hxxps://getunx[.]cc/Key

Analysis

geolocation tags

eueuropelondonukunited-kingdom
user interaction
yes
max time kernel
269s
max time network
258s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260130-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260130-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
20/04/2026, 00:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://getunx.cc/Key
Sample260420-bb7slsaz2t

Score

8^/10

discovery persistence ransomware

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
462	5476	msedge.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_778285120\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_778285120\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_778285120\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_778285120\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_778285120\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_778285120\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_778285120\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_778285120\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_778285120\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_778285120\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_778285120\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_778285120\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_778285120\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_778285120\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_778285120\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_778285120\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_778285120\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_1302367182\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_1490204709\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_1160841380\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_778285120\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_778285120\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_778285120\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_778285120\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_778285120\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_778285120\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_778285120\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_1490204709\deny_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_778285120\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_778285120\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_778285120\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_778285120\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_778285120\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_778285120\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_778285120\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_778285120\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_778285120\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_778285120\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_778285120\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_778285120\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_778285120\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_778285120\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_778285120\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_778285120\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_778285120\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_778285120\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_778285120\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_778285120\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_778285120\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_1490204709\deny_etld1_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_1490204709\deny_full_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_2105979793\edge_autofill_global_block_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_778285120\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_778285120\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_778285120\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_1302367182\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_2105979793\autofill_bypass_cache_forms.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_2105979793\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_1385175973\kp_pinslist.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_1988807870\manifest.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_778285120\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_778285120\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_778285120\_locales\nl\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5476	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134211204162631419"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3431708735-1789331158-1295227519-1000\{39F4665D-04D8-4E51-A7CF-41ECD4D186D3}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3431708735-1789331158-1295227519-1000\{8A604F32-61E1-4BBF-8285-6E78C65E75A5}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1144	msedge.exe
1144	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 25 IoCs

pid	Process
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4704 wrote to memory of 4576	4704	msedge.exe	82
PID 4704 wrote to memory of 3408	4704	msedge.exe	83
PID 4704 wrote to memory of 5476	4704	msedge.exe	84
PID 4704 wrote to memory of 3744	4704	msedge.exe	85
PID 4704 wrote to memory of 3408	4704	msedge.exe	83
PID 4704 wrote to memory of 3408	4704	msedge.exe	83
PID 4704 wrote to memory of 3744	4704	msedge.exe	85
PID 4704 wrote to memory of 1328	4704	msedge.exe	86
PID 4704 wrote to memory of 3856	4704	msedge.exe	87
PID 4704 wrote to memory of 1328	4704	msedge.exe	86
PID 4704 wrote to memory of 1328	4704	msedge.exe	86
PID 4704 wrote to memory of 3856	4704	msedge.exe	87
PID 4704 wrote to memory of 3856	4704	msedge.exe	87
PID 4704 wrote to memory of 3752	4704	msedge.exe	91
PID 4704 wrote to memory of 3752	4704	msedge.exe	91
PID 4704 wrote to memory of 1044	4704	msedge.exe	92
PID 4704 wrote to memory of 1044	4704	msedge.exe	92
PID 4704 wrote to memory of 5628	4704	msedge.exe	94
PID 4704 wrote to memory of 5692	4704	msedge.exe	105
PID 4704 wrote to memory of 5512	4704	msedge.exe	106
PID 4704 wrote to memory of 6104	4704	msedge.exe	107
PID 4704 wrote to memory of 5216	4704	msedge.exe	108
PID 4704 wrote to memory of 5216	4704	msedge.exe	108
PID 4704 wrote to memory of 3620	4704	msedge.exe	109
PID 4704 wrote to memory of 3620	4704	msedge.exe	109
PID 4704 wrote to memory of 6000	4704	msedge.exe	110
PID 4704 wrote to memory of 6000	4704	msedge.exe	110
PID 4704 wrote to memory of 6000	4704	msedge.exe	110
PID 4704 wrote to memory of 4832	4704	msedge.exe	111
PID 4704 wrote to memory of 4832	4704	msedge.exe	111
PID 4704 wrote to memory of 4832	4704	msedge.exe	111
PID 4704 wrote to memory of 4560	4704	msedge.exe	112
PID 4704 wrote to memory of 4352	4704	msedge.exe	113
PID 4704 wrote to memory of 4352	4704	msedge.exe	113
PID 4704 wrote to memory of 3428	4704	msedge.exe	114
PID 4704 wrote to memory of 3428	4704	msedge.exe	114
PID 4704 wrote to memory of 3428	4704	msedge.exe	114
PID 4704 wrote to memory of 4304	4704	msedge.exe	115
PID 4704 wrote to memory of 4304	4704	msedge.exe	115
PID 4704 wrote to memory of 4304	4704	msedge.exe	115
PID 4704 wrote to memory of 3576	4704	msedge.exe	116
PID 4704 wrote to memory of 3576	4704	msedge.exe	116
PID 4704 wrote to memory of 3576	4704	msedge.exe	116
PID 4704 wrote to memory of 1760	4704	msedge.exe	117
PID 4704 wrote to memory of 1760	4704	msedge.exe	117
PID 4704 wrote to memory of 6140	4704	msedge.exe	119
PID 4704 wrote to memory of 6140	4704	msedge.exe	119
PID 4704 wrote to memory of 5532	4704	msedge.exe	120
PID 4704 wrote to memory of 5532	4704	msedge.exe	120
PID 4704 wrote to memory of 4600	4704	msedge.exe	121
PID 4704 wrote to memory of 4600	4704	msedge.exe	121
PID 4704 wrote to memory of 4600	4704	msedge.exe	121
PID 4704 wrote to memory of 1572	4704	msedge.exe	122
PID 4704 wrote to memory of 1572	4704	msedge.exe	122
PID 4704 wrote to memory of 1572	4704	msedge.exe	122
PID 4704 wrote to memory of 4408	4704	msedge.exe	123
PID 4704 wrote to memory of 4408	4704	msedge.exe	123
PID 4704 wrote to memory of 4408	4704	msedge.exe	123
PID 4704 wrote to memory of 1144	4704	msedge.exe	124
PID 4704 wrote to memory of 1316	4704	msedge.exe	125
PID 4704 wrote to memory of 1316	4704	msedge.exe	125
PID 4704 wrote to memory of 4144	4704	msedge.exe	126
PID 4704 wrote to memory of 4144	4704	msedge.exe	126
PID 4704 wrote to memory of 4144	4704	msedge.exe	126

