hxxp://canary[.]hyperbeam[.]com/r/teamkatan

Analysis

geolocation tags

asiadelhiinindia
user interaction
yes
max time kernel
899s
max time network
897s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260130-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260130-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
22/04/2026, 22:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://canary.hyperbeam.com/r/teamkatan
Sample260422-13ch8acz5v

Score

7^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
3576	msedge.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3576_388690704\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3576_167110760\json\i18n-ec\id\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3576_167110760\json\i18n-notification-shared\ja\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3576_167110760\json\i18n-hub\zh-Hant\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3576_591889892\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3576_233018246\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3576_384946917\adblock_snippet.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3576_167110760\json\i18n-hub\ja\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3576_167110760\json\i18n-hub\th\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3576_167110760\json\i18n-tokenized-card\zh-Hant\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3576_591889892\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3576_1513099877\v1FieldTypes.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3576_167110760\json\i18n-hub\es\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3576_167110760\json\i18n-hub\ko\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3576_167110760\json\i18n-mobile-hub\pt-BR\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3576_167110760\json\i18n-shared-components\de\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3576_167110760\wallet-webui-708.de49febeeb0e9c77883f.chunk.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3576_591889892\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3576_591889892\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3576_167110760\json\i18n-ec\it\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3576_167110760\json\i18n-shared-components\zh-Hant\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3576_167110760\Mini-Wallet\mini-wallet.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3576_591889892\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3576_591889892\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3576_167110760\json\i18n-ec\pl\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3576_167110760\json\i18n-mobile-hub\nl\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3576_167110760\json\i18n-notification-shared\fr-CA\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3576_167110760\json\i18n-notification-shared\id\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3576_167110760\json\i18n-shared-components\ja\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3576_591889892\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3576_167110760\json\i18n-ec\nl\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3576_167110760\wallet_checkout_autofill_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3576_591889892\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3576_442787674\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3576_167110760\json\i18n-ec\da\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3576_167110760\json\i18n-mobile-hub\zh-Hans\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3576_167110760\json\i18n-shared-components\fi\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3576_167110760\Notification\notification_fast.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3576_1358871863\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3576_591889892\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3576_591889892\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3576_591889892\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3576_233018246\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3576_167110760\bnpl\bnpl.bundle.js.LICENSE.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3576_167110760\json\i18n-hub\cs\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3576_167110760\Notification\notification.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3576_591889892\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3576_591889892\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3576_388690704\edge_confirmation_page_validator.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3576_167110760\json\i18n-ec\es\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3576_167110760\json\i18n-hub\sv\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3576_167110760\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3576_167110760\shopping_iframe_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3576_591889892\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3576_167110760\json\i18n-hub\fi\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3576_167110760\json\i18n-notification\nl\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3576_167110760\Wallet-BuyNow\wallet-buynow.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3576_388690704\edge_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3576_167110760\json\i18n-mobile-hub\es\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3576_167110760\json\i18n-notification-shared\ar\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3576_167110760\json\i18n-shared-components\el\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3576_167110760\json\i18n-tokenized-card\ar\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3576_167110760\Mini-Wallet\miniwallet.bundle.js.LICENSE.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3576_591889892\_locales\ka\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
persistence privilege_escalation

Accessibility Features
T1546.008

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4692	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134213694476061877"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2605425648-1229640847-2920638550-1000\{6F5E09D3-D1AD-411B-B20E-54BE9F26962B}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2605425648-1229640847-2920638550-1000\{5F8C033D-F6A6-4553-97FA-FF8140C7D0F2}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3840	msedge.exe
3840	msedge.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
664	Process not Found
664	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 31 IoCs

pid	Process
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
1036	osk.exe
3576	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
1036	osk.exe
1036	osk.exe
1036	osk.exe
1036	osk.exe
1036	osk.exe
1036	osk.exe
1036	osk.exe
1036	osk.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3576 wrote to memory of 4032	3576	msedge.exe	83
PID 3576 wrote to memory of 4652	3576	msedge.exe	84
PID 3576 wrote to memory of 4692	3576	msedge.exe	85
PID 3576 wrote to memory of 4652	3576	msedge.exe	84
PID 3576 wrote to memory of 4652	3576	msedge.exe	84
PID 3576 wrote to memory of 5164	3576	msedge.exe	86
PID 3576 wrote to memory of 5164	3576	msedge.exe	86
PID 3576 wrote to memory of 2288	3576	msedge.exe	87
PID 3576 wrote to memory of 3656	3576	msedge.exe	88
PID 3576 wrote to memory of 2288	3576	msedge.exe	87
PID 3576 wrote to memory of 2288	3576	msedge.exe	87
PID 3576 wrote to memory of 3656	3576	msedge.exe	88
PID 3576 wrote to memory of 3656	3576	msedge.exe	88
PID 3576 wrote to memory of 5692	3576	msedge.exe	92
PID 3576 wrote to memory of 5692	3576	msedge.exe	92
PID 3576 wrote to memory of 5692	3576	msedge.exe	92
PID 3576 wrote to memory of 2812	3576	msedge.exe	94
PID 3576 wrote to memory of 2812	3576	msedge.exe	94
PID 3576 wrote to memory of 4904	3576	msedge.exe	95
PID 3576 wrote to memory of 4532	3576	msedge.exe	96
PID 3576 wrote to memory of 4532	3576	msedge.exe	96
PID 3576 wrote to memory of 4532	3576	msedge.exe	96
PID 3576 wrote to memory of 756	3576	msedge.exe	97
PID 3576 wrote to memory of 4536	3576	msedge.exe	98
PID 3576 wrote to memory of 756	3576	msedge.exe	97
PID 3576 wrote to memory of 4536	3576	msedge.exe	98
PID 3576 wrote to memory of 3424	3576	msedge.exe	100
PID 3576 wrote to memory of 5564	3576	msedge.exe	101
PID 3576 wrote to memory of 5564	3576	msedge.exe	101
PID 3576 wrote to memory of 5564	3576	msedge.exe	101
PID 3576 wrote to memory of 2636	3576	msedge.exe	104
PID 3576 wrote to memory of 2636	3576	msedge.exe	104
PID 3576 wrote to memory of 2636	3576	msedge.exe	104
PID 3576 wrote to memory of 5892	3576	msedge.exe	120
PID 3576 wrote to memory of 5424	3576	msedge.exe	121
PID 3576 wrote to memory of 5068	3576	msedge.exe	122
PID 3576 wrote to memory of 788	3576	msedge.exe	123
PID 3576 wrote to memory of 788	3576	msedge.exe	123
PID 3576 wrote to memory of 2404	3576	msedge.exe	124
PID 3576 wrote to memory of 2404	3576	msedge.exe	124
PID 3576 wrote to memory of 5908	3576	msedge.exe	126
PID 3576 wrote to memory of 5908	3576	msedge.exe	126
PID 3576 wrote to memory of 2796	3576	msedge.exe	128
PID 3576 wrote to memory of 2796	3576	msedge.exe	128
PID 3576 wrote to memory of 1108	3576	msedge.exe	129
PID 3576 wrote to memory of 1108	3576	msedge.exe	129
PID 3576 wrote to memory of 1108	3576	msedge.exe	129
PID 3576 wrote to memory of 1908	3576	msedge.exe	130
PID 3576 wrote to memory of 1908	3576	msedge.exe	130
PID 3576 wrote to memory of 3840	3576	msedge.exe	131
PID 3576 wrote to memory of 1432	3576	msedge.exe	132
PID 3576 wrote to memory of 1432	3576	msedge.exe	132
PID 3576 wrote to memory of 1432	3576	msedge.exe	132
PID 3576 wrote to memory of 4332	3576	msedge.exe	133
PID 3576 wrote to memory of 4332	3576	msedge.exe	133
PID 3576 wrote to memory of 5316	3576	msedge.exe	134
PID 3576 wrote to memory of 5316	3576	msedge.exe	134
PID 3576 wrote to memory of 5316	3576	msedge.exe	134
PID 3576 wrote to memory of 1616	3576	msedge.exe	135
PID 3576 wrote to memory of 1616	3576	msedge.exe	135
PID 3576 wrote to memory of 4212	3576	msedge.exe	136
PID 3576 wrote to memory of 4212	3576	msedge.exe	136
PID 3576 wrote to memory of 4780	3576	msedge.exe	137
PID 3576 wrote to memory of 4780	3576	msedge.exe	137

