003b6540bf1ea5aae4f705984c8dd10cdc1
SSDEEP 384:iSvcZLcBXFgFCaWTbHs79Yx3G8blzur7C:iPdcBXFEiHsxm3G8wC
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 19KB
SHA256 8cee5bd186e467817b75dd8a772adea8dfa1cd844315934215b3bb3a1eaf14ac
MD5 eea63957df37828e082514ec1a6ddbe2
SHA1 08516761d04b072dc6f8eadac23223be36d3fc19
SHA512 f2e3aa250af241c42888a1dd2648b070987375d325eef16a2af3d43c596666b2ad5dcf1c33739f824edcd2c03ffcd93a230f88d54d0a2e0b216d972a08e5c3ae
SSDEEP 384:ajn2m8I8FgJVU/etjfl8VRc8PW8x/4w8oaHBnhnpN8RXtkrwfUumdhmTFTVBavXo:xHiBaPFIDWlJEF+X
MD5 SHA1 SHA512 SSDEEP

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 bd922d536c4541e9932129d6484d1239f8f6363b469202b402bdf1199dde9cd7
MD5 d0aaff473853f441c858046859283407
SHA1 939fcd1c2521ba2ffabb8afb10010f8c69d384c2
SHA512 873461df4ae193af77da6e1c3bfb85f1b1d134dabb9398ba4ca9cefb1af1ee3acdeba34cc6f238eaa18f085ba8a0e84f70ae6cbbf23c22e8f63cb6195d701549
SSDEEP 384:sVUSi6PsHKdcsCcHSdw1JEj1mwgij8VI0AR:sfiTKdc8HSS7Ej1mcj8E
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 f7c07a9cb349e40986123d9354e088d4c5a8a8958267e47356068b11f975f11d
MD5 b7c8553d259b520e84f42bb467ad41e9
SHA1 4e25b8c37012b9c762ad7a92e5ce757aac0516b4
SHA512 5f14cedfed69ac5382ed3d9ea7346ae6cf59afe69a9947f1cb1abe235e9201d510da6932db7abb04811c1f9a57f113902586a25478f8035ae3a00fabe2c99a86
SSDEEP 384:sVUSa6PsHKdcWC6HSSw1UGEj1mwXWoij8V9PUAm:sfaTKdcMHSDSGEj1mOIj8u
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 8e75136cbcc61372e4414fc02ce228b47b5e9088b0887b3da1528ebfe6ad1ff1
MD5 ad5c05695a1c533374c0708fe4161748
SHA1 29cb883dde76f5967b978f948457724e95d3e98f
SHA512 e3ff4b3c0b20fd651ff1275da95b96666d8380561957d46cb8ae4db85888fd163b8a0e49b0c99a485fd7f3aa638cba156b2666d7fb1e527157ea87ce0845fbf3
SSDEEP 384:sVU2rpd6PsHKdphC6HS4w1hGEj1mwyWiij8V9P8Am:sHbTKdpjHSdHGEj1mpsj8e
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 20KB
SHA256 cb138c17c0f630e945e948596733eec60f06f2d8cb53e79dfb0d64a1f719b186
MD5 472f74930996412d19484b31e8bccdbe
SHA1 541ac45ac1da14a0db5fdf2081e4b4c7d46f2d76
SHA512 5ba6899f23bb50ff7bd3eebcbf13d79c677522e0bfbed2f75e57850ef3f830add11f087c1d5e0fd8f46e096aeb8648abc73c0e28def5b0eaaa7e7fa203fb8e35
SSDEEP 384:sVU2rpqc6PsHKdpoTHZ46HS4w1hGEj1mwyWiij8V9PlAk:sHMcTKdpGpHSdHGEj1mpsj8z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 504170a403ae7cdc0940367e7135a35a1c603fd2c6eebb7c3f3f10946299c493
MD5 9dff4af59c7409632696e61a8c49bffe
SHA1 a02ba7f311a0ef0b284efa03d0d2eb00c9b676af
SHA512 05f34d83e24ff8837693933bc919218dbfee6a6c113294baed1158a3965d7f3415e92cf968f5d9d37994ea0c7e41e174b8068b7640cbe49abacc0a2138273636
SSDEEP 768:04yQpsrWFflH/8F1+UoAYDCx9Tuqh0VfUC9xbog/OVisLlI+HfUro4lv:04yQpsrWFflH/u1jaxsLm4f/Mv
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 8344f0b459d477bc1d1c2324b18830e4879ea482c01656e0080017b6946b79d8
MD5 118ea3d18c1e77bffe3d2e1ed21c0193
SHA1 43d9f6bd04880188c2a984336ccd39a6b3797849
SHA512 4f336d25b27a348c2861b31f4e9747d9f119887f4c7c6d527214b62e7fa623dafa93f75451275d80013798c31963ef6106fa837c8c947a3342fdfa436aef2caa
SSDEEP 768:0htQ6RrWFflh/8F1+UoAYDCx9Tuqh0VfUC9xbog/OVoLrsLlI+HeUro46:0htQ6RrWFflh/u1jaPLrsLm4e/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 85b8b4f73c23349ef9d9aee52460a69ca7b7accd9008d51c2593f4f5a0352ccb
MD5 4401d859ceaba00b2c3fff7cbf64bd83
SHA1 99403d7d605e18a39fab6c6f902d2e226ebd4c86
SHA512 78c4c6e95ce086835b3916a1f01cfe36dd5d8c606de677525a1e587f894925d7657ca55df25ce440691c78da6afa4f05d3a3976fc3336f4fd86b7466387ff337
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe5873b4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5873b4.TMP
Size 48B
SHA256 2c7ec694ec021ae37bd526d29fbd8a7eba7291d23cbd28b5817eb249b7b786ff
MD5 f08da3e5e6da1215d98a22e2bf562489
SHA1 e47482490d9e9a83a114ff9afa5bf2afd9de4ddd
SHA512 d022487b65e675a3e3497310a9be347da2ac5a5916d091ca14700b75a29aad3295b3c8f1048bf19307799373605655766a65f0d9b5ea28e7bcf9fd0f6ee5062a
MD5 SHA1 SHA512