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://getunx.cc/Key
1⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x308,0x7ff9e156c188,0x7ff9e156c194,0x7ff9e156c1a0
  2⤵
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1644,i,13154329108925386667,13705293946754597021,262144 --field-trial-handle=2972,i,7905005484504159161,18218490209235105049,262144 --variations-seed-version --mojo-platform-channel-handle=2956 /prefetch:2
  2⤵
  PID:3408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1772,i,5559722134478017431,7653014902406393898,524288 --field-trial-handle=2972,i,7905005484504159161,18218490209235105049,262144 --variations-seed-version --mojo-platform-channel-handle=3020 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:5476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2096,i,1597257781994239132,8885433192227396735,524288 --field-trial-handle=2972,i,7905005484504159161,18218490209235105049,262144 --variations-seed-version --mojo-platform-channel-handle=3028 /prefetch:8
  2⤵
  PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3392,i,611331299933680182,14303449937677165231,2097152 --field-trial-handle=2972,i,7905005484504159161,18218490209235105049,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:1328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3396,i,6284137194935790843,7577794569392393677,2097152 --field-trial-handle=2972,i,7905005484504159161,18218490209235105049,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4944,i,12264416844471311991,3006006624202202107,524288 --field-trial-handle=2972,i,7905005484504159161,18218490209235105049,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:8
  2⤵
  PID:3752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5036,i,13314308247913412676,7325839230538001410,524288 --field-trial-handle=2972,i,7905005484504159161,18218490209235105049,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:8
  2⤵
  PID:1044
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5620,i,6795313353366874128,5417563625245935002,524288 --field-trial-handle=2972,i,7905005484504159161,18218490209235105049,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:8
  2⤵
  PID:5996
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5620,i,6795313353366874128,5417563625245935002,524288 --field-trial-handle=2972,i,7905005484504159161,18218490209235105049,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:8
  2⤵
  PID:5628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=772,i,13790650012247432645,9521939185730951013,524288 --field-trial-handle=2972,i,7905005484504159161,18218490209235105049,262144 --variations-seed-version --mojo-platform-channel-handle=600 /prefetch:8
  2⤵
  PID:5692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5680,i,8428359897087089526,269267586972950593,524288 --field-trial-handle=2972,i,7905005484504159161,18218490209235105049,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:8
  2⤵
  PID:5512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=768,i,4869637161808260919,823135578012076467,524288 --field-trial-handle=2972,i,7905005484504159161,18218490209235105049,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:8
  2⤵
  PID:6104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6156,i,4423850033796288821,11879061307193843342,524288 --field-trial-handle=2972,i,7905005484504159161,18218490209235105049,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:8
  2⤵
  PID:5216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6216,i,3244506665614115932,9822401092865331942,524288 --field-trial-handle=2972,i,7905005484504159161,18218490209235105049,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:8
  2⤵
  PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5084,i,3383465132556705323,12724833833831233003,2097152 --field-trial-handle=2972,i,7905005484504159161,18218490209235105049,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:1
  2⤵
  PID:6000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=2068,i,17095043650226057415,18216541151211824637,2097152 --field-trial-handle=2972,i,7905005484504159161,18218490209235105049,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:1
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5676,i,9163616642034492845,4356378175500517295,524288 --field-trial-handle=2972,i,7905005484504159161,18218490209235105049,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:8
  2⤵
  - Modifies registry class
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=600,i,1124513038714998718,4135921386084630492,524288 --field-trial-handle=2972,i,7905005484504159161,18218490209235105049,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:8
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6500,i,12266076080840017593,4457448546586156165,2097152 --field-trial-handle=2972,i,7905005484504159161,18218490209235105049,262144 --variations-seed-version --mojo-platform-channel-handle=6524 /prefetch:1
  2⤵
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6568,i,6163239483347468583,10243426295264282569,2097152 --field-trial-handle=2972,i,7905005484504159161,18218490209235105049,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:1
  2⤵
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6756,i,10668412322981917855,2628254536988881784,2097152 --field-trial-handle=2972,i,7905005484504159161,18218490209235105049,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:1
  2⤵
  PID:3576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7152,i,1418648877597384528,12608194132493314039,524288 --field-trial-handle=2972,i,7905005484504159161,18218490209235105049,262144 --variations-seed-version --mojo-platform-channel-handle=7156 /prefetch:8
  2⤵
  PID:1760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7020,i,732080623020748539,10665042437853533725,524288 --field-trial-handle=2972,i,7905005484504159161,18218490209235105049,262144 --variations-seed-version --mojo-platform-channel-handle=7288 /prefetch:8
  2⤵
  PID:6140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6888,i,11901122546143766738,16983409678108090928,524288 --field-trial-handle=2972,i,7905005484504159161,18218490209235105049,262144 --variations-seed-version --mojo-platform-channel-handle=7024 /prefetch:8
  2⤵
  PID:5532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7340,i,16079267234412380282,3085360382639898215,2097152 --field-trial-handle=2972,i,7905005484504159161,18218490209235105049,262144 --variations-seed-version --mojo-platform-channel-handle=7352 /prefetch:1
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7452,i,13570562189104146760,4495733232459802132,2097152 --field-trial-handle=2972,i,7905005484504159161,18218490209235105049,262144 --variations-seed-version --mojo-platform-channel-handle=7472 /prefetch:1
  2⤵
  PID:1572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=7580,i,7889801820724372985,12504322076087447474,2097152 --field-trial-handle=2972,i,7905005484504159161,18218490209235105049,262144 --variations-seed-version --mojo-platform-channel-handle=7576 /prefetch:1
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7752,i,2698410013731832648,2904326913634867463,262144 --field-trial-handle=2972,i,7905005484504159161,18218490209235105049,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7408,i,10313319918918739106,9680019102071743072,524288 --field-trial-handle=2972,i,7905005484504159161,18218490209235105049,262144 --variations-seed-version --mojo-platform-channel-handle=7316 /prefetch:8
  2⤵
  PID:1316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=7868,i,16314829398707419913,3566894969639796085,2097152 --field-trial-handle=2972,i,7905005484504159161,18218490209235105049,262144 --variations-seed-version --mojo-platform-channel-handle=7872 /prefetch:1
  2⤵
  PID:4144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=8020,i,14561203037917629143,8218104175089399890,2097152 --field-trial-handle=2972,i,7905005484504159161,18218490209235105049,262144 --variations-seed-version --mojo-platform-channel-handle=7360 /prefetch:1
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=7440,i,6593860418806954483,12405391515110319383,2097152 --field-trial-handle=2972,i,7905005484504159161,18218490209235105049,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:1
  2⤵
  PID:3268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=8308,i,16078713831977180900,10390681248163183214,2097152 --field-trial-handle=2972,i,7905005484504159161,18218490209235105049,262144 --variations-seed-version --mojo-platform-channel-handle=8276 /prefetch:1
  2⤵
  PID:944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=8328,i,18209531842443662794,12190520958497401991,2097152 --field-trial-handle=2972,i,7905005484504159161,18218490209235105049,262144 --variations-seed-version --mojo-platform-channel-handle=7804 /prefetch:1
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=8560,i,15018941130790167117,2579464819561566053,2097152 --field-trial-handle=2972,i,7905005484504159161,18218490209235105049,262144 --variations-seed-version --mojo-platform-channel-handle=8576 /prefetch:1
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=8736,i,9170029650170475230,12937832548774422422,2097152 --field-trial-handle=2972,i,7905005484504159161,18218490209235105049,262144 --variations-seed-version --mojo-platform-channel-handle=8532 /prefetch:1
  2⤵
  PID:2620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6068,i,2247733850992296169,1751386343224337500,524288 --field-trial-handle=2972,i,7905005484504159161,18218490209235105049,262144 --variations-seed-version --mojo-platform-channel-handle=4760 /prefetch:8
  2⤵
  PID:5248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=8516,i,2808559300686520774,18164073729019705321,2097152 --field-trial-handle=2972,i,7905005484504159161,18218490209235105049,262144 --variations-seed-version --mojo-platform-channel-handle=8476 /prefetch:1
  2⤵
  PID:3464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=8380,i,15809676319340765473,5032650586307981789,2097152 --field-trial-handle=2972,i,7905005484504159161,18218490209235105049,262144 --variations-seed-version --mojo-platform-channel-handle=8176 /prefetch:1
  2⤵
  PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9008,i,325813316430258055,4007122407899616595,524288 --field-trial-handle=2972,i,7905005484504159161,18218490209235105049,262144 --variations-seed-version --mojo-platform-channel-handle=9096 /prefetch:8
  2⤵
  PID:968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=9084,i,4344674029794931954,7893977338312290764,2097152 --field-trial-handle=2972,i,7905005484504159161,18218490209235105049,262144 --variations-seed-version --mojo-platform-channel-handle=9116 /prefetch:1
  2⤵
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9396,i,8927404047866571175,13275236695244877396,524288 --field-trial-handle=2972,i,7905005484504159161,18218490209235105049,262144 --variations-seed-version --mojo-platform-channel-handle=9392 /prefetch:8
  2⤵
  PID:5560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9500,i,5749195876539362980,5489994637827050557,524288 --field-trial-handle=2972,i,7905005484504159161,18218490209235105049,262144 --variations-seed-version --mojo-platform-channel-handle=9516 /prefetch:8
  2⤵
  PID:3752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=8740,i,12020662413429677162,6949022138333763639,2097152 --field-trial-handle=2972,i,7905005484504159161,18218490209235105049,262144 --variations-seed-version --mojo-platform-channel-handle=8856 /prefetch:1
  2⤵
  PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=8752,i,18360347014315290482,18170321844148324399,2097152 --field-trial-handle=2972,i,7905005484504159161,18218490209235105049,262144 --variations-seed-version --mojo-platform-channel-handle=9480 /prefetch:1
  2⤵
  PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=8388,i,13400133803145683006,10510496775179410295,2097152 --field-trial-handle=2972,i,7905005484504159161,18218490209235105049,262144 --variations-seed-version --mojo-platform-channel-handle=8824 /prefetch:1
  2⤵
  PID:4256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=8592,i,10453311207552033540,16196107335808016066,2097152 --field-trial-handle=2972,i,7905005484504159161,18218490209235105049,262144 --variations-seed-version --mojo-platform-channel-handle=9488 /prefetch:1
  2⤵
  PID:60
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8256,i,10770297038096957167,14404886782017048477,524288 --field-trial-handle=2972,i,7905005484504159161,18218490209235105049,262144 --variations-seed-version --mojo-platform-channel-handle=8520 /prefetch:8
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8892,i,18411850653648270578,15459934917959120476,524288 --field-trial-handle=2972,i,7905005484504159161,18218490209235105049,262144 --variations-seed-version --mojo-platform-channel-handle=9376 /prefetch:8
  2⤵
  PID:1924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8560,i,16296016066482715168,9157937931792608752,524288 --field-trial-handle=2972,i,7905005484504159161,18218490209235105049,262144 --variations-seed-version --mojo-platform-channel-handle=9208 /prefetch:8
  2⤵
  PID:972

