hxxp://gmail[.]com

Analysis

user interaction
yes
max time kernel
220s
max time network
222s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260130-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260130-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
24/04/2026, 03:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://gmail.com
Sample260424-eaw69sd13z

Score

4^/10

discovery persistence ransomware

Malware Config

Signatures

Drops file in Windows directory 19 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2824_1852243106\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2824_2049428839\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2824_64659098\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2824_64659098\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2824_928193552\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2824_1995695057\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2824_1852243106\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2824_64659098\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2824_928193552\classification.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2824_624992889\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2824_2049428839\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2824_2049428839\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2824_64659098\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2824_928193552\travel-facilitated-booking-bing.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2824_928193552\travel-facilitated-booking-kayak.js	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2824_624992889\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2824_928193552\extraction.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2824_928193552\automation.js	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1256	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134214759024181172"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByDirection = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\NodeSlot = "2"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Downloads"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Downloads"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 00000000ffffffff	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2 = 3a001f44471a0359723fa74489c55595fe6b30ee260001002600efbe1000000037b452249891dc01804c7c4ea591dc01dc1788269dd3dc0114000000	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 010000000200000000000000ffffffff	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 = 14002e8005398e082303024b98265d99428e115f0000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1092616257"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2783838373-340812344-1280766377-1000\{CED38BFB-1C8E-45EE-AC71-FD7360F000B5}	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 020000000100000000000000ffffffff	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\IconSize = "48"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\NodeSlot = "3"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupView = "0"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:PID = "0"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2783838373-340812344-1280766377-1000\{5B3DBEDC-001C-49A8-9170-F92ADF5E0FC5}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Pictures"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Mode = "1"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1968	msedge.exe
1968	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 30 IoCs

pid	Process
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1252	msedge.exe
1820	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2824 wrote to memory of 3652	2824	msedge.exe	83
PID 2824 wrote to memory of 4256	2824	msedge.exe	85
PID 2824 wrote to memory of 1256	2824	msedge.exe	86
PID 2824 wrote to memory of 4256	2824	msedge.exe	85
PID 2824 wrote to memory of 4256	2824	msedge.exe	85
PID 2824 wrote to memory of 4776	2824	msedge.exe	87
PID 2824 wrote to memory of 4776	2824	msedge.exe	87
PID 2824 wrote to memory of 2400	2824	msedge.exe	88
PID 2824 wrote to memory of 2400	2824	msedge.exe	88
PID 2824 wrote to memory of 2400	2824	msedge.exe	88
PID 2824 wrote to memory of 1400	2824	msedge.exe	89
PID 2824 wrote to memory of 1400	2824	msedge.exe	89
PID 2824 wrote to memory of 1400	2824	msedge.exe	89
PID 2824 wrote to memory of 1648	2824	msedge.exe	90
PID 2824 wrote to memory of 2332	2824	msedge.exe	91
PID 2824 wrote to memory of 1648	2824	msedge.exe	90
PID 2824 wrote to memory of 1648	2824	msedge.exe	90
PID 2824 wrote to memory of 2332	2824	msedge.exe	91
PID 2824 wrote to memory of 2332	2824	msedge.exe	91
PID 2824 wrote to memory of 4048	2824	msedge.exe	94
PID 2824 wrote to memory of 4048	2824	msedge.exe	94
PID 2824 wrote to memory of 5004	2824	msedge.exe	95
PID 2824 wrote to memory of 5004	2824	msedge.exe	95
PID 2824 wrote to memory of 1840	2824	msedge.exe	97
PID 2824 wrote to memory of 1840	2824	msedge.exe	97
PID 2824 wrote to memory of 1840	2824	msedge.exe	97
PID 2824 wrote to memory of 3516	2824	msedge.exe	98
PID 2824 wrote to memory of 3516	2824	msedge.exe	98
PID 2824 wrote to memory of 1820	2824	msedge.exe	99
PID 2824 wrote to memory of 1820	2824	msedge.exe	99
PID 2824 wrote to memory of 3424	2824	msedge.exe	100
PID 2824 wrote to memory of 3424	2824	msedge.exe	100
PID 2824 wrote to memory of 3424	2824	msedge.exe	100
PID 2824 wrote to memory of 4668	2824	msedge.exe	101
PID 2824 wrote to memory of 1576	2824	msedge.exe	102
PID 2824 wrote to memory of 4668	2824	msedge.exe	101
PID 2824 wrote to memory of 4196	2824	msedge.exe	104
PID 2824 wrote to memory of 3928	2824	msedge.exe	105
PID 2824 wrote to memory of 3928	2824	msedge.exe	105
PID 2824 wrote to memory of 4536	2824	msedge.exe	106
PID 2824 wrote to memory of 4536	2824	msedge.exe	106
PID 2824 wrote to memory of 4704	2824	msedge.exe	107
PID 2824 wrote to memory of 4180	2824	msedge.exe	108
PID 2824 wrote to memory of 4704	2824	msedge.exe	107
PID 2824 wrote to memory of 4180	2824	msedge.exe	108
PID 2824 wrote to memory of 2508	2824	msedge.exe	109
PID 2824 wrote to memory of 2508	2824	msedge.exe	109
PID 2824 wrote to memory of 1952	2824	msedge.exe	117
PID 2824 wrote to memory of 1936	2824	msedge.exe	118
PID 2824 wrote to memory of 1764	2824	msedge.exe	119
PID 2824 wrote to memory of 2712	2824	msedge.exe	122
PID 2824 wrote to memory of 2712	2824	msedge.exe	122
PID 2824 wrote to memory of 2328	2824	msedge.exe	125
PID 2824 wrote to memory of 2328	2824	msedge.exe	125
PID 2824 wrote to memory of 1764	2824	msedge.exe	126
PID 2824 wrote to memory of 1764	2824	msedge.exe	126
PID 2824 wrote to memory of 1156	2824	msedge.exe	127
PID 2824 wrote to memory of 1156	2824	msedge.exe	127
PID 2824 wrote to memory of 1968	2824	msedge.exe	128
PID 2824 wrote to memory of 4584	2824	msedge.exe	129
PID 2824 wrote to memory of 4584	2824	msedge.exe	129
PID 2824 wrote to memory of 4648	2824	msedge.exe	130
PID 2824 wrote to memory of 4648	2824	msedge.exe	130
PID 2824 wrote to memory of 4648	2824	msedge.exe	130

