hxxp://ptoszek[.]pl

Analysis

user interaction
yes
max time kernel
43s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/04/2026, 07:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://ptoszek.pl
Sample260426-jpvdfaas71

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
122	discord.com
123	discord.com
143	discord.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4944	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134216634832731918"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2714754311-527593155-1440850301-1000\{CA9AF4FA-9AF2-453D-9681-E935584AD199}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2714754311-527593155-1440850301-1000\{26177BE4-B4D2-4C95-B7FD-87AE89BF72B6}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe

Suspicious use of FindShellTrayWindow 61 IoCs

pid	Process
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe

Suspicious use of SendNotifyMessage 40 IoCs

pid	Process
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3820	CredentialUIBroker.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4384 wrote to memory of 3716	4384	msedge.exe	84
PID 4384 wrote to memory of 4944	4384	msedge.exe	85
PID 4384 wrote to memory of 4800	4384	msedge.exe	86
PID 4384 wrote to memory of 4800	4384	msedge.exe	86
PID 4384 wrote to memory of 4800	4384	msedge.exe	86
PID 4384 wrote to memory of 388	4384	msedge.exe	87
PID 4384 wrote to memory of 388	4384	msedge.exe	87
PID 4384 wrote to memory of 4920	4384	msedge.exe	88
PID 4384 wrote to memory of 4920	4384	msedge.exe	88
PID 4384 wrote to memory of 4920	4384	msedge.exe	88
PID 4384 wrote to memory of 1892	4384	msedge.exe	89
PID 4384 wrote to memory of 1892	4384	msedge.exe	89
PID 4384 wrote to memory of 1892	4384	msedge.exe	89
PID 4384 wrote to memory of 4908	4384	msedge.exe	91
PID 4384 wrote to memory of 540	4384	msedge.exe	92
PID 4384 wrote to memory of 4908	4384	msedge.exe	91
PID 4384 wrote to memory of 4908	4384	msedge.exe	91
PID 4384 wrote to memory of 540	4384	msedge.exe	92
PID 4384 wrote to memory of 540	4384	msedge.exe	92
PID 4384 wrote to memory of 2684	4384	msedge.exe	95
PID 4384 wrote to memory of 2684	4384	msedge.exe	95
PID 4384 wrote to memory of 1396	4384	msedge.exe	96
PID 4384 wrote to memory of 1396	4384	msedge.exe	96
PID 4384 wrote to memory of 1396	4384	msedge.exe	96
PID 4384 wrote to memory of 2736	4384	msedge.exe	98
PID 4384 wrote to memory of 2736	4384	msedge.exe	98
PID 4384 wrote to memory of 3784	4384	msedge.exe	99
PID 4384 wrote to memory of 3784	4384	msedge.exe	99
PID 4384 wrote to memory of 808	4384	msedge.exe	100
PID 4384 wrote to memory of 808	4384	msedge.exe	100
PID 4384 wrote to memory of 4452	4384	msedge.exe	101
PID 4384 wrote to memory of 4452	4384	msedge.exe	101
PID 4384 wrote to memory of 4120	4384	msedge.exe	103
PID 4384 wrote to memory of 5112	4384	msedge.exe	104
PID 4384 wrote to memory of 5112	4384	msedge.exe	104
PID 4384 wrote to memory of 2288	4384	msedge.exe	105
PID 4384 wrote to memory of 2288	4384	msedge.exe	105
PID 4384 wrote to memory of 3388	4384	msedge.exe	106
PID 4384 wrote to memory of 3388	4384	msedge.exe	106
PID 4384 wrote to memory of 2552	4384	msedge.exe	107
PID 4384 wrote to memory of 2552	4384	msedge.exe	107
PID 4384 wrote to memory of 1064	4384	msedge.exe	108
PID 4384 wrote to memory of 1064	4384	msedge.exe	108
PID 4384 wrote to memory of 2748	4384	msedge.exe	117
PID 4384 wrote to memory of 2544	4384	msedge.exe	118
PID 4384 wrote to memory of 2072	4384	msedge.exe	119
PID 4384 wrote to memory of 2760	4384	msedge.exe	123
PID 4384 wrote to memory of 2760	4384	msedge.exe	123
PID 4384 wrote to memory of 2760	4384	msedge.exe	123
PID 4384 wrote to memory of 2408	4384	msedge.exe	122
PID 4384 wrote to memory of 2408	4384	msedge.exe	122
PID 4384 wrote to memory of 4236	4384	msedge.exe	124
PID 4384 wrote to memory of 4236	4384	msedge.exe	124
PID 4384 wrote to memory of 4236	4384	msedge.exe	124
PID 4384 wrote to memory of 860	4384	msedge.exe	125
PID 4384 wrote to memory of 4288	4384	msedge.exe	126
PID 4384 wrote to memory of 1584	4384	msedge.exe	127
PID 4384 wrote to memory of 5116	4384	msedge.exe	128
PID 4384 wrote to memory of 3040	4384	msedge.exe	129
PID 4384 wrote to memory of 4288	4384	msedge.exe	126
PID 4384 wrote to memory of 4288	4384	msedge.exe	126
PID 4384 wrote to memory of 1584	4384	msedge.exe	127
PID 4384 wrote to memory of 1584	4384	msedge.exe	127
PID 4384 wrote to memory of 5116	4384	msedge.exe	128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://ptoszek.pl
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffaf482c188,0x7ffaf482c194,0x7ffaf482c1a0
  2⤵
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1860,i,2502558262668096015,12626895804416247356,524288 --field-trial-handle=2344,i,9008081277874065763,10818388661320400784,262144 --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1708,i,403728326611121665,5864369928435029835,262144 --field-trial-handle=2344,i,9008081277874065763,10818388661320400784,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:2
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2348,i,1873863989039687104,13851035839836293663,524288 --field-trial-handle=2344,i,9008081277874065763,10818388661320400784,262144 --variations-seed-version --mojo-platform-channel-handle=2592 /prefetch:8
  2⤵
  PID:388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,12716137201920806949,14657311486290545225,2097152 --field-trial-handle=2344,i,9008081277874065763,10818388661320400784,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,6877113427893706135,16694945861812226314,2097152 --field-trial-handle=2344,i,9008081277874065763,10818388661320400784,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:1892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4292,i,6281287224545661095,9979533572662156378,2097152 --field-trial-handle=2344,i,9008081277874065763,10818388661320400784,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:1
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4304,i,2279765033372948171,4401155047390895218,2097152 --field-trial-handle=2344,i,9008081277874065763,10818388661320400784,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:2
  2⤵
