hxxps://www[.]xeno[.]onl/

Analysis

user interaction
yes
max time kernel
131s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/04/2026, 02:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.xeno.onl/
Sample260417-db36jagy6x

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
37	discord.com
32	discord.com
33	discord.com
36	discord.com

Drops file in Program Files directory 13 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4304_1468997678\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4304_1015184739\deny_full_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4304_1015184739\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4304_725038874\v1FieldTypes.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4304_1468997678\keys.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4304_1468997678\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4304_1015184739\deny_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4304_1015184739\deny_etld1_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4304_725038874\autofill_bypass_cache_forms.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4304_725038874\edge_autofill_global_block_list.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4304_725038874\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4304_725038874\regex_patterns.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4304_1468997678\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4480	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134208678770857853"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-721190819-434563495-2007910846-1000\{510ED18B-D533-48CA-A0B3-5CDB8FB7754E}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-721190819-434563495-2007910846-1000\{83208BDF-A23F-45C8-8431-A6B30C063EBA}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5880	msedge.exe
5880	msedge.exe

Suspicious behavior: LoadsDriver 3 IoCs

pid	Process
656	Process not Found
656	Process not Found
656	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 31 IoCs

pid	Process
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4304 wrote to memory of 4380	4304	msedge.exe	83
PID 4304 wrote to memory of 4480	4304	msedge.exe	84
PID 4304 wrote to memory of 5200	4304	msedge.exe	85
PID 4304 wrote to memory of 5200	4304	msedge.exe	85
PID 4304 wrote to memory of 5200	4304	msedge.exe	85
PID 4304 wrote to memory of 4584	4304	msedge.exe	86
PID 4304 wrote to memory of 4584	4304	msedge.exe	86
PID 4304 wrote to memory of 2304	4304	msedge.exe	87
PID 4304 wrote to memory of 2304	4304	msedge.exe	87
PID 4304 wrote to memory of 2304	4304	msedge.exe	87
PID 4304 wrote to memory of 4868	4304	msedge.exe	88
PID 4304 wrote to memory of 4868	4304	msedge.exe	88
PID 4304 wrote to memory of 4868	4304	msedge.exe	88
PID 4304 wrote to memory of 2380	4304	msedge.exe	93
PID 4304 wrote to memory of 2380	4304	msedge.exe	93
PID 4304 wrote to memory of 3136	4304	msedge.exe	94
PID 4304 wrote to memory of 3136	4304	msedge.exe	94
PID 4304 wrote to memory of 5760	4304	msedge.exe	96
PID 4304 wrote to memory of 5380	4304	msedge.exe	104
PID 4304 wrote to memory of 5380	4304	msedge.exe	104
PID 4304 wrote to memory of 5380	4304	msedge.exe	104
PID 4304 wrote to memory of 1036	4304	msedge.exe	105
PID 4304 wrote to memory of 1036	4304	msedge.exe	105
PID 4304 wrote to memory of 1036	4304	msedge.exe	105
PID 4304 wrote to memory of 4592	4304	msedge.exe	106
PID 4304 wrote to memory of 4592	4304	msedge.exe	106
PID 4304 wrote to memory of 4592	4304	msedge.exe	106
PID 4304 wrote to memory of 3272	4304	msedge.exe	107
PID 4304 wrote to memory of 3272	4304	msedge.exe	107
PID 4304 wrote to memory of 3272	4304	msedge.exe	107
PID 4304 wrote to memory of 5284	4304	msedge.exe	110
PID 4304 wrote to memory of 5284	4304	msedge.exe	110
PID 4304 wrote to memory of 5284	4304	msedge.exe	110
PID 4304 wrote to memory of 1940	4304	msedge.exe	111
PID 4304 wrote to memory of 1940	4304	msedge.exe	111
PID 4304 wrote to memory of 1940	4304	msedge.exe	111
PID 4304 wrote to memory of 4956	4304	msedge.exe	112
PID 4304 wrote to memory of 4956	4304	msedge.exe	112
PID 4304 wrote to memory of 4956	4304	msedge.exe	112
PID 4304 wrote to memory of 1352	4304	msedge.exe	113
PID 4304 wrote to memory of 1352	4304	msedge.exe	113
PID 4304 wrote to memory of 1352	4304	msedge.exe	113
PID 4304 wrote to memory of 5008	4304	msedge.exe	114
PID 4304 wrote to memory of 5008	4304	msedge.exe	114
PID 4304 wrote to memory of 5008	4304	msedge.exe	114
PID 4304 wrote to memory of 5456	4304	msedge.exe	115
PID 4304 wrote to memory of 5456	4304	msedge.exe	115
PID 4304 wrote to memory of 5456	4304	msedge.exe	115
PID 4304 wrote to memory of 2908	4304	msedge.exe	117
PID 4304 wrote to memory of 2908	4304	msedge.exe	117
PID 4304 wrote to memory of 2908	4304	msedge.exe	117
PID 4304 wrote to memory of 5916	4304	msedge.exe	118
PID 4304 wrote to memory of 2300	4304	msedge.exe	119
PID 4304 wrote to memory of 4716	4304	msedge.exe	120
PID 4304 wrote to memory of 4936	4304	msedge.exe	122
PID 4304 wrote to memory of 4936	4304	msedge.exe	122
PID 4304 wrote to memory of 4936	4304	msedge.exe	122
PID 4304 wrote to memory of 3076	4304	msedge.exe	123
PID 4304 wrote to memory of 3076	4304	msedge.exe	123
PID 4304 wrote to memory of 3076	4304	msedge.exe	123
PID 4304 wrote to memory of 1280	4304	msedge.exe	124
PID 4304 wrote to memory of 1280	4304	msedge.exe	124
PID 4304 wrote to memory of 1280	4304	msedge.exe	124
PID 4304 wrote to memory of 3608	4304	msedge.exe	125