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1732

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2496

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 46a1eae1fecf49acea451f3862de92bfc0d04347c31f337b1b20a824533a9b1c
MD5 3ca03739e43181be3a6da5f571d6f1e3
SHA1 8ee43e5325a4a3c85db7e0948d192c9c87f085a7
SHA512 7e01203f6dd40073e0305c84a1263a649f8dd249a11bfd12f4df6b961cef416b883269f4cf95f551345131a19eab3fc4c54071a430a10502605397e92336da62
TLSH
T11DD0808C11767C30D4ED4B7114467707A55EC4624883931334A365780C530009DD74F7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ec880f0c5279dcee4c2fa0d92e3dd0f94953916823358924550a9c39702b8d09
MD5 747ebacd4f00d16c2abddca6ebd0e94a
SHA1 8d034cb8b72a8b538f1887c75df30e286c9dfccc
SHA512 f81a74e31a96fc04ecd4d77ffba9f164d92dddde62237198692f964f981a54c84e58a1152235a3c590b4035593bc5ac57ea6adc4df258eaa354b647f174ddb76
TLSH
T1C2D0808815726C30D4DD4B7114867707B65EC4624883931334E365780C930009DD74F7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 9a066df1600287eec29eef184072b1824641743ac1ff3c769e83e38083f09b12
MD5 1ed5b3b205bb61e43f5fdd90828f8b1e
SHA1 e0b75f57282281d3c31c9fb1137ac608a655845a
SHA512 fa43440fb19d5334883a72c46087feb76561bf52affe380f356f6617f308905fd61a945da2ef1b80794f0fa91ac7e4abc4ce6ab841d5435ab12a1638d1e69211
TLSH
T13FE02BABC861AC270AFC572D65904B45F75157572B405E6F3B3C820C8F7433B415585C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000094

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000094
Size 74KB
SHA256 e1649c17ea16555266789c2007ae07b5a031c8b39f110f7066d2d51c52cfb025
MD5 3174b94525ebefaf05251da45ee41125
SHA1 f9e60f8f7c7b172bade19820fd90a382ff08d9a4
SHA512 bf8b6b934f24368cf7f6372332d3791499d6cab73a0aff1b83248145905f797eea6b2bf5a8140df1407767ad5c9def36950696688798777e3c866c36b3ab2d5e
SSDEEP 1536:5E1QCa4UzYJGLJ34Jq8SofcWyisyA5aFoIt9luwUWQUlxeL7FM:5E1tVUzYYJIJXLZPuIt9lxUW2+
TLSH
T10E7312C86FB38B86E9C0B44FAAEAEB38190621490558B7014C2D77CF279D4C52AD0DE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a6