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://gmail.com
1⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x274,0x7ffb42ebc188,0x7ffb42ebc194,0x7ffb42ebc1a0
  2⤵
  PID:3652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1768,i,2980353342486557827,5637815112381884982,262144 --field-trial-handle=2428,i,8958513639919157959,2579850194234507668,262144 --variations-seed-version --mojo-platform-channel-handle=2420 /prefetch:2
  2⤵
  PID:4256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1956,i,9794780942867712611,5295077096054578307,524288 --field-trial-handle=2428,i,8958513639919157959,2579850194234507668,262144 --variations-seed-version --mojo-platform-channel-handle=2456 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2588,i,15014404147326212775,9932191254422746402,524288 --field-trial-handle=2428,i,8958513639919157959,2579850194234507668,262144 --variations-seed-version --mojo-platform-channel-handle=2600 /prefetch:8
  2⤵
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3484,i,492745411836517391,15802325827870301634,2097152 --field-trial-handle=2428,i,8958513639919157959,2579850194234507668,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3508,i,634114816077694159,136361302199225387,2097152 --field-trial-handle=2428,i,8958513639919157959,2579850194234507668,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
  2⤵
  PID:1400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4228,i,7408839845537250516,752036140175512306,2097152 --field-trial-handle=2428,i,8958513639919157959,2579850194234507668,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:1
  2⤵
  PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4252,i,16591706896027183581,7078294362708643838,2097152 --field-trial-handle=2428,i,8958513639919157959,2579850194234507668,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:2
  2⤵
  PID:2332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,8337260263729979826,11820525556432594213,524288 --field-trial-handle=2428,i,8958513639919157959,2579850194234507668,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:8
  2⤵
  PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5164,i,10115366116624469287,15415168547380261417,524288 --field-trial-handle=2428,i,8958513639919157959,2579850194234507668,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:8
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5272,i,2022269407122728471,12711373038952857475,2097152 --field-trial-handle=2428,i,8958513639919157959,2579850194234507668,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:1
  2⤵
  PID:1840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3772,i,3760686936095444762,4596306084380582199,524288 --field-trial-handle=2428,i,8958513639919157959,2579850194234507668,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:8
  2⤵
  PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3768,i,2621314019514525702,13235225459488496520,524288 --field-trial-handle=2428,i,8958513639919157959,2579850194234507668,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:8
  2⤵
  PID:1820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5192,i,6796851327178037607,7609246234109208194,2097152 --field-trial-handle=2428,i,8958513639919157959,2579850194234507668,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:1
  2⤵
  PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6068,i,2086523907074742794,18080624185054082518,524288 --field-trial-handle=2428,i,8958513639919157959,2579850194234507668,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:8
  2⤵
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,13309365953206182146,10105078137884138698,524288 --field-trial-handle=2428,i,8958513639919157959,2579850194234507668,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:8
  2⤵
  - Modifies registry class
  PID:1576
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6260,i,1014212526919683484,4521613167536047171,524288 --field-trial-handle=2428,i,8958513639919157959,2579850194234507668,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:8
  2⤵
  PID:1792
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6260,i,1014212526919683484,4521613167536047171,524288 --field-trial-handle=2428,i,8958513639919157959,2579850194234507668,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:8
  2⤵
  PID:4196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6496,i,13219922451469778857,14507002276928649348,524288 --field-trial-handle=2428,i,8958513639919157959,2579850194234507668,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:8
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6696,i,5703073468279404739,13946263547125602688,524288 --field-trial-handle=2428,i,8958513639919157959,2579850194234507668,262144 --variations-seed-version --mojo-platform-channel-handle=6692 /prefetch:8
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6720,i,13916371654724266048,7610528156829393862,524288 --field-trial-handle=2428,i,8958513639919157959,2579850194234507668,262144 --variations-seed-version --mojo-platform-channel-handle=6768 /prefetch:8
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6776,i,5631550962671587700,9922589693747559882,524288 --field-trial-handle=2428,i,8958513639919157959,2579850194234507668,262144 --variations-seed-version --mojo-platform-channel-handle=6596 /prefetch:8
  2⤵
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6488,i,17410321529403047064,5751253772026389328,524288 --field-trial-handle=2428,i,8958513639919157959,2579850194234507668,262144 --variations-seed-version --mojo-platform-channel-handle=6752 /prefetch:8
  2⤵
  PID:2508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5848,i,6953728575626001265,3773759028941013111,524288 --field-trial-handle=2428,i,8958513639919157959,2579850194234507668,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4512,i,18359083409923917252,7235681160170801181,524288 --field-trial-handle=2428,i,8958513639919157959,2579850194234507668,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5316,i,15808913645697930266,12606982698919172279,524288 --field-trial-handle=2428,i,8958513639919157959,2579850194234507668,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:8
  2⤵
  PID:1764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5236,i,17167576910194127971,15732049817658709287,524288 --field-trial-handle=2428,i,8958513639919157959,2579850194234507668,262144 --variations-seed-version --mojo-platform-channel-handle=7016 /prefetch:8
  2⤵
  PID:2712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2152,i,14135154213891230141,8987493934081025616,524288 --field-trial-handle=2428,i,8958513639919157959,2579850194234507668,262144 --variations-seed-version --mojo-platform-channel-handle=6692 /prefetch:8
  2⤵
  PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3740,i,3514919248385564765,12815401432436392359,524288 --field-trial-handle=2428,i,8958513639919157959,2579850194234507668,262144 --variations-seed-version --mojo-platform-channel-handle=6624 /prefetch:8
  2⤵
  PID:1764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6896,i,18368844755922193005,4711722559381557335,524288 --field-trial-handle=2428,i,8958513639919157959,2579850194234507668,262144 --variations-seed-version --mojo-platform-channel-handle=6568 /prefetch:8
  2⤵
  PID:1156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6664,i,6356247568036454125,7908033729281269837,262144 --field-trial-handle=2428,i,8958513639919157959,2579850194234507668,262144 --variations-seed-version --mojo-platform-channel-handle=6928 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6972,i,2056727228043838403,11486466824823277693,524288 --field-trial-handle=2428,i,8958513639919157959,2579850194234507668,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=5564,i,14053897696790397825,12553932764526532211,2097152 --field-trial-handle=2428,i,8958513639919157959,2579850194234507668,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5624,i,15452205413235220538,13834113076709579145,524288 --field-trial-handle=2428,i,8958513639919157959,2579850194234507668,262144 --variations-seed-version --mojo-platform-channel-handle=6860 /prefetch:8
  2⤵
  PID:1956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=6520,i,7221648278508225270,10368891852221635891,2097152 --field-trial-handle=2428,i,8958513639919157959,2579850194234507668,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:1
  2⤵
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=5308,i,8140898714802900957,17606542622189510842,2097152 --field-trial-handle=2428,i,8958513639919157959,2579850194234507668,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:1
  2⤵
  PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=6872,i,10996044910561127724,9129754637311703537,2097152 --field-trial-handle=2428,i,8958513639919157959,2579850194234507668,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
  2⤵
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=5760,i,10843006211726453808,14753693418703541627,2097152 --field-trial-handle=2428,i,8958513639919157959,2579850194234507668,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:1
  2⤵
  PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=5340,i,15556779767882154096,11132232312211988312,2097152 --field-trial-handle=2428,i,8958513639919157959,2579850194234507668,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:1
  2⤵
  PID:3888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=5744,i,7790955123279238726,14836498318476025289,2097152 --field-trial-handle=2428,i,8958513639919157959,2579850194234507668,262144 --variations-seed-version --mojo-platform-channel-handle=600 /prefetch:1
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=7172,i,7991487313474879156,18028493340470854049,2097152 --field-trial-handle=2428,i,8958513639919157959,2579850194234507668,262144 --variations-seed-version --mojo-platform-channel-handle=7240 /prefetch:1
  2⤵
  PID:1820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=7408,i,2498343439123985206,5505018834185782592,2097152 --field-trial-handle=2428,i,8958513639919157959,2579850194234507668,262144 --variations-seed-version --mojo-platform-channel-handle=7356 /prefetch:1
  2⤵
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7704,i,12798941656439867121,445385262276679614,524288 --field-trial-handle=2428,i,8958513639919157959,2579850194234507668,262144 --variations-seed-version --mojo-platform-channel-handle=8028 /prefetch:8
  2⤵
  PID:2524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=7816,i,14972824517119933670,13030230499502929055,2097152 --field-trial-handle=2428,i,8958513639919157959,2579850194234507668,262144 --variations-seed-version --mojo-platform-channel-handle=7920 /prefetch:1
  2⤵
  PID:548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=4352,i,7716598544650671430,8497476339994342069,2097152 --field-trial-handle=2428,i,8958513639919157959,2579850194234507668,262144 --variations-seed-version --mojo-platform-channel-handle=6588 /prefetch:1
  2⤵
  PID:2552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=8024,i,17713300376807386298,10142042625291557513,2097152 --field-trial-handle=2428,i,8958513639919157959,2579850194234507668,262144 --variations-seed-version --mojo-platform-channel-handle=7640 /prefetch:1
  2⤵
  PID:3892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=7108,i,2318701188500788028,2658205583122673202,2097152 --field-trial-handle=2428,i,8958513639919157959,2579850194234507668,262144 --variations-seed-version --mojo-platform-channel-handle=7980 /prefetch:1
  2⤵
  PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=5836,i,16628652462004002999,12063332432108172863,2097152 --field-trial-handle=2428,i,8958513639919157959,2579850194234507668,262144 --variations-seed-version --mojo-platform-channel-handle=7948 /prefetch:1
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=5788,i,11545487406682804260,7598152820499475049,2097152 --field-trial-handle=2428,i,8958513639919157959,2579850194234507668,262144 --variations-seed-version --mojo-platform-channel-handle=7132 /prefetch:1
  2⤵
  PID:416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --metrics-shmem-handle=7200,i,18123480964940544928,9831670083494782339,2097152 --field-trial-handle=2428,i,8958513639919157959,2579850194234507668,262144 --variations-seed-version --mojo-platform-channel-handle=7268 /prefetch:1
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --always-read-main-dll --metrics-shmem-handle=6336,i,4744435171743785368,10041887252939460797,2097152 --field-trial-handle=2428,i,8958513639919157959,2579850194234507668,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:1
  2⤵
  PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5504,i,13914891898038021960,291888340420322679,524288 --field-trial-handle=2428,i,8958513639919157959,2579850194234507668,262144 --variations-seed-version --mojo-platform-channel-handle=8164 /prefetch:8
  2⤵
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8268,i,14134841925235483489,15440720248705577397,524288 --field-trial-handle=2428,i,8958513639919157959,2579850194234507668,262144 --variations-seed-version --mojo-platform-channel-handle=8236 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:1252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3292,i,14954893826081654721,5819159521120289164,524288 --field-trial-handle=2428,i,8958513639919157959,2579850194234507668,262144 --variations-seed-version --mojo-platform-channel-handle=3992 /prefetch:8
  2⤵
  PID:2260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8324,i,5870215685064632526,4172208678997015271,524288 --field-trial-handle=2428,i,8958513639919157959,2579850194234507668,262144 --variations-seed-version --mojo-platform-channel-handle=8332 /prefetch:8
  2⤵
  PID:1136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8608,i,12716554216525195474,10051463503927933202,524288 --field-trial-handle=2428,i,8958513639919157959,2579850194234507668,262144 --variations-seed-version --mojo-platform-channel-handle=8596 /prefetch:8
  2⤵
  PID:704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --always-read-main-dll --metrics-shmem-handle=8268,i,15743892386161519162,15341853016521721707,2097152 --field-trial-handle=2428,i,8958513639919157959,2579850194234507668,262144 --variations-seed-version --mojo-platform-channel-handle=8848 /prefetch:1
  2⤵
  PID:3576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8984,i,7875310956669420936,3464206365053191119,524288 --field-trial-handle=2428,i,8958513639919157959,2579850194234507668,262144 --variations-seed-version --mojo-platform-channel-handle=9008 /prefetch:8
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4468,i,4398220216876600584,15667128826952556025,524288 --field-trial-handle=2428,i,8958513639919157959,2579850194234507668,262144 --variations-seed-version --mojo-platform-channel-handle=6864 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:1820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --always-read-main-dll --metrics-shmem-handle=8976,i,17306771452567613373,10278327632328153666,2097152 --field-trial-handle=2428,i,8958513639919157959,2579850194234507668,262144 --variations-seed-version --mojo-platform-channel-handle=8892 /prefetch:1
  2⤵
  PID:5540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --always-read-main-dll --metrics-shmem-handle=9204,i,6694871787349138418,3938562398766890812,2097152 --field-trial-handle=2428,i,8958513639919157959,2579850194234507668,262144 --variations-seed-version --mojo-platform-channel-handle=9212 /prefetch:1
  2⤵
  PID:5148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9344,i,10453975540194384269,2287718169829528285,524288 --field-trial-handle=2428,i,8958513639919157959,2579850194234507668,262144 --variations-seed-version --mojo-platform-channel-handle=8904 /prefetch:8
  2⤵
  PID:5468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --always-read-main-dll --metrics-shmem-handle=6664,i,2444695866653497908,3837016531989745047,2097152 --field-trial-handle=2428,i,8958513639919157959,2579850194234507668,262144 --variations-seed-version --mojo-platform-channel-handle=9420 /prefetch:1
  2⤵
  PID:5804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --always-read-main-dll --metrics-shmem-handle=9276,i,11671838513803006036,13485848470912780095,2097152 --field-trial-handle=2428,i,8958513639919157959,2579850194234507668,262144 --variations-seed-version --mojo-platform-channel-handle=3752 /prefetch:1
  2⤵
  PID:5664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --always-read-main-dll --metrics-shmem-handle=8556,i,16121160795680559903,17306279661792161947,2097152 --field-trial-handle=2428,i,8958513639919157959,2579850194234507668,262144 --variations-seed-version --mojo-platform-channel-handle=8552 /prefetch:1
  2⤵
  PID:5852