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.xeno.onl/
1⤵
- Drops file in Program Files directory
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2a8,0x7ff99ed1c188,0x7ff99ed1c194,0x7ff99ed1c1a0
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1860,i,2240236849379066679,3529058115916096741,524288 --field-trial-handle=2168,i,10119242372682828248,1437145412009230801,262144 --variations-seed-version --mojo-platform-channel-handle=2204 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,9976581103664046955,12588299688815294494,262144 --field-trial-handle=2168,i,10119242372682828248,1437145412009230801,262144 --variations-seed-version --mojo-platform-channel-handle=2164 /prefetch:2
  2⤵
  PID:5200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2572,i,5627738154102691791,5101719573090007101,524288 --field-trial-handle=2168,i,10119242372682828248,1437145412009230801,262144 --variations-seed-version --mojo-platform-channel-handle=2712 /prefetch:8
  2⤵
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,1421366533484099153,11949361918498706826,2097152 --field-trial-handle=2168,i,10119242372682828248,1437145412009230801,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,2191765977095989470,1424450282725392186,2097152 --field-trial-handle=2168,i,10119242372682828248,1437145412009230801,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,17626794328887107421,5020235655012250432,524288 --field-trial-handle=2168,i,10119242372682828248,1437145412009230801,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  PID:2380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5156,i,7844487854924419790,5148709938982111673,524288 --field-trial-handle=2168,i,10119242372682828248,1437145412009230801,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:8
  2⤵
  PID:3136
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,15538282995575301108,12993750504841318968,524288 --field-trial-handle=2168,i,10119242372682828248,1437145412009230801,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:8
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,15538282995575301108,12993750504841318968,524288 --field-trial-handle=2168,i,10119242372682828248,1437145412009230801,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:8
  2⤵
  PID:5760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4908,i,9836165085777012303,15200476072349382443,2097152 --field-trial-handle=2168,i,10119242372682828248,1437145412009230801,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:1
  2⤵
  PID:5380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=6368,i,435594278315389880,5664727850010707385,2097152 --field-trial-handle=2168,i,10119242372682828248,1437145412009230801,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:1
  2⤵
  PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3500,i,15240540574651590472,2768570685090118278,2097152 --field-trial-handle=2168,i,10119242372682828248,1437145412009230801,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:1
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6420,i,6253192132956361274,1186483015201462444,2097152 --field-trial-handle=2168,i,10119242372682828248,1437145412009230801,262144 --variations-seed-version --mojo-platform-channel-handle=6548 /prefetch:1
  2⤵
  PID:3272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6332,i,9897542057088572829,5133329895016199915,2097152 --field-trial-handle=2168,i,10119242372682828248,1437145412009230801,262144 --variations-seed-version --mojo-platform-channel-handle=7132 /prefetch:1
  2⤵
  PID:5284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=4000,i,17303688935578770323,16291009829052083375,2097152 --field-trial-handle=2168,i,10119242372682828248,1437145412009230801,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:1
  2⤵
  PID:1940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=7072,i,12617935210998591182,9073874510615267116,2097152 --field-trial-handle=2168,i,10119242372682828248,1437145412009230801,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:1
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6908,i,7252139533880156677,6077917399595143734,2097152 --field-trial-handle=2168,i,10119242372682828248,1437145412009230801,262144 --variations-seed-version --mojo-platform-channel-handle=6904 /prefetch:1
  2⤵
  PID:1352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6800,i,7115838555823525165,13932042359597961364,2097152 --field-trial-handle=2168,i,10119242372682828248,1437145412009230801,262144 --variations-seed-version --mojo-platform-channel-handle=7176 /prefetch:1
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=3532,i,4660358287454813385,10352760264061621333,2097152 --field-trial-handle=2168,i,10119242372682828248,1437145412009230801,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:1
  2⤵
  PID:5456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=3480,i,12333431845050421522,5135049909101735961,2097152 --field-trial-handle=2168,i,10119242372682828248,1437145412009230801,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
  2⤵
  PID:2908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6428,i,10409875103499101454,3372853250903378940,524288 --field-trial-handle=2168,i,10119242372682828248,1437145412009230801,262144 --variations-seed-version --mojo-platform-channel-handle=7084 /prefetch:8
  2⤵
  PID:5916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6260,i,10545352767846088731,2147607425380815272,524288 --field-trial-handle=2168,i,10119242372682828248,1437145412009230801,262144 --variations-seed-version --mojo-platform-channel-handle=7308 /prefetch:8
  2⤵
  PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5008,i,10030718414000227147,1734328252267955576,524288 --field-trial-handle=2168,i,10119242372682828248,1437145412009230801,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:8
  2⤵
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=5216,i,3857599416010553791,1737293708236298395,2097152 --field-trial-handle=2168,i,10119242372682828248,1437145412009230801,262144 --variations-seed-version --mojo-platform-channel-handle=2004 /prefetch:1