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a6
Size 164KB
SHA256 26a896626222f6de14f71668807c1cd1eff4860138496d2d97bae497b1cdacb1
MD5 299cf81ea75a36b05af65b770b86873f
SHA1 04e3b362773e123b245eea9ed86627c6e4b28d9d
SHA512 874c0b94c68faec7dfd95e0b1e4e70aeb026f9a23981cb741c74084133cfb2b4bff15790bcdc1be7803a50a8d1a7031428d4402eee9ebb11942107c94555f20f
SSDEEP 3072:4WNN8coGiJvf6sVJ13gc/IF/bxMUTG5EVnXa9xfIVui//29nJYXOQ5MhRqqPC5YR:4WNWc2SuRm/bxMUq40xw0It5wqqa5YR
TLSH
T19CF312CABB8BA4339D85799444DE89BB5F96DB338804973488DBC7BD7DE85E0C0812C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00010c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00010c
Size 3.9MB
SHA256 5a7682aac17e76beaf12058346209bf6bb7a999cae5d4aecf686698360e79dc4
MD5 149f0d13e99237577fb508691890f034
SHA1 42259b57d3420dad6d22abd508b49bfb88d7549d
SHA512 247a4dd73baa60f994ce406741ae6979f57c41ba201c58d833169717af71de8a7071c00b8af799f14bc9f062731ee69e1132330239e1ef59f24aec3a49eb733f
SSDEEP 98304:XAiuN0V0ZhWQ7LepW4ghq6ZrWecBcG4uK7o:u0VeWQLrhX1Wxao
TLSH
T1DE1633217B80D033D2A315325FA9E76D97BEB6691E22425B67C80E0DDF32841BE35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 4KB
SHA256 2a4dc441f2cb2d880b16196590eda40a6026deaf576f445968e7e9b3026034cd
MD5 640928573498741f5ec60578199f725b
SHA1 69a51e1cf4cda66d3c96e3869aa9809b7c6b9fc2
SHA512 cef2924b9eb223d32b7796eb525a707ce857b1e3ab592f6980f8c2b74048c1ee304bf74d0f4d3f30b28835cb3586ad8dd8720ee8e8014531bf1d31621985783c
SSDEEP 96:FiQK86mnGVfdXfm+qkBf87SMqmg5ax3IR:FNK8f6MKR
TLSH
T15481085B5CD48C16E7D400B299BC18D83E3397284A375E2E2ED5C2BD4E067DE20B89DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 8KB
SHA256 06195c2b2fa6b5052892a0558b211397b43d9c82d19f2abfd885f19965fa208c
MD5 0b2c6bb120550524f0f1962541ac031d
SHA1 b15ceeb69ca8523ee1759034c044e55bd3140d82
SHA512 74bf9ce444bcd6fccda7e1d7073411723a4fe518b20a1e5d08e49bab39bcfa0a484957fd1a68f5590e69e3a0b9c4152917df364342f382cd8c2e0a117f715454
SSDEEP 96:4lkFShZq1VDCEtlGmuh7lEzwq7oUc1q7k4TGqD3Q9VevklJR7B03y7yTayjq2:4lkFCU7KFh7qzc1+NA9ooJ/03RTZjq2
TLSH
T15A028F1B4CD5C852EBD605B2A5EC0AD47E3283A841732E2A2DC19ABC4D473CD5178DFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe595440.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe595440.TMP
Size 3KB
SHA256 153d46166a0d869a08a03f37ccd68b1d7c996bfe5d485c814258485ee54c7b85
MD5 31ffa019da1d45084b4bd801f7ab11ea
SHA1 018c48af1edc55feb3cd75b5fc905acc170925b4
SHA512 573eee8a6b1971ec91ec176e8f080c3ee1f7a6e70a78a1a785faef3693ab0b8d7bef0d9a92c4934cc7cea407154ec4e7b0f09c773fe4776e3721964d397bd740
TLSH
T17E7118534DC58C25E7E000765ABC14E87E7387284A362E2D2DE9C3FD4E05BAE60B90DD
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\000003.log
Size 17KB
SHA256 de466fea7e5c3529ecee48cc0d8fe3050ce6bbef6f5b4264ab1006ad14f856fd
MD5 c6e0ab1ac357f76536cafcd902f1c202
SHA1 9067a897dc7950edcd7b7f4b00112be8bda8db6b
SHA512 2b69c2c9b33530da9fc9fd1a90794b882783903cb40abc2c355162eefe3b5d05f513db736015d6998d97691ea988de625ec3bec104150c04eb854b9b05cf9130
SSDEEP 384:fBuCcTAPpyaCao4SiIKP0ISIZIFIVIFIsIGIVI4px7bOkMWMA0iv0:JuCcTAPpyaCao4SQPTpx7bOkMWMA0iv0
TLSH
T18E828961B5F9061AF27B5FBBA8B21BA54D7ABE452D04D81E6860624D4C31F40CD33B3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\LOG.old
Size 345B
SHA256 0df87a2d25ad30c9b6dd7620f6fc8ee591bd3e3d4adfca7864d2380c577f6c2b
MD5 344dc0a89e5e272d6db4260d999f698c
SHA1 c95dad62002121fbeda6a1b94e27b9582bbe6138
SHA512 c5381e573e9638719c93194de0a2212585559af5caad2d0aa5e4367bb49350b0545d08fc9cf4d172bedd65e12fc293f17275529f56bb0b628d2a1303a62f35fc
TLSH
T1EFE0D87D88C9C1AF925450D60A28FB0A95B72B0BA68CAD454E9CD8547042044F86D251
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 11KB
SHA256 539fea9e76537836b3c34a5a63106e47cc92742cdcaa3bbcf21da2e04dd3fd6a
MD5 0afb888eb798cda02256dd29f44a9556
SHA1 d3e0c0580ed342faf197d3747adbf0e1ed242718
SHA512 90decf27d7bd1e06b39fb9684d613c8766c2a2d71745f7df947eb0e9426dbc6d30d017102eb7638408b93ed0931ceac6ee77d118fd61bbf8f4c593439ba30d7f
SSDEEP 192:D1ddL7k7B79787w787eJ7+7u7b7U7m7ZQ1j6I/5ieETW5Q7z7h7E7I7b7e757T7x:D1ddLY15A0YaKif4SdQ1GI/5ieETW5Q+
TLSH
T1623299FB86F4857EA82116F1AA28BF1FCE6D0558536C3C1BC9D59F47A3E2431D24098E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 22KB
SHA256 1285fa10a967ec8c4ef409d0c6a8d5beb5edcede30152345ce620c85572b57c6
MD5 3a151b2cd80a15bfb62021f787cdd227
SHA1 80134b2e5d4afaa0f11f20eb6acc21e580533929
SHA512 e841afab4f75fab28bddbe3b98cc9be70981ee6d331b5253a019e6a3b38333d1106109a7467ce8bdedd594dbba06b62febe1a3ae7566613e0b17ead40bc4da17
SSDEEP 384:D1ddLY15A0YaKif4SFLeFKsJGJ7VfGdsatBtZtktmtpnAcQ1GI1ieETW5Q5DgVV7:H0uEojvaTp
TLSH
T188A2CDFB87E4857ED82152F0AA24BF1FCE2D0559436C3C1AC9D59F4B93E2471E240A9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 346e22d85197ccb618d4d17be06264464aef41d34e3f2b6408fc1772a2d8f3f8
MD5 845b3aafb2ab5dceed68147a597e87a6
SHA1 12e38d291d5c225e93b0a4cbcd32ec1b8485fd62
SHA512 f3c48f13a2817fdd14c9894446b5e1932c6f33e8253ee3e8f159f27e695e819880abf428a611cb2a7e74b8b84621d701404fb5c81a8bcde6a8bace4e917939e5
TLSH
T181D023A3539031B9B67C7FC5C055AC4FC337101104D2D9D411E2DD981E36C7C5517144
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 a55af51d3bb8e3a2270bddfc643828251fcc440d832b184fe99b7f77decc3a0d
MD5 9d728e1f19edd0b4ffdf44371163e704
SHA1 bf8151dcb5d31c14653c770397102fe4bc256495
SHA512 b3b549bd8d74f982dc4368d71e6261365a81a9a008525ae808926727f74df9066de8dca7adbe5d54eaa1fa0511fed58011a3c9f70de2a768b8420d249424b448
SSDEEP 384:sxZgQbq37/fRsZNnQjtHHbvEJ4VzJmVf7mBFT:shW37/fINnEHbgmzAE3
TLSH
T14782E657A934997B8CDAD219F544BB27D6F515A396804E44AEFCCE0C04EBBEC6102C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 23KB
SHA256 9cb3310137030f52ef63bff27614b643de10f0ef977c4f7a9190f5474f943f2d
MD5 d0ffcfca5df31feb2ac6901e8ac61572
SHA1 7c5b665f571c746dd1b98210da0b6e5362834efa
SHA512 2ae2175f4d4890af02cce9aa3beef534a1e8c2531a9241cf0fdb14f14a458af0b59fa11126961ab18a4171450eedb58c6c38dbd21501516fa99985688f9da5aa
SSDEEP 384:sxZgynGbqLm17/fRsZNnQjK0fHbIEG4/4VzJmVf79BF1fQ8:s3GWLm17/fINnAHb5mzAbtn
TLSH
T125B2E9576530997B8CD7C615F825BF26D6E510A3DA844E88AEFCCE0C04EEBED2102C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 6acd10454cc9bdf435317d91e874aec3e9ae38a4dee5a68ae0bea169bd2e1a8d