  PID:540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4884,i,13021327468158009402,10256440303636411620,524288 --field-trial-handle=2344,i,9008081277874065763,10818388661320400784,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:8
  2⤵
  PID:2684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5256,i,13740541794158494942,5566511554227428147,2097152 --field-trial-handle=2344,i,9008081277874065763,10818388661320400784,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:1396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3500,i,14246740116085665975,7554389364097283828,524288 --field-trial-handle=2344,i,9008081277874065763,10818388661320400784,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:8
  2⤵
  PID:2736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5576,i,13991799193049818445,2939481620200333594,524288 --field-trial-handle=2344,i,9008081277874065763,10818388661320400784,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:8
  2⤵
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3520,i,8789530727734448022,2799680633144994946,524288 --field-trial-handle=2344,i,9008081277874065763,10818388661320400784,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:8
  2⤵
  PID:808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3568,i,5703146621388773177,8338008401795864209,524288 --field-trial-handle=2344,i,9008081277874065763,10818388661320400784,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:8
  2⤵
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6132,i,2092805636416431024,10025687382174489715,524288 --field-trial-handle=2344,i,9008081277874065763,10818388661320400784,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:8
  2⤵
  PID:1916
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6132,i,2092805636416431024,10025687382174489715,524288 --field-trial-handle=2344,i,9008081277874065763,10818388661320400784,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:8
  2⤵
  PID:4120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6304,i,16403949213169295309,16513018451010766966,524288 --field-trial-handle=2344,i,9008081277874065763,10818388661320400784,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:8
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6304,i,9713471508529971209,13417100442085328802,524288 --field-trial-handle=2344,i,9008081277874065763,10818388661320400784,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:8
  2⤵
  PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6516,i,16955543830072905672,15951631008476017130,524288 --field-trial-handle=2344,i,9008081277874065763,10818388661320400784,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:8
  2⤵
  PID:3388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6588,i,17112276227305771381,17278496509843855040,524288 --field-trial-handle=2344,i,9008081277874065763,10818388661320400784,262144 --variations-seed-version --mojo-platform-channel-handle=6596 /prefetch:8
  2⤵
  PID:2552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6604,i,14903591413982039056,7216028061550500842,524288 --field-trial-handle=2344,i,9008081277874065763,10818388661320400784,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:8
  2⤵
  PID:1064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4836,i,4207430363926324016,5616583230886165150,524288 --field-trial-handle=2344,i,9008081277874065763,10818388661320400784,262144 --variations-seed-version --mojo-platform-channel-handle=4888 /prefetch:8
  2⤵
  PID:2748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4840,i,714632896704669259,4386230752707518398,524288 --field-trial-handle=2344,i,9008081277874065763,10818388661320400784,262144 --variations-seed-version --mojo-platform-channel-handle=4812 /prefetch:8
  2⤵
  PID:2544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4824,i,7112828288088260440,152461401741365422,524288 --field-trial-handle=2344,i,9008081277874065763,10818388661320400784,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:8
  2⤵
  PID:2072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5476,i,3817454234796184753,6319776767378634176,524288 --field-trial-handle=2344,i,9008081277874065763,10818388661320400784,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:8
  2⤵
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=5112,i,11031204309720119990,8247510953451247338,2097152 --field-trial-handle=2344,i,9008081277874065763,10818388661320400784,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:1
  2⤵
  PID:2760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=6636,i,16929224143907895155,17485524645460848903,2097152 --field-trial-handle=2344,i,9008081277874065763,10818388661320400784,262144 --variations-seed-version --mojo-platform-channel-handle=6840 /prefetch:1
  2⤵
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6976,i,788044204293333803,14975940152154722323,524288 --field-trial-handle=2344,i,9008081277874065763,10818388661320400784,262144 --variations-seed-version --mojo-platform-channel-handle=7380 /prefetch:8
  2⤵
  - Modifies registry class
  PID:860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=7564,i,1414017337601359404,13756713740229219758,2097152 --field-trial-handle=2344,i,9008081277874065763,10818388661320400784,262144 --variations-seed-version --mojo-platform-channel-handle=7632 /prefetch:1
  2⤵
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=7224,i,17899254383204767277,15646257946013295345,2097152 --field-trial-handle=2344,i,9008081277874065763,10818388661320400784,262144 --variations-seed-version --mojo-platform-channel-handle=7636 /prefetch:1
  2⤵
  PID:1584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=7176,i,12286966316826963128,8497138128571272795,2097152 --field-trial-handle=2344,i,9008081277874065763,10818388661320400784,262144 --variations-seed-version --mojo-platform-channel-handle=7648 /prefetch:1
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=7184,i,6950125061270954055,6921891203649790775,2097152 --field-trial-handle=2344,i,9008081277874065763,10818388661320400784,262144 --variations-seed-version --mojo-platform-channel-handle=7164 /prefetch:1
  2⤵