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6884,i,13296848405682095347,7024123504502792215,2097152 --field-trial-handle=2168,i,10119242372682828248,1437145412009230801,262144 --variations-seed-version --mojo-platform-channel-handle=6868 /prefetch:1
  2⤵
  PID:3076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=6312,i,1091616836034135471,16510793739313227899,2097152 --field-trial-handle=2168,i,10119242372682828248,1437145412009230801,262144 --variations-seed-version --mojo-platform-channel-handle=6676 /prefetch:1
  2⤵
  PID:1280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6912,i,6566074309213182115,8821752678169589702,2097152 --field-trial-handle=2168,i,10119242372682828248,1437145412009230801,262144 --variations-seed-version --mojo-platform-channel-handle=7100 /prefetch:1
  2⤵
  PID:3608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=6972,i,3765875420696655160,1731552574898241679,2097152 --field-trial-handle=2168,i,10119242372682828248,1437145412009230801,262144 --variations-seed-version --mojo-platform-channel-handle=7228 /prefetch:1
  2⤵
  PID:5284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=7220,i,14945678832900332690,9540652362436272927,2097152 --field-trial-handle=2168,i,10119242372682828248,1437145412009230801,262144 --variations-seed-version --mojo-platform-channel-handle=7276 /prefetch:1
  2⤵
  PID:5988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=6316,i,14015259795845853097,9484772522061196366,2097152 --field-trial-handle=2168,i,10119242372682828248,1437145412009230801,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:1
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6504,i,4532866105387525037,5289625969341214127,524288 --field-trial-handle=2168,i,10119242372682828248,1437145412009230801,262144 --variations-seed-version --mojo-platform-channel-handle=7324 /prefetch:8
  2⤵
  PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=7176,i,13955379758812777444,16872194777199505135,2097152 --field-trial-handle=2168,i,10119242372682828248,1437145412009230801,262144 --variations-seed-version --mojo-platform-channel-handle=6796 /prefetch:1
  2⤵
  PID:5964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=6860,i,7662197032530269013,12650171757215909974,2097152 --field-trial-handle=2168,i,10119242372682828248,1437145412009230801,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:1
  2⤵
  PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=5348,i,9043995168986532344,14024397437432709509,2097152 --field-trial-handle=2168,i,10119242372682828248,1437145412009230801,262144 --variations-seed-version --mojo-platform-channel-handle=7592 /prefetch:1
  2⤵
  PID:688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7696,i,11568698840348288625,14603987919884375412,524288 --field-trial-handle=2168,i,10119242372682828248,1437145412009230801,262144 --variations-seed-version --mojo-platform-channel-handle=7716 /prefetch:8
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7760,i,1340227677754251921,11190113701866198864,524288 --field-trial-handle=2168,i,10119242372682828248,1437145412009230801,262144 --variations-seed-version --mojo-platform-channel-handle=7872 /prefetch:8
  2⤵
  - Modifies registry class
  PID:5656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7776,i,12280579649678872372,18060287768187848122,524288 --field-trial-handle=2168,i,10119242372682828248,1437145412009230801,262144 --variations-seed-version --mojo-platform-channel-handle=7708 /prefetch:8
  2⤵
  PID:5888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=7988,i,1405446904122514189,5778855981756586388,2097152 --field-trial-handle=2168,i,10119242372682828248,1437145412009230801,262144 --variations-seed-version --mojo-platform-channel-handle=7972 /prefetch:1
  2⤵
  PID:5372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=5516,i,8743650454168033363,9271582532800135111,2097152 --field-trial-handle=2168,i,10119242372682828248,1437145412009230801,262144 --variations-seed-version --mojo-platform-channel-handle=7608 /prefetch:1
  2⤵
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=8144,i,8122815468777352425,5130817518460704494,2097152 --field-trial-handle=2168,i,10119242372682828248,1437145412009230801,262144 --variations-seed-version --mojo-platform-channel-handle=7604 /prefetch:1
  2⤵
  PID:5940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=8324,i,8554787796344585595,13699236392802472041,2097152 --field-trial-handle=2168,i,10119242372682828248,1437145412009230801,262144 --variations-seed-version --mojo-platform-channel-handle=8328 /prefetch:1
  2⤵
  PID:2940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=3628,i,17960617417911984667,13061489659630032259,2097152 --field-trial-handle=2168,i,10119242372682828248,1437145412009230801,262144 --variations-seed-version --mojo-platform-channel-handle=7640 /prefetch:1
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=7948,i,16329244525752805894,261916125585584068,2097152 --field-trial-handle=2168,i,10119242372682828248,1437145412009230801,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:1
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=7784,i,1225091229476425072,6479638644916643222,2097152 --field-trial-handle=2168,i,10119242372682828248,1437145412009230801,262144 --variations-seed-version --mojo-platform-channel-handle=7328 /prefetch:1
  2⤵
  PID:6068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8372,i,3324124485360948146,13229220158373228052,524288 --field-trial-handle=2168,i,10119242372682828248,1437145412009230801,262144 --variations-seed-version --mojo-platform-channel-handle=8428 /prefetch:8
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5372,i,13813150003910370548,1437902160070630684,524288 --field-trial-handle=2168,i,10119242372682828248,1437145412009230801,262144 --variations-seed-version --mojo-platform-channel-handle=8340 /prefetch:8
  2⤵
  PID:1616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=8416,i,7049276652911757835,11327438736076876440,262144 --field-trial-handle=2168,i,10119242372682828248,1437145412009230801,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5880