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://canary.hyperbeam.com/r/teamkatan
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x234,0x308,0x7fff8ddac188,0x7fff8ddac194,0x7fff8ddac1a0
  2⤵
  PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1788,i,15725108858268153143,8720568713130016009,262144 --field-trial-handle=2308,i,15364501072865460345,15715414837238111332,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:2
  2⤵
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1956,i,4551343646558912856,4294158649710195868,524288 --field-trial-handle=2308,i,15364501072865460345,15715414837238111332,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2496,i,12840225859633633369,1400635827551929143,524288 --field-trial-handle=2308,i,15364501072865460345,15715414837238111332,262144 --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:8
  2⤵
  PID:5164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3416,i,1246537361124575513,14229849654398930311,2097152 --field-trial-handle=2308,i,15364501072865460345,15715414837238111332,262144 --variations-seed-version --mojo-platform-channel-handle=3432 /prefetch:1
  2⤵
  PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3420,i,8643850327268939290,7143042728516759999,2097152 --field-trial-handle=2308,i,15364501072865460345,15715414837238111332,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:3656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4912,i,15991660846004123554,10958238091220386294,2097152 --field-trial-handle=2308,i,15364501072865460345,15715414837238111332,262144 --variations-seed-version --mojo-platform-channel-handle=4956 /prefetch:1
  2⤵
  PID:5692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3636,i,1881115163325612920,11289965928763327982,524288 --field-trial-handle=2308,i,15364501072865460345,15715414837238111332,262144 --variations-seed-version --mojo-platform-channel-handle=4736 /prefetch:8
  2⤵
  PID:2812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5156,i,3598359221225963921,4844292675635622595,524288 --field-trial-handle=2308,i,15364501072865460345,15715414837238111332,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  - Modifies registry class
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5244,i,5789768779928244863,7868877459054101763,2097152 --field-trial-handle=2308,i,15364501072865460345,15715414837238111332,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:1
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5484,i,9386404628467170459,6845027338766175395,524288 --field-trial-handle=2308,i,15364501072865460345,15715414837238111332,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:8
  2⤵
  PID:756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5488,i,1915570497198183872,15457669736937960335,524288 --field-trial-handle=2308,i,15364501072865460345,15715414837238111332,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:8
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,2550536609115574274,10182229222085194989,524288 --field-trial-handle=2308,i,15364501072865460345,15715414837238111332,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:8
  2⤵
  PID:2004
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,2550536609115574274,10182229222085194989,524288 --field-trial-handle=2308,i,15364501072865460345,15715414837238111332,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:8
  2⤵
  PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6276,i,3057184858416538706,4465340393025875370,2097152 --field-trial-handle=2308,i,15364501072865460345,15715414837238111332,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:1
  2⤵
  PID:5564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5232,i,16489725534123911167,6293620933058105573,2097152 --field-trial-handle=2308,i,15364501072865460345,15715414837238111332,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:1
  2⤵
  PID:2636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6164,i,7946523264036794248,12060978259595228028,524288 --field-trial-handle=2308,i,15364501072865460345,15715414837238111332,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:8
  2⤵
  PID:5892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6152,i,16239761315892085073,3491875259306993575,524288 --field-trial-handle=2308,i,15364501072865460345,15715414837238111332,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:8
  2⤵
  PID:5424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,9177953631868925856,9698755198029432052,524288 --field-trial-handle=2308,i,15364501072865460345,15715414837238111332,262144 --variations-seed-version --mojo-platform-channel-handle=6676 /prefetch:8
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6164,i,16618557165215269721,7422073426868469864,524288 --field-trial-handle=2308,i,15364501072865460345,15715414837238111332,262144 --variations-seed-version --mojo-platform-channel-handle=6756 /prefetch:8
  2⤵
  PID:788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5272,i,9452098863555470893,1996553068428560352,524288 --field-trial-handle=2308,i,15364501072865460345,15715414837238111332,262144 --variations-seed-version --mojo-platform-channel-handle=6436 /prefetch:8
  2⤵
  PID:2404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6784,i,10133016252017942493,18444914590932246968,524288 --field-trial-handle=2308,i,15364501072865460345,15715414837238111332,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:8
  2⤵
  PID:5908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6820,i,12353829659950298221,906395206403606830,524288 --field-trial-handle=2308,i,15364501072865460345,15715414837238111332,262144 --variations-seed-version --mojo-platform-channel-handle=6836 /prefetch:8
  2⤵
  PID:2796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6260,i,5719992646435760014,97603051842485851,2097152 --field-trial-handle=2308,i,15364501072865460345,15715414837238111332,262144 --variations-seed-version --mojo-platform-channel-handle=4968 /prefetch:1
  2⤵
  PID:1108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5012,i,5692446752849767466,7970361502509975552,524288 --field-trial-handle=2308,i,15364501072865460345,15715414837238111332,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:8
  2⤵
  PID:1908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6900,i,8607263376540243405,3905955267059968107,262144 --field-trial-handle=2308,i,15364501072865460345,15715414837238111332,262144 --variations-seed-version --mojo-platform-channel-handle=6892 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=6564,i,14480482870944282728,17496575247544322052,2097152 --field-trial-handle=2308,i,15364501072865460345,15715414837238111332,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:1
  2⤵
  PID:1432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5048,i,9131736167820220045,13421956248707083312,524288 --field-trial-handle=2308,i,15364501072865460345,15715414837238111332,262144 --variations-seed-version --mojo-platform-channel-handle=6524 /prefetch:8
  2⤵
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=5384,i,2384516165657285801,13514032902599212390,2097152 --field-trial-handle=2308,i,15364501072865460345,15715414837238111332,262144 --variations-seed-version --mojo-platform-channel-handle=6620 /prefetch:1
  2⤵
  PID:5316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6272,i,15695790667427611350,5922917167360250337,524288 --field-trial-handle=2308,i,15364501072865460345,15715414837238111332,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:8
  2⤵
  PID:1616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4824,i,2755467918219321986,3055445266327303619,524288 --field-trial-handle=2308,i,15364501072865460345,15715414837238111332,262144 --variations-seed-version --mojo-platform-channel-handle=6956 /prefetch:8
  2⤵
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=4988,i,6971016744228502543,14260089141575367028,2097152 --field-trial-handle=2308,i,15364501072865460345,15715414837238111332,262144 --variations-seed-version --mojo-platform-channel-handle=3948 /prefetch:1
  2⤵
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4908,i,11495370615059469720,11573697580963998148,524288 --field-trial-handle=2308,i,15364501072865460345,15715414837238111332,262144 --variations-seed-version --mojo-platform-channel-handle=3920 /prefetch:8