MD5 4c6a0e03298025d1aac7eb3b73d903cd
SHA1 9478204277191e51758b2576a15f07ad4a1a55db
SHA512 11df6569fbafdde3903ef6f512b9ddf89bf658ad7731c5eb29c0e123a26f7271a2e704eccd47c5afaad8f7135cdc5251f923ce855edc6f8fd980f61abc645bb4
SSDEEP 192:sxZgQRyyMqZ/K1Ml8Mk7/fRsZN9s9jFU9zodp6tHW6+WNXM7/Y4/BPkp/PIgjV3J:sxZgQbM7/fRsZN9Qj/mHbI/0BjX
TLSH
T13D72F8166934A97B8CDBD209FA457F53D6F9157392904E04AAFCCA0C04E7BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 3649cdf066f0a775dd2c86f814d3c4fde861a972654f1f73ace7258d974399c6
MD5 c4ae09d35dfdf647e39c2ab8a1dc987c
SHA1 8d595d4edf3747cba1ffa5128bfb25eaa1f79c45
SHA512 664cc5682761cb93a32104aff6d5a480b573f64905e7d7078913da4a921e30985404f6a2b329a97ed5cbd792cca6af4bdc6fcb0f48c4be8a484993ae1104cfa5
SSDEEP 768:ByYz+Sb7pLuL/W2WvW6dS8F1+UoAYDCx9Tuqh0VfUC9xbog/OVetGBLldredurov:ByYz+StE/W2WvW6dSu1jartGBLLCdl2A
TLSH
T148F20B3B680CCB7E4F804E9CDC2A7E9A6DE802CF9AD8885447F9944C03C66EB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\00c4e2e0-32c7-4a55-9dc3-d0dce4c1240b\index-dir\the-real-index
Size 72B
SHA256 023899a7cff991b32d5dfe2bd59a1e0d998c7a51b0c235ad0f1472ff4c5c7a01
MD5 889729760a1c6a8f26615620245bc4ce
SHA1 bf5e5e6d615e8bc5a01b66e2431a8eb6bbeb2a65
SHA512 3d991f41046e943712d72f798b92422aee94950795ace583787a691756d0689951335184f9faa9de58f59d6c8be5a495bd3593a0b78dcc873fad75536ef8d26d
TLSH
T12AA0022003589042C14106B0514617936355ED298111439BC49006978C915599F01148
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\00c4e2e0-32c7-4a55-9dc3-d0dce4c1240b\index-dir\the-real-index
Size 72B
SHA256 c0c90060fcaa7a20fc139758dc59696cd46ffde8192c024fe2b14c03a54d5205
MD5 1ef949e0c17e41fc89e19a9515d95199
SHA1 3df8e10328c5c77a7b6942fc8b0321bddb076b72
SHA512 3da941beb301f38779ad5d4c24e036dd549eff9e5d155bf86dca295ac7b8d79875205ffcac2b760bfa824d9ef893af29b89d78ae52fc2e69190b5d013c4a870e
TLSH
T1E7A0022139D44067E45106F8619741902B18DC2902098B155C901D5ACC5D15E5502474
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\13237b31-7679-4a75-abf5-5ee0578f1867\index-dir\the-real-index
Size 72B
SHA256 a4cecea873678cd2bc57f3a15a4adb04daba2d127288faa4b673dac38a620625
MD5 ea46956dd1c663446420d31a1e636ab1
SHA1 3440de8bded26aaea37f1fb8430e278e5d4bd38d
SHA512 5e8b8610234c5ea180a49d326dff4b4fd7f56cf11c86febeacec16e34fff87963d97638215a9ebb56b24e358dd80a221f9fc903e50424707ceaa34f4829a3c5d
TLSH
T136A002206A445099C570877191C2157472565F1562055AA361900446F9EA2C54755150
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\13237b31-7679-4a75-abf5-5ee0578f1867\index-dir\the-real-index
Size 72B
SHA256 46b8149be8ad9e7690ce9d9c3f4cc090b84d71c967df0a362870fd5f1a1b44c9
MD5 65d3858e6a52557058981e193daa8860
SHA1 725e273f1ebd107f34962c052031f840268dfc76
SHA512 dd17f84a7998fec37a8a88bc95f295bae47ddffa39ffc33ea5f57154ee940e58bda95e2fba667583a97bad287b77a049d1243fb7e1eb5512ceef546ca988b156
TLSH
T1C4A0021817489301C15083F210D31A4332146AA0E2090795D0A18159EEE72444607B8C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a5c98.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\13237b31-7679-4a75-abf5-5ee0578f1867\index-dir\the-real-index~RFe5a5c98.TMP
Size 48B
SHA256 357edab093a799d27812b4e614dc7473ad92545243dbff482f8a2d70604aa4eb
MD5 4faec8fcae79f093ec80b0fc1396aedf
SHA1 8a091c1c79fcd32c11d3d9434830b2b76b8b7618
SHA512 ed7d1ef4a6eeae47a4fb26346125b207efb1ac4ffc879fe8c87e0a7c4f7c982e33c2eedc7ec0816aa00aa11a836cb4d1ce94c999b8f0a064a2431928c3e4df05
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\672268d2-05af-465c-bc04-21e6e42af3da\index-dir\the-real-index
Size 72B
SHA256 63a273441fe466ddc52362f7ddfd6d165cfe2315e9249b221eb3328ae8c38af1
MD5 30fcd7b30d6c9ad452d526658972fa50
SHA1 453de1af4ef490727e80c172dab7942f7de8f8f8
SHA512 95d17c0faf3902cb11a3da8d1849901e6a5e0b9a40cc13b01a99bece5df28164a34675f778eff2d82380f4adf87a79a8386779ee6448ba018c951537736057f0
TLSH
T1F0A0025002B08005C0079EF025A3638166119C115607120592E11195CF956A947524FC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a5f19.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\672268d2-05af-465c-bc04-21e6e42af3da\index-dir\the-real-index~RFe5a5f19.TMP
Size 72B
SHA256 ec476784be8d50808b5cd8ae900a1d05dbf54f6962ccfb5421580308a7295477
MD5 f2d8bf59868ac5b22c6c5c40d75ae552
SHA1 dd539dcca3cfc8fc4354fcda9f5a7c81bfc48b3c
SHA512 98d69a67896a15cf7979111bb27f21c673c0232464d5e3925fff05a0c5920d1806e981884f957491d0432ea545aec07fc34f8d1acd8c466df38e04c9197b1c77
TLSH
T1D6A0021203D00516D012E9B12696374516008D246502160645A56044CE9145387550BC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\a436c435-d795-4690-91ef-aea55e901e12\index-dir\the-real-index
Size 2KB
SHA256 a3fa4c156b8d65ff4658deddba3aca9f834a349a4aa846dfc844c3f1cd663913
MD5 3679d327ac0112a5a13506ee1b80a79f
SHA1 ef7a7aae7e786c656c28e81df474953f85f31c68
SHA512 4d336be3e56113cd9898c98b8af07512678468774a4ea093a83d71a41b90045686bcaff10aba4f37fc6c69ab6b93a2c458d71fe81e6c3d1f88f64770bfccce5d
TLSH
T1FB51C81DAC0F5F65CD7825B608B61841337894CDAFE44B07ECAD5DB1345231A1E4A827
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a7b6b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\a436c435-d795-4690-91ef-aea55e901e12\index-dir\the-real-index~RFe5a7b6b.TMP
Size 2KB
SHA256 62ffec4876a9be34936e2e75b92b16278199f17008f971e82f37be89aad4845b
MD5 6a59bb75bd3222ffb6688b88b81b4f2f
SHA1 8d2d6f60b6b2bdceec99c0a01084b1d9af7c2f05
SHA512 1584066beafbc07d0570a0a0b489dd6a88a528f07d4a2e4c45f137ee6b3fe3f89b19ec32bc8dcdd6c1f26cf2cf03bad3c0d6809629ffd37fbcf5188bb21dea27
TLSH
T12D51D75E9C430A32C9A085B355CA5468333D68554D09BF0735FC8A33ACC37AE3C56344
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 476B
SHA256 5ac28af208e3172280072caa05b0c767867746b5fb848044e78f58769c3acdd2
MD5 492265d08e78370b45b6ed425410c135
SHA1 990e2a64b7c83c6ce84ec8669708e563f1fabf17
SHA512 368b9ac1b7b84a856f2b9825ced2db9ab119aae8f15f8db4a7f22487dbc548531ecc7be1c8a0476da30dbdc5dd3a8bb45a7e68180be9c4d9e804c757c06799a2
TLSH
T108F027F75FE72818FCABD3E724B0446402457958C8519D5F2517B287A0B161A348BCA2
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 481B
SHA256 e870b02e6a83442d974c08be4cef6e61b071f1a2916866ed5558fb81bd358689