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1348

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 538c1a0bded49157881b1c0e111a58732912def07977f599efb60ebb986ecbbb
MD5 2e5f50c6e7cd1b1d6049d9d3e57a9866
SHA1 28319f3d040fd1e80776d82fef3baa00dc34dec2
SHA512 1a56a7d8e7dc2aa514d9d57d40d74133033bdabf84bd35a3b65f0b62eeda07a00060dd4058de9c4703a2c70d201c867647a11b5cbacf4bb2c1ee4acd92d13058
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7u:fwUQC5VwBIiElEd2K57P7u
TLSH
T1F7B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5bda7a4acde298b84944249ed34d5f4674b498a9ab3f35787c59b8f7a9a1aaed
MD5 dfc8ac88f96ffe8348bce76837920954
SHA1 787d07afc824d92e954563b275efb5a49c6fc276
SHA512 72be7e33e6964b22ed7243503c858ab3f3c02b7c8a4a188b612a13618c3bdccb35c49ee49690b28e188ac7a585df290375e609eae08846e2359f92e3e6054b90
TLSH
T13ED0805D52B39C21CDB6D5B004053F453656D557554B9356D4323C381C5314159C12D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9dc0e8e0b3744cd2688352565f359bc3c2a3049763bbb5af7d458c7c14fc65c8
MD5 4a181341ed5806b77c1ba57a47d171f7
SHA1 34371d7deb64a3224bb6528cd2b0853bccdff309
SHA512 d6b7c787c9227af20082a7c78c2be50c64a0e6b7705d189840149b9f139092b6de707919723bbc294dd1635b975f8e198a2a11b77251b5558d265bfa5bca2baa
TLSH
T1F3D0805D12F39C21CDB6D5B004053F453656D557554BD357D4323C380C5314159C12D7
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 357B
SHA256 aa47f1ae11d1a022fcbb1ec42e2145e787c2b7db135a78bc2de069889b0aebd1
MD5 044190039bae6edc7110cc44c6e74d78
SHA1 f03b59410dfdd37a253cc2f83418bae0e0fd388e
SHA512 9937efec0a26a09f365d5061814fe11e5942c0825ef3d1f0d8e742d93dfa09ffc4c9a48fed903ff5ad9f927839c3b2399750adf107acf58465547b0aa29e9203
TLSH
T103E0D81B0784C2F60109ACC78EEC535F426A750DB7ACC7FA3619F18E14064C05545CD4
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000086

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000086
Size 361KB
SHA256 02ff49f4431a46d64078b37db37186bd2f8c65655c9a81086ff174ead4486a18
MD5 10f1c35cb246fe221073a913340b48a8
SHA1 8101001026872a40a3653a4ece0da291b90458a5
SHA512 00031ac8af944b437463ef2027fa381873b6e08f68945248e58007a4ef7a5cec37adff6d14f67fcf7de2f5c85ffd1e723c1f1652d6a014eee66f84bdcaad2a6b
SSDEEP 6144:0OJ1vV2jDLDukAPWOlTbj19gCY/tqglNixzN4LtBDRPqyQK6+fWAyU+8tWncBl5y:0OJv2PLKkAPWATbj1ah/cgnAN4LtBDR8
TLSH
T14974236687ED80BD68F6890D1BCC7FA768CF928FF46EC8D9428E5185C408F7921B7611
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000092

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000092
Size 84KB
SHA256 ef1a84f90faba9e8fe20621808c5ac243fc27dfe78aa2eed356ec5d3fc261d59
MD5 0569384cef60ab486d3c6f998436e72d
SHA1 659428a7d179c375403afc80d09a7fd4a2fe0252
SHA512 504f379be0b65e588a31e71e8f54f15e4c81b0d96b8f0e86473b69d98e5973d99f80a1a29ba6aa24527716ac846baceb7113d86cbd86dd67807b370b0894da7e
SSDEEP 1536:9hGd8IPPoBUFpRRX3NzJ6blma2rmsM5+GpZSywks71Qf13tOFsWy:9ho8kPoBURXdGlmeJcGiRk01QyFa
TLSH
T1FE83024ADB3E3198C70C4B61D5FA5AE1861EBB8354DC0868D845AE7F11BC8CE11693DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000093

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000093
Size 20KB
SHA256 0853a7d80c2dcbf17e3cafe04332391ef4067e65d0f6712009399febc059cf03
MD5 001421d61a22df634206a8a7b486ce16
SHA1 9bd41e85857219050eca0498fc3404d06ae7ce48
SHA512 59a002a6e634a50e121a2b3cb1742274263641c6aa0d82320a1dbe5365d02f8116dc1a97009050e42b99e01bb32225e128983b762e432567bb2b1667fe826a95
SSDEEP 384:LWOPjtxgNeTZ9qpiK6jC/5Slrabx69Vk/siggPSyWC/l2nIcuEgwL7PvV:KKmNeTZeiKhQH9Vk/sigTctXAz9
TLSH
T18B92E114AC4FC52F56964A28EBD9002A44953DBADB17043722EF6E4F637395093AA83B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000099

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000099
Size 256KB
SHA256 f3fdb11faee00508cfab853c284debb72a6054ce7a437005f271fdaa419c8c9a
MD5 be569398e0e595dd2f72e1bc4cb2e4c7
SHA1 a7a59eddb0ea2dacb98ff03113480327c1805c9c
SHA512 475d255ae27e373971a32efb3c28faaa9aba5e3b6790329c211e038d1258f84b826b88aed8c7451749a608dad9aa433b9454520314c20339fe6527872bb15f61
SSDEEP 6144:oxQsrSL1TgnPaBehiQ0tlOw49YjoCrT3:eQESLNMaBeGyS7
TLSH
T14644BDB4FBC3D782CB132BBDA43D3D374BA852C561D05A0744639D26A598B26E30727E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009f
Size 256KB
SHA256 058eb9674b820893fff9e55cfe93bd695bd889d05f0f90334d3b989715777d83
MD5 9dfb182f3c052fce549551574c7b340a
SHA1 0c3678063cd5bb8bd5bcdeee48f0ef6e7e010dd4
SHA512 64212b0e9cc7518893beba3f2df2dd5a5b228c1f267f9765ef9c5ae328cb7b7abab8f3dcd574aebeecc543f2ede018b5e69412bf57cc840dfce9125b97e1f9c9
SSDEEP 3072:kgfDA0xxnEw3BLm2IZ/TD50hJlxfboz1c+mc/a9tKcJ7K:k70xxEwRMZ/ulxTslkJ
TLSH
T19C441674F7C3EB82DB4326BDA03C3D731B9401C5A1C5591B49A39D61A499B3AE30B93E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a1
Size 512KB
SHA256 02b0a8ad7f3e9727b28cebc2ee1663712b990da7cc10dd96025420be6315dc94
MD5 9c4994ee71ed65500105b3f15520946a
SHA1 d2b907a0d4e91781e6a84acc400658e2244d9c12
SHA512 6e23ab30afb45947f85feaeae82cdb3603b250f0175a346820ea9a125bffbd3d57d5140a92b8c0af36e6cb60aca2f51fedbaf0796a6834cff95b953658bf71fc
SSDEEP 6144:LOudzRoFS0/wxHqywh0aNqbi3oCKImWcbL5MSRSMzc1DN1cGexAlfE:3dzRiwC2at3OIYbzRSWc5N1cGexwfE
TLSH
T136B4E0B0FBC3DB80C74326BDA0BD3E371B1204C161D94A0789537D519461FA6AB2BA7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000aa