  2⤵
  PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=4964,i,781867874629642867,5501124630786843027,2097152 --field-trial-handle=2308,i,15364501072865460345,15715414837238111332,262144 --variations-seed-version --mojo-platform-channel-handle=1320 /prefetch:1
  2⤵
  PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5708,i,11222091807079689117,10644325686989383011,524288 --field-trial-handle=2308,i,15364501072865460345,15715414837238111332,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:8
  2⤵
  PID:5860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=6268,i,6592914455004834105,11508302164144217491,2097152 --field-trial-handle=2308,i,15364501072865460345,15715414837238111332,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:1
  2⤵
  PID:2384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5984,i,7609398139090364858,1092598930531856982,524288 --field-trial-handle=2308,i,15364501072865460345,15715414837238111332,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:8
  2⤵
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6820,i,11515223117287402947,7869156709481430295,524288 --field-trial-handle=2308,i,15364501072865460345,15715414837238111332,262144 --variations-seed-version --mojo-platform-channel-handle=6940 /prefetch:8
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=6484,i,15383064594264070239,8956526316161778463,2097152 --field-trial-handle=2308,i,15364501072865460345,15715414837238111332,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:1
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6252,i,1267984161496180383,5345737298987139498,524288 --field-trial-handle=2308,i,15364501072865460345,15715414837238111332,262144 --variations-seed-version --mojo-platform-channel-handle=6812 /prefetch:8
  2⤵
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=6844,i,11610752582495282510,6944715327574525319,2097152 --field-trial-handle=2308,i,15364501072865460345,15715414837238111332,262144 --variations-seed-version --mojo-platform-channel-handle=7088 /prefetch:1
  2⤵
  PID:5448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7148,i,11869724277973120627,8538510719823669171,524288 --field-trial-handle=2308,i,15364501072865460345,15715414837238111332,262144 --variations-seed-version --mojo-platform-channel-handle=7120 /prefetch:8
  2⤵
  PID:5920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=7032,i,6562310446124706414,16522190933810639061,2097152 --field-trial-handle=2308,i,15364501072865460345,15715414837238111332,262144 --variations-seed-version --mojo-platform-channel-handle=6732 /prefetch:1
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=6944,i,13602851262630356893,6090568261020889464,2097152 --field-trial-handle=2308,i,15364501072865460345,15715414837238111332,262144 --variations-seed-version --mojo-platform-channel-handle=6860 /prefetch:1
  2⤵
  PID:6132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3944,i,18302467463206834307,16924991589355432456,524288 --field-trial-handle=2308,i,15364501072865460345,15715414837238111332,262144 --variations-seed-version --mojo-platform-channel-handle=6812 /prefetch:8
  2⤵
  PID:320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=4968,i,10576177430194288295,12733436873739476863,2097152 --field-trial-handle=2308,i,15364501072865460345,15715414837238111332,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:1
  2⤵
  PID:1440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=6944,i,14843703210150494638,16177654677303432333,2097152 --field-trial-handle=2308,i,15364501072865460345,15715414837238111332,262144 --variations-seed-version --mojo-platform-channel-handle=7040 /prefetch:1
  2⤵
  PID:5424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6932,i,1458543725602078997,2599741605562101300,524288 --field-trial-handle=2308,i,15364501072865460345,15715414837238111332,262144 --variations-seed-version --mojo-platform-channel-handle=7076 /prefetch:8
  2⤵
  PID:1808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=3276,i,15702750625181168657,10225665481097993903,2097152 --field-trial-handle=2308,i,15364501072865460345,15715414837238111332,262144 --variations-seed-version --mojo-platform-channel-handle=6984 /prefetch:1
  2⤵
  PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=3628,i,5757421925356143775,5183215724316126766,2097152 --field-trial-handle=2308,i,15364501072865460345,15715414837238111332,262144 --variations-seed-version --mojo-platform-channel-handle=4820 /prefetch:1
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5036,i,1173313604381700611,14468348611635350929,524288 --field-trial-handle=2308,i,15364501072865460345,15715414837238111332,262144 --variations-seed-version --mojo-platform-channel-handle=6568 /prefetch:8
  2⤵
  PID:5212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=7024,i,3769065366509475297,5147005619295389693,2097152 --field-trial-handle=2308,i,15364501072865460345,15715414837238111332,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:1
  2⤵
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3632,i,12090290413687456340,7490761602610696382,524288 --field-trial-handle=2308,i,15364501072865460345,15715414837238111332,262144 --variations-seed-version --mojo-platform-channel-handle=6984 /prefetch:8
  2⤵
  PID:3868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --always-read-main-dll --metrics-shmem-handle=3940,i,1660572214986289247,3080449303051023745,2097152 --field-trial-handle=2308,i,15364501072865460345,15715414837238111332,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:1
  2⤵
  PID:5196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --metrics-shmem-handle=3920,i,6072068531452315231,17368834180297987799,2097152 --field-trial-handle=2308,i,15364501072865460345,15715414837238111332,262144 --variations-seed-version --mojo-platform-channel-handle=6860 /prefetch:1
  2⤵
  PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --always-read-main-dll --metrics-shmem-handle=5028,i,5544815585357930701,349586438905163635,2097152 --field-trial-handle=2308,i,15364501072865460345,15715414837238111332,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:1
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --always-read-main-dll --metrics-shmem-handle=4760,i,18294158461080314380,7897413797179880192,2097152 --field-trial-handle=2308,i,15364501072865460345,15715414837238111332,262144 --variations-seed-version --mojo-platform-channel-handle=4972 /prefetch:1
  2⤵
  PID:5956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --always-read-main-dll --metrics-shmem-handle=6348,i,16187995863586701836,17382175337466161751,2097152 --field-trial-handle=2308,i,15364501072865460345,15715414837238111332,262144 --variations-seed-version --mojo-platform-channel-handle=4812 /prefetch:1
  2⤵
  PID:5860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --always-read-main-dll --metrics-shmem-handle=7020,i,3929002050507446326,8293648053424877822,2097152 --field-trial-handle=2308,i,15364501072865460345,15715414837238111332,262144 --variations-seed-version --mojo-platform-channel-handle=7108 /prefetch:1
  2⤵
  PID:2712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --always-read-main-dll --metrics-shmem-handle=6872,i,15253761738161222850,4516969162843872962,2097152 --field-trial-handle=2308,i,15364501072865460345,15715414837238111332,262144 --variations-seed-version --mojo-platform-channel-handle=6984 /prefetch:1
  2⤵
  PID:5216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --always-read-main-dll --metrics-shmem-handle=5888,i,13383476999365358547,3918424885176295576,2097152 --field-trial-handle=2308,i,15364501072865460345,15715414837238111332,262144 --variations-seed-version --mojo-platform-channel-handle=4972 /prefetch:1
  2⤵
  PID:896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --always-read-main-dll --metrics-shmem-handle=6680,i,9269710641202879476,14306277783001834550,2097152 --field-trial-handle=2308,i,15364501072865460345,15715414837238111332,262144 --variations-seed-version --mojo-platform-channel-handle=5016 /prefetch:1
  2⤵
  PID:5800