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 228KB
SHA256 4bd5eb66f73b9465c5d2ceef030525acb018f916a543030c809b63283257dba2
MD5 a23a70c3ec3d690515338e4fde7b36ba
SHA1 97e7ba1f36bfb4706433074dece5538fca21a272
SHA512 1bec7657dfa87ee8a76f4181a7aefcd84e3e5df0769df1a30fc0c0c08310d67d85b42b54ede51187f2978e3c4f5ee575aaff5d3c32ba96b16e16f2fa6bdc41ab
SSDEEP 192:51moNtKfT8a0QQnGzaW6qt8K+dJIhPJyiqzX1i+VpdssMV7due8FPu:b7qfQrQQnyn6qt8K+dJIhPJyvzl5cYP
MD5 SHA1 SHA512 SSDEEP

Submit Download

6f43a196-abcf-4cf5-85c6-fb96b38bbf7c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\6f43a196-abcf-4cf5-85c6-fb96b38bbf7c.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

CloudConfigLog

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog
Size 872B
SHA256 3e7ea7c71076f11746b5f7b24944fe065debaab276102275568594eb7a3d4d8c
MD5 073768eb479b19374c2dbffb74f270ea
SHA1 964563bfe77874c93adc7736e1c5f4e6af5456dc
SHA512 e6cac6ae0b9a8048eee4839ceadbca8231def2f242b29050918a919e9e68daf9cb073b56f84836eb12dd0cbfbfadad1c167bf476bcdd3777dbed3b9ad227aba9
MD5 SHA1 SHA512