MD5 5d2fff881baf63595e1976c79ae30048
SHA1 57e564c9a48126bb27ca432d78c74bd9f92a7a26
SHA512 c91123aea6a173b9ba462f8252d1d99e40b9c3a535491d22c981b67888e47ee025b0c9911479e6a5d25c5a2b91f216e486ef0b0d508c791697e0448d5c8d07e2
TLSH
T1BBF027F76FF72818FC9BD7E764B0446402443D58C842DD4F2517B29BE0B161A248ECA2
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a566779293633a3ea3f8a3ec5ffff2d59df0622b\d285d425-b4d0-4875-b768-a17aa20f0186\index-dir\the-real-index
Size 120B
SHA256 d249c1f134ee1f889b4dab83411cd8127d6f5faa592f811da6aafe4de7feeceb
MD5 10f6b68a25c4edb98aaedb144f02228a
SHA1 c49459f1df2822b51c205640a900596cda512ad9
SHA512 853f2f1bb351778429f065fc38c4a67513352c2313ea78d77e2c22d11293c79102a552d928b2e80e468b71c9cee395c39ec4f1042019e52389c674a6e93445fc
TLSH
T18CB012AA60C70DC2CC1D4270724912E933C0D468090543475054169898536D06C12850
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a7f34.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a566779293633a3ea3f8a3ec5ffff2d59df0622b\d285d425-b4d0-4875-b768-a17aa20f0186\index-dir\the-real-index~RFe5a7f34.TMP
Size 48B
SHA256 010dff78e40d2bd7be74ac3c51e8628fdc141d1e7c1b6f1f894331ec549d9561
MD5 a3e862874138adf6d5cf0d8b0f55cdec
SHA1 6f4ed02ef59e19d3a260c78f3ba9f4b08b25c0b9
SHA512 f1d589bb156fe2db3b3fb7821e916e1842b86ff9c878f0202f277442857f07b626622b5b1cbe1c140c15a64ea8ae38d48ad6d2c8976f106489f35dde2ed294dd
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a566779293633a3ea3f8a3ec5ffff2d59df0622b\index.txt
Size 112B
SHA256 66287ea716785b3cc152868e3ff04c29c137b8778c251d3d15dfdbbc21fa91da
MD5 49f60fcc63fe6d0eff1aa5118c1e7a1c
SHA1 f7242f9620df325a7873151bb100f500ffa82cc5
SHA512 bf3669af61a468d1394813985636a8ad44da6a9bc392bef3b0f5aadbea949e8150556c4d1ef5631aa892ee73bd6c0b3c5a528f4d7d0222101116f53f589e3d23
TLSH
T155B012F70490BD0B7F4082C20C4424DD471747E94CEE5D0C4C4CA41990310F69C4F9A2
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5a7f63.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a566779293633a3ea3f8a3ec5ffff2d59df0622b\index.txt~RFe5a7f63.TMP
Size 117B
SHA256 dede410ba8dd3745d85e51dc86b3c20e80c8a228acf432d1f73e82a7024b9f5d
MD5 010ff58d07cef27dbb3c862f2840958c
SHA1 d1c9676f198eab25559aeb13d54018adbf18318a
SHA512 61d0a0762e9d65cb0106bc818300beea2fe1cbc3872bfe47d0c98061f3c50d4c90cc415d9aa79e9a9180817dba43d70498bedad98b651e7d48b8508cbf367b69
TLSH
T1C4B092F700A07D066F004182085824CD472B0F9848AA9E084C49B409B0710F78D4E992
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 f315ae2bf7a9c90fe735fae12b338cb96cea75f0afbb12689f36063b51b3d6c4
MD5 a23394f66389cd46bb1f2e76267a5ed3
SHA1 585d879642fbc0caf226bab7ec9ccdaaddc70cc0
SHA512 5d424b0583e359e10e240e0462a35eb64944119fa36de10e62c9384a809a042fce13ef544ffdb67d749d52af068bafdfbf10ee1aba627d91749117747efec545
TLSH
T1A9B022388C02E08BC02C03B8C8C002CC30388CC80B0F202080BC02BCA023B82C0F300B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a7d4f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5a7d4f.TMP
Size 72B
SHA256 fcb380b093a4f722f45cef4b6174c72f3d16f54a511f3fa5e43d44c8cf2332cf
MD5 3aad23950684d05b7918e8de2a71a4be
SHA1 58763c9b9a616e0e9d26889374301ba60c2b33a6
SHA512 726958b63da0a724723b2a2431d1c4da318084ebe490e01b8c09e8e1a8c90391cc892df4aae182fe99e715cb8569caefdaffa94b24667599b78d63e5ec97f27b
TLSH
T10DA00294C34EA810C408157D901BA3402720C86A4409573388E1E5DCADE15405DD2143
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 e7f0825b849c2a8dda26be0bbf3c220094819b9be97463156c171f794874f94c
MD5 14d6d4d4104bf2a6e12acd0042b1ab95
SHA1 1947d116c3e8f543c9a78561e6e18d049e255c20
SHA512 14028ebae982e42a1c1ea9e88fb4059431855918b2a68d133ee3fef71113441cf3051bbb02ab76ca3343c4e2b3f0c9e81e9257a8d6ba4c931099dd6c1bbc44d5
SSDEEP 192:spVXRJp5l/NfcNAsiuy/GLAE41EqnUE7KWJhN5dyduy0UErMXCiKnQ4HCqfQodNq:sPXbpH/jZzNzVDnxZv6
TLSH
T13BB22615717A43903A3E65CA8595B86E12C731B33018E52B7BF804A61F6BE20DEFD9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 57b2d2b618f0ec8c99478e3860055cd11c499be2e0e74a442a73e0a332d57dd3
MD5 fc40cb3450bb4f4f42ec0386d1da0d63
SHA1 d2f4fc799e646f139ef01287d024a0775afd8135
SHA512 ada9a1e187c752e3a29248a7aada29e8b58f7c6abe82b412433d1de917f763205b26039b675e8d139aecabb40cb1e25ae334fd780944608fffde7f113b1e33e9
SSDEEP 384:nLEiFavqMg3sN28TUNTUlImkr1prIP5Um4f5Yy/XNgjYtxn0dnS4mtmG+8rNlk+a:LfFayv3Jwg3prOGYy/9ggx0dS4sml0E
TLSH
T103C24B75EC98DAABEDE68FC9E7497A17DEE00197D58C4AC4CAC81D0D00975EE1307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 62a51a3f65e3d3b2bdfc0c91b5341854c426da83b229f6a95ea48eb6a2d174fc
MD5 bddbde747b3b289b7f53a33712e3144c
SHA1 e038611489be5698d55f0ff6d3a9f087f9d146d3
SHA512 1be8b4df714b6f1d1f9dabd426d6e5c5d59daac4d39ae4634bd76cff71f5a15cb50a8c3b1ecc20d462269d278f10118065ae308358825afafc30bad251046e9c
SSDEEP 384:nEEiFavqMg3sNt8TUNTUlImkr1prIH5Lm4f5Yy/XNgjY2XhWRdnS4mtmG+8rNlkF:EfFayv36wg3pr49Yy/9gLhWRdS4sml0E
TLSH
T1D8C24C75EC58DAABEDE68FD9F7497607DEE00197D58C4AC4CAC81D1D00875AE130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 2cc63630926564bf00b789b866b80b42422cc4785e56c770e53a439ba057b70a
MD5 0cebd78138caf384520d13147c1b110f
SHA1 a6fbd012d0eea90c4ee90536893ec20e71e9d954
SHA512 50f5ef2d607f2ba30750cf07ce2bf1885b49b1f661056dd93f221d71279440eb1252c15aa7849d5fb96dc37ebe6464673b351250aedaadce52445364fd5e36da
SSDEEP 384:nEEiFavqMs3sNB8TUNTUlI4ke1prIHbUKm4f5Yy/XNgjY2XhfRXU/AatId6jlZr/:EfFayf3qwgmprJMYy/9gLhfRXabW6TfL
TLSH
T14DC24B76E864DEABEDEA8F99B74A3607EEE00197C58C4AD4DAD90E0D00875DD1307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 02357130ec43eb5c374a588f5a6955a7b441d8c82f535cad4abdec7645832738
MD5 7a7ae3903f0d2c232f484b45a8f566f7
SHA1 92ddbe8b86a3660555d4071149c32bfdc5017038
SHA512 3bbd1685e4614fae04f53923364fa4486ca7c54834f985108adc3c83462b304919a64e771c8c3639f3cb02a28b7ce7caf26330bb487299b1a66e7e04a8698d5a
SSDEEP 768:NfFJccQ43qwgmprcMYy/9gLhfRXabW6TfZ/:NTccQ43/n9YpyWah/
TLSH
T128C25C36E894DEABEDE68F99F34A3607EEE001A7D58C5AD4D9C90E1D00875ED1307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 91f8897406a243ff885b59e8b35472d3bc121cc04579d5676582d85ab814ee2e
MD5 16c78b6f909f0a97ebdeee594e3ddafa
SHA1 9238c4dc270fb9ce9e43713f7fc278b186597468