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5876

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3692

C:\Windows\system32\osk.exe
"C:\Windows\system32\osk.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1036

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x490 0x2ec
1⤵
PID:2992

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Privilege Escalation

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c1877fbc0c43a45e793044a62162a5fb8c5c9dacc6820f192e229549bf23e282
MD5 d7f6a0a3a239b65bbc4d7200cee11fea
SHA1 bc633583358feec3947b57794222463c529d6a40
SHA512 ac97a2816b8d8e6c559e30dec4991e0c20f54b4e6f42611680d63a9ff163e987f62a0d16d6d81e1b2ad20caa1759922ad0c71c527bcd24a2b835bea2edb0a9ba
TLSH
T171D08008A2777C30C4A8D470244F7B453919C5774653571558723D685C6305114469D7
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 3e2435e0ca02be8e9eea1ad3376c8d762ed992a0f70e5b52c09d65db530fe46f
MD5 90f3e8a8a787148b1289251ad22d0542
SHA1 7afa3ee7811ce1c75900592f8fd226ad0c2f7458
SHA512 6f22b2aceffab30200f1dd263f66d9c05d4baacf768b0b779f3a6852dea4a8f5d4f6d015161060160839170dccf8e6dae21847bbdaebd110d1b9c2ce440846c2
TLSH
T1F0E026A54AD8C2DE9385E867476C530C8282370AAAD86D5E2B0484C830C20C8E3C2D91
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 357B
SHA256 cb4f14a89751b23d8047bb751c90d7b7086fad4f04e6ef625ec59028aa7c3abd
MD5 0a396bcfc4182711da80efc2070178ba
SHA1 f4042b936204faf0819f1caf209fa0c294961001
SHA512 4fec2a75e265e72082d90a4d17bd4a939f6703a742454febd556d3c2313d2926f0d7a6b5e9f6bb0a82185c932f939a86a13d0d36e3ddcfd75fc4aa90270a0987
TLSH
T120E0261E1BF4C3E45982A45F87FD731C0146320AB69DCB9AB2C8A48E26C04CC9B26CA4
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 384B
SHA256 4722e60304d514e69ba319f6e63ac7cf798fdf58f21e37825fc959b1852ced8e
MD5 9fcc54ef13e2698443385883829f2b16
SHA1 16639f6a37d52aaf0cd2a400bc2cb446b8a09b95
SHA512 0b195601657c08adf49416eb28ff833d7f669ca9927e1a476463c2628c06458d61cb49df1ebe65f70914e29b1101af9cd30b876b030ea9ca12ec51a94d9fcca8
TLSH
T117E068A9F8DCAE8EE3E54BFD63B6B0400F8402D28416DF130630BDC036916F01FA2120
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 a27dd7a9f451ef7bb50bb861b78f46fbe4ae266cbcc3846afde1a15fc3db0065
MD5 cfc7ec3fd47948a706d96449c6b3fd38
SHA1 85145e6b5ad16d8fc1988ef2261d5919e7b35626
SHA512 7b50ce5c69b4a8fec006e182593607e4da3af2bc1aaeee41e01bd9f110264a4072976a2c380e0b61eef58f537c1023003f0b1f35893f53914ab18eba8a88f1b4
TLSH
T11DE02BAACD20DC3B1DFD1B1861450646E6D413276F50494F3E3D92098FF0636455AC5C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 0f45c35bad99e5ab592a81ef88ff1349861c5217330eba77cd0fc41f4449ccef
MD5 7e24b2e3f9b4bab27cf34cab2a217f2e
SHA1 89c1a0477448c0e9df081eb622b595ca4d365160
SHA512 8bf96b159e55302ce5530eeed91ece2c6e4a14e9a58e76874840239f2b3fa73b869de929cfe15d2f2fe0dcd98c52bbea31a64f9004c4f55f168781bc65885cf8
TLSH
T166713CD0C0B5C428D7E394B48AF71C1DB230596972130F2F65D6643EABA270350F6570
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 9f8c62843232c53afc017508568b8e25bd6f336f9edb604eea52304a2bec1b04
MD5 51780cf116d4c11a65dc258850a121a0
SHA1 c47fd0e04b6b893458aa64b8cecd83fd71e925a2
SHA512 7c8bae04457ee8e48a127958918906d2f3cba5bdc2794fa36a3eedd6db3e6fc68caed02c11f839d7b8af1180cf35e4f6fe385e29c97e56ed4a0bb433479adc47
SSDEEP 96:D/O6JK56kazBgIqDj6eixqAb6ajEBwmGj4/Qilj:DW6JK56ka1gIqDj6eixqAb6ajgLGj448
TLSH
T15281EDF783B19A6E891195F0AA18EE2BDE2C0615436C3D768AD0EE07D3E3071E011B4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 601447b50d1ec14347c7df0e31cec952346a82c58c032b6bded58f409f40ca00
MD5 ccf112d145c7475f833ca9856762e4b9
SHA1 303d5e8f1eccb228db482448c0a12458611edeec
SHA512 ab054acd807cd56f59b1bab7dfdedac5bdf516b5a29e13a065fa144c42ab09bc76b7801944ab65825d237bb83552b53f95a22d1303b669773efc7d1fc4524879
SSDEEP 96:D/OSJWYRVzBgDVpDj6ewVxqAvwF6asEBjXm:DWSJWYRV1gDVpDj6eqxqAv86asgjW
TLSH
T1A691EFF783E5966E892195F0BA18AF2BCE1C0A25436C3C26C9D5EF0793E3471E111A4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 b36de8356df79e4dff7a6bccb12d41af96a97460dcb89a586d5e5069c614d12e
MD5 5759259b05999a2a7a65fac0a24fd22b
SHA1 980df42463a882a42c1904379ecd66da3c7fb512
SHA512 ab0c0f8c46e92068e6aa16c97d2c6d243c4bb988e14660ee40fce7bb5bc3711cbb40f0f86bbb5bd156d721c883497935de223f9500231cbcba57695afb2fb396
SSDEEP 384:sxZCwqF+/fys9ivTcFVqSHbiDlSAYVWxBI:sa3F+/fnir8VPHbixSAYVcI
TLSH
T13B82F9166A38997BDDD7D619BA85BB53D6F8112392804E449DFC8F0C00E7AED321782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 d7b35756d6af84a037a2f0c3e08c9788cc24a368491307320731fb9bf9d9f087
MD5 f4cf3864e9d76588c96043a3eb06da92
SHA1 fd41590579ff88c3120ae8714c5626220634635d
SHA512 624f88d3d62b1b961aee16fa25e04217fc55fe45fba1701240b598d48077fa496f50af2c36aaef7f56d4642184b75a1ea7064cb03303eae4cbce0033fb541a06