Submit Download

CloudConfigLog

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog
Size 23KB
SHA256 d71f9bd804f627986ce844e08c6d84dda0466eed060bc0e9b67fc91daf1bf17a
MD5 7ee876de536e7d527b5766480e69aab5
SHA1 ad24caaccc81013fbd0376b98d6dc81e068b7113
SHA512 5eca469b343809d5c3ab0c7fed3d6936b0bb3887f60c3e778ddf85159b2887c09e65354fa99ff0eb90282b9d27f8e6b2e4beb13f3029129f73f9f9569abf79db
SSDEEP 384:kXJOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ub:OJOk/FY7/2lagbCtCkQ7wDlH/h+umbAy
MD5 SHA1 SHA512 SSDEEP

Submit Download

CloudConfigLog~RFe58a803.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog~RFe58a803.TMP
Size 465B
SHA256 090cc5889e798135253598619b1b6abe2a6f29648ec0b82311db4f3f7823b6b7
MD5 50b38dfdfc33251a2c42952a281ad971
SHA1 b4b910f8fe9ba03b6ab40afe6c91ed222a192231
SHA512 a58299d74f797dea5318ff26ccd6c3a49aa3a8d43dcf67c82b2ec303a9bc4c60703c5dcc11adab1f7a2eea65e882d3a741578286d421faed0e96398c248cefa1
MD5 SHA1 SHA512

Submit Download

office_endpoints_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2.0.0.0\office_endpoints_list.json
Size 3KB
SHA256 8480f3d58faa017896ba8239f3395e3551325d7a6466497a9a69bf182647b25e
MD5 94406cdd51b55c0f006cfea05745effb
SHA1 a15dc50ca0fd54d6f54fbc6e0788f6dcfc876cc9
SHA512 d4e621f57454fea7049cffc9cc3adfb0d8016360912e6a580f6fe16677e7dd7aa2ee0671cb3c5092a9435708a817f497c3b2cc7aba237d32dbdaae82f10591c3
MD5 SHA1 SHA512