  PID:3040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=7172,i,8398597288212453867,17916539764473464191,2097152 --field-trial-handle=2344,i,9008081277874065763,10818388661320400784,262144 --variations-seed-version --mojo-platform-channel-handle=7716 /prefetch:1
  2⤵
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=7548,i,12893726254062227466,14992176388059366001,2097152 --field-trial-handle=2344,i,9008081277874065763,10818388661320400784,262144 --variations-seed-version --mojo-platform-channel-handle=7148 /prefetch:1
  2⤵
  PID:2664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8736,i,14243555930101514228,14097840699739582924,524288 --field-trial-handle=2344,i,9008081277874065763,10818388661320400784,262144 --variations-seed-version --mojo-platform-channel-handle=8812 /prefetch:8
  2⤵
  PID:5208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=8788,i,2414280688698560419,5821325953928445109,2097152 --field-trial-handle=2344,i,9008081277874065763,10818388661320400784,262144 --variations-seed-version --mojo-platform-channel-handle=8808 /prefetch:1
  2⤵
  PID:5216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=8984,i,13726387015477838687,1180802670252140249,2097152 --field-trial-handle=2344,i,9008081277874065763,10818388661320400784,262144 --variations-seed-version --mojo-platform-channel-handle=9004 /prefetch:1
  2⤵
  PID:5388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=5776,i,14200665045296657449,4871370551103076390,2097152 --field-trial-handle=2344,i,9008081277874065763,10818388661320400784,262144 --variations-seed-version --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  PID:5856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=8360,i,7055891065916753734,10234822313853430837,2097152 --field-trial-handle=2344,i,9008081277874065763,10818388661320400784,262144 --variations-seed-version --mojo-platform-channel-handle=8344 /prefetch:1
  2⤵
  PID:5936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=8108,i,17114340687855270145,1241651747331957895,2097152 --field-trial-handle=2344,i,9008081277874065763,10818388661320400784,262144 --variations-seed-version --mojo-platform-channel-handle=6728 /prefetch:1
  2⤵
  PID:6000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8632,i,4186404789895742726,8809169428605160247,524288 --field-trial-handle=2344,i,9008081277874065763,10818388661320400784,262144 --variations-seed-version --mojo-platform-channel-handle=6700 /prefetch:8
  2⤵
  PID:6012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=7192,i,10737202497292483912,3181657316665371827,2097152 --field-trial-handle=2344,i,9008081277874065763,10818388661320400784,262144 --variations-seed-version --mojo-platform-channel-handle=6584 /prefetch:1
  2⤵
  PID:3208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=8600,i,9397723748557368023,7435008394944490644,2097152 --field-trial-handle=2344,i,9008081277874065763,10818388661320400784,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:5548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7908,i,8817426787677773264,9306698104409632860,524288 --field-trial-handle=2344,i,9008081277874065763,10818388661320400784,262144 --variations-seed-version --mojo-platform-channel-handle=7904 /prefetch:8
  2⤵
  PID:5380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=9000,i,6582063248663929611,10323199181598985998,2097152 --field-trial-handle=2344,i,9008081277874065763,10818388661320400784,262144 --variations-seed-version --mojo-platform-channel-handle=9040 /prefetch:1
  2⤵
  PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8840,i,7018896231627481669,254039199578905017,524288 --field-trial-handle=2344,i,9008081277874065763,10818388661320400784,262144 --variations-seed-version --mojo-platform-channel-handle=7936 /prefetch:8
  2⤵
  PID:740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7984,i,13070564406317587139,5952393832036044790,524288 --field-trial-handle=2344,i,9008081277874065763,10818388661320400784,262144 --variations-seed-version --mojo-platform-channel-handle=8712 /prefetch:8
  2⤵
  PID:1100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=8144,i,15307687126742179046,495581729580675250,2097152 --field-trial-handle=2344,i,9008081277874065763,10818388661320400784,262144 --variations-seed-version --mojo-platform-channel-handle=8208 /prefetch:1
  2⤵
  PID:5240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7992,i,3838246039011512237,1176208519372833750,524288 --field-trial-handle=2344,i,9008081277874065763,10818388661320400784,262144 --variations-seed-version --mojo-platform-channel-handle=8440 /prefetch:8
  2⤵
  PID:5760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=8180,i,3180613050009661733,281943090025926119,2097152 --field-trial-handle=2344,i,9008081277874065763,10818388661320400784,262144 --variations-seed-version --mojo-platform-channel-handle=8976 /prefetch:1
  2⤵
  PID:5772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9224,i,2595329977641869614,2404185620529595774,524288 --field-trial-handle=2344,i,9008081277874065763,10818388661320400784,262144 --variations-seed-version --mojo-platform-channel-handle=9336 /prefetch:8
  2⤵
  PID:5820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --always-read-main-dll --metrics-shmem-handle=9700,i,9144752254400386366,10014710375067879810,2097152 --field-trial-handle=2344,i,9008081277874065763,10818388661320400784,262144 --variations-seed-version --mojo-platform-channel-handle=9716 /prefetch:1
  2⤵
  PID:5376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --metrics-shmem-handle=9680,i,18385156766415737160,18386978210323401710,2097152 --field-trial-handle=2344,i,9008081277874065763,10818388661320400784,262144 --variations-seed-version --mojo-platform-channel-handle=9720 /prefetch:1
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --always-read-main-dll --metrics-shmem-handle=10188,i,17593722294823406202,2633943166459847419,2097152 --field-trial-handle=2344,i,9008081277874065763,10818388661320400784,262144 --variations-seed-version --mojo-platform-channel-handle=10116 /prefetch:1
  2⤵
  PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=8400,i,11203237450196785274,1184035569495741600,262144 --field-trial-handle=2344,i,9008081277874065763,10818388661320400784,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:8
  2⤵
  PID:4112