SSDEEP 384:sxZCwM+/fys9ivTcFVqSHbi5tsZYVWxBI:sat+/fnir8VPHbi7sZYVcI
TLSH
T1E472E9066A38997B9DCBD619BA45BB53D6F8112392804E44DAFC8F0C04D6AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 297850bc89047afe102160c811b74e0315399fc268c2a9cc3aabfc47f07ebe48
MD5 395a493cdc2bcccb195b541150dc198c
SHA1 44d866290334f9563a164b028419fb530c338d11
SHA512 073a9c3d2dd4aded98e62aff6edeca11dcaf6ebd4c3d94bea13d6858eb4f53dc491dff68cb68c426b246501ee76d5294de3748508ff3af2b393dfb45ecd1fbac
SSDEEP 384:sxZCRM+/fysxHvTcFVqSHbiXV/JWjYVWjyI:sa++/fDHr8VPHbiZ4jYVTI
TLSH
T14672F8056A38997B9DCBD619BA45BB53D7F81527D1804E48ADFC8F0C04E6AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 c0ca0aa7bec579a2fe264a123d0e2bb9e6ebe7e548349170ae670b5a528af522
MD5 a4cc53d6a0bfd6eb6d4f3a4e59e07f2f
SHA1 f79587aec10c4185422774505e476cee48766d4f
SHA512 83bbb894531c79961564cc14bcdb09896f483eb373650aea9a441d874026d3f4f3a2d967843bbd7b392de4642e3323fe35734ebe6944c85505b86f87171841f6
SSDEEP 768:Q1Mj2O97pLuL/OmWvOKhC8F1+UoAYDCx9Tuqh0VfUC9xbog/OVij+xLlh7WxLroC:Q1Mj2OrE/OmWvOKhCu1jafj+xLLqx4it
TLSH
T145F2EA3B284CCB7E4F804E9CEC2A7E9A7DE801CB96D8895447FA844C03C66EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\28565a612f670c4bdcf51699be023a135085e8a1\b35cb630-d1f5-41af-b689-72acdc7496fd\index-dir\the-real-index
Size 336B
SHA256 eaafd268c911af29acc4d05c1ecd7633f23212eae4fa5c722b8565bbb767afe0
MD5 726f054626f82bf914475bede5fdaaab
SHA1 92e390f294c2f313280724b003db5d7bb9716bc1
SHA512 e57ae5d759eec4663e86666f17ca88fce13f96a8d662dc43539068e4e3730618dceacdc33a9d86a9ca0bbe0586582b77a56558cce1fb38a7615245a92eccbc88
TLSH
T140E0A745B4D4E299EC98197844C999E097B5D96108669D0F6098C16EB627438AA19042
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe586b96.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\28565a612f670c4bdcf51699be023a135085e8a1\b35cb630-d1f5-41af-b689-72acdc7496fd\index-dir\the-real-index~RFe586b96.TMP
Size 48B
SHA256 fe9b68a6adc4160cabd58051d96053d048975fd73d47779384bade1c080e79b1
MD5 7f13af55506a0e19622eb7c1c6ae8570
SHA1 ac836b439c76c458998dfa3fcacad510583df427
SHA512 8ded5cec1bc8198437f8bd2e8354e2053436ee2ad2618ee1bfcee16de97309b3e305b8435258febd0dcfa004e91c2e63d90e477afd72be585ea5de1026e10653
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\28565a612f670c4bdcf51699be023a135085e8a1\index.txt
Size 266B
SHA256 8a5590e0c1b815793a9055d4ac16b7db81f89ab589c09c43e54ef44cb571934f
MD5 2c0a9d2974e9cefd4ea507a883649ed0
SHA1 56e8acfa6ee5d0746351fbab60e5547db6e0969f
SHA512 0f3be959df70396eff1acafb7bafc94d42b0565db1c7397f77e15debb679b6493cd95c80a2936d2731e00463a8aa9418708ca9fff0673dd58d71c307a12fa702
TLSH
T1B7D02B5232524A33AF26858934E9E54C8D3E794A67A0CE2CD0104C0301EAC633637F57
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe586bc5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\28565a612f670c4bdcf51699be023a135085e8a1\index.txt~RFe586bc5.TMP
Size 271B
SHA256 d31893c53cba9b22eb349d01daa1c32a45e9fb6e2e4c4673e3d87066a005a035
MD5 44928f7df9096d5af06536adebb45d40
SHA1 6bb90ee95a20551bc0f4e8dad3b638c64a5439d7
SHA512 8a711b766cae002597cd686e2c16f5092d187ca7f1d936bed2fe7433f471847a13f79a387f0db39362ed137fc60261a183335a5a2470bbf911c34d446bd5cc16
TLSH
T1C4D02B52225646336F26848A34E5E54C8D7E7D4A6790CD2CD0516C0311FAC672637F46
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8072a27b-6b0d-4652-8b46-6979758de9d9\index-dir\the-real-index
Size 2KB
SHA256 ba55ba4cfb9a44495d086b4ad0c3b90dbad5a144f61580129fe065147516707a
MD5 34306c7f794053b01fb66aa8e589e048
SHA1 2486cfc46972035e2636b82c854296a9d086da54
SHA512 d6ea8a0ce4ded9c05e0c5cc137c063ceda488d631eec39b60e7aca60b5baf480e094ed0ca7000b01921b2a70cd794a36299c9a0b66547d98f37e495a455dc36a
TLSH
T11351088CCC8E5B47D8BD42B258FA056533380CEF1A685A0729FC4A396C8326A28D7218
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5c9f06.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8072a27b-6b0d-4652-8b46-6979758de9d9\index-dir\the-real-index~RFe5c9f06.TMP
Size 2KB
SHA256 769cec84a2414d3341fdaed4ce9820db11242f02076074072b53bf6f8d7eaa59
MD5 cff067e8e2cbee6235c53774a60ee23f
SHA1 69d3306c49d96cdf90a1cc42f0270ec85a5f19f3
SHA512 e3edb2425e112404f0c1ce09d2b6eccab23e0169d0be5bb8a36b188e46d9668784864f45a105bf62db20b2112804179756778a9fd03d070e2dc368e8c03ee41d
TLSH
T18851C95E9C530A31CDA091B359CA5469333D68954945AF0B35FCCA33ACC37AD3D66394
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 474B
SHA256 8e6cdad1b960c5ff379b4c83bf0441974ddcbf58fb0a12c6337c0cc03d7a24e3
MD5 9415d119a503263eca7af127313de9f1
SHA1 83d32952c7d8a3b9cccfc224994c5b947cfe4100
SHA512 7cdcfcceeba91d10517b2d87e132e4142a28da26df6d0d0248afb2cedd258f96718ef98efea468bd89a2e04773ee96fc47d5a59d3087c63ddaad4d1e6b469ede
TLSH
T158F020B73EF30804F9EBD3E534720470060A7928C591EC8E2516B2E260B2386749ED22
MD5 SHA1 SHA512 TLSH