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000aa
Size 19KB
SHA256 31c5b6405e6d06cbb485c7dab9ffbc2089923067bf27b600c47b20c2ea93bec1
MD5 e759b5ff3294ef714c035eb757348611
SHA1 e1683f96d2b6743fd74bb134928627831c54e654
SHA512 2d814fe372e4fcc103c12f10c2e4c8ada693eae48bc8a5074d3513ef45cba127312e9a078d4b61ab25efc68ef12aee6d783e8b48d57df31fa9d6f9fbcacf25f7
SSDEEP 384:ZnNxJS4e0XhwKjPrc2AM08dBK2jw8FaolF+e207GqOKkKB/eprgNU7oRIU5mGj:BNxTDXhworxAPh2jbFue25uN2pki7oRZ
TLSH
T15B92D15838E26EE10F5104E78DC69B114CAB1757350AB9D897DBBCE0A2206B5376FB3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000b0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b0
Size 28KB
SHA256 9e2e13c571924d7e8c61c76887e9054641a3942abd8698a3951ccf811b921072
MD5 276a2ab5fc87095c383cb6de71318018
SHA1 2d33b295566031d2262fbade6657897c354bb6ae
SHA512 647e7a43c0ef8ada2603131f22ddfb06f507406c14b6009f14791fb6336433e09b4d01826d50b4e80913da469fec731e97eceebc7132aa1e7550f6be34afb30c
SSDEEP 768:m5BTkt+dHAsmwybQCkKAGCsGNp5SLMB1a:uVHApzA1Jp5SABY
TLSH
T117D2E02A49B9B40671BDA7BC84B8933FC2B028D0666D10CB5B1701772F96A82E5EA543
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000b5

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b5
Size 26KB
SHA256 404e2397c0b003536c6fe95e14359e705bde4e8fbab006796f9cd2d98ed49daa
MD5 c1ea414275d0e8a1128355429ffaafb3
SHA1 b50de4370b08788bd2128577d8ad71f147e405e6
SHA512 b07db4b8443f914129a719148c8bceb83c20e79d6cada92a1c9acc91437cbb8a8abac008cd386d4338a5af40fb160b5f0df31d18a31632550107e2369d48da03
SSDEEP 768:ZSq6pCDcGw8/epE5kqA14wjAR24bGJb3ZVz:ZOCDPN/4E654wj4bA3Hz
TLSH
T1ABC2E17A2372C59A45019375A0E7C393F65BF2251866A0DCBF116F8C3E06980F1EFE26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000cf

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000cf
Size 62KB
SHA256 df670e09f278fea1d0684afdcd0392a83d7041585ba5996f7b527974d7d98ec3
MD5 c813a1b87f1651d642cdcad5fca7a7d8
SHA1 0e6628997674a7dfbeb321b59a6e829d0c2f4478
SHA512 af0d024ba1faafbd6f950c67977ed126827180a47cea9758ee51a95d13436f753eb5a7aa12a9090048a70328f6e779634c612aebde89b06740ffd770751e1c5b
SSDEEP 1536:Q9pfnSa+E9Az52gNbkYtUtqvUhZRHuLdrx07LXz:uhnSpE9A1EY6tBPix07Lj
TLSH
T1695301D4670EE2A579F2CF23BF59C5C00803162D8E11AA68FFA063878D8430BA793D1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000d0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000d0
Size 68KB
SHA256 0274a299b3a81687a5192c4ff424872941d24a0b986035abacbbcda16ca5210b
MD5 d67f112773e898f90e775e65ebeb6385
SHA1 86b3728d490c3c6a6a97809f6b2eb7c2eb19cdf3
SHA512 f6e93b614653bc993daf4e0391000efe6286f78a9cc7d15a5836501d3016f5801c7cde8e8f875f2f1d6981dedc0946dfc87b83133cbecc5af92de3b122999823
SSDEEP 1536:fInxmnkHNVx/Uur0YtX30S30zT9HQG4TGnzmC4:rktPRbn4zTezG6/
TLSH
T13963011299EB3F1CBD0EFA80BEAD35EA0325C995A652A3F5073453E72425B60C025D6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000d1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000d1
Size 19KB
SHA256 af18b3681e8e2a1e8dc34c2aa60530dc8d8a9258c4d562cbe20c898d5de98725
MD5 1bd4ae71ef8e69ad4b5ffd8dc7d2dcb5
SHA1 6dd8803e59949c985d6a9df2f26c833041a5178c
SHA512 b3ff083b669aca75549396250e05344ba2f1c021468589f2bd6f1b977b7f11df00f958bbbd22f07708b5d30d0260f39d8de57e75382b3ab8e78a2c41ef428863
SSDEEP 384:/Und3PKicut4yiFkC9RWzlJpa2/CKYOyDJmCZyXJTW4PO821GyLjSoBwNeS:0UizQDYlJpaQCKYOyDJpI5Kx821DS3Nz
TLSH
T13692E1670BCE314E422EE25FA316A51733E41BE1EFE49640D6AA70D81C38DA243179D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000d2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000d2
Size 65KB
SHA256 f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4
MD5 56d57bc655526551f217536f19195495
SHA1 28b430886d1220855a805d78dc5d6414aeee6995
SHA512 7814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb
SSDEEP 1536:654NcGosP0w+UcGoanS2RR/QwNdIvEsgXn:6iRsw+UkC5QdEfXn
TLSH
T1055302E4123CA75C49FC43EA5434D635BA4B31ADABD4102FB69BC4258F6EA824447CFB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000d3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000d3
Size 37KB
SHA256 7285081bec1a1e6958b28c4664dcf5bb7812f886d08867a468eb204976ee7ea7
MD5 bfc53a3db7175d91f2331d4836ea93e7
SHA1 672a93f961b54efb9cf8d4d571db5f6991b6e744
SHA512 b0e78a43ff2ab012bd5b914a688c3379bf3625a8bcc53d660c196d39f6daeca3e88053ef8190f0dc150c6f70ca73bf1f8598f4c638cb8a98814730854d22876e
SSDEEP 768:GhnGemEkcTXZOsvrOACJI/EGb530WTsaARfZkt6ltIFuJffdJ:GhndBTXnTcm530WTERRkcfIFU3X
TLSH
T1DF03E17A7B2B391619F5B37638E5F4ED186B1BB72064B15AD35EC3023B0500D867814D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000d4

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000d4
Size 236KB
SHA256 910b4ce889c4c55c52f2c7c50a73b1dac3e749684fc4036be940b441e7a01d8b
MD5 bc4a0a650cee8c104efe931f440a00da
SHA1 b407dcd7ce027fff6536e52bdbb21f35ae71eaa0
SHA512 a0cfae3d84fb7d4c20864d95873b6220fb29a1111eaf20d40ea02918e6eb5ef2eb2c442433ae5639e5bbdd642bc270ef948fe32a658bb5d7347c69460dc7dd34
SSDEEP 3072:BW20znFnSTSlbl/hl1QLFl8PZfFrIU8km78HoIIoOCCZ36T:BW2InFnSTSlbl/PWgiXh9e
TLSH
T1473409F71AC029605C43C352A8BB77071C6DB9BBB20599ADEB75C4B3CCAA4D7102762D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000124