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1580

C:\Windows\System32\CredentialUIBroker.exe
"C:\Windows\System32\CredentialUIBroker.exe" NonAppContainer -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3820

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x500 0x4f4
1⤵
PID:5196

C:\Windows\System32\CredentialUIBroker.exe
"C:\Windows\System32\CredentialUIBroker.exe" NonAppContainer -Embedding
1⤵
PID:6084

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 9a2e622d2c642c5d0a969898b68196ae51f1d4bccc7f447c6273328b5d99f0fd
MD5 5b96906a4651cf3dff41194bbdbb8c14
SHA1 a9a9516fec3c7390975614d1e889a73af399c34c
SHA512 09264b56c71adfea75508f0fabad86bee6d5eafa2808e9e3ad5a3ed6030e9212e7fc8c472ccb153a8a6d37e23e63b7fc6a018d01e16a3104e30eee6188ab1707
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7b:fwUQC5VwBIiElEd2K57P7b
TLSH
T104B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 499f1baf84ccad9aec7e713f14831c28ec8ef6c26551e081f63481da9e10b787
MD5 0b7b7a3907c43b76a43eea92605bfc69
SHA1 b3d127433999df0affab0fc41fa6d73226ec079b
SHA512 67d637e6bb845665c58d6f0a256303841a077e8a03562447569857bb2f980056eb08233e2e8f7e3c0c468adc11695b7c60631f1f3f77f122b5344c0ccc3b2c7c
TLSH
T1D3D0805C9371AC70C7CDC9B1585777453D1AC5629A4247252C732D7D1C4258174991C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9a68569752b554830bdaeb1e8a10446a2bf48a5c40d9055644b0ff7d12eb909e
MD5 619aee87184943036a7fd0a470ee34f3
SHA1 f2e0d05b802871a84b6abab52ce17fbe477f2644
SHA512 618e8ac028bfff63cbfb3dc8165970fe8da37fa98ba9c72a9b4a3b3eb9d922078cf4371b48f699b16e64d0205ac715cb0a1b9fccd6953e5bda90f6d945b76ad1
TLSH
T157D0805C53B1AC70C7CDC9B1585677453D1AC5629A4287252C732D7D0C435C174991C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0b04489861797cec03fc7404687d31ed4755ebf931038495ba158cbbf77e5994
MD5 8d5497a0d6d631f289ddce3b8713b067
SHA1 e9a86741ddb9ad11d98682073f961e7ab3f714c3
SHA512 509da8d02aa51e8910b1998ff4f2dc501dd78e46a217b34ab4cbd3c8fb5b35e21fc44077baf2fceb5ca1c6a95e4d892ddf87e1a0c25401516589fa338e6d3d4f
TLSH
T14BD02374F796E005C32C00735562D291375A850135938454F45D845DAC683F677D84C7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000085

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000085
Size 1024KB
SHA256 7601b38a63aaa60949320db82213a0c22052806e048ce681898a5942835c9d55
MD5 bfcce7486b10d4a68cc17839c79c0bfa
SHA1 82f6484afe9528b30055eb16faf55aaf9bc3286d
SHA512 9acdf9f3439c382e967ab5fddad85ae5d6a79ba9a9ce7c35357d0e41b31afd06785d2c3bd7f9491da8a641d59263c81d8a3988315a1faf34bf3f9d937bc223b0
SSDEEP 24576:nfWpB7cIpoIc1i/UEVMgrgAKBbhhthCCgKuHemSPvNHXl:elXpoqRM5tHtQCgK+WNXl
TLSH
T1DF25338227D079196230BD3E48E7CC686F4A6BCDDD98165DF2CB53921D1B3026E44EFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000093