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 13B
SHA256 01a3e5d854762d8fdd01b235ce536fde31bf9a6be0596c295e3cea9aaf40f3dd
MD5 3e45022839c8def44fd96e24f29a9f4b
SHA1 c798352b5a0860f8edfd5c1589cf6e5842c5c226
SHA512 2888982860091421f89f3d7444cacccb1938ef70fc084d3028d8a29021e6e1d83eaef62108eace2f0d590ed41ece0e443d8b564e9c9a860fc48d766edb1dc3d9
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 131d80364bd138f5660bc66840983c5dd9f62ffd755532e21127be458da879c2
MD5 194f3a2ac18bb721a3ba0984b5d70856
SHA1 65f3ecb7babf718911b1ac8045c93c3b384939ce
SHA512 1393e6a818da9be8a38330aee4ca65b6912deb4b8ec1dc9b8873711ab68decd923f90bf7702536e03959addf57fa9ebc4dec944db933df2f330788fea8faafbf
SSDEEP 192:zvmLsNbLdBhb9wuxWiRUBOIZZqrgatsiOLPf6k:zEsNbLR6upAOiHatozB
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 74f8dfb47947e6bc5bd64d5a0f2faa80fe5d4dae5b6ef8f556a09566fe26d781
MD5 14db2bf22f434c7982ae89f839e0af5a
SHA1 564d1657618acb89df1e19cc9540f96378da1f14
SHA512 629ff3fd4acd5f2a40ab22e6b7011ef8846f96cb85dd62fe30237eb30777fe3cbad87b1e6f65f35c1e163069f2e2675438cfa924b6daaf5a2fdd142a18c2ea08
SSDEEP 384:nsE6iXXXM898lqOPGmuWJT5K+4YosNb9R6uWASFHatRzKLbeTcRSKqWhpU/BfzN:sE6esE8lDldUGosrSARzKwcs/BbN
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 7KB
SHA256 e75ca97a0adfa88827d95edba10782136520a7f2565e35d6b51658ce4dfe5238
MD5 88d6bd142798a16c3957a16abc6aca3c
SHA1 54e25436e7708a9f13e164d64a5d14cf802fd501
SHA512 4947b47dcf40c0383fd897eaedc541b6845580e6011f5f15cde5740ca9a473b4cb59cdde166f825fd1cbb15c40a0685e8dcd936f99862d172c4fc6b972589065
SSDEEP 96:0NqONkCyUfzw7vqqcnG5ih/cIVURLl8RotopG1pBwPFxvGHkEdqNpvsEqL4e4mJ3:RONbyKwuqIWiRUPiOqvsEqLPOTip
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 6b02302c364b289b016f90a4204dd91615ccdb8e49d1a476a0a5e851569c124d
MD5 243cd7770c1e4ec588d2da0422feb999
SHA1 6f3080db5f00f00d1a47196b8f7ac1da946af20c
SHA512 69216cf8dc305cee078c86716a4b121558d8e2f11864eaaf09e42a7d65f679abc11be1600f940c1b2077680e2c3221a47b754dbaf03b5e2e29b6aa96b0fb99f5
SSDEEP 192:zvmqsNbLdBhb9wuJWiRUBIIHZqrgatsiOLPf6k:z5sNbLR6uRAI4HatozB
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 3d925214e397f37b6662c08f7d3f9e6976bae56098f8734c99d8af0d21d23081
MD5 d5be463b0fec4d383055d008ec0f198d
SHA1 e60ddcfd9f597be1e529dbd1d77b709adace5b9c
SHA512 cae817c57137f5514b63d08c4cfea5d9a708f44caef8bc86eaea90f259b51f0be4f8cd5ead6149b3f17a995194020922d332bf4ca0b2c17979d216722b6ea5f7
SSDEEP 768:8FpE6esE8lDldUG+UnCgXrW++sTmC+T2+GgvzKwcs/BbN:eeB85dTTrnUK3ABbN
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 62645dae2bedcc2b77569c45a774ccc79d60ac39909739c6950c67018467d76f
MD5 a1f10d46f26b03d79505b852c725de56
SHA1 a2846482f5d6633f2c5210268bc84e106a54399c
SHA512 f44554108a92784f36d68597224b71a5fd35d76f9a60e1e2cdd4ecc5260978c5f09ac978b77d123a8498740708f2d0ede5f99567b54567b75783d9fd584864df
SSDEEP 768:8FpE6esE8lDldUG+UCCgXrSP6C+T2+3BzKwcs/BbN:eeB85dTgrLK3ABbN
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 55f5d5aa70ca81b6f8759a470362829e53002d2a1f7c61f20d42149738114a2a
MD5 be1232504b24a8908024dba05fffc482
SHA1 50f1358106ac607c6268a384cddd9a00b398c6c4
SHA512 bedd7f423ec18d24fe9572ae764326c40435dba0a46923bc796b87fabbf6809beb34699c026b356322080bbc0bbe5e9c38b2340b64bcd0ee77a640560c432beb
SSDEEP 384:n9E6iXXXM898lqOPGmuWJT5K+4YgsNb9R6uWASFHaIRzKLbeTcRSKqWhpU/BfzN:9E6esE8lDldUGgsrSVRzKwcs/BbN
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 7KB
SHA256 25bd715b6a06fd6b3f3a3c7fe37c88d237a9626d8a194b910ae4e7ea2419bd18
MD5 3dcbcde86e087b5668b8de51e0b32562
SHA1 abcab1f3f2ccaa3912b5636c8fc80fe80ce95ccf
SHA512 8d5b1bdc884fac4f1c66c37c16e23783dcc4b92a93f414a2dee8657efbfdc4647de47b93952de9e4794da032781d4c2c14174566eb8eaebf1cf549ff6cb497f8
SSDEEP 96:0NqONkCyUfzw7vqKnG5ih/cIVURLl8RotopGyJpBlPFxvGHkEdqNprvo+rbhsibt:RONbyKwuWWiRUQpFOqrgatsibLPfp
MD5 SHA1 SHA512 SSDEEP