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000124
Size 169KB
SHA256 dc548ade259c43525a460d8f042283024d2a6f54d113539147cc8c5e34722dd9
MD5 c08790bf6f84c1694b0a227c81f8a5fe
SHA1 b403448f2a75a1163e7e1d49d40fe0690e27e68d
SHA512 4ac179b3df1264c5c4f068ed25ffc00430293f8924f5bc42c4cde8563aa08a4b8c32733ea3772059d06b26d967805672cf445a84d1d172c64e743474a0a3473f
SSDEEP 3072:NHeP9YewEaoPHz/2ewHCKhthzNZf2v+yWjAdauLZLFk1ZAYwwQzAEyG+h1K:IuLEfPwHBthz722y3r6XAxw5rG+bK
TLSH
T1380422FC0DBF8E497ED9C2ED186701A1DE43E1ABEDE53CB4AA941CA4C35311B644662C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 e2f7a8835a4bbd4e50ec2782ffa1017f7f62e355ae1ea4310c75b096642a75a6
MD5 6533025dd478b667a5b930ab6964655b
SHA1 569428c6dac8821e67f7aa18e2292d22fff50a76
SHA512 846879d4e8641e3bc805ee92e575d443feb21ccf33331e718db836456488b49c15ae84e192029875f9c1ad659774abcb9e3ff9dcf4cd0db5d1bacf640618d6e0
SSDEEP 48:srh1ST83s55t8PG8jpw0M1yHaoEkQU0ZW62lAT17STulHdpioBaX:ahwTks5z8+Wpb6mCZb2mT17STulHOnX
TLSH
T138815E65CC518E1BE3D82379519F7861BD65B9791F7A2AEABBD3263F46133078083030
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 541760e68c6922bf07bad54fdb8a7b00ee0f6c4d925ee1b5a075dd3816888ece
MD5 f2abbce2ddd7c47482de66bc00d04453
SHA1 57dd54ffbd46a75fb4e9dc239e68fc34b555714a
SHA512 9e134ed0e85c65a2dff215e3f679c794bf3417e0f9ab4c720743543e6e7c5c26dd171dc404c2bba7f6356f5d6bc4188cb800e0bc0a9e42380aae5f9153a6e2e0
SSDEEP 48:Sh1ST83s55t8PG8jpw0M1yHaoEkQU0ZW62lAT17STulHdpioBaBw:ShwTks5z8+Wpb6mCZb2mT17STulHOny
TLSH
T1D5915E65CC518E2BE7D82379519F7861BD62B9791F7A2AEABBD3563F46033038083430
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 11KB
SHA256 3522e4e1005b6856603609020f7aac1f18a0635504a4e5da86a981c584776a41
MD5 5717b43b063643c5aa3dc4a7be250871
SHA1 2dedae19798cfe50356219b2916e6ddbf5eefd6e
SHA512 3cdf37165d2d10f24ae885f8d8a382c4138f8cc11f2ddad01e7c1871a02b267fc12622ae69e50715ae9a8860dda8c4b1f4926609865e520e8ca8024bcea5cd52
SSDEEP 192:QvXumtxcCNP9uXySUMptE+BpC4w+71BmENP:GXumMCNPoXyX3+Bpv71BmENP
TLSH
T1C4321C19DCD0DA12EFD82A74608F5C632C717A711B3A0FCBEAFAD76EA4036D66543420
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 7dab8a9411d6647908272d7f92b0c22aede579f63e6aefaa15cec905153a1727
MD5 6af1871940d28a238963ef9caf672b5f
SHA1 2a20885bba80428a1524491afd9d88ac4b8b38dc
SHA512 157a0f8de64bfb99c2c7f886c61a098359dbd92183e446d203453c46598d2a9be174d5da6c24401006304d4eb641e2d8e39c524a68f6e17667803b98cc536138
SSDEEP 192:DlCnxK8K9b/0armrj6ii3uOqH8Qm7j5l3/vGztk:DlCnxK8K9b/0armrGii3uOqH8Qm7j5lX
TLSH
T1D7E1AAFBC3E9822DC91195F4AB156F1FCE1D0514432C3D6A88E4AF1BA3F2871E115A9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 77a073060832dd3987d11f1c41e0c14334d4532f98e59f100930589d54d8e865
MD5 48796568b1eb0e3790a7b70a2b1b3f61
SHA1 e116e523d91fb8c372ae5da12a363635e0109d9f
SHA512 8f6e78298ca4003ff216aeb4aa5a12454ad2d25ffe05ff5cdf6bc80474cb1699e2b28ca56fa8fbbabd3be4409d54e7dcd546fb02f1a36178c7c65743a807951e
SSDEEP 96:DGOCnRTK8yb/zQaVdm2Oj6wNZuw3oI1Z0zR:DlCnxK8yb/0armrj6wNZuWoI1ZqR
TLSH
T117A1BDF7C3E9812EC9115AF4AB15AF2FCE1D0A14432C3D6AC8D4AF1B93E2831E11565E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 fc2f24da52dc35b254528a4c9ff323abd7d6bba09a30045f7d6096fc71cfeb3b
MD5 f7348f0250330fca6ca5c69d01bd1bbb
SHA1 7d54cd51a72a821665b2a17482d3262155ec279d
SHA512 3040c11741f9db66cb615d29aab43f6edbff5beb4f5f0d7a6e8d2363803840bf1c842d2d346f46f26f011b8e1c2c759707a16f90f49fb9a105f20a46ec13babc
TLSH
T1D6D022AB230870B9A69E2EB2806EBD8EC32A10384A829AD814E0D898463AC6C050F155
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries~RFe5ae4d3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe5ae4d3.TMP
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 5ddd5af442ffcdffa117dea2631a45ae1da48390bec0680c4a60e345e41194b6
MD5 e74a56a04b6ee999c463d47bf19ec2f2
SHA1 97a20c427280fbb511032670c742cf621d5fdc0e
SHA512 1356bc92b0c51f2005edc35f396baa696777933e93eb0d322c0628755775cb6f362261c4eebc3e64e5c67bcd59c75dbd5923f9fe9441719c6815525fa5db8e66
SSDEEP 192:sxZv3BXR7yM//K1Ml8UQHkS/fdsLnSLoRqNIdprTnHW6+WNuf1TYMX2e6f8eIg5L:sxZvxXNqES/fds2LNuXHbATPuDV
TLSH
T17D62E756AA349977CCD7D209B645BF53E6F5053292940E48AEFCCA0C04E6BED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 08d55a9f91d82911cb7781450f4f9d9a804c8eec18c7a6e851f86d1dd75e5da3
MD5 16d25e686f5eaf365deee3fd5c4ebfa8
SHA1 ff89cd3784b50951c7cbbb7198052dfce88cf152
SHA512 b0a9c78e076fb98e853ad3649bb7fee96a205bcf465cc27ba01fba9274f0bed4d1164819ec463bfee013143a3f6f0bd895d971a342f9c92c7eb8540a33b854e6
SSDEEP 192:sxZv3BXR7yM//K1Ml8MkS/fdsLnSLoRqNIdprObHW6+WNuf1TYMX2e6f8eIg5BJ:sxZvxXNMS/fds2LNukHbATPuDV
TLSH
T13F62E856AA345A77CCDBD209B645BF53D6F5053292940E48AEFCCA0C04E7BED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 403bbd36a77389e46d4a6eb49294c82b04fecb7ab955eab75f35fa2ca17e322a
MD5 39e8ad84f0b9a3702fc56266a798f6be
SHA1 db3ea738c573a33b4351c2a4de729fbb81860651
SHA512 caecd1a8556a42099a57c04fdbe8fcb863338492d8a79a60d07e7636acd5ddb634e25665f826cf77a725f29df98e4fca9240c17170026899615468db37b60431
SSDEEP 192:sxZzR7yM//K1Ml8MkS/fdsdnSEoRqfIdpJSpHW6+WNu/1/Y/VNn8eIg4J:sxZzNMS/fdsoENQIHbg/QDc
TLSH
T10F52D956AA345A77CCCBD209F545BF53D6F5057292940E48AEFCCA0C04E6BED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 26KB
SHA256 ce961042e220dc0fb005c076e3b2bd390634d6fe5070b62fd9d5e3954903e7bd
MD5 aa48a4b5d1e1b9a6227b1e40971d7b67
SHA1 0ece71b62a20aeedef61c0b8859c68923cfabdba
SHA512 6911076f3132e860538a378c53db3c77bda50a36b4e91ac32fa5ec7b4c1161037b488e8bfa5cd3b122cce804a802bdd2d5966ab40f484d3eb37927c4a919fb9d
SSDEEP 384:sxZ0nNXEqUm4S/fds2LNedhHbIVEEfTTNBsR2FD73KIY:sWJTUm4S/ffLNWHbOfNeGH3Kj
TLSH
T1A9C2B7D7A0304AB799D7D529F424BF2AD2B504229ED44EC8AEECCE0C00D7AFD6512C97
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 21KB
SHA256 29afa73013418f43f111042a146529157b8d1330fc5ce126fa55de141eaea48d
MD5 5b3701aecfa72bae16fd8bb86f880289
SHA1 a21115b8c0cc324a0b1181d9ce0a9363ad4aec0c
SHA512 62d6259e6d0c621c5f653ccbdb64bd1e4840d4c69a683c3927709ca3ca2c33af1ce2de1b0389e5ce4b2f81169f7ee4105244be9e5760b194f17f5d308f3e2ffc
SSDEEP 384:sxZ0ncXNqUm1S/fds2LNtdfHbfVA/sqt8DPA6KIY:sWU8Um1S/ffLNPHb47u86Kj
TLSH
T1A3A2E797653089778CD7D119B825BF26D6F404629E844E8CAAFCCA0C04EAAFD2216C67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 23KB
SHA256 24d0769325a0d14c62ea3b75fdca92fa0cd755fef53216798319fa686cee74b0
MD5 c113cc00b051650fd0d3cfb4f49652a6
SHA1 8d83dc22367649c1153cbb35c971acc650c0c842
SHA512 52a06166cd87e77fc0adc0c4e3c4721c391c77acaa2dd10e569004f912654f493240702cdb0a6c8774012f4a010b660b66af23fa4880dde9f1b179444a8678c4
SSDEEP 384:sxZ0nNXNqUm1S/fds2LNedhHbIVEfIQtJDi3KIY:sWJ8Um1S/ffLNWHbnZHu3Kj