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5304

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2140

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4304_1015184739\manifest.json
Size 177B
SHA256 096e772e0f2e8c15e6dec9087ee0a1fb8b0c56b25061626aedc9e7e705adfc2e
MD5 2714a51ed8c2a891ad73b7488ab655b9
SHA1 9a8cc479aec8de1b4eb678e5d68b23b16a39dc99
SHA512 4811522c06ad6946626a9f4d12eb62a1d623825d18a1cd0ad7b628f4c059f37d299b5857abffd959e4ea53239412490539f5705b4aa6c6951d13c68e6d5b72ad
TLSH
T1E6C012EFDC509DB215EB4323156D43C4E733CF4B1546490935FB66082A25981C193500
MD5 SHA1 SHA512 TLSH

Submit Download

keys.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4304_1468997678\keys.json
Size 8KB
SHA256 ae6e69a145f84c0a261b4e82888779fbf137f193881d687588e1af71609ae947
MD5 d3ebc1cb4b692c6e2d29a4625420fe73
SHA1 4ce74c1e9af6fd34d6379ec0fec6afb24082a7c1
SHA512 e34b855615e6a3bf770f27d85aa29ca57a324c08bd8f8d9c0130e2a142c0e4a5f17bffd0861b725acc8a2316f73b7fe50406b0af26264a5c2d8f37599b260860
SSDEEP 192:uNtGbR+mFGfvPNyR9Pm4lOvMwkoR9PuGMXcy:ORmqwKjA
TLSH
T18402A57F14A41181CE7FC1698F0B78B78FA038065BCA3A83539BFA49494296D173B5B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4304_1468997678\manifest.json
Size 79B
SHA256 7ea98f2308a9c51d17a1ac71b64afbe2a41ff0a083a166a0e4cc428bf44f0715
MD5 817fea104100763cd1bf4f15a51bfe94
SHA1 589717cf98cf7e2d55fc0d6025a4b8e215ed13d6
SHA512 da7b959d93113c5a6be360f90d9c721989c5e7acad7fa592081b582c4c3a0c4a9066a71473fd8492ce7fe7b0fbfd6870d939428a67fbd508fcf6b2c6dc1a41ea
TLSH
T15EA0122058019233108407600360478243551C022015244809461041258813A12A3128
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4304_725038874\manifest.json
Size 119B
SHA256 7169d86e87f904218238cd293e043e20b7828afad9acd1ff2e5d64188530b9d7
MD5 7382260298fc06c135b7c7399e9acff9
SHA1 6a829f795a3b8be25200675e00abfa1908fdefdf
SHA512 f0ce77f9f72fb6721bcfa9b03f77b0771e8217988183787c00dba4f9d9f19cdba252ddd656422336035f81939cb97c8b5dcb4f036a39280198c17cd04faaaed4
TLSH
T191B09273A800E83830E9EB91093A8243F320AB4BA585640A3625485C0B2B9F990606C4
MD5 SHA1 SHA512 TLSH

Submit Download

autofill_bypass_cache_forms.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\autofill_bypass_cache_forms.json
Size 161B
SHA256 f7510e38f81f8a84027304070205dd55127e3233fdf011411465ede67b5b5d92
MD5 4b1a79b1996f03fb926a97912835c881
SHA1 ca43e23f7bbb4ff3839751f722df3c38ef7bd8a7
SHA512 c2e07a1b311ab71d94c7b874d645fe1114fdccfe4468875d6b23318fbe327481a60b2782af105b7546b3c1e6c3a7ec67261b21a0587f914cc7bf77c55f1f568e
TLSH
T1E5C08C07ABB804230B414E0B590DEFC9990476F6D5C146FEAB75A5A98A3C6B0005B74A
MD5 SHA1 SHA512 TLSH