SHA512 ca3c2d9da0b23a4a9511c4e3cb57cc67da133d5842345e29e113112df04e27b98c125d6b2fec808e9f9ce4c8c880871256ed07a135b42fb2156b0a30b1870308
SSDEEP 768:EfFJccQ43qwgmprcMYy/9gLhfRXabW6TfZ/:ETccQ43/n9YpyWah/
TLSH
T159C24C36E894DEABEDE68F99F34A3607EEE001A7D58C5AD4D9C90E1D00875ED1307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 8e3f51e975a7553fe41ccf9d8e74cbe0160a9ba2cb43f455e513664515654be9
MD5 15b67011b4fdd24021d3f3c88924d3a4
SHA1 654ac661e517aa47a05276f5662dcf277bd2a1e9
SHA512 fa839572fe7b5c8cf6dd82d398e03512ef8904b226f3f6cea0478b1f8049ba31272eec88332718d6e665bbc620099e57e048c7b806e455b359f9fdfadd23dac0
SSDEEP 768:TFJccQP3qwgmpr2LoYy/9gLGRXabW6TfZ/:/ccQP3/R9NyWah/
TLSH
T142E2B2F598D79976D9AE4B87A37D2E029AFCC157B5884A94FBC40E0CCC861BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 6b7e45864ad2791c4daac4cc237882035bd95edcbaf33f901dd711125a6fb510
MD5 dfdf657d5d689624bb6666f018b7e0f6
SHA1 4c531a88952e5680c30b4333944f8918b913d82d
SHA512 9a3bf9b814c60e8f20376fd2331bc9a4cc79b2bd6803032328f86d5a7afceac2764f5dfa2a98ba730b88a973c7776e5f38d6271bf88847c15ff2f870959b9207
TLSH
T1F2E0020112080467C015033151C71B143E71801003830215967001BD1C303003934940
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 a81c1b6df65d8e431d441373388f17dd08e31585a7524e646f7bb6c4933d7e1d
MD5 f70f684786f398f0bc494a70a70c5aac
SHA1 6360bd2f6a68b09dc9c6bd5e84b0f01e338877a6
SHA512 4970812c77122531b3363c82473b8b714379edc475e0abb64ea7148ce5393028737d76685d699c9dbd7fa9a24dcde72b75b631689e9a07497bc9f2529135d277
TLSH
T14FE00942534944BAC469133214D357247AF2C46042B30356AA6015A96CA33002E39F80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 5104488ad2f4131384772a909ce4af6902b4b02c1edb9533de238564b487b993
MD5 6616de726146fa4efc109357cde7d719
SHA1 108a578b50171e05b8d7451001aa07a0e31b3ccc
SHA512 4bea4cbad710a89b146e280e1714c4a95090d5e041f870ea5a44fb62d24e99c47364d21f44e0f219d0c314dead15ac3eb55387e9d6234924cb4a1f28e81f612e
TLSH
T1C5E00102938400BBC02C033200C34B307AF2807012B202165A20147C1C633443F34F80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 8f07e14a8b419f85ae8fe7f95f7ca71fc6c442fe3d2ce3fdb356bc7bf3ba07b2
MD5 923b59e19503ec60552e96579d27dcb6
SHA1 c0e1d90957e5e6cb990fa40a4eeee37b0b6eb096
SHA512 1e4b09db2644356699e946d48d999b23ebcbd7d4b1998662fe494a7507e7bac2a4d9c6ec4d51bb979315a26c324c70799f3c0fa1d84cfc107cd68759e6058945
TLSH
T17DE00452978944BEC46D133214D39B34BEF284B462F30266AA6119BD5CB37447F79F80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 6bcd34051ca0268fac9655931b95e29e48ef8742eb242b1f55e086496cd08831
MD5 d271d1426b801af08a8071020b9d53f3
SHA1 7097fcc12207a6af2cb0572f9e4b4a7a1dae7868
SHA512 e96332230e04d3d1986a53ff5ae7c3868b9dc591063a7362971274d0392e676bab9271549bd3694767194bd292a547afe11187359ad669fd55bf92a290beaf5b
TLSH
T10FE002011308047BC029033111C71B247FF1C02003E303169A7001BD1C323003E34F80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 f3dee8c191008e4e42159ad8ab7c8545a9dfd7420fa34cec57efd967f31b4fe2
MD5 c5d22b0ab2265b133979f9908697d326
SHA1 bc37752d5a46e4c19f1a8419d5fd69d6e9b148a2
SHA512 f8f0c6ac9ad43b8a9cb991a607774a295dcd54256ef9a4297df232444f598f86c69a6ea2e5eadb301a85daa44ed125aa799cbff003c47ebf6066ce8914ff90d0
TLSH
T131E00952538944FBC46D133214D39B24BEF2C47042F30366AA6119BD5CA37403E39F80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe59ef67.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe59ef67.TMP
Size 392B
SHA256 f0ef84a11d232e099d25522ce85d12e2a0c84e84bf2856f836dddf7a6b061209
MD5 f0078e8aa39cf34ff7e16a33a92a90ce
SHA1 2f2ee08e699421bd6c9b9e7fdf601aeacc527846
SHA512 f54d333a30a3841788aa2510a3cba5e4d10130c327a73612ce40dae57eebf8993ca62cdc51b9f82056d68d37b31395f238742e8c3979346473f8a100c0d43938
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 a8a77b8212fc9eb9a7a79f0e1f41c98107918d9dbe7adfacc3bb6e5aff920db9
MD5 e6d720fc8dff531b78f6322db1c69447
SHA1 027e8a39a44155b5dbb7706aabaa308616231313
SHA512 788ae4aae5c56c65f98b9f1ea9216f3108809e012e8756c2059db04fdd8c8fd9d1a23e0c0e52a1285f9da0f330e26bac6042aa2fe3effbae67d273cd67f0032d
TLSH
T14F4151E04C3E2AD1D4BD0A3E748B78FCD5DCCB2AF5A4347D6824DA880A3A50D248543F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 9f724b073e6c5cfa71d66bad1fa8be62513784278cf7512d3432535fe433acfe
MD5 5662b7bf3a6af05ec9ed45712e928abb
SHA1 6183ad8b90181bdcff2dc2746f9cd0b724263138
SHA512 f001c7ddce25f0d504ce701c1d5b4e9729a581c48888474946efae4fac877e41437056463be2d36cc9adff78770dd15d00c050b07f9e188ed3e133134c21afa1
TLSH
T1D4414FE14C3E26D2D8BC0A3E708B78FC95D8C72AF4A4357D6824EA88463A51E644543F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 650f5115146491dcd1d716353a7837ca8e393430a19fb7ded8a2ff70b3f39589
MD5 c72ad10b05d7b236a311022f512f5ce1
SHA1 8b537f087673c8087eadd0b3b9e85540c36e7e23
SHA512 6d976b375f3b6d00233ba31a2fa3f0fe4a81aa7c05e5be292dc4af8f308a95ab82bee8b278f55e09f7e3bc17da353e6138c07245f8f047346376b41fdfc75d89
TLSH
T1F94141E04C3D26D1D5BD1A7F708B38FCC5D8C72AF964313D6824DA840A3A61D658443F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 cc28f07e6d32097dc6cd81a99dfbafe990d96fa15496c5c711a9c8bea812e09f
MD5 c6865a07d3999a679399e0f94eaa475f
SHA1 e9364aede45831be90241fee0dfb1bf975f6f995
SHA512 5185d7d3818ee43befab04f093e217a46c218c22eecbb177880199b5156f64b9eed7bebf9d6780cf42c5f27658d9a5b780ed6c03b54621ce0ed6206fd47dca23
TLSH
T1D24140E04C3D2AD1D4BD0A7E709B78FCD5DCC72AF9A4357D6824DA884A3A61D248443F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 2a31328c31cfa15a6aba20b7e1accc9306f84b3a2342aaf19d5a1da7479874b9
MD5 3dc1616c2e4dac70a2c376ea527a330f
SHA1 8a1799439369fd2b60b0d1d0fb89e1dca44b69fb
SHA512 c24602f7c6ec6518fbebf5f4a8f0323743f52dcd4212f57e92a6f1bd972dd6e9a171676df72db9bb8f752044e513cc7ee9056524b171030cc35462fba796dab6
TLSH
T123413CE04C3D26D1D0BD1A7EB08B38FCD5D8CA2AF9A4353D6824DA984A3A61D648443F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 dbd053317fa853172153b9686693acc9ce41b18b471f44f1fd0c71bf848772a5
MD5 427ae20649bc555055083d291cd23858
SHA1 14566f6cc01c5fdb4a2957ac13c135e3b77a5df5
SHA512 90d2aa74920c55e43df6e74261f82b261122432a7d76cf5b176c161729ff2159155b8516240a2b15c0cd1cfc88aa3a423e764bfee606ebcdda594c544c462df9
TLSH
T1A84141E04C3D26D1D5BD1E6F708B38FCC6D8C72AF964313D6818DA540A3A55E648543F
MD5 SHA1 SHA512 TLSH