Submit Download

nav_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json
Size 2KB
SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
MD5 499d9e568b96e759959dc69635470211
SHA1 2462a315342e0c09fd6c5fbd7f1e7ff6914c17e6
SHA512 3a5922697b5356fd29ccf8dcc2e5e0e8c1fd955046a5bacf11b8ac5b7c147625d31ade6ff17be86e79c2c613104b2d2aebb11557399084d422e304f287d8b905
MD5 SHA1 SHA512

Submit Download

54116402-7a0c-4eb1-be1d-f4eacd72fe55.tmp

Path C:\Users\Admin\AppData\Local\Temp\54116402-7a0c-4eb1-be1d-f4eacd72fe55.tmp
Size 156KB
SHA256 0a6b11a5b642bf6c1938189707e109a1f48eb02018cfb146f09e74a753567d1b
MD5 b384b2c8acf11d0ca778ea05a710bc01
SHA1 4d3e01b65ed401b19e9d05e2218eeb01a0a65972
SHA512 272dd92a3efbf6cefe4b13127e09a9bd6455f5fc4913e7477c6712e4c3fd67efe87bd0d5bf1ec6b1e65f8d3aa0ac99d5bcf88d8a44d3f3116527253a01dde3be
SSDEEP 3072:REqT/cpnWG/Mrp/D8JSZJtO7ytDxzD0Obh9FyqnwKIBcrxavPh:6yknM9/rJtO7ytDxpysFISIvPh
MD5 SHA1 SHA512 SSDEEP

Submit Download

9cc63db9-8248-4d88-be30-ea5fc6aff3ba.tmp

Path C:\Users\Admin\AppData\Local\Temp\9cc63db9-8248-4d88-be30-ea5fc6aff3ba.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

45448fa9-e906-411d-b9c2-d46d64f38a57.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2456_2068684529\45448fa9-e906-411d-b9c2-d46d64f38a57.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5 SHA1 SHA512 SSDEEP

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2488_1812268908\CRX_INSTALL\_locales\en_CA\messages.json
Size 711B
SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
MD5 558659936250e03cc14b60ebf648aa09
SHA1 32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA512 1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2488_1812268908\CRX_INSTALL\_locales\en_US\messages.json
Size 1KB
SHA256 4f70eca8e28541855a11ec7a4e6b3bc6dd16c672ff9b596ecfb7715bb3b5898c
MD5 64eaeb92cb15bf128429c2354ef22977
SHA1 45ec549acaa1fda7c664d3906835ced6295ee752
SHA512 f63ee02159812146eee84c4eb2034edfc2858a287119cc34a8b38c309c1b98953e14ca1ca6304d6b32b715754b15ba1b3aa4b46976631b5944d50581b2f49def
MD5 SHA1 SHA512

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2488_1812268908\CRX_INSTALL\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2488_1812268908\CRX_INSTALL\manifest.json
Size 1KB
SHA256 eb10517d6ac10eb4a0dc967eb2773a06a74bfa270e48d146bf5db5071bd7714a
MD5 9aaf263712da64f3d25c3590cc1bb25f
SHA1 ee37307feb5fc24012c690e3dc6cd1785f81cd06
SHA512 00e2e3afe26eaeefc58a92569b5391124250781b40cab9fa8abbbfb2a1b080c232998aef42d532ac1163c4128ae4cb4fab5daf8bb7a7c530d4889f08a72f8ed3
MD5 SHA1 SHA512

Submit Download

memory/5848-995-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/5848-996-0x0000000000400000-0x0000000000460000-memory.dmp

Download