Submit Download

ba23d8ecda68de77_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\ba23d8ecda68de77_0
Size 15KB
SHA256 845b50812fb44e35caecb9b612c6542087706a4c970cfb17e68c430b18851f25
MD5 24ad92c6f8b476f6a5730780c0fdbf3d
SHA1 d370cf10e5704b701abaf138613a61efaa816409
SHA512 fff7e2db1eece5b0c82383d07fd32120a72c68501c47c2f2e5bb7533449d45cdc06d1d743dca2f3b490e10d4deb8c9bc22aa2d0aa3767b7548d9a06fa69be82b
SSDEEP 384:uv4vSEyIh+sDVqD6XDSpWE4vpmouO3+0+AV57jMQFqRMmenD:uv4vSEyIh9DVqD6XD44vppuwxjjMmqRi
TLSH
T1BA72E9A672BED17587EA87D789212211A213B588344BC0F9F3AC5DE70C56947463EF3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ba23d8ecda68de77_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\ba23d8ecda68de77_1
Size 46KB
SHA256 abcd4d22da4dd2e747145fd4859a2e6d286aada6855b4386043870c9c7e7cfd7
MD5 f895089d3ce66bfb9f6915b82adaf48b
SHA1 c0abbd1d5fe266a521c694d82a4f281c7abcbd62
SHA512 373c6b79fd9ebf09de8f3773a9e952d6c5b27683db6b00e641b4c4afd33997e5d859e23866d4b7b4293466e0e83d205c372d4357d492fd0889cce04cf2c47cb1
SSDEEP 768:QxmMYNZlrMFN71l15ON9LPKwrDuNH3/57ayYQUV1is9PYvkA7OB5jiCuGKCS:QaZS71l15ONRCwrDUHP52mYYvkA7Orjc
TLSH
T176231A524355662BCE2643FB59A7452BB33982093FC3C35F9696D3322C227F74E0D91A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f1cdccba37924bda_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\f1cdccba37924bda_0
Size 4KB
SHA256 90551d153a9bf5185513d17d1b982a48a83e9786f0f7df859a2f21610e931ef6
MD5 7c5e502fdc2cd5de6bed41b0cc535c9e
SHA1 e2320ceb1f2cc458b7ffe8bd0250bee4b4f4a593
SHA512 891b1daa177979fd66c828d24d2db5baf2a2cac550a82b91332decf1ebb2349393f46bac0d749ab9b654ffe52ebd3348a199983454f1245f38d7e84ded1b7959
SSDEEP 96:jCsBATCg9RuV+1edMnFnX6TDvsxjOgAHSkBoz+l+OqS6zRj:+yAOeR4+1MMnh2Dvsx6Xy6oz+Fqth
TLSH
T1E7A10AA60A98C6A3CE9BFCB6EAD1C8252F7C214652A76042F041CAE61CC37C41767F1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f1cdccba37924bda_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\f1cdccba37924bda_1
Size 3KB
SHA256 e23a9eac29da2e92d351d16ed527a2bc2001e5dc59b02e6db26e75c6bdd23197
MD5 d91f43b4963d97da747e85b7a049b93d
SHA1 04dbaa481645a9c7813efebcd19a684100263f3d
SHA512 676a292a3eb518c901b95e3870db87ca298d954d8fc8c3b40e750f56750d58a0b5a2f04f6d48777004080a4eb4351bf8d622fb39b574e7103fe108dc6ab762df
TLSH
T1CC81729582951C27DE2AA7BE45E3C41ABB3A01047FD3D312566223B118633E3366AD23
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 bf222b85108157fe26272c0b89257e749190e7651ba2677991a90e82102f4cd4
MD5 c90e9f4b1fcfb87e29209d2642929060
SHA1 eccfc2fae86aa1240ec2acb20a387d4e3b632425
SHA512 e01a5983ccf5ad284f656e6f077604ee7a635ab64b2c76682b1a77d98c48245f147622ab3d42bf623daae9fbdddbd0f0b091d5c96496b7c8e5df520d748f727f
TLSH
T185B012C1804E2502CC9103746B8210383B108F248401220EC1E0E0F8D5360505153201
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 3d4ea7af062c8ab58e0f66918bf52597c00c33e555ea03e0ac392db8c4c8f719
MD5 260c26c23754fd88b6a4b62896c3a95c
SHA1 dd2441a7253958ba9265428cb55b957859fcdaa0
SHA512 9d5681fd12720925d27a806f56a40e6ad75a96d457929c168e1955b971adcd4cce037a48786ca4451ad5d57cd57bc7ce43d32da5cf7088dfc9a18960fb164243
SSDEEP 192:sh1WlDub/kDnmtTYB19srn97bQHSr/54UdaVtq/5bfsRLSjRD:sHWJujkjmxYpYTslStD
TLSH
T19BB20411313A06903A7EB9CA8194B96F46C330737118B46B7BB914A64F6BE60DDFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