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000093
Size 1024KB
SHA256 4d533a703b38029986a1d2f0b82a8394038fa77753121435f451d8879c55ec3a
MD5 8fa7bc297e91956e9454a9e65f38a751
SHA1 857c98064be7fb509c4e591318452662ef956e54
SHA512 42ed51969c7055cfae0770ba8062b671c9f02039beb0d7d6bbbe1a4632fbfd1b7dd15452158a6ecbc337b5fc5857314ad20e07fbec701ff3375e39cd79de6c70
SSDEEP 12288:avUl4h58STsuKVn6WI9Yqj9OdqyzIJUXYjXzoFoklGmpj6j62e34CDfkgNyeaaQ:avAw8wUDuUNIgYTk/VdAze3jLkgNyb
TLSH
T12825234861F735A0E8323EFC29666ED53435C6289B6903B7EBF19FB7E84C340E251895
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000096

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000096
Size 361KB
SHA256 02ff49f4431a46d64078b37db37186bd2f8c65655c9a81086ff174ead4486a18
MD5 10f1c35cb246fe221073a913340b48a8
SHA1 8101001026872a40a3653a4ece0da291b90458a5
SHA512 00031ac8af944b437463ef2027fa381873b6e08f68945248e58007a4ef7a5cec37adff6d14f67fcf7de2f5c85ffd1e723c1f1652d6a014eee66f84bdcaad2a6b
SSDEEP 6144:0OJ1vV2jDLDukAPWOlTbj19gCY/tqglNixzN4LtBDRPqyQK6+fWAyU+8tWncBl5y:0OJv2PLKkAPWATbj1ah/cgnAN4LtBDR8
TLSH
T14974236687ED80BD68F6890D1BCC7FA768CF928FF46EC8D9428E5185C408F7921B7611
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000ac

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ac
Size 1024KB
SHA256 790a033a65ac3ec75b2a6e6c90551111accacb52112eb10544a56c0ec78379ea
MD5 512af37d0e6d173e96361d5db3affe43
SHA1 2630f4a249445dc8ef5b52491f4b262974361cba
SHA512 2b9a477fbbe354e47c88f0efd2f077a3a912c18f02518e61306713a657e552a54905c9e6ba3bda9d40614b5b3c1cab78f7721d91a507b45f36ef31bf5ea8571e
SSDEEP 24576:CVYC1qUqMNzy6i+HZdjkkdN4VmTWU/WQob:CugqU3Ndi+3jj4VovWQK
TLSH
T1F625336B09F3A715FEB4C4B2407CEE81B239676B22D123DF219B461AFA97C403701257
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 c4edfa7151689d6e920ba06af65731383aafce461e6381a2e77056df43d00940
MD5 de33e86b87a2251a6dc2f6c691678106
SHA1 b9b54cf34773a8a5ec4e872e796a51c147c55b92
SHA512 e232ed731e4dec6754dab277304047bfa7d34e1920caae4095792fe587a2d19b960d8f5add468d4b6e95efcb3091e3f22ed60fd9ec260ba9b3e36b33582f7d5d
TLSH
T12D614B84B0EEB429F3F30DB916D99468367087AC06472EF13EF5557D7A9EB322084A13
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 28c878e032764bdf3bfd3e4a9b3d477656ef2167be21cc2cd91798ec04c6b1a0
MD5 52b20f6e09b27fcbbd760e3097fa39d9
SHA1 ffe7e63f892c33d3bc8f0b33f30a52c4010cd7df
SHA512 61ad037d629cb885a0be679e9f534913ef377e82602d65c539b6c3d7559921d433eeb074c8516ff2121d30e092e4c2fbf6fd8870795b115936793bc8a8422580
TLSH
T189715E84B0EDB429F7F64DB906D59068327087AC06432EF13EF5957D7A9EB321084B13
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58aa93.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58aa93.TMP
Size 3KB
SHA256 0886a53df27b1ea5915c3a52b8c61530e7f19c0d389c353fbfd9099da00c8520
MD5 a2daed6d803b679afb3fbaded342936b
SHA1 52bef407a8d7ba08d7a20bf19c8d7860f1739cb2
SHA512 e904d212d486deb92dd5d26c2e0f52dd68fea4acdbf934abc0c92d404a5123b572c8ead2bd81d38a95655b8b8413c014ee4d2bc581e36e06faf323d56e1b9c12
TLSH
T1C0613B84B1EEB429F7F34DB816D59068367087AC05472EF23EF5417D7A9EB322084A17
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