TLSH
T1FAB2D9976530897798D7C529F825BF2AD6F504229E944E8CAEFCCE0C04D7AFD2112CA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 0bb9b998a4f17c5cc20855717cf53be7fe9ce15d8822d49e224d8e78dec2a20a
MD5 ac456246af7ca024bdfa7e95bb8d61aa
SHA1 86b8feec668b32aecca331834841b1a1c47b019b
SHA512 a589d805cde9bb8dc3b819ada4799a3ada01374f1af608348e81415f2ac91c7eb826b5394005858b49b31fb1798c4b213174eabf1161a4ddf04a6d4d1801ecb8
SSDEEP 192:sxZ5BXR7yM//K1Ml8UQHWOS/fdsLnSLoRqjebk2dprqOnHW6+WNuHtagd1/YMX2s:sxZXXNq2OS/fds2LNHWBHbAV/PdDV
TLSH
T155720857A9344A77DCD7D21DB905BB53E6F5047292940E48AEFCCA0C04E7BED222782B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 0873b5354b8d0b4a02e2a96f5cd04b94800ac3f948610740799703138e09738f
MD5 ef16d4b055e490ee8d525346283a3be6
SHA1 9631434d5d61fe2890ce4a3c9fb58d2e248a9e1b
SHA512 1f14d0c472b8e25887797167c088c1ef6f817f96b1eecdf1de570101d6d97816390c32f90ee965b638cbd82e4147651ad98475fc320e4d17899481f796665228
SSDEEP 192:sxZUBXR7yM//K1Ml8MkS/fdsLnSLoRqNIdpJObHW6+WNuuDxYMX2yVn8eIg5BJ:sxZsXNMS/fds2LNuOHb7xPVDV
TLSH
T14F62E756AA345A77CCCBD209B645BF53D6F5057292940E48AEFCCA0C04E7BED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 273fb99b2c365ebe685bd62d61eb0add9c62803a2cb4a9842ae911d8079db796
MD5 2e7c4b6e75885a294b8c7c7d32d3a392
SHA1 60286e1b99063f91514b7b2dfb9c258d4401c7ab
SHA512 41dbe544e213967d797de462d49a46608a9977ef7d0db20832e90d6ca767bec59ff0f9e120c6121f57d89b5e46db386a798c9530e03b769762cd943ed48a4d59
SSDEEP 768:VH8If3k7pLuLn37Wvjdwx8F1+UoAYDCx9Tuqh0VfUC9xbog/OVgpOyLlsu7Fproi:VH8If3oEn37Wvjdwxu1jaZpOyLeQFCze
TLSH
T182F20C3B680CCB7E4F804EDCDC2A7E9B6DE8018F9698889447F9845C03C66EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\209f8c64-9908-4287-ae05-b72d46d21193\index-dir\the-real-index
Size 72B
SHA256 0851c45bea7d20d19b76b915356fd75168e0e1d29be45fb5e11039a2958e66b7
MD5 e18cb7b9e7bdca1e5ee53361887be425
SHA1 d4051e1564e2f2afc27982b3468e6727c65a85e3
SHA512 8fdb82087adffbd1cddf491f94facfa46aa66ea0b7d072c96bc23407d4a3c26c751f9264483d0217db3437a5b5565b52173a186d6377b3166458438d5c4112f2
TLSH
T178A00215AEC04001C02212F1299707836764D9B422592F0B55A10456CC65B494D5101C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\209f8c64-9908-4287-ae05-b72d46d21193\index-dir\the-real-index
Size 72B
SHA256 401590c36033bc4341786aa756bcc26bbe672fb88ef3569208b730312a732e29
MD5 04dcd7f2f61ef95ba3bdff11d6a7094d
SHA1 61180698c619e6b1c933eb12d778201b560e32d9
SHA512 2af348f2421f3202ad3e9576d04f651d39be2e3c451655d2894bf0081238a3537c1014584ccf26aed8be638e001835f38a7a2b20b9464b5be187984a56338202
TLSH
T117A0025043804505C0139DF1169A36526A10AC141103530744911444EE54C518B450BC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\5677303a-ff2f-4cfd-9b84-4652e99254cb\index-dir\the-real-index
Size 2KB
SHA256 0a98078413e2385aecb5916f5a66491cecce6190e55bb949b2cb4a77899a63cb
MD5 b77d3cd1ac3519cd33b2c268cb5de88b
SHA1 c95b6ab359539ba90323b9a075d2f4360d360e44
SHA512 245bee68c0855412fd8190b2fa375423a2e76a3dbdff096a7bbd0b269aed9d382eb48b8967d2a020041e737bb5255a555320a4f94fbd114822c479fe6f3425ec
TLSH
T1C251B45D0C0F5FA2CC6A45B609B204943374ACDE1AF80A27E8ED8978585343A1BD9739
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\5677303a-ff2f-4cfd-9b84-4652e99254cb\index-dir\the-real-index
Size 1KB
SHA256 6add577b87b4a10ba37dcb1ac87187d677855f9816fe464e5408e13ce51519bd
MD5 8bc0c6b26752b13bf48d42e80888bfc9
SHA1 f7c6df54d5af5742f5711e30da0c89faf7a36f79
SHA512 5d4d58ceb50291676d392f58ce7f1b4172c030abb117b919d1b263c4a6e68a854de9c83ef7d5e3e748c4fa89a8b02d9bfbd757913ba92ffc7a4f56697c70258b
TLSH
T15331C85D5CC64D03CC7685B001B9293C333899ED1F485307A55C45396D9F6666DE3208
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a903b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\5677303a-ff2f-4cfd-9b84-4652e99254cb\index-dir\the-real-index~RFe5a903b.TMP
Size 1KB
SHA256 ca15284ccb7786d081c0851371a96b8da053f93faa653891d03fd3394778bdfd
MD5 7634da1b8547b05c4a6001daa0f97015
SHA1 d901e5a961cc355dc51360509c1ed251672f8435
SHA512 37462eb7977059231fb5993e64f0cebe14a8a7f0fb3ab84cda3af9038c3e8b44eeed2f7d5488df4fd19d7154dab16cba4a2661d89905dee9eeaf79dca08916b2
TLSH
T17D31B75A5C984E13CC60917145CE652D333DE8E916409B0B65EC8A33FCD7BBD2DA3254
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\6cf368d6-b996-4771-983e-b52cfd70446d\index-dir\the-real-index
Size 72B
SHA256 e306e99a5affd2923f1b28a4b024431a33d2c4459cf32732aa8f5a9d95b7bdf4
MD5 e4f83a60fa8b188b85a71621440c5310
SHA1 001d79e4ebb9990079d669be4cf8e7b2e686a771
SHA512 9bcf94c7f9a05eb2a3c61a033aa8942fbefe029825ed0c82ae2a71dd459d677315daee0ca8fb05e5962c9a75c607dc9f5762a999a6b537551e4328455beb8bcc
TLSH
T1E7A002200268C061F40A0EB1D98206543324DCA52141430B859948999E922788DC504B
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 481B
SHA256 a20d5263a7db98ef4eedc81b1b2baaccf94ef71c7c85e4db214cd49f9591f64c
MD5 74d23db8014f77cd3892369b693c51e4
SHA1 6f22318560610f18bc995a648c4ac5e1bfb9f850
SHA512 b5b998412787ed088ebcf24d8ce5aa8386e87b3fb9d499456f2b8feacef7bb675f7887035752bdeff25223ea66236105d80dae71c81c5a5fa8ded8f8d80d1395
TLSH
T176F027E23FE72924FBEE86D6287100A906697D84C905AC5F1427B3579174358281DC32
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 55c2174491c3e96831c238348d7cc18ce5ce8439fca3153ee1355d09258da028
MD5 57fb327e4c5247aea1066ed1a52d0665
SHA1 3dbdafb96b3cbb0def373be2206a84fa05dca75f
SHA512 80eecec647e2acea4e874d2088de2830b688f3af91ef22fd1210432474dd5b213ebf82600ef52469309defb9b5ac6188c9a96dba5c04574ba31f06121d4e853f
TLSH
T118E020F73BE72834EFAF87D6147154F801597944DA05AC4F5037A79B5174794380AC32
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7028cd436c4a77f9bd4d8ea1bb813f143a1e2682\index.txt
Size 141B
SHA256 11104b1108a453f8c208c641330324d41236edf250d5fd65b783876c52ce9e5a
MD5 164330687654158046779cc574268ab9
SHA1 06cdd072c23eb11feec7738db1be0ac855616e3f
SHA512 4ce97d2939b8414c4f52bc9a508e7ae7b3d3682e7ced90d0fe1d300787d22f847d537064fa8de63842f2518689e3c3d12b0380098de78e7fc837fb5158a9c3fc
TLSH
T1A8C02BBB6101150F37618EC535023C08691DF40895C50CD9902F3415C14087BCD2FD02
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5b2789.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7028cd436c4a77f9bd4d8ea1bb813f143a1e2682\index.txt~RFe5b2789.TMP
Size 148B
SHA256 182fce48fce31d63f45d7df026600dd9672d05070ea51c3150b3808a49ff9cd3
MD5 4cf39ed7c78d3b1976d57ac4f80dd76b
SHA1 30dda99280aa1a07cc7c4791bd2677540efeb2b3
SHA512 cdbaa7c722dab3020e597bc64414ed0bf996ebce4eafc93240bcb730c6ddf4cc6e06a63989735eadf4e52c8740e6d74a8233ee5bef856f6ac1e191ef50f47889
TLSH
T155C02B7B5001440F37214DC635023C446C2EFC0899C90CDAD02F3415C170877CE2FD12
MD5 SHA1 SHA512 TLSH