domain_actions.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Domain Actions\3.0.0.18\domain_actions.dll
Size 83KB
SHA256 d35c8efcb710239f009633bcc5ae904ac6dafa985d451bedf791cf6909f014d4
MD5 956f610121cd5827fd5549097b79cd9f
SHA1 dbd23f99895a3a92fbe04c3c35d475a6f6998fd0
SHA512 3cc4712f64474497495d229ddd743c6bf25c30c3fbfca2525f46227d99a59a0f9e80e2119ffb40bc8a707b539f65f907e2e1565ea937e0387db47cf7269944e6
SSDEEP 1536:sNGnmI1FOxAdgxBf8paY3JQzQik428fKagFVbydki8yyafuzWk:sNG91FPgrfrPza428fIenya2Sk
TLSH
T16D83F180DF58411BF86F4835E0B269857A78E6B50FE092DF2376C9590E12FD1AF39705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 37caebfd3785b1d09097f8a9fde442b2c6b60c4ac2619606dee23f738f4e6776
MD5 e8f3f7b98ac7ef79c26d49c7344e37d8
SHA1 d3e5a9feb06b2146a68c6912b032837409aef465
SHA512 a561be5fedc59938b7d17caaa5716d599629c8b212a5633c53fbec4c3beb46a7124a053f540722e99dedd28a29e2e8890428e8778c9035222c89839c9cb2b801
SSDEEP 384:n0piFejccCs+Bt0S35c3sNU8TUNTUlI4A1MOgU+yYFRduz4foYlM6WPzHXvD+jQL:0AFIccQa3Nwgv0REY2JXMQ7fa3afCM
TLSH
T187E2B4F598D78976E9AE8B97A33E6E029AFCC157B4880594F7840E0CCC8717FD306925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 3d3a4558144033526986cb641e91a74136b8921b458071f54badee208128fae4
MD5 f527a146e08de5457519eb1d87d4ba0c
SHA1 d561ed325bd3ae45ae589fa357b14cca18fcf654
SHA512 a39913881edcdd6a78e3487a9f3b3e5f2b614ba1de34053dfd3b6acb218b9e1c9f43cb2060a4946f81ccb017787dc5a3174818755a008cfe7ec586331d81334f
SSDEEP 384:n4HiFJjccCs+Bt0S3Y3sNU8TUNTUlI4k1MOgU+IcFRduz4foYlM6WPzHXvD+jIaU:4CFJccQ43NwgrgREY2JXMIa3afCM
TLSH
T16DC25A35E894CDBBBDEA8F95E34A7743EFE00297849C5AE4D9D91E0C00871AE1307D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 fc857cf15b3bbbe484881d2563908f9fa2721787d2988dccf712b3075f38afd8
MD5 6eb6546eb0addabc763dafef9ff115fd
SHA1 32a8b6776b5efa3c53fd0bdd41903a62749b3298
SHA512 17ec96892c2153397c5ba9d3b18a87291809c4b3f0370e55e2f1991dbac821c12f396c35dbdbedab85c23302188e22247d99af1a4570c86fd04fe0149f3590b3
SSDEEP 384:n0HiFejccCs+Bt0S3I3sNU8TUNTUlI4A1MOgU+ScFRduz4foYlM6WPzHXvD+jVaU:0CFIccQo3NwgvkREY2JXMVa3afCM
TLSH
T1C7C25A35E894DEBBBDEA8E95F34A7643EFE00297858C5AD4D9D91E0C00871AE1307D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 6ee67971359d4cc63761783aad08f4ceba507443d1e2358582bbe547485b07be
MD5 0642ce029e25dde4a6880039844ef5dd
SHA1 f0f1db07fd70324a24184de08a276c9dc1062646
SHA512 1b1491ed423d335eb995f038263175a8d94729eeed259c2850085518e0be89bba00bd27bdd97ccf92a790326bfbc2284e34153e55151324f1aa023e469d8111c
SSDEEP 384:n4HiFyjccCs+Bt0S3I3sNU8TUNTUlI4A1MOgU+rcFRduz4foYlM6WPzHXvD+jUaU:4CFcccQo3Nwgv/REY2JXMUa3afCM
TLSH
T153C25A35E894DEBBBDEA8F95F34A7643EFE00197858C5AD4D9D91E0C00871AE1307D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 2903d33d274fe3fd6a36fbaa8d6d0d029edf71144839e8c78628ed234760f358
MD5 c2b9194eab4673b2c63dc7c3a9704ae6
SHA1 9d721dde569a9d2f5b8b611334ab833e513973fe
SHA512 ac195b0c63e6d9c77e8ae267ad53a35e35f0524e832ef60555dd35ac07d620c32eb41a80400d111c855dfcb11b531631de4ca7419cc5ce202fef0925a38844e5
SSDEEP 384:nTHiFavqMg3sNG8TUNTUlImkrOgU+Tt1zz4foYlM6WPzHXQEi+enUBG8MLjrN1ku:TCFayv3Lwg227Y2JsEiVZ8KXv
TLSH
T1A2C24C75E854DABBEDE64FDAAB4A7603EEE002A7C58C4AD4CAD81D0D00D71DE1347C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 e894dcfb05833a4305ff45a27d81b7b2f03cd5851230a6b711aa422d369f7b65
MD5 77e47f14272b79d42446c5e2e296e4cf
SHA1 98e9025cd2244d5f2ff97cae866c3df4ea810889
SHA512 703e18276e8ce445fd48fd598fa5dd4bcaf2e7b96d616a31dd4e0795e7b07fc605b5b8e8fe4f7f57dab2622816f5533dd35a817ed1c5aaab2a228949ddaf6738
SSDEEP 384:n3HiFavqMg3sNg8TUNTUlImkrOgU+1jCDz4foYlM6WPzHXvD+jFai+enUBG8MLjr:3CFayv3dwg2jLY2JXMFaiVZ8KXv
TLSH
T124C25B75E854DABBEDE68FD6A74A7603DFE00297C48C4AD4DAD81E0D00D71AE134BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 3b2330336c0738ab5ba55dec933c7cd95a76ff30a6611b63d356ca24794725ce
MD5 fc7374bd5a3a4cfb7a6195fee1a97571
SHA1 5e39b8c4c1e041160274f05adebaceaa2eb3b1f8
SHA512 0fbb789bbd0769a18cff92e94da3bb2bcfb205a7a27e13bd6c1d64cef44b773fcdbdc427baa50179d7c8189debcd19acf27e6b9c591834ce081019cbc3ba55e2
SSDEEP 384:n0HiFyjccCs+Bt0S3I3sNU8TUNTUlI4A1MOgU+rcFRduz4foYlM6WPzHXvD+jUaU:0CFcccQo3Nwgv/REY2JXMUa3afCM
TLSH
T106C25A35E894CEBBBDEA8E95F34A7643EFE00197858C5AD4D9D91E0C00871AE1307D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 0587487771567cc5d8b4ae57dd81dffaa758f1a63af4ba0249ef367f663c05f1
MD5 392d6d28c53c21c761e1793d220e9c55
SHA1 c00d48a027c6e325cc1282998cdacb8911d9cf65
SHA512 38d63be51de8bc075539c1e2cc7178915514c9b7f0b9eeb1c2634894e477643ed0f8d917efd8bbf0364c10d55086e2c5088a577bdbe972201165029806dfeec3
TLSH
T1724173D14C3E66D1D4BC0E7EB08B78FCD4D8C62AF5A4347E2C68EA84463A91D648543F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 5f02319376547f39fbc935eeaf3ee10db8f464055deb68f304b21130e2b76620
MD5 b0d3a8a4989e50bdc108e9c02ad1c00e
SHA1 394517405da7f3cd5b0c66134bad5f2185222984
SHA512 fb4d5a6d817c8cca1ba3d255b704f56e91b56db1774fb2f3ad1134b143fde3fc1ec1591dd4054eead5699a7009f2fce3a81ce81e95d5e514fa7b8b63983b3b86
TLSH
T1B64161D00C3E66C1D4BD0A7E708B38FC95D8CA2AF5A0347D2854EA84463951D248443F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 d6d36d562dc1faa1f168ede8915105003f406dfd6eb4325106b4e0aa003bebf7
MD5 418dab86ac4b3c34a12c7e2ea76512c0
SHA1 df5e4ded9fd62f109028c83b4b5bb32cec846661
SHA512 dfdecded1fe9d12993a42ee1b27d785c56caa5ccd2b66916d622df3cc7a8ac933131c204323368efea69983fda46c9221947e655fc363f020cf84f938ab0d8b5
TLSH
T1E34160E04C3C56D1D5BD0EAFB08B38FCC2D8D72AF564313D6828EA980A3A61D648543F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 c8b780b0ed32b6a7b78296d7cfc9e21cf2a50ba064dfdf3bd349a98ff8b492de
MD5 15a5865e5cda44cab9a55fac267fa858
SHA1 eeed38402d9f2e562ec0056e11d6daf89bb28fff
SHA512 bc1f75964b8f688f17b193e51bc24728cbcbd45a6f284546b1b55a9bd56e91363d737bd2afb57835ed81197e7097d7b7163d6db296846cdc1e0992dea68d4cb7
TLSH
T182413FE05C3D66C1D4BD0A7E709B38FC95D8CA2AF5A0347E2864EA84463A61D248443F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 e9f3f0a10a7273ab33c2e9bf30f160241858132f4dbe1503ae49781081ded29a
MD5 eb60fd9c26627141bfc20356399cdd06
SHA1 deda4e43c09e7a314ed71db609d6d1613e6be286
SHA512 a8f4d859b7f97beb6c2060cb8fc0e5b1b15a11146f31de4fd6ad27256513da3ecf979f13b7f313c656a829342654dcf965a39088be019614ca8a018369a2391f
TLSH
T1E8516EE18C7C1AD0D5BD1A6FA04B34FC82E8D226F560353D6828EA880A3A61D748543F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 934ec3458ac78051487ee97ecc9d565d0fdad5db937bd14cd33691263cf85a98
MD5 167484853f2585b761bdaf34c0816068
SHA1 146eb13d73d5d57f13aceb0595512203e1f16d33
SHA512 9cdf5e41bffab18512359f4107b327d995974dede0c84604af65beaf5ddf7bb7d0cf974eae3145857ee6ef54807a752024ee8215415dade3d7782bb2e13adbb6
TLSH
T177413FE14C791AD1D5BD0ABFB08B34FC85D8D72AF564307D2868EA980A3A61D248543F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 7f1c8190eda49c76d366886d60da9b584c79504233e28962f8d95a8455e99185
MD5 3a180ff2f26e8f5fbfc069d397ebe642
SHA1 6c9d83ff5fd86799c469d0da331826a878211045
SHA512 3803d3cb97290473a4357e58e84918958b954bf9d0e97fa55d16a300c0e9ee47cd1c066582bd3e1947647320548371f21171ebdfaf765fbe117a56733eedda4d
TLSH
T1FF4141E14C381AD1D5BD1AAFB08B74FCC2DCD726F560353D6868EA880A3965D648543F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 b3897ee9727037f2d403457332f4ffc92e9da9496c369b64ffc4d6a92e358c5f
MD5 6e68dc9f362e5e4765a4e483d78a289c
SHA1 a9c23b1379b5f0e73942c8abc9267123cda7df9e
SHA512 30b4d2e48d7b6cb98119ddb9a23981a2e5748a7e1771b102c09fd2dbfcbc8ac906589f552af3af76320b6d336e84b096838074a6c4a3e5dda7fed64e18f75236
TLSH
T1BA516FD14C7D1AD0D5BD1A6FA04B38FCC6E8D625F960313D6858EA880D7962D74C543F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 d69473bebeb709b579eae3ec407d177b71f950865f7acd51adfd8b71a469ba5c
MD5 79160c96493792fd0ffdc472c6d5f566
SHA1 e49e50504c111e37b85ac5bc2b6b007d0d0770fc
SHA512 d378f15fe94fb52c03b77949de57478da56718b12dd4f406a8c4c3bd71ff8351f160b44356a22949f85cea59001ca818a0ac84f3b54002be13084116fb299ab3
TLSH
T195513FE14C3C1AD1D9BD1AAFA04B78FC82D8D626F560363D6868EA880A3961D748543F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 01bdd428fcbc4cfe1c07d592d6ecddc2071460e05b6220be3a356447a7d7cfac
MD5 3da4a6d12fa036b070a1a7868013aefe
SHA1 666f3696d7853942e19fceb48a455403da8ac937
SHA512 c6f8313851bc392a8779076efa4ad81a7b378dda56e81de468b96059ee23850fe672b3593cdb1a46212b94337cb7b78f5c3f90958a30d2585d6229f085cd7d8a
TLSH
T1054141E04C3D66D1D4BD0ABFB48B34FC85DCD729F564347D2864EA944A7A61D248443F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 61fbce4093a0f729d767f514d9d069fcfc9b488389e2d4977ca9d0b6129af3e8
MD5 f84ee992318c36793007d2d46624c901
SHA1 9da1b163d079d25b5ba22549ef9619f80d2ad8c1
SHA512 6b6dbe04846b346c5284bbd946a500ee496e9abf85cbdff5b61ece9f5fbaf6d0283524ebc42b7c66152a1d15999cecaf6a98b0e75a8f42282dd9e4ec6f9229ac
TLSH
T1E34131E14C3D6AC1D4BD0ABE749B34FC95DCC729F5A0343D2C64EA84467961D248443F
MD5 SHA1 SHA512 TLSH