Submit Download

edge_autofill_global_block_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\edge_autofill_global_block_list.json
Size 6KB
SHA256 7d3c45c8207ba69066516e51e10a2137bc4f1fce070a692e0c65225f9856e04c
MD5 5d4464dabc1289c3a010e14c05b92c57
SHA1 d2d185faca1cd13a6d42dea68803a9941074707d
SHA512 f93f4b58efc0127946ffa1b2950a1cf71da6f77a6ab4cf98ad8ada6a751d6261be4818ff8c64fe1f1d45467aa070e0823d15be36c8259c1044fb2d1289df9994
SSDEEP 192:C73stL7O9FnLk25+tF4B8K5b+QiGoztWuDpR6lFuftdHAa4/i:nwJ2r
TLSH
T133D16A2BA91C54B32A044839128E5BE47DDD73B6DD6008D6D650C0B9AEDFCB8203FDA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v1FieldTypes.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\v1FieldTypes.json
Size 509KB
SHA256 611e7995ab7599a0c89f98d6c6152a42aaedf7449748109a465bb5b0badd0af2
MD5 b1c140ef49f01eea089d3957da1a529f
SHA1 de64781f20aac98b4d2bbc497e3defa83b25aa8f
SHA512 02ddfcbaf9eaff793f251bd983394cf473b1340182ac1f3217cb7258ddfbd2de066ab08af16b47a378644bcc1871ad6ed8c641f6a053802c90e77f648e4f4be8
SSDEEP 1536:jlKS/dYt+dtxX9U2/W++dGcUooTHR6rF1azQmkEMUmxralqDAtyttVJAC5c8KrVx:B
TLSH
T148B48E2BF9F25C634D822A32053E18996A30615F5CEC6CD4BB3E211F4F2C1791E797A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 030978901609c12837a9b1afdcd1ee9f12ef19339fd94725f17a7cdb1e945f36
MD5 35e76198d1c2c61d3c2a49119ba65747
SHA1 a5ae8329c9e762bed0a3d6bc5584e8faf6d26a77
SHA512 8b21ab6c5e29ab0ea7652b7adadb04a05eb734a52faa779252fbec4acd45079c7ad3f83f36227a419f0a59fc94eb1cf408bcd782459cf4691b6eb727be746fd3
TLSH
T136D0800925B7DC74D059847018977B4D7555CD6B4D4657163473283D1C4B4504D911DB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 827caedd6ba67a465e2378da508ebf9f7e5dc38b9ff3d1086fe8a0b10ad23634
MD5 6a7649ad8529021b8a0bf012adb69564
SHA1 bc6cb8e64c0f5c84a887a19005280de2e2ff95dd
SHA512 316ecd29696eeae0002f91778818c1c4166e5bbf8440eddea3560a6ea0fb49f25e4e33c48c2d7c73eb08507c015f5aa7eb4187e6558ebdc4cd44c5bd980d8c3a
TLSH
T133D0800529B3DC74D055847018D77B4D7665CD6B4D4657163473283D1C4B4504D911DB
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 45f7446b5b7d3f6b2fc70049c4e42f35b3971df0125b6f3ff6b4211fd2459332
MD5 96012b45e94d2a8a9501fe22c7fae241
SHA1 831d5beec13d620dbe15c7ccdbfd7476d2990707
SHA512 d9c363b91cfa6447c7f2acb06b43b5bb81f75bfd0ab500602c80698c93232d6a4a5c769e35e1918b5d59c82c9b0c3448054b46d0114f7024fb5ff215cbdf02ea
TLSH
T1E9E02BE5C872EC2718FD1B1860545682EB55134727C1485F3A3C93088FF9937459685C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000087

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000087
Size 361KB
SHA256 02ff49f4431a46d64078b37db37186bd2f8c65655c9a81086ff174ead4486a18
MD5 10f1c35cb246fe221073a913340b48a8
SHA1 8101001026872a40a3653a4ece0da291b90458a5
SHA512 00031ac8af944b437463ef2027fa381873b6e08f68945248e58007a4ef7a5cec37adff6d14f67fcf7de2f5c85ffd1e723c1f1652d6a014eee66f84bdcaad2a6b
SSDEEP 6144:0OJ1vV2jDLDukAPWOlTbj19gCY/tqglNixzN4LtBDRPqyQK6+fWAyU+8tWncBl5y:0OJv2PLKkAPWATbj1ah/cgnAN4LtBDR8
TLSH
T14974236687ED80BD68F6890D1BCC7FA768CF928FF46EC8D9428E5185C408F7921B7611
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a0
Size 74KB
SHA256 e1649c17ea16555266789c2007ae07b5a031c8b39f110f7066d2d51c52cfb025
MD5 3174b94525ebefaf05251da45ee41125
SHA1 f9e60f8f7c7b172bade19820fd90a382ff08d9a4
SHA512 bf8b6b934f24368cf7f6372332d3791499d6cab73a0aff1b83248145905f797eea6b2bf5a8140df1407767ad5c9def36950696688798777e3c866c36b3ab2d5e
SSDEEP 1536:5E1QCa4UzYJGLJ34Jq8SofcWyisyA5aFoIt9luwUWQUlxeL7FM:5E1tVUzYYJIJXLZPuIt9lxUW2+
TLSH
T10E7312C86FB38B86E9C0B44FAAEAEB38190621490558B7014C2D77CF279D4C52AD0DE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000ad