Submit Download

ba23d8ecda68de77_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\ba23d8ecda68de77_0
Size 111KB
SHA256 198033b460602e4c1f6b4274ace508e85bf0b4b4a01e1e7cecc2faf73b394171
MD5 0a61526938ee911a40c20af594bfaf61
SHA1 a2c558c848668858b0770917875f790b08e730b5
SHA512 964b072af80697bd1ac84be287e524e9f2faed4ebb7da50c1875b84dd034a4b26ff845b019e3cdce2e0997b0c6c4f216749b8c233e87f74aec8c3a8e4dee02ce
SSDEEP 1536:AO49U3+xPCJWjtG8gEezKL/NuTXTapIJN9xKgeLy2pTLNXzsq:j49K+xPCJWjtG/EezKL/oTXTmi8Vy8XZ
TLSH
T141B3BA32769C54AB0E8ABEA45056B50392BC7467B844D078F21467FC25DBFB013BBEB1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 2b15cda2d7871ba19cb3bcad6cf9adac1c6bafa85448b284132371b4b26b48b7
MD5 480602feddf86142083f1c19efe82994
SHA1 0998febdc6f2829ade674ee5abce489a685461f5
SHA512 6f6b11cd249a274254c7b8122cbf378fd11b940fe1c4ec6351c3f5c845770257faececfb1652b1a8421deb33ec335eb6c767b8c57cd4839c835c057b09b55f78
TLSH
T12AA0021291D56149C0408270D0A101C67B51A8666A05B76140E47458AC58184A56601C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5b2826.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5b2826.TMP
Size 48B
SHA256 ee94fa8842cbad824fa61bd5a32d047828b46d532ea0189c8e67b8c8c83a9b71
MD5 0a86352c1d9c1df8371a4ab40ab9ab34
SHA1 a9137c0c79f6c74f8ec4bc17ee0145d39cb5fe72
SHA512 6fe69d92ac06a6e0af51ab306dda04da5fdc0816fb7d61c24752e69fcd534b4db209343b82b8f20b914f1bf8a31709fa7b2f862b6dd27c1c3281d92f2615ff8b
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 b8aea9aaa05666201cd9c37645e6767ecfe6e588d2afa934477a0f3688c0e2eb
MD5 927c12f3adfc0c7d38949ef332118d05
SHA1 a6a811d3f52741f5c776569acb47a48e69b0860c
SHA512 5e9fa37c97bb6f4fc48e7502ef0084a78b837007a65bd77ae74e4a0a525547fe8420f7e19606c181fdf410eff02fe9d29c35b67deaa80adf679b7e17048fe81f
SSDEEP 48:KMkIjK1CsJsIzKFKMPyZAI7K1Sc8Sn+icAsggoU:KMkAK1CQsAKFKWKAwK1SNSn+icAsggoU
TLSH
T1BA9132D2363A02C1393E674E8452B42E528570A73058A53B77F9C4A91F66EA3CDFDCC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe593520.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe593520.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 351f70b4886bc1753e7c7f2612c741123287d298d0225a089f695db46f6ac43d
MD5 f6ee3e1c4c04a39837b4c949c61118ac
SHA1 b5203b360a34a5e6e11b05ef7f43e9f2b4370590
SHA512 8fa77557c875ca0e1e108dddbc44ce77e15858d54668be79f32dece5cb410e15d8e4a38468978023d4b31b200da09295f5470a3ed92701db1af3edfec96ed874
SSDEEP 384:nJjccCs+Bt0S3vsNYkiJGxkujJ4I2/BaBo5W2I83j0ztf3p:JccQPS52/BQoxIm0Vp
TLSH
T159827C3568756C3B9EB3AD15F54B3B176FE8817752902E64D9C9CB0C00DB2AC231FA26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 29KB
SHA256 052831b7a6e48a031a41146c51bb92c79e784c5ea9050f244730bb954055b238
MD5 4e342c02d05b8d2d048d3645d1b9c62a
SHA1 166d3c6cd3d2ef23803a1df2f42151b1009f3286
SHA512 fa4e9a31fd0b68cd2fb7cd3e4fec513e79cf2e293fdc737f14ab9546a0087d7506108f920a38f9d256526d732559fff3a223e0d4a7ec7ba53b6d1535d77d92f4
SSDEEP 384:n7iFejccCs+Bt0S3tZsNk8TUNTUlIRAlTQaaki6xf/wJ4I2/BaBo5WaI83j0ztf5:WFIccQDlwgT8w2/BQo9Im0Vp
TLSH
T17AD293F598E3993AE9AE4B43633E2E469EBCC16371841994FB854D4CCC871BFC30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 61fe3dfe2e4eefcb29debf80d379a4201bbe2181957bc3308afee94ab1adc79c
MD5 ced5ba6b7329eccc4691da8725f2f419
SHA1 67d0ee22c2f705a553c8b12a7badd8529afac45b
SHA512 431460b83b006f7fa2bcac17bc97f7ffdaff51c877b14ffbb3123a7abc28adfc2a63cfd1fc3018fc1b3f23dbc1eacd1d46ea438d7e1eb6444c6d590cdf75229e
SSDEEP 192:9ONF6s2QmiUyqpBoJ4I2LrBaY0I4vQCU6:9ONF6JzBoJ4I2/BaBLHU6
TLSH
T13202FA35A8787C7B5EF3AD45B48737275FD4512BA6942F44C6D85B0C00DB25C234B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a8320a90b1d553f0e019ccccefcdec74a0316c98f28b8c7001273b31c9c33279
MD5 cdda2a4fb40311e5a9f45aa51e037c38
SHA1 a5c914dc3621a90f5b924f58c9233c5b2be41e97
SHA512 4bd0caf428d4edfa383faa0219911b7c5fd1cb980f6c025086daefb9f2bc2f48ee77ea4c11721a7bd74791e0962d0ec1fc4e6261b2c9e2abc27cc163799f0334
SSDEEP 192:vONJ6sMQmiUyeGpvoJ4I2LrBaY0o5Wpc0mqkU6:vONJ6LovoJ4I2/BaBo5WPIU6
TLSH
T1D6120A35A878BC6B5FF3AD56B4473B275FD4522BA6843F54D6C44A0C00DB25C230B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 66d25f66845dfc2ed6aea54633def29323b1eb44ad061d2092308ec0bfab1eca
MD5 e7272e6d9d5d8fb2d2524adccb58b9fc
SHA1 5486e9c590727b989d08e9dd5d83cb80eca7ea00
SHA512 c5ab5195cd43f9f36f32950e4e17c983ea85ff389d036945a3d53bc87f3704c39aec735f3b326add40a6d83a990844ce3acabf774f1cd68001ff9fb4373ce88a
SSDEEP 384:nPjccCs+Bt0S3vsNYkZJGxkujJ4I2/BaBo5W2I83j0ztf3p:bccQP152/BQoxIm0Vp
TLSH
T110826C3568756C3B9EB3AD15F54B3B176FE8807752902E64D9C9CB0C00DB2AC231FA26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 32db2b0594cae8c9d32aeddf05c2b05d93700dd0d2336138c3030957e96344e8
MD5 a0c6b3fff202f07deb12fcbe8d5602f0
SHA1 aefec0b230f84ad7fb8f22fa9fa422c02a97bfe0
SHA512 2767a0531776fda6516e95d22c3c1bba91a73bdc65839505bc27e46b919b69c40296d2461a2d9583eec43e9a78181423a9bfc8110e58dc474a2e06cc54236ddc
SSDEEP 384:n7iFJjccCs+Bt0S3tzsNI8TUNTUlIlkZJGwku6Df0wJ4I2/BaBo5WJI83j0ztf3p:WFJccQ1VwgCnw2/BQo4Im0Vp
TLSH
T153D283F598E3993AE9AE4B83A33E2E465EBCC15371841994FB854D4CCC871BFC30A915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 e2efbbcb8228d3ad4c9ccb3f54c93c9e8972a841a76ff06db46cc642be544f86
MD5 3443089aa19ceee1da38211e3d29c94d
SHA1 2c0b09efb85d3cc9040744bd609ea0619f69f56a
SHA512 82afa49e750f42a4c5ba7a88badf1067e51242273a1973bb58f4a063c2d6213f69b90ee071ee98e33bf2b80854f4eda2e023b791b050fce4d5cf1b9be6b7fc4c
TLSH
T15CE00402A30005BAD029033002CB1B212AA2C02406E646A7AA2111693C227802E34E89
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 4d5a01892fedf3ad449c0d945d780f46ec03cf2aef037375920de1cbc31aedf1
MD5 c21936296f3a97eee0f108e59a1d89be
SHA1 9293703d765d46fe909d3b47bc2e05a21a6dfbbc
SHA512 cdde497ad4ad90079dc36bfcbb86d4ac7d090d21618c527fdf94ef2b17ae38d70d33a60d0ebbb71799c5d8bb2bf46f29447c937f3def95b0dc371027b7beedb4
TLSH
T1E7E00102E30005FED02D033002CB1B213BF3C02406E74767AA21116D3C223802E34E89
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 6e8f5bf9c2ac11debc76b8da948b41662fd07c3bf01a90c13d6b32e9d38098f4
MD5 e4e901b20fc691cd4791b1ff0ff2622d
SHA1 7b07795cd056a4425bc4673acf7a2047d30d8ed3
SHA512 594e2753fcf0707f6f0f4d8dfa884b5b6ce1a5941f1252f8b28c9aa884b127ab1a624319d50bbeaff74fcc06636619fa1df7f07b87d4b013babc983e66c5689b
TLSH
T123E00802A35005FBD019073152D71B617AF2912506E64AAB9A2111693C277456E34F85
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 1275ee71b251fc7352dddf8410fc2cb3fdaad07d359860cbfcfad462517ed7ef
MD5 8a75dcadfe70d452833d00d6be7d70c1
SHA1 d484fe83fa79adbe10f449efe7ec8da5d1bcfaa9
SHA512 f9bda50b0c2c7be3703104e05f7bfd5f71318af631c426beb7b70f7ac7134d810db6d016a4ca2d8ba7cae7a3d3f1bb9ac79110c056a659f8e6dc35b0763962d6
TLSH
T114E00103A30005FBC009073012C71B60BAF3C13403F64AAB9E2216A82C637452E34F45
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 f3403c0e04bb75b207bbe68e23256d411d140f8182c68bb822d10cff9015aa55
MD5 41b4dd8223d2ff7061e855b2620808a4
SHA1 8bd40810b191a4d3b80b0ffd52383f762ca0912e
SHA512 fd408a99fb4a036876640dccf922dfa1a8c7076be9f94b6472c310177f6cb067bc1acc2d6d045ccdf5be15c9f5a13333429701bc97b169d2d46ce0b4f35211b9
TLSH
T121E04803E30005FBC019073012C71B207AF3813403F64AAB9E2212A83C637412F34F85
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 3287bd6c2d4fa41b94bb2adf439d2d4f16443346141f29789944fa69b806c1c9
MD5 dda2dba25a80bc64593864becd9457b0
SHA1 3116d22944254c5c3d8623bda1e0c0fb352499d7
SHA512 12c6b86c129be622464ff1306cf153fda4bf4e3a56b8b33103206df0030e7d520becb1f57d364aa1232bdb92cb8cdee8207686c6a05a7f217d0b8b2bbd97486c
TLSH
T13CE00203A30004F6D00C023002C71F112B63C03402C64367AF31116C3C203402D34C09
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 0807abb0f657ce570dcd20b55a07e674ba2cd0abc3924c547591f72cbd800400
MD5 71e51afdfb1504e685daceb9e8061e03
SHA1 2419afddb083bc3001933b79a377426d14694b3a
SHA512 df4a7d5376b2a027ff4e668d20e30a4b6346592f9e16c74012184a1b00be0fc205e1bab2c0518c510621c54d9473f0910cfeaae30b6be7219f6d44ad997d3746
TLSH
T1F1E00202630004A6D008023001C71F112B62C02402864367AB31116C2C203402D24C09
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 ac51f76667ea1ccc0f078f39b0d4837bf3a700b86c8066da0c2e041592037306
MD5 7c69deb737fd669f9dc7625eb535b0ab
SHA1 e0c6ba225bb4faad1217735f6a9a079e2d62add1
SHA512 6740c06deecad34c029becfedc5eb0a6dedc1db7f4872e177fee037fdf206ef01ffdbc567f63b43a9ba25de84f06370bfa195a0cc831f7d6543db01d88f3406c
TLSH
T164E00103E30104FBC009073002C31B60BAF3C12403F64AAB9E221AA93C633452F34F45
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 25cbeb03841afcf78806d9462a38424253ba67072159dc872a2f91fbac069ebb
MD5 5a28e6dcbcf8856a1bdcd2d949b516cc
SHA1 edba7f748069e87a0e2da936295be9c347a49ecc
SHA512 7fb885f522fe92838b0cce541a99f4e29d344c6eabeec813fa644c7108c092a0aa48551bf2999598fab97349b06e00465102692c6c5f25c68c4eed282fdf83ae
TLSH
T116E00102E30005BAD029023002C71B213B73C02406874367AB2111693C203802E34C89
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe58f75b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58f75b.TMP
Size 392B
SHA256 7e3af47e01568fc1d6defef661a7ee13473e1159e8f3d02fe6c764d0d26d5e68
MD5 7fd063d29e11907d3f46e55e90f52c18
SHA1 6c6045888b0a2814a34710332b33d27a368b2d0e
SHA512 4269f7e53adccf110e154862c6dc120749499abdc04ecb30068286b8a0324a828b7640e1ac7a28a2f54257402c8edd78821500040f53e3e380225ad9d4721953
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 30e8b5d48a130d6bf81847b89c208c7a087525e9b7d9a0a97bcf21598332b63b
MD5 bf165c172af1f75083dd4c7e8915ad0e
SHA1 2eb27e18672fd0a1816ab00d00078a570eb62711
SHA512 a58ad7ee2e18750242b9c5d53224218bef54ecd50e067170da12510559c455979fb0523044d4c23d5d5a523562165e471f95d939376df623bfdea9228ca25256
TLSH
T181F09ED29D7E36C0D6E50F6ED44B64FC40D89506F05CB579484CEAD8913950B254287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 732B
SHA256 0c1b4dc8f72139abc5b2e25e5d0097c1d3529ae18001b1a64ff535e345378b32
MD5 0ad641099b286eebf58a290b5bde86c0
SHA1 922d3e17ccc238f1bf276051af3ad5cdffb20397
SHA512 8661612608382058967a1f2ef25c7fbee41a3c2c748838346c044a48058ba081e84750e4a0de424903813499876fa7f69beba345d8ebc396340d830f1a7c81e0
TLSH
T1220110D29D7E26C2C1AA0F6ED08B26EC40C8D106F19CB07A0C8CF9D4823880E188283F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 612B
SHA256 ce7879978d6dc1ebc353b93e509ab0dcd980bc78615af00080f3db1cb23e79d4
MD5 a15cd0a1e68c6b9c3945d3192091dc4a
SHA1 5162188f19a245162594501e5febb31a7626aeb4
SHA512 a7ec103cf7c6fa801e1850205c4c06cadf96c21b1fd56db058a2980c472b1ff2f25c69a73f943de8dff815d69217995ad880e85ca7b8ced8cfa1c506315f7368
TLSH
T18DF0ACD29D7E35C2D5AA0F2ED44B25EC54D89606F49CB57A484CEAD4913940F248287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 d720bfb51f21b650c2ba85c0168232f852cd723b8347e947554a5455300c1e1f
MD5 22f6610961f4083cfbd747bf20cf8934
SHA1 4ea1329adf096021ce4c6bae6589b57ead85e3b9
SHA512 25913d6e31d1affa64a8eb1a8704a296a1219f0e4192efc635c7d5c7dda30aa54bf4e55a82a443fa4e3b52f609767f47e6763689a59ccaff9fd8fcaab36661f7
TLSH
T1C9412B6CA6FA0148B3B7BF5AAFF768AD447B79772E4AD45D00110D4F0A22A40C871B37
MD5 SHA1 SHA512 TLSH