37616cf5-8930-45ca-8fe3-e8a43334896e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\37616cf5-8930-45ca-8fe3-e8a43334896e.tmp
Size 14KB
SHA256 1f65e3d482499040f214d7021b76562619a0cc3eb976f71d0d339fcbaf02528a
MD5 befa60703f197927756fb7ee51501816
SHA1 ab933e3710ec7b6948999ece2e5fab4f2216ef55
SHA512 5e1b7be07efcf2ae470c04fe815e600d577112843c33b7801c39e01db568cc22c4bda2fd90bbe1348719f168d3aaac27619e2f57e48b04bc6adf401965478468
SSDEEP 384:D10f7XNO4ZrAHpKO6vUcRxfAakGGi2by7H9q6c99IVDreum/2dZpP63t7Ra4xXXN:erbQ
TLSH
T1D362A9FBC3E4862CCA1156F5BB157E2BCE5909648B5C397688D4EE0B63E2831E20174E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 12KB
SHA256 51f3b1f0fdb16202b64bfc4541b16f00b994d1fea3381a826ad4b5ba4e7680ea
MD5 d487d0cd62e4c102093a8ec1d2b95031
SHA1 12fee8f7d8d0b8001f229d42219c8aeffdca257e
SHA512 735c16c9465727415142a2fe0979b388304b5133ade8d8fc6f6def9c7a00e5576ba8f67c21062676fab355e3d6e745030dffb0e65dc569059a8327f6652da822
SSDEEP 384:D10f7XNO4ZrAHpKlxfAakGG+G2by7H9q6c99IVDreum/2dZpP63t9pRa4xXXqLn9:YrQ9
TLSH
T1C152A9FBC7E48A3DCA1155F5BB157E2BCE5909608B5C397688D4EE0B63E2831E20174E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 22a4d53cc32d02a7e689a3001328c911b96f9e6ba719a1b223731abd91fa2e16
MD5 ae3ff6e62b40b4bb6fb4bd1587b269e0
SHA1 7b14ca9c0efab4943ecb5f134aee65f0e21d4965
SHA512 a05edd82391ce9a93d095306ff82463e34b298ea393b69085eea2e7da72cbd2f9668ce3c24be1880e5530f5882ee985bee4fd2f083efc76428546ee8ac3e45ef
SSDEEP 192:sxZTRVyM//K1Ml8Myj/fastHT+tDIdp17HW6+WNawB/PWWLv6KIg4J:sxZTXaj/fasd+uJHbL/tc
TLSH
T1A852D816AA349977CCDBD209F955BB93D6F5146392900E44AEFCCA0C04E6BED2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 e98a95035383f042cab50b0f4ab2141ead39941491f397b1a439711cb01ca809
MD5 1bb997c755eb4605f60553d0e1383f8d
SHA1 b577f7a2f185cc518b98ce7472cd22377215fe41
SHA512 7abfc386b8bed3e8cb664ee37b66b6b9497dccf67850dc8aac0f8901e3ca79c02783f744be15ea6b55f0a64b6be54c4830a2ce42b02e317a16b54d1aee4ed06f
SSDEEP 192:sxZCRVyM//K1Ml8J5j/fasnHTItBIdpRtHoxHW6+WNdmOWSSc/33/BgGWDxV2JWZ:sxZCX+j/faszIcQHbiw/0KO
TLSH
T12682D8A7B53489778CDAD629F541BB7BD6F51426D2D04E806EFCCA1C00E6AED2103C5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 3b313baa3e9b7f17e3a6e2db2b8680526bad8cb91e45ae08cbf39267f54456ab
MD5 bc322190ed02e12f9a3d805453696ac5
SHA1 e30dff196d30856e67fa2d6b3c35a96b3c6a3507
SHA512 357dcecd39cecccb38cb5fe73c30589392f9049c7f9539f5ad0aa3921e64fdc9fb3ad0fc8d6a5fa768acd9aa40f3e8978cac92319ca13b9fe8a7a23258d236bc
SSDEEP 192:sxZTRVyM//K1Ml8MFj/fasnHTItDIdp1grHW6+WNawB/BgGWDxfgcW3gRYFxhkBn:sxZTX9j/faszIusHbL/fzA
TLSH
T18D72D767BA34997B8CDAD619F545BB67D6F5042792904E84AEFCCA1C00E6AEC2103C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 8394b4963c452dac4eee0db0c59e00e5a6619739cfa58e44e8ba11172b7259b9
MD5 ce888f806f9336e7811a53f3c378099d
SHA1 e95730fbdcf1261addcf6989dace853238bec92a
SHA512 24a5a5bde76af86b421f85aaaa4a39873bcd14044450f2dbab29bee1fec877280400cf1edd77a6cf7683049aacc44f8d395822a3312e9c95889959e6b753277f
SSDEEP 192:sxZCRVyM//K1Ml8JTj/fasnHTItBIdp2HoxHW6+WNdmOW+qtBgGWDxV2wW3gzNYn:sxZCXoj/faszIcNHbat0LO
TLSH
T1C072E767BA3489778CDAD629F541BB77D6F5142692D04E80AEFCCA1C00E6AED2103C5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 40a14227f334cc1d9ce0b7d53d697ff358ba54bc942502e56a75cf02ce6d181a
MD5 cce1408997ef0f9cf99d81777705d860
SHA1 438077324dc3b1cc3bc8794fb7bf1aac6abaf89a
SHA512 a5c3f5acbabb9e2e0d371673092f73d6ad00a2d333fc9af2bdfaaad6b463af957eea102543dc05c0a027f9a3234e4431dcde41380e68e3972c9f446ac33f2aeb
SSDEEP 192:sxZCRVyM//K1Ml8Jzj/fasnHTItDIdp4hkHW6+WNdmOWq4VrBgGWDxV2wW3gzNYP:sxZCX0j/faszIutHboVr03O
TLSH
T1B172C767BA3499778CDAD619F541BBA7D6F5042792904E80AEFCCA1C00E6AED2103C5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 46dac2efca039e1f021dda202abdac97ca608bf2a9af11b780ae280dbff2709b
MD5 e5164741f256e0fe8a605b331548de6e
SHA1 5e4a930f693e02d232e7aa9e99ade89cd67cda09
SHA512 1cc080267f88c41fe1326deaf5da89a26fe5fe0f39947de23038169dc376b6a044464779e38540ed69a23704bcabdd4589ad0100670d1bf171f1c8f7bc641913
SSDEEP 192:sxZCRVyM//K1Ml8J8j/fasnHTItBIdpRtHoxHW6+WNdmOW55YI1/BgGWDxV2JW33:sxZCXnj/faszIcQHb69/0kO
TLSH
T1EB82D767B93489778CDAD629F541FB7BD6F5142692D04E80AEFCCA1C00E6AED2102C5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 c052fbb3a8627ef0fd4471aa646845274968cefbe82af5aa9205882e8ad7481e
MD5 035296842982ba6978853542afbc1dda
SHA1 334efcdf7434feefb11dc8d24e87ba6aee6e1659
SHA512 a6334997a8418b8ac714dd429bbf6bf8e5860e8a88f6e8609ce4c9749a80c5763e76d05146700c1e837f2d396fc2a3ce3f6937c43e297c4b482c23446c3b5066
SSDEEP 768:fD0G97h7pLuLnFJWvFnSP8F1+UoAYDCx9Tuqh0VfUC9xbog/OV93vk8LlSMdFxrN:fD0G97XEnFJWvFnSPu1jas3vk8LcEFKW
TLSH
T141F20A3B280CCB7E4F844E9CEC2A7E9A6DE8018B96DC895447FA844C03C66EF55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 fc88b668382113243b52e26b7ea26d6b2ef74ef92ca8a61e4d78ef6935dac1c4
MD5 dd877f950d27b7adcc2b2d51df885d1a
SHA1 d57c87e147d6d96f289544dc0c9367ff12b2de8f
SHA512 76bb19158731673d03b5a6865d4507659c0c53a90657078c1a9e9e124d798e145d1cc40ad2d23e66b7757a964bb05e702235c83810be4e60559ba9474e9e634d
SSDEEP 48:KY7IJKEg0vyhQIHK5Wk1BIZKKcETyWsdIcKuX:KY7OKEg+CQQK5WOBSKKcqa
TLSH
T156918751307B16803A3E768DAA94B86B068130673029F43B77BA60A15F67E159DFC8FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