Submit Download

3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 54f761e00d363bd15db7bae3cc55144c80148a5fa1db7c3c2049e0e406a9142c
MD5 b1ac780361002049b0a10a7fd30fd809
SHA1 0ee0a7dc27fd175ab7abd6e5649890be3e2795b5
SHA512 1bd8b1d2dc30bc62728d3d08085a446e8c037b02499687affa9a0bb18c6bdfee19104eabdcd8a52c2d0b542046abf26b7fdf81815037d4923e31231b0dfb7d60
TLSH
T156C02B5538F9488C2FA5257ED238092E12E4C912310022B0002ED804103465C13A0C2F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 f2fac0e307e8ad56848ed2a7a8614be12b6a8feb95762447565936cd2bc3384f
MD5 3d5c3d4ffae64a61e802aefe61331907
SHA1 6dde95fdd05a3cb3112bb2339e3b80ae29c59965
SHA512 cf977a0fce2e282860d91c65064219c9bdb2ee94ac800da8f72d346b5af8bfa664c6dae96d232b74523efa80c7eeacf88c19e6fc395dc3b9881590c152d09cd3
TLSH
T1A5412758B6F91148B3B77F56AFF6A86E447B79632E06949D10020E4F0A22B40D861B37
MD5 SHA1 SHA512 TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

miniwallet.bundle.js.LICENSE.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3576_167110760\Mini-Wallet\miniwallet.bundle.js.LICENSE.txt
Size 551B
SHA256 38ed54eb53300fdb6e997c39c9fc83a224a1fd9fa06a0b6d200aa12ea278c179
MD5 7bf61e84e614585030a26b0b148f4d79
SHA1 c4ffbc5c6aa599e578d3f5524a59a99228eea400
SHA512 ca5f2d3a4f200371927c265b9fb91b8bcd0fbad711559f796f77b695b9038638f763a040024ed185e67be3a7b58fab22a6f8114e73fdbd1cccdda6ef94ff88f3
TLSH
T108F08B5A31E12673416285A1270B52DE7F0C10BDB0AF39779444C3386C348EE82D0EE1
MD5 SHA1 SHA512 TLSH

Submit Download

notification.bundle.js.LICENSE.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3576_167110760\Notification\notification.bundle.js.LICENSE.txt
Size 1KB
SHA256 363f376ab7893c808866a830fafbcd96ae6be93ec7a85fabf52246273cf56831
MD5 8595bdd96ab7d24cc60eb749ce1b8b82
SHA1 3b612cc3d05e372c5ac91124f3756bbf099b378d
SHA512 555c0c384b6fcfc2311b47c0b07f8e34243de528cf1891e74546b6f4cda338d75c2e2392827372dc39e668ed4c2fd1a02112d8136d2364f9cab9ee4fa1bd87f5
TLSH
T1A2313A5B32F53673416245A1670B52DEBF0C24AEB56F38B79495C3387C388ED82D1DA1
MD5 SHA1 SHA512 TLSH

Submit Download

strings.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3576_167110760\json\i18n-tokenized-card\fr\strings.json
Size 2KB
SHA256 c67b555372582b07df86a6ce3329a854e349ba9525d7be0672517bab0ac14db5
MD5 cd247582beb274ca64f720aa588ffbc0
SHA1 4aaeef0905e67b490d4a9508ed5d4a406263ed9c
SHA512 bf8fa4bd7c84038fae9eddb483ae4a31d847d5d47b408b3ea84d46d564f15dfc2bae6256eac4a852dd1c4ad8e58bc542e3df30396be05f30ed07e489ebe52895
TLSH
T17251EE3D88F4489B60C7921B6B1142D7C9704E36D704F3848A63828A035BDEFB0BF69D
MD5 SHA1 SHA512 TLSH

Submit Download

edge_checkout_page_validator.js

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3576_388690704\edge_checkout_page_validator.js
Size 990KB
SHA256 217a62797b59bdfc667227a422876ccd0f782b2ea41d33fc93c36a6a0db35b09
MD5 80cc733f42616192c044a04fc5abcf81
SHA1 1bf191a0a41ffbe64d3d92c4100421282edb02bb
SHA512 8b521e98dbb71462a19e6c783aaf62dca949befa830bacff12d0c13b3edc38e676b8cc70cd5af98dcd06fb50191747e37cde6e0779bc27515d65751af1487b42
SSDEEP 24576:cs4emRApsqvGzkJUAKjKQmwzErmdJt3LPafik0BwrpiU8LRKLRzMEiJsfaGx1huq:cs4emRAqqvGzkJUAKjKQmwzErmdJt3LC
TLSH
T128253C84E1E2253466D74CB960B7D2C4B9DC04583399F1E4FA6C588ADB0FD4723F6A3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1036-550-0x0000017CD10F0000-0x0000017CD1199000-memory.dmp

Download

memory/2992-622-0x00000233C5E00000-0x00000233C5EA9000-memory.dmp

Download

memory/2992-1018-0x00000233C5E00000-0x00000233C5EA9000-memory.dmp

Download

memory/3424-253-0x000002C3CC400000-0x000002C3CC4A9000-memory.dmp

Download

memory/5876-24-0x0000018236290000-0x0000018236339000-memory.dmp

Download