Submit Download

3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 54f761e00d363bd15db7bae3cc55144c80148a5fa1db7c3c2049e0e406a9142c
MD5 b1ac780361002049b0a10a7fd30fd809
SHA1 0ee0a7dc27fd175ab7abd6e5649890be3e2795b5
SHA512 1bd8b1d2dc30bc62728d3d08085a446e8c037b02499687affa9a0bb18c6bdfee19104eabdcd8a52c2d0b542046abf26b7fdf81815037d4923e31231b0dfb7d60
TLSH
T156C02B5538F9488C2FA5257ED238092E12E4C912310022B0002ED804103465C13A0C2F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 b87af127317aeffc5bf38fb68e935b41b8654344aec00d8b833bd81007b07120
MD5 3e06380f5a529245971634052edc128a
SHA1 9e4d7f41cff1011a3dd6f516eb6929251b2f04f1
SHA512 c047986165db85238fe8fc844194a027b0c35d5628caab7fdf638d12deee675cf284907e6660b672dd5f47ea8272c50804e52c2703be8b43bbf4eeed833deebb
TLSH
T13341E698A6EA1108B3B76F5A9FF7946D487BB8772E0BD55E10110D4E4A73E00C871B33
MD5 SHA1 SHA512 TLSH

Submit Download

ccba5a5986c77e43.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Size 9KB
SHA256 671c5cc640ec90a3ae9ba3a1e1b641ab99a532e32b85bb8ff353b3998af604b9
MD5 408b89f302af8bb6256ae4a6c0c7f8b1
SHA1 7383e08c6bb95e4f965e55b72976a2e7f67ee61a
SHA512 8e24cddcf5d56789c1d95076a2bdc749a053ce5ccb86a30d78e62fc5fb0715326acc86cf104aac65115343f66feeefc5023b79d8d0def6bd0f31dc496de3b6c9
SSDEEP 96:e8tJmm+bus9KfJJUrNmnsO29HoCQRmZusdJfJrusTokfJnIusb:jgRGQrNEsO296Ryd5FBI5
TLSH
T1F022EF0467E61519F2F3DE71AEF6BA21EF7BF91585081A0E408082070963E54DE6FBB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ccba5a5986c77e43.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Size 12KB
SHA256 1df5573af45830f6cc34282855114554585fd274b404219fd8fff83be3861a34
MD5 f10fc24477f2651353b2e3aab77c0803
SHA1 66d845c12117418908669185bbfd57a7e4677d5f
SHA512 13f8308c779400868b02257219c09ead0778debfb654c318a2602032a793554e76ed541da91e805333db1d4eebc83a5c2ba10bb672c9c6dc6fb973c43dbabcab
SSDEEP 96:VKfJJm+aFusnKfJmm+busnKfJJUrNmnsO29HoCQRmZusfJfJrusTWkfJnIusb:8vMkgRkQrNEsO296RyL5fBI5
TLSH
T1E042DD046BE61525F2F3DE71AEF6BA21EF7AF9058518190E408082070967E44DE6FBB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5628-200-0x0000021084A00000-0x0000021084B14000-memory.dmp

Download