ec7aefb4-acee-425c-b996-51d75550f995.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\ec7aefb4-acee-425c-b996-51d75550f995.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 762ba21c6a5ea10d6430f2d489d0e1b2cdd163b0eea37e9c03ee1d5eae416b2c
MD5 4a523ba5b34b6cb8c75874ae79891292
SHA1 3404db9cdeb831ea817ce7ea8c60f88ba6fd8600
SHA512 e58c8870ec4595c078c26ff4e39f347bda9ac3d419155662bfe1b350eee25ebbc7871720f75e1dcd68a89d3e92c61cca60b26ec1216a5db98173c8bd654e0e4d
SSDEEP 192:uuUgsNUY5QHPEWpSL+Z0ZehQmiU1DpS47b+jE+FdmOaxyERLSkq/yU8:njsNUEWEQZCZwndX+bdmL7sZyU8
TLSH
T12C421B3568386C7789A2AA45F44B3B539FF4202B9AC53E94E6ED4F0C00C77ED2317926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a9fd7e3275f36a5aac8434f83445075a61e742aca32e3a67847b38a55ad65915
MD5 4ff4449555fc7c366bd467eaba3f0f93
SHA1 c41de20d787a5f9205711c8cc7280a6b6fabc3ba
SHA512 f03911c4b095eb3810ce74ecdcf63410682c8707b5a16fe0d205b72dad37142bcebc434d5e748d98846b04cde4594833db8e7864bedfb84659e2c88a5301c926
SSDEEP 192:YONR6TZ0qQmiUysKlab+jE+FdmOaYo84NTsU6:YONR6TCmMlg+bdmLY0IU6
TLSH
T10F02F83568382C7BCEB2AE45F48B2A235FE4107B99D53B94D6E85F1D00D779C2307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 44e13c2f26873f9452c981f514375ef5fe81bb98e8640a2b6155cf53ff8b49e4
MD5 bf581207b12c0f7aa6ede30d19ae95f4
SHA1 84ba1bc3807e543997cce7a7d1af5a8fd2f6f1dd
SHA512 69363d27a5d1f4c8bdf51bdddd22778e5139d3cde05691e3bcb62696685ec4e162aa3daa991f3ff07ddcbf86ba1303e3ce4546e5017b8c4be47083600acc872a
SSDEEP 384:nujccCs+Bt0S3PsNUhWEQZCZfFLX+bdmL7zZymTV5fPnznmmf3Y:YccQvATZCX7C8L7zcmDnzmuY
TLSH
T1A9825B3618B42D3BD9A29A05F44B3B536FF4507B96D43EA4EAD98F0D008B6ED1307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 79e04045e48c73ed9c1140852b190fdf848874b2fe4119146dc0f2481bf90c06
MD5 af1380a542f2abd72a6ed904eb482946
SHA1 c9cd5131d89d4c1ac907a142ac78dd423277674b
SHA512 c9a6c7194648e6560b64e1c60f20107071dd2913d1352a7de080e655960c5334fe09105ebeb94798ed64eedd50d5800a1538fb98adbd1de361560a2c24f90931
SSDEEP 384:nujccCs+Bt0S3xsNUKWEQZCZtA1X+bdmL7zZymTV5fPnznmmf3Y:YccQRfTZCoZC8L7zcmDnzmuY
TLSH
T1DB825B3618B42D3BD9A29A45F44B2B535FF4606B9AD43EA4EADD8F0D00C72ED1307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 2f47f435517358218c716bf6a111143f3ddbaffb2e43af44f45d3c53939d6e99
MD5 7f105ab465e7d0a4a601922a2fcedceb
SHA1 75d355db8adf7097d8d4e697eb53acd5b07994c9
SHA512 792d3e323f885c7e99102fda13a4aa5685373032f686d75fcbe85b3cc7e66fd215a9e37e77f3911ef97129e6c932eb016715c1ff871649e808fc729c968062fb
SSDEEP 384:nujccCs+Bt0S3ZsNUyWEQZCZgYLX+bdmL7zZymTV5fPnznmmf3Y:YccQ5HTZCJ7C8L7zcmDnzmuY
TLSH
T177825C3618B42D3BD9A29A05F44B3B535FF4607B9AD43EA4E9DD8F0D00876ED1307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 2822ecef6045df55089a9ce84dbee9c867013d663a326adfd223928aba8bcbf8
MD5 7c3c784d2fe32f6d4f3d1017a431fa2b
SHA1 9a19e7477fb74c469621ed2d60d03ec7674525c5
SHA512 7c0e0b37114f658e05df7b0421e28fa82a2d3b464da26751633e79f5e81f9df2c83fd9190480c302ab0140414a9f12d30f179766a0488302f5146a03d721698b
SSDEEP 384:nniFejccCs+Bt0S3csNc8TUNTUlIlKWEQZCZHA1ZDfQL+bdmL7LZymTV5fPnznmz:iFIccQ8xwghTZCawLC8L7LcmDnzmuY
TLSH
T1BCB22A36D8A4DE3BEDE38B85F64676979FF0116786D869D4DAC94E0C00872ED030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 2b0519f445c2aa4588cc300ecc3a97d2954fe4a34965c40be37bb07528e65ff8
MD5 83fd71726a55a6533cff1cc1fe734e1c
SHA1 7e0483a188f26ed2f6c05e5a11b2c02d9874ddc3
SHA512 b6ecc96b005686eefb21faee80808bd2ad96e25994751767d511d387b3fd1a1b063369c3c87b46194b2291ecb65e1b787a001a25e8963e2f8f9fb70023260fa3
SSDEEP 192:fON16TZ0rQmiUyxK/ab+jE+FdmOaxyEtcXkq/yU6:fON16TCdv/g+bdmL7YZyU6
TLSH
T15312F93668786C7BCEA2AD15F4473A635FE4216B99C57B94EAD94F0C00C77AC2307932
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 3735c4868f1e73435c0724ec83f338582d77fcbc4d045d0242abeda0ea6e9fdb
MD5 9ee74006bd142f62304cc734471017e6
SHA1 9dbca03b891961ba0ec1e9f29c53d9555153f058
SHA512 c0bb9054b8c19e610407ab7ab473191a8044400c26221ecca3d4e17402ef9cca69b881a53c00bb17f32ca8b71be0d9c02b19f24b9bff3aa84c15db80b41a324c
TLSH
T17C41E96CAAE91144B3B76F5AABF7656D447B78372E46D45E00010E4F0A73B01C8B1B37
MD5 SHA1 SHA512 TLSH