Submit Download

20f57258-b972-472e-b235-0e2fb626a94a.tmp

Path C:\Users\Admin\AppData\Local\Temp\20f57258-b972-472e-b235-0e2fb626a94a.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2824_1025859171\CRX_INSTALL\_locales\en\messages.json
Size 851B
SHA256 6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c
MD5 07ffbe5f24ca348723ff8c6c488abfb8
SHA1 6dc2851e39b2ee38f88cf5c35a90171dbea5b690
SHA512 7ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6
TLSH
T175012506E2516A2B03B2A12775613641F57045EA1200DCBB7A7CD41C9FB6DAB918BBD8
MD5 SHA1 SHA512 TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2824_1758107669\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

download.png

Path C:\Users\Admin\Downloads\download.png
Size 902B
SHA256 dcfb024836e070b482681313994be2b64b0c37bd4858505522b110a7f6a5a1f2
MD5 2835be041e9f22cb1a7d5f925ed9b94e
SHA1 650720ab04644869b5abdf33325df2849c6c4e9f
SHA512 d148186a294d31e9026e9057de5e0983048ab08a0f63091c0699ab47108e5661100eaf8cecd607a2d63058049e566fb912999fbbd7f10d0e679d14eae55897c4
TLSH
T1B6119BD66972A7347113475EE8C351154B5CD89C59754619529CFC7C37200658568EC3
MD5 SHA1 SHA512 TLSH

Submit Download