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ad
Size 164KB
SHA256 a483e4870dc7ed163c895ae662304450a9d933b2d529e69d3225b81f98770cf9
MD5 ffa80ae83a2c7c8866df270322117afc
SHA1 53b810bc63072a99204cbaa975b4293f50d9b80b
SHA512 d8ea0d2c9c09aa1a43bbe123ddb52958b6ab7a56c60cc6793851606ab6de1d65738b20f5076b50ab6dff4a74ab5360363cb848d91675dcce5b9222780299c473
SSDEEP 3072:S5IoR39rjoAHKz8mT72RSzMHDNalo38IyP4VirdS/KFKZH4Qua:S5/trdK8FS1odk4Ard8YQ7
TLSH
T110F3135639AF2A1498842D3E6412BDFCD9282317F375F617092EE725B1CD888D3B1B78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 288e36610568adb1cb4c2421d7705ff3a1a8569b911e6272bf3f2a13b7ba5d01
MD5 f8d8e59cc5c1d703b6cd4e106a20b1c2
SHA1 13008cbc24745ea553641c5cfa95873e4ed28e40
SHA512 222746a637a767b014eb037cabbf4f6f4411738ebb0c42c0e00580596530d6d74852ee9cf1383e0fa54f5c72b4c9db7b71b4aa70bf44bef36f5291840abde8da
SSDEEP 96:I4vSVCV6tol3nNIV6VuUt2cttKTobV7Ck1MBIiux+tG90V/lo99HyNsmszF:Iobo6MWttK/k1OS4g0k/LB
TLSH
T121D1501C8291D12AFBE5427899F129C47AFC53B8F61FCE963BFE01BD45027A26004AD7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 44592e14267488d8e6b754ea93781c6870dc25edf66e35547eda1b6973c9a381
MD5 0e6ce4c429f50ce44c3a234924122abf
SHA1 2fbb16854f26219e23d42e36da05691f806500c5
SHA512 9a098b0c20acec61f678a7bd3b99327c21398b66bdc8235310c4a884e09eac35f5cae7f84e545931c759186552d5954429a390d15175ce8c80a4d9464fff5092
SSDEEP 96:e7SVe7tRJnNhVxsGXxERtOkLKzfk1tIiuxP847dZNl+2gw5OMf:54x9GtOpk1tSpxf5Oq
TLSH
T185A1F74C9185C52BEBE681B58DF128847AFC4378D01FCEDA3BFD05BD9642B7220585C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 11KB
SHA256 5d7a12592edd51fc490d05b26d649019e8cc4ae0a7a3baa0260ce25ebc05c087
MD5 a96080a20aa04d5ef3886350e2b4e71f
SHA1 6fd379ee3c4f67e30a35527420ef8d0268438c17
SHA512 f72c9772d4c4b04a7099c7b99befb0a033aae0705e1d4ad620a3e3d7b9b44fe85fd2d15d77e2b7489a2c4daf53e3271e51fafc1de55ed936be4fd5446934d997
SSDEEP 192:D19l8IjK8CHrof4zVX9ah1gIY22BGj6H0+X3XobX2vF7EBAAlNvfyjIP2SLKEtlb:D19l8IjK8CHrof4zVX9ah1gIY22BGGHY
TLSH
T13F326AF7C3F9866EDD1163F0AA243E17CE591615432C3C4B85E5AF0B97E24B1E281A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 60a23eab5e5f8eef40c13b9da1a6b57f744c12395558099f20dc901c8ab21250
MD5 17faa38ac7519d0a4d87a283737d8df9
SHA1 b67ab91d857dba9aac809410c3cc5d4859514457
SHA512 9ae6b0470b53b8e7620fd76b0f823dad4ed658364f2ca4dec0aee6c5ad58eb9ccb963de402ff13413be7265f18bd8e9e29e299202263bb9d7a54e3a0af45cf56
SSDEEP 384:sxZNEqG9/fJs7dEi7EHbc7XHj8C2VzFmcEH:slTG9/f2d7YHb2Dd2/m3
TLSH
T15892D653A538497B8CDA9A25F444BB7ADAF51127D2C05EC5AAFCCE0C00E7BED6102C5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 e62540fe930d02fdf240980097741e926405fc69bbd263b54d1996ed09df8365
MD5 936f7ff0737ecf2f8e3be391d3b9262a
SHA1 e4b2d4108d6ffb2893e2de955cc33ee94c702aa4
SHA512 3ec22fc6dc7b2596f88f941cd61e79e8ec13871bd1553178d162dca24c8c7796ba1a9e36eb32507f52bf5471a0a6ed16ee738cd89643e26f5b05c63e8280d377
SSDEEP 192:sxZNR7yMqZ/K1Ml8Mk9/fJsfGAf7QqrjYqzodpcpHW6+WNi2t/YKwRkmmNIgjyJ:sxZNEM9/fJsfNEioYHbl/fmcjO
TLSH
T1C262D8156A38597B8CDBD609F645BF63DBF91563D1900E44AAFCCA1C00E6AED620382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 d76eae67a8650d6faa53db6a13857816499f835504331d6b0d94b19dede24fe8
MD5 c24be901a5a3df81addc31acf00455cb
SHA1 07724e6e972b1f6b564a9cc1966e6978fd82d9bc
SHA512 98a899a75ce6037bc05f98cc7912197de3da45ba946726b295b267237240e7f86477f38a027ed79c5dd6f44e6ee3a2eecdf1e5fb4f41a5d0827fa5064fc06434
SSDEEP 768:DcgLiAo7pLuL/aeWvaShq8F1+UoAYDCx9Tuqh0VfUC9xbog/OVgMKJLlhzCpUroK:DcgLiAUE/aeWvaShqu1jahMKJLDOp/K
TLSH
T16FF20D3B6C0CCB7E4F804E9CEC2ABE8E6DE4028B9698C95447FA445C03C66EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 37dd713d7f58a8cd7937b0f0b09260b437c7a55291f74f6e571e60e3ebb14eb4
MD5 3af1725df4814a57f1d67c6694b3b002
SHA1 e53d5a048b896c2f7affe68d0a7d857225d7d0b4
SHA512 64b51b18eddf15e141e021df8d932638d1daf7a3c2969d3d959f0fe1cd84abeb75ee6cf60dac5832827666f4171e77bcac6e4018de21a997ba0de27aa6b46868
SSDEEP 192:kBhNHfIVfhRXF4B6W4KqV2j6Ok4pYLQobOyzcp/KLNz3BnR3/wh6Wwq6t:krN/INhx+kcxKBzxnR/wh6Wwq6t
TLSH
T1B1B24C11717A12813A7E399AC595B42F76C230633098B93B7BB914A60F6BE20DDFD4CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 9eb706b9a236657e5d226f2337993886ad260646bd3728637fb7ca4e7460df47
MD5 221f2c9dd16202eae0dbe02fb892be0e
SHA1 2becdfc07a0933e414a08c52628383fcfd26d080
SHA512 3b316166d04949ce6ebddead1b0e7de39e7fdcb6cd8317e1e72f371ed48eedd096be5f4e40baed5c806a5a9957d5eb00f27c016fd2e4f0a2fca28f447d789981
SSDEEP 384:nuiFavqMg3sNt8TUNTUlIm2ZTPENX6OwfjYplDJsP9yRYV/Vw1mRgCe0QrN1k+5X:FFayv3kwgHguYplJKQRYk1m2/00P
TLSH
T15DC25B35ECA8DEABEDE69FD5AB0A3A07EEE00267958C4AD4DAD80D1D00D71DD1307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 788ee5a3af2d8921814b88bd10c2a6a3d2fc9f1c76738fe2619a5453a4e61980
MD5 daaffe96f310aa2d425786da407e8122
SHA1 6e803c7d93bc0cc32149722716f58fb9d0d67c15
SHA512 84c8b855e2f69b5a4847437deaf059806d94183fcfcfe6b3787d003390e5c30d0db644aab905d18287df6ed16cdf7cc7f884d44ed7f1a917aed5abe522610d44
SSDEEP 384:ntiFJjccCs+Bt0S32sNJ8TUNTUlI4CZTP6MY2OwfjYplDJsjuESBFyzUrN1k+5vz:kFJccQWUwgd3Y6YplJvESakJF
TLSH
T1E9C23A32E8A4CEBBEDE68FD5A74A7A439EF0016795885AD4D9C90E1D00C71DD130BD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 24f8b2cd0ba1b6f8ab48af1aa1625ee509395612361b94cd37cca5ecaa34e734
MD5 1e11ad6086ae519dde547102db543054
SHA1 9e6a0f234e1a1a2cc226b094c7811362ed28dc27
SHA512 1c9000697f47f8a03b690a7fc2e3c36fb85a3fd246b7b46cfc23a98bbe5f3c09a843710fd308ff30a1f0c03a340530e485ac30d04ae9a7a35692790af4d92e5f
SSDEEP 384:nCiFJjccCs+Bt0S32sNJ8TUNTUlI4CZTP6MY2OwfjYplDJsjuESBFyzUrN1k+5vz:JFJccQWUwgd3Y6YplJvESakJF
TLSH
T16DC23A32E8A4CEBBEDE78FD5A74A7A439EF0016795885AD4D9C90E1D00C71DD130BD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 e5ceec21f1dcc91ed73b3bca1612eae386d9527586a3fbbc4be9b9f37cb3030a
MD5 10c5c9b6c160155e1bdf1313516142f9
SHA1 fe86c6ff3662afede52f5748ea4342cd9817f15f
SHA512 1c8e855dc30a36421c04d3546ac894fba8153b78f206782d03d2bd2c02dbd94ee64ecb643386637359d2977fe7f87d15d6ed9f9e92fdcf39e19129c41da43478
SSDEEP 384:ntiFJjccCs+Bt0S3tasNJ8TUNTUlI4CZTP6MY2OwfjYplDJsjXESBFyzUrN1k+5r:kFJccQsUwgd3Y6YplJuESakJF
TLSH
T18CC23932E8A4CEBBEDE78FD5A74E7A439EE0016795885AD4D9C90E1D00C71DD130BD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 a2ac6bf797a428c59e43c798cfb90992963e9d891dbd6eb9ab4901e963dedb33
MD5 772f34f44d02d770243bd9aadad25029
SHA1 7d639ca5fab3752f7b7d78ce726ce8e9965761ae
SHA512 e914fb28139e95f6a832052c373fb63f11bdbaac8cf0d8fd228806a26b79b4dfbc117eb52d7de9849699419d141c364803f24c2c481bd100a652f778c0c99888
SSDEEP 384:nuiFavqMg3sNl8TUNTUlIm2ZTPfekOwfjYplDJsjfERYV/Vw1mRgCe0QrN1k+5v/:FFayv3kwgHikYplJ2ERYk1m2/00P
TLSH
T11BC25B72E8A4DEABEDE69FD5A70A7A03DEE04267C58C4AD4DAD80D1D00D71DE130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 6ad1b158f6e4678d1f60f36fbb00d439287c6203e538e4f661190af2ee2d2554
MD5 7d00a61107cc5ace805f4fd09984fc54
SHA1 b36a4b036e0c435d233d0902a3c98db515b39aa6
SHA512 dc576ffbfc8fc82872afcc552b0ed5b6dc6de9a8de0e1dae0525f795e9d5dd704c840c5df7cd76e7b3a02412ecfc36e11990d6bae704930aba6a761599dc3e23
SSDEEP 384:nCiFavqMO3sNJ8TUNTUlI4HZTPIDXOwfjYplDJsj4EZJlrN1k+5vI+t:JFayh3UwgUqtYplJHEZJx5
TLSH
T13DC22971E8A8CEABEDE79FD5A70A7A039EF04167858C4AD4DAD80E1D00D72DD130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 cdba68f7f468f446ac205abadc9fd0d2f5de478b50a7a797e63d6cd44bfc76f1
MD5 a1aa48a5ed93e1bc2250a13f4e613bab
SHA1 b33fa8b5d28ff99bb1fa8115b4823e1a298e9514
SHA512 f8e0a2455b05086250f4950638974f1ebe2a49c4645215d2bf3fa48623093cf7f0597c3218c27295a8fe10883add3252ed60aba2821b31052315bb0f783e58cd
TLSH
T1F0E002205700005AE02417300083173427E1E11002720707551049640C1B3105E18780
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 ce8d96ee455589d79efa05b241f37af6db6ee77d3e8682e85305c2a164e7fade
MD5 81a899b057069be66dbe6f8ac236b4bd
SHA1 c5cd1f453734e6be3af5d8c2dd1edf975dd67921
SHA512 cf606de39490a6e42c5e6cb067856cd8898f2129820e6ba0d46963c9af4fbd7ef5ab1c6905dc3d8fed616e0ea4d071010504d49bb0d4f620a306fc6da6c07562
TLSH
T162E002605B40009FE0641B3000C313383FF1E11103330707950089740C1B3506F18780
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 899251a3ed547da5b4577a3880b1957eff46198fb224f498d11ca2da51fb355b
MD5 af83ccaec8d43f886fc274ba1d4bad35
SHA1 b6f33189cf6e445539dbcdc512b9e83eee872691
SHA512 a926eda2098785e08871d2ea6179879238884d70142827310b38cbe95426305f7837f797355dab9e023d3e86c90b8ea2c8b820dc69a718b6eb4e8742c88955f5
TLSH
T1F8E002619B4000DFE0241B3000C313343FF2E12113330707591149741D1B3605F18780
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 d79b3d121ab97905fc07d93523a140f3e5bf0e949a52d7d150f7d4f1c6f9f3c8
MD5 470333e0e6e34e28476dc439dda29f41
SHA1 6202d082bb71965b69ada43575a1d42e9de198d6
SHA512 b2d59eb6af79aab9153ee61a61dc2180d0b0c07a4df35c75470bfe28c545dde0b516d90e5ce95de7c186cf0f3f5e6d08e1e37adfebe193b18e2b0fd2e595c917
TLSH
T1FEE00161DB4040AFE0381B7044D313343BF2E16513730707591549742E1A3605F68BC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe584590.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe584590.TMP
Size 392B
SHA256 d0302f5ab3821e78ffde5987370674b80d20048a5dede70b46f78d68d813775f
MD5 c3bb8f3ff033881365c25ac9f91a75c5
SHA1 8feec6cbd01274ea2302e1b06764ce684f592356
SHA512 d2b20203e392e5f19c604d5f49cbc4197b7038760a94707eb81d440f8e59be59cb917abfdbcfab8cdaba7941d70ed1876983b5f4386d765051788a7a3eed1680
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 991b9f93117701e57e14915af3d800c21ab5c8b22bca75c0cf6c3657bc746cad
MD5 9f84164a2f788947be2197708128730a
SHA1 b650f3952145efef5b953a44e6b3c7e7f063864a
SHA512 d92709570bec91940d799ebc02c78fc35c206bad0a7f326c2a454134c386b049c0d5b051acfc7b5a415abd4f458b614d260e89aa993b6353e648b3461783c655
TLSH
T19E4162E15C3D1AD1D0BE0A6FA04B38FC84C8D32AF168347D6868EE984B3E94D240143F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 d4d3d367dbed92af02a9e922ff69c96f99ab9e97faf22c0c87626cbed108aa29
MD5 46827a1af8036ffe4592dca134cc6a7c
SHA1 fbbc69c584eedda43d64fb1acb1475265acfc1eb
SHA512 7c55a965e5d045447e40031c86e59d5f28d6eddabab63758427a789caea0398a3ad28171b0718c4481abd574eb37f124010a74a4623cb91c0df1912a57eaad33
TLSH
T173412EE05C3D2AD1E0BE0AAFB04B38FC84D8D726F568747D6858EA98473A54E254143F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 551b5d45674e685ce42bfad9fff59c2b88013f6b55f022edbc16b0f3c5331515
MD5 dfadd3bbcae128d4205fcb6c178f3aaf
SHA1 005be079c2cf9d7cc57b17192391298786f0cd6e
SHA512 ccca0bb1a5dda3e846892598fcdd5961f95b6b76e8677699fb846d206cef5b8a3a9e3dad59b6d18bcf83adc115474e843a457865545a24a5e42003b77e227ce1
TLSH
T15F4120E1983D2AE1D4BD0E6EA04B78FC84D8D326F178747D6868EE98463A95E640143F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 357d104153ad2c26904cb2c538e1da6ea0595e9828491e665150d1b3c44c4e9e
MD5 8b608c03f7911fd5440833eead910784
SHA1 71bf8f889608b690a2c520514820f79e4db4bc64
SHA512 877d57c66ddc70bab099adfaa1b147de2f9a5fbf683082c30d6cf2694f51ae656674d12d983b07bfe18336b0845b05a34f73dacf8b1bbc86e44953bb42f541d5
TLSH
T11D413A5CA6F91149B3B36F5AAFF6986E88BF78332E06945D10110D4F0A23B40C971B3B
MD5 SHA1 SHA512 TLSH

Submit Download