Submit Download

099d32db-43b3-41a7-80f4-7415db8a96cd.tmp

Path C:\Users\Admin\AppData\Local\Temp\099d32db-43b3-41a7-80f4-7415db8a96cd.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

148aec9c-c72f-4615-86ba-62137a34a97b.tmp

Path C:\Users\Admin\AppData\Local\Temp\148aec9c-c72f-4615-86ba-62137a34a97b.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4384_1783582500\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

583e623c-df2d-402c-bf30-5dd65c819f7d.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4384_876459348\583e623c-df2d-402c-bf30-5dd65c819f7d.tmp
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

media_images_ptakwspodniach (1).jpg.crdownload

Path C:\Users\Admin\Downloads\media_images_ptakwspodniach (1).jpg.crdownload
Size 46KB
SHA256 1480e09300dde94453bbf45950edbd2bcee237629c59c4930ae3dffa675ca75b
MD5 9987455160273726f5894678429d5abe
SHA1 5291675ba62eb06953ea2543d139eb8d8ba1dd4f
SHA512 75086a0cd7c6768c1a004871ce73e2da80a4b8b55134a881729b81067610e5fc61b5db5d9f4c1840a55f7fa74a782a8d3e33df10cb37c3d50eb6d6a560e1ae1d
SSDEEP 768:/yJ5hj4MA0IAdPvTlCX3QF58j+Tnupwusb+Yq47rhRsuD4SUtJNpe1qkw62fPW90:/yXN4M7dPvqQr8jIupw9bVq47rUSUtJz
TLSH
T1B92302ED296162B0F4ECAD04FF030E4A31EF8F26265B6203D0E81E29E5263E9375574D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads