hxxps://t[.]me/CRUNCHYROLL_ACCOUNT_BACKUP/3985

Analysis

user interaction
yes
max time kernel
334s
max time network
330s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/04/2026, 18:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://t.me/CRUNCHYROLL_ACCOUNT_BACKUP/3985
Sample260429-wpbbsaes8y

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Program Files directory 28 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5104_1378160356\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5104_1912973183\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5104_335846248\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5104_1047232940\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5104_476970026\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5104_1912973183\office_endpoints_list.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5104_1912973183\smart_switch_list.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5104_1621054500\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5104_1621054500\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5104_1621054500\sets.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5104_974499731\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5104_335846248\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5104_335846248\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5104_1746558623\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5104_1621054500\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5104_974499731\extraction.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5104_974499731\travel-facilitated-booking-kayak.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5104_1047232940\deny_full_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5104_1378160356\nav_config.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5104_974499731\automation.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5104_974499731\classification.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5104_974499731\travel-facilitated-booking-bing.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5104_335846248\keys.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5104_1047232940\deny_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5104_1047232940\deny_etld1_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5104_476970026\crl-set	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5104_1272653005\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5104_1272653005\protocols.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2220	msedge.exe
5148	chrome.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134219595333414724"	msedge.exe

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-745935970-1373868228-562466063-1000\{16086A04-023A-40A6-9DF5-063D79FEEF58}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4292	chrome.exe
4292	chrome.exe
5520	msedge.exe
5520	msedge.exe
4292	chrome.exe
4292	chrome.exe
4244	chrome.exe
4244	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 63 IoCs

pid	Process
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe
Token: SeShutdownPrivilege	4292	chrome.exe
Token: SeCreatePagefilePrivilege	4292	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe
4292	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5104 wrote to memory of 3096	5104	msedge.exe	86
PID 5104 wrote to memory of 2220	5104	msedge.exe	87
PID 5104 wrote to memory of 4468	5104	msedge.exe	88
PID 5104 wrote to memory of 4468	5104	msedge.exe	88
PID 5104 wrote to memory of 4468	5104	msedge.exe	88
PID 5104 wrote to memory of 5060	5104	msedge.exe	89
PID 5104 wrote to memory of 5060	5104	msedge.exe	89
PID 5104 wrote to memory of 4884	5104	msedge.exe	91
PID 5104 wrote to memory of 4884	5104	msedge.exe	91
PID 5104 wrote to memory of 4884	5104	msedge.exe	91
PID 5104 wrote to memory of 2128	5104	msedge.exe	92
PID 5104 wrote to memory of 2128	5104	msedge.exe	92
PID 5104 wrote to memory of 2128	5104	msedge.exe	92
PID 5104 wrote to memory of 1940	5104	msedge.exe	93
PID 5104 wrote to memory of 1940	5104	msedge.exe	93
PID 5104 wrote to memory of 1940	5104	msedge.exe	93
PID 5104 wrote to memory of 1076	5104	msedge.exe	94
PID 5104 wrote to memory of 1076	5104	msedge.exe	94
PID 5104 wrote to memory of 1076	5104	msedge.exe	94
PID 5104 wrote to memory of 1116	5104	msedge.exe	98
PID 5104 wrote to memory of 1116	5104	msedge.exe	98
PID 5104 wrote to memory of 1648	5104	msedge.exe	99
PID 5104 wrote to memory of 1648	5104	msedge.exe	99
PID 5104 wrote to memory of 3336	5104	msedge.exe	100
PID 5104 wrote to memory of 3336	5104	msedge.exe	100
PID 5104 wrote to memory of 3336	5104	msedge.exe	100
PID 5104 wrote to memory of 360	5104	msedge.exe	102
PID 5104 wrote to memory of 360	5104	msedge.exe	102
PID 5104 wrote to memory of 4264	5104	msedge.exe	101
PID 5104 wrote to memory of 4264	5104	msedge.exe	101
PID 5104 wrote to memory of 2116	5104	msedge.exe	104
PID 5104 wrote to memory of 1452	5104	msedge.exe	105
PID 5104 wrote to memory of 1452	5104	msedge.exe	105
PID 5104 wrote to memory of 1888	5104	msedge.exe	106
PID 5104 wrote to memory of 1888	5104	msedge.exe	106
PID 5104 wrote to memory of 2336	5104	msedge.exe	107
PID 5104 wrote to memory of 4284	5104	msedge.exe	108
PID 5104 wrote to memory of 2336	5104	msedge.exe	107
PID 5104 wrote to memory of 4284	5104	msedge.exe	108
PID 5104 wrote to memory of 684	5104	msedge.exe	109
PID 5104 wrote to memory of 684	5104	msedge.exe	109
PID 5104 wrote to memory of 5112	5104	msedge.exe	115
PID 5104 wrote to memory of 5112	5104	msedge.exe	115
PID 5104 wrote to memory of 5112	5104	msedge.exe	115
PID 5104 wrote to memory of 2128	5104	msedge.exe	116
PID 5104 wrote to memory of 2128	5104	msedge.exe	116
PID 5104 wrote to memory of 2128	5104	msedge.exe	116
PID 5104 wrote to memory of 3784	5104	msedge.exe	119
PID 5104 wrote to memory of 3784	5104	msedge.exe	119
PID 5104 wrote to memory of 3784	5104	msedge.exe	119
PID 5104 wrote to memory of 1628	5104	msedge.exe	120
PID 5104 wrote to memory of 1628	5104	msedge.exe	120
PID 5104 wrote to memory of 1628	5104	msedge.exe	120
PID 5104 wrote to memory of 3840	5104	msedge.exe	121
PID 5104 wrote to memory of 3840	5104	msedge.exe	121
PID 5104 wrote to memory of 4348	5104	msedge.exe	122
PID 5104 wrote to memory of 4348	5104	msedge.exe	122
PID 5104 wrote to memory of 4348	5104	msedge.exe	122
PID 5104 wrote to memory of 1332	5104	msedge.exe	123
PID 5104 wrote to memory of 1332	5104	msedge.exe	123
PID 5104 wrote to memory of 1332	5104	msedge.exe	123
PID 5104 wrote to memory of 2660	5104	msedge.exe	124
PID 5104 wrote to memory of 2660	5104	msedge.exe	124
PID 5104 wrote to memory of 2660	5104	msedge.exe	124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://t.me/CRUNCHYROLL_ACCOUNT_BACKUP/3985
1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b0,0x7ffd5fe6c188,0x7ffd5fe6c194,0x7ffd5fe6c1a0
  2⤵
  PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1908,i,2162704326983419587,3748576031257610799,524288 --field-trial-handle=2056,i,5045507603719301752,4727907662089768271,262144 --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,8371275154567910236,9828004074021120155,262144 --field-trial-handle=2056,i,5045507603719301752,4727907662089768271,262144 --variations-seed-version --mojo-platform-channel-handle=2052 /prefetch:2
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2460,i,13094792174902508226,9528632801029177654,524288 --field-trial-handle=2056,i,5045507603719301752,4727907662089768271,262144 --variations-seed-version --mojo-platform-channel-handle=2448 /prefetch:8
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3376,i,15833061333391025076,10819596063107164240,2097152 --field-trial-handle=2056,i,5045507603719301752,4727907662089768271,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3372,i,3201659333895228192,9635788442848206271,2097152 --field-trial-handle=2056,i,5045507603719301752,4727907662089768271,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4200,i,2867413598375696133,864358090118257023,2097152 --field-trial-handle=2056,i,5045507603719301752,4727907662089768271,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:2
  2⤵
  PID:1940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4156,i,14156036923190945623,17259440179738482438,2097152 --field-trial-handle=2056,i,5045507603719301752,4727907662089768271,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:1
  2⤵
  PID:1076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5176,i,6569759285944280512,10290593103865864427,524288 --field-trial-handle=2056,i,5045507603719301752,4727907662089768271,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:8
  2⤵
  PID:1116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5100,i,13342187147512635396,10865727919776257107,524288 --field-trial-handle=2056,i,5045507603719301752,4727907662089768271,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:8
  2⤵
  PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5308,i,2231436781723038743,17191803005493979246,2097152 --field-trial-handle=2056,i,5045507603719301752,4727907662089768271,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:1
  2⤵
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1640,i,16860020155790462311,9083313566085778835,524288 --field-trial-handle=2056,i,5045507603719301752,4727907662089768271,262144 --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:8
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4296,i,10007262218158295047,15316974758517636419,524288 --field-trial-handle=2056,i,5045507603719301752,4727907662089768271,262144 --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:8
  2⤵
  PID:360
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5848,i,11187947261431472952,10901388604171006190,524288 --field-trial-handle=2056,i,5045507603719301752,4727907662089768271,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:8
  2⤵
  PID:2548
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5848,i,11187947261431472952,10901388604171006190,524288 --field-trial-handle=2056,i,5045507603719301752,4727907662089768271,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:8
  2⤵
  PID:2116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,5769044987670029706,9513553493414204272,524288 --field-trial-handle=2056,i,5045507603719301752,4727907662089768271,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:8
  2⤵
  PID:1452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,11157404325780603406,1958923281745874646,524288 --field-trial-handle=2056,i,5045507603719301752,4727907662089768271,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:8
  2⤵
  PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6168,i,9432421378090430228,957010886799889245,524288 --field-trial-handle=2056,i,5045507603719301752,4727907662089768271,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:8
  2⤵
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,12317508450760720056,10188414813082557047,524288 --field-trial-handle=2056,i,5045507603719301752,4727907662089768271,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:8
  2⤵
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6568,i,836450987089842715,774431660915840829,524288 --field-trial-handle=2056,i,5045507603719301752,4727907662089768271,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:8
  2⤵
  PID:684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6324,i,4798621626118219643,4056433248717106164,2097152 --field-trial-handle=2056,i,5045507603719301752,4727907662089768271,262144 --variations-seed-version --mojo-platform-channel-handle=6544 /prefetch:1
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6128,i,4120493269731092767,2080776156818201271,2097152 --field-trial-handle=2056,i,5045507603719301752,4727907662089768271,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:1
  2⤵
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=5860,i,7419806786884551955,10045855147576464036,2097152 --field-trial-handle=2056,i,5045507603719301752,4727907662089768271,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:1
  2⤵
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6744,i,9713370916376853406,4856582219004577544,2097152 --field-trial-handle=2056,i,5045507603719301752,4727907662089768271,262144 --variations-seed-version --mojo-platform-channel-handle=6756 /prefetch:1
  2⤵
  PID:1628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3476,i,17497865244317492319,8144279310172492909,524288 --field-trial-handle=2056,i,5045507603719301752,4727907662089768271,262144 --variations-seed-version --mojo-platform-channel-handle=4504 /prefetch:8
  2⤵
  PID:3840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=6248,i,17476928661293099658,6611284613033151440,2097152 --field-trial-handle=2056,i,5045507603719301752,4727907662089768271,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:1
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=6732,i,11958582274464348500,15420474789837401994,2097152 --field-trial-handle=2056,i,5045507603719301752,4727907662089768271,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:1
  2⤵
  PID:1332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=6352,i,9404291948171290603,1695907772440598666,2097152 --field-trial-handle=2056,i,5045507603719301752,4727907662089768271,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:1
  2⤵
  PID:2660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=6564,i,2693705264858316778,965766786297546304,2097152 --field-trial-handle=2056,i,5045507603719301752,4727907662089768271,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:1
  2⤵
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=6240,i,9002023040286572589,1473336509800779833,2097152 --field-trial-handle=2056,i,5045507603719301752,4727907662089768271,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:1
  2⤵
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,8005879578904837224,690789541763965560,524288 --field-trial-handle=2056,i,5045507603719301752,4727907662089768271,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:8
  2⤵
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6328,i,14414751155397738095,4217793207132896550,524288 --field-trial-handle=2056,i,5045507603719301752,4727907662089768271,262144 --variations-seed-version --mojo-platform-channel-handle=6564 /prefetch:8
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5200,i,14766229186213507746,4238414212199450716,524288 --field-trial-handle=2056,i,5045507603719301752,4727907662089768271,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:8
  2⤵
  PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=5308,i,9797772712992493209,18141738152220722633,2097152 --field-trial-handle=2056,i,5045507603719301752,4727907662089768271,262144 --variations-seed-version --mojo-platform-channel-handle=6588 /prefetch:1
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=1640,i,867517387791249451,1576730199888137294,2097152 --field-trial-handle=2056,i,5045507603719301752,4727907662089768271,262144 --variations-seed-version --mojo-platform-channel-handle=4872 /prefetch:1
  2⤵
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=4352,i,5071437890302996326,17537592228889866084,2097152 --field-trial-handle=2056,i,5045507603719301752,4727907662089768271,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:1
  2⤵
  PID:60
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=3988,i,909380133433515643,13406146823342076031,2097152 --field-trial-handle=2056,i,5045507603719301752,4727907662089768271,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:1
  2⤵
  PID:3624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=5284,i,10734832891041105514,6288974277530355871,2097152 --field-trial-handle=2056,i,5045507603719301752,4727907662089768271,262144 --variations-seed-version --mojo-platform-channel-handle=3924 /prefetch:1
  2⤵
  PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=6600,i,4261860732626918838,4871580895414704186,2097152 --field-trial-handle=2056,i,5045507603719301752,4727907662089768271,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:1
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=5532,i,13896263293052837870,14941000197646074752,2097152 --field-trial-handle=2056,i,5045507603719301752,4727907662089768271,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:1
  2⤵
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4316,i,1271545416580903616,1715063480580673271,524288 --field-trial-handle=2056,i,5045507603719301752,4727907662089768271,262144 --variations-seed-version --mojo-platform-channel-handle=5104 /prefetch:8
  2⤵
  PID:2548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=6328,i,11873390406025442366,17529120723092243677,2097152 --field-trial-handle=2056,i,5045507603719301752,4727907662089768271,262144 --variations-seed-version --mojo-platform-channel-handle=3964 /prefetch:1
  2⤵
  PID:924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=5316,i,2889892090509928465,10955966281780018134,2097152 --field-trial-handle=2056,i,5045507603719301752,4727907662089768271,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:1
  2⤵
  PID:540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=6180,i,1292402971602744740,5219570128122422992,2097152 --field-trial-handle=2056,i,5045507603719301752,4727907662089768271,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:1
  2⤵
  PID:2544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=5228,i,8085332169151285919,9211774375340245527,2097152 --field-trial-handle=2056,i,5045507603719301752,4727907662089768271,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:1
  2⤵
  PID:556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6836,i,6573292513094589613,13635129803491403620,524288 --field-trial-handle=2056,i,5045507603719301752,4727907662089768271,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:8
  2⤵
  PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=7204,i,7230757005416534540,8508559271562530529,2097152 --field-trial-handle=2056,i,5045507603719301752,4727907662089768271,262144 --variations-seed-version --mojo-platform-channel-handle=7208 /prefetch:1
  2⤵
  PID:1148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6860,i,3423262921188792679,7029219468515673758,524288 --field-trial-handle=2056,i,5045507603719301752,4727907662089768271,262144 --variations-seed-version --mojo-platform-channel-handle=6904 /prefetch:8
  2⤵
  PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=2820,i,2450139559298581847,13675301715524964002,2097152 --field-trial-handle=2056,i,5045507603719301752,4727907662089768271,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:1
  2⤵
  PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=7156,i,15270211593300786131,9801950175531900873,2097152 --field-trial-handle=2056,i,5045507603719301752,4727907662089768271,262144 --variations-seed-version --mojo-platform-channel-handle=7216 /prefetch:1
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=2820,i,13599774716975713026,5063507411748453996,2097152 --field-trial-handle=2056,i,5045507603719301752,4727907662089768271,262144 --variations-seed-version --mojo-platform-channel-handle=4884 /prefetch:1
  2⤵
  PID:1872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --metrics-shmem-handle=7304,i,12424593703340441647,5583383500489742390,2097152 --field-trial-handle=2056,i,5045507603719301752,4727907662089768271,262144 --variations-seed-version --mojo-platform-channel-handle=6876 /prefetch:1
  2⤵
  PID:2568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --always-read-main-dll --metrics-shmem-handle=6216,i,12581420580602371748,9194839016940421517,2097152 --field-trial-handle=2056,i,5045507603719301752,4727907662089768271,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:1
  2⤵
  PID:648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --metrics-shmem-handle=6628,i,2222466237548521883,5218150821305749026,2097152 --field-trial-handle=2056,i,5045507603719301752,4727907662089768271,262144 --variations-seed-version --mojo-platform-channel-handle=4884 /prefetch:1
  2⤵
  PID:3828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --always-read-main-dll --metrics-shmem-handle=7252,i,1359679140023542494,3150769372597969696,2097152 --field-trial-handle=2056,i,5045507603719301752,4727907662089768271,262144 --variations-seed-version --mojo-platform-channel-handle=1640 /prefetch:1
  2⤵
  PID:2604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --always-read-main-dll --metrics-shmem-handle=5552,i,14623775969740250535,12972730379770316536,2097152 --field-trial-handle=2056,i,5045507603719301752,4727907662089768271,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:1
  2⤵
  PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --always-read-main-dll --metrics-shmem-handle=5132,i,16092978141934003000,611135082763875104,2097152 --field-trial-handle=2056,i,5045507603719301752,4727907662089768271,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:1
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --always-read-main-dll --metrics-shmem-handle=6656,i,16991800919452942015,11651516109098947549,2097152 --field-trial-handle=2056,i,5045507603719301752,4727907662089768271,262144 --variations-seed-version --mojo-platform-channel-handle=6832 /prefetch:1
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --always-read-main-dll --metrics-shmem-handle=7212,i,9566939957329064622,7965948529559319883,2097152 --field-trial-handle=2056,i,5045507603719301752,4727907662089768271,262144 --variations-seed-version --mojo-platform-channel-handle=7272 /prefetch:1
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --always-read-main-dll --metrics-shmem-handle=6880,i,10889684429967884280,7739475673368452483,2097152 --field-trial-handle=2056,i,5045507603719301752,4727907662089768271,262144 --variations-seed-version --mojo-platform-channel-handle=7364 /prefetch:1
  2⤵
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6948,i,5074873687484469656,9570858176536709719,524288 --field-trial-handle=2056,i,5045507603719301752,4727907662089768271,262144 --variations-seed-version --mojo-platform-channel-handle=2724 /prefetch:8
  2⤵
  PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4304,i,2769953552874896801,6295441584635261662,524288 --field-trial-handle=2056,i,5045507603719301752,4727907662089768271,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:8
  2⤵
  PID:3796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7424,i,7789739320073549587,6457533454725623248,262144 --field-trial-handle=2056,i,5045507603719301752,4727907662089768271,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5576,i,12271233627449026462,11315339621918697216,524288 --field-trial-handle=2056,i,5045507603719301752,4727907662089768271,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:8
  2⤵
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5952,i,115448582473135445,16557586339689110594,524288 --field-trial-handle=2056,i,5045507603719301752,4727907662089768271,262144 --variations-seed-version --mojo-platform-channel-handle=4888 /prefetch:8
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6888,i,9682311562237894687,18444084190954100696,524288 --field-trial-handle=2056,i,5045507603719301752,4727907662089768271,262144 --variations-seed-version --mojo-platform-channel-handle=1348 /prefetch:8
  2⤵
  PID:3544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5396,i,16735876909864561323,14598292682171520142,524288 --field-trial-handle=2056,i,5045507603719301752,4727907662089768271,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:8
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2020,i,14850962527678033807,8270976452983969504,524288 --field-trial-handle=2056,i,5045507603719301752,4727907662089768271,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:8
  2⤵
  PID:6000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6212,i,6633163850091614054,15031389183186582605,524288 --field-trial-handle=2056,i,5045507603719301752,4727907662089768271,262144 --variations-seed-version --mojo-platform-channel-handle=6940 /prefetch:8
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7340,i,7291302237661937991,2619089111403231,524288 --field-trial-handle=2056,i,5045507603719301752,4727907662089768271,262144 --variations-seed-version --mojo-platform-channel-handle=7312 /prefetch:8
  2⤵
  PID:5216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7380,i,12753770471973547920,12618915213086906658,524288 --field-trial-handle=2056,i,5045507603719301752,4727907662089768271,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:8
  2⤵
  PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7480,i,18297450904160862921,1259525293925152307,524288 --field-trial-handle=2056,i,5045507603719301752,4727907662089768271,262144 --variations-seed-version --mojo-platform-channel-handle=7456 /prefetch:8
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7472,i,12022462773308934427,779679131981762034,524288 --field-trial-handle=2056,i,5045507603719301752,4727907662089768271,262144 --variations-seed-version --mojo-platform-channel-handle=7416 /prefetch:8
  2⤵
  PID:1976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5376,i,8531039861781198218,13332105969614805611,524288 --field-trial-handle=2056,i,5045507603719301752,4727907662089768271,262144 --variations-seed-version --mojo-platform-channel-handle=6832 /prefetch:8
  2⤵
  PID:5648

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2980

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffd51b6c728,0x7ffd51b6c734,0x7ffd51b6c740
  2⤵
  PID:3420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1604,i,17903303441819303812,10822384986576071667,524288 --field-trial-handle=1952,i,10583010290505250930,14959261736116305103,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2180 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1756,i,16409865029386749782,4773547954003533268,262144 --field-trial-handle=1952,i,10583010290505250930,14959261736116305103,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=1824 /prefetch:2
  2⤵
  PID:5156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2296,i,10210661141225992069,10309417740525325339,524288 --field-trial-handle=1952,i,10583010290505250930,14959261736116305103,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2688 /prefetch:8
  2⤵
  PID:5208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3248,i,10152681015959056016,3363201800693415111,2097152 --field-trial-handle=1952,i,10583010290505250930,14959261736116305103,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:5236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3268,i,11190196301199055292,8024821391137544793,2097152 --field-trial-handle=1952,i,10583010290505250930,14959261736116305103,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:5248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4320,i,15610919495054794,11846354851753393071,2097152 --field-trial-handle=1952,i,10583010290505250930,14959261736116305103,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4344 /prefetch:2
  2⤵
  PID:5312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4724,i,17672515771067525223,4485572353845503070,2097152 --field-trial-handle=1952,i,10583010290505250930,14959261736116305103,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4728 /prefetch:1
  2⤵
  PID:5548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5524,i,7397761646521692655,8683527858735097026,524288 --field-trial-handle=1952,i,10583010290505250930,14959261736116305103,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5528 /prefetch:8
  2⤵
  PID:5868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5588,i,58986525204861235,9220837269602596379,2097152 --field-trial-handle=1952,i,10583010290505250930,14959261736116305103,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5696 /prefetch:1
  2⤵
  PID:6116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3536,i,6488488562803554426,9087018475681677790,2097152 --field-trial-handle=1952,i,10583010290505250930,14959261736116305103,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:5696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3252,i,6026389062341580450,12229622336456567381,2097152 --field-trial-handle=1952,i,10583010290505250930,14959261736116305103,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:4032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=3476,i,2306648352967877057,9653170254125044225,2097152 --field-trial-handle=1952,i,10583010290505250930,14959261736116305103,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:5932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=3336,i,7484342986866315293,4040219553857706303,2097152 --field-trial-handle=1952,i,10583010290505250930,14959261736116305103,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:5924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5820,i,14027540188010617829,11383005326055540722,2097152 --field-trial-handle=1952,i,10583010290505250930,14959261736116305103,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:5596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5904,i,16590853354121192921,11245681924577773088,2097152 --field-trial-handle=1952,i,10583010290505250930,14959261736116305103,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3916 /prefetch:1
  2⤵
  PID:5432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6048,i,12756724607792508698,6772149641681175150,2097152 --field-trial-handle=1952,i,10583010290505250930,14959261736116305103,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:5956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5952,i,9113416548550869860,2634011133583666809,2097152 --field-trial-handle=1952,i,10583010290505250930,14959261736116305103,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3920 /prefetch:1
  2⤵
  PID:4660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=4576,i,2552344079442529173,2448746623428714422,2097152 --field-trial-handle=1952,i,10583010290505250930,14959261736116305103,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:4516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5856,i,3211424793896459968,14928464050075885760,2097152 --field-trial-handle=1952,i,10583010290505250930,14959261736116305103,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6032 /prefetch:1
  2⤵
  PID:3376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5964,i,17720579708732623974,3287575400150040367,2097152 --field-trial-handle=1952,i,10583010290505250930,14959261736116305103,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3932 /prefetch:1
  2⤵
  PID:5712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5796,i,5260229905725569587,10561147270522735848,2097152 --field-trial-handle=1952,i,10583010290505250930,14959261736116305103,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6048 /prefetch:1
  2⤵
  PID:3824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5800,i,12590653690785473064,1042955516524528725,2097152 --field-trial-handle=1952,i,10583010290505250930,14959261736116305103,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5952 /prefetch:1
  2⤵
  PID:5932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6084,i,5644848932247111534,6723767038431978712,2097152 --field-trial-handle=1952,i,10583010290505250930,14959261736116305103,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5996 /prefetch:1
  2⤵
  PID:5592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=3332,i,10974660260497010843,738840992921137336,2097152 --field-trial-handle=1952,i,10583010290505250930,14959261736116305103,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5952 /prefetch:1
  2⤵
  PID:4208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=5808,i,4244418333114861038,5730330499024821307,2097152 --field-trial-handle=1952,i,10583010290505250930,14959261736116305103,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5524 /prefetch:1
  2⤵
  PID:2144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=5956,i,6527108460374642841,14815361788374472298,2097152 --field-trial-handle=1952,i,10583010290505250930,14959261736116305103,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5836 /prefetch:1
  2⤵
  PID:5700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=5944,i,7509254563975808796,12724782303524587865,2097152 --field-trial-handle=1952,i,10583010290505250930,14959261736116305103,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:5736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=5984,i,1731877544623077110,6470201581716220701,2097152 --field-trial-handle=1952,i,10583010290505250930,14959261736116305103,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:5936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5952,i,17007529845850504698,7634805811934166964,524288 --field-trial-handle=1952,i,10583010290505250930,14959261736116305103,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5808 /prefetch:8
  2⤵
  PID:6132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6080,i,13146898226670134415,11442086560066974824,524288 --field-trial-handle=1952,i,10583010290505250930,14959261736116305103,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3252 /prefetch:8
  2⤵
  PID:5924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5772,i,14351391150290446442,5677120597530578249,524288 --field-trial-handle=1952,i,10583010290505250930,14959261736116305103,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5820 /prefetch:8
  2⤵
  PID:5796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5680,i,3030538527607885602,1714098677946342104,262144 --field-trial-handle=1952,i,10583010290505250930,14959261736116305103,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=1204 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4304,i,11031794179583527037,18016870884562578191,524288 --field-trial-handle=1952,i,10583010290505250930,14959261736116305103,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4652 /prefetch:8
  2⤵
  PID:3800

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5292

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5972

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5104_1047232940\manifest.json
Size 177B
SHA256 096e772e0f2e8c15e6dec9087ee0a1fb8b0c56b25061626aedc9e7e705adfc2e
MD5 2714a51ed8c2a891ad73b7488ab655b9
SHA1 9a8cc479aec8de1b4eb678e5d68b23b16a39dc99
SHA512 4811522c06ad6946626a9f4d12eb62a1d623825d18a1cd0ad7b628f4c059f37d299b5857abffd959e4ea53239412490539f5705b4aa6c6951d13c68e6d5b72ad
TLSH
T1E6C012EFDC509DB215EB4323156D43C4E733CF4B1546490935FB66082A25981C193500
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5104_1272653005\manifest.json
Size 135B
SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
MD5 fbebd68ecaa98928909421f66909c054
SHA1 99d787d90f7ed2e5ad924f9c5668eb988b5a6c07
SHA512 749a3b2be47fe28399dc763888654a3e8d397e06e8d3c3af3965bb45846a1336e6ab4ca82c82c3df846b34a2afafa2156f2690e9bf347ab175408dc0171c61cc
TLSH
T158C04C668D51DEAB00A747A56B295315E23B4B4B5044800A7AF5429C1A288964171944
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5104_1378160356\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5104_1621054500\manifest.json
Size 85B
SHA256 2d905d7b28b1afd313753d14f6a916a2e56ec4c1316bfa43046b09214ceb6090
MD5 8ce95626b39ebc2401eee0b34c24fc7c
SHA1 f97a2fefe756f7a03e388e1333573b884730c2b0
SHA512 f04e4f695977918adf6e0603386b6f9c75a4a2202b0fe7215b642f3db491a1db398039cc28633b8e2541749403581622d28c1400f3f8fc66a3daab200e27266d
TLSH
T106A0121018015DE318880320213143D2D3A51C05247437001106108019B8636027A22E
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5104_1746558623\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5104_1912973183\manifest.json
Size 160B
SHA256 2a7fe18a087d8e8be847d9569420b6e8907917ff6ca0fa42be15d4e3653c8747
MD5 a24a1941bbb8d90784f5ef76712002f5
SHA1 5c2b6323c7ed8913b5d0d65a4d21062c96df24eb
SHA512 fd7dfec3d46b2af0bddb5aaeae79467507e0c29bab814007a39ea61231e76123659f18a453ed3feb25f16652a0c63c33545e2a0d419fafea89f563fca6a07ce2
TLSH
T133C04C23ED18BABA12F587D40971DB43F7F0031B34E169463B39948C5F761B8925175A
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5104_335846248\LICENSE
Size 1KB
SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
MD5 ee002cb9e51bb8dfa89640a406a1090a
SHA1 49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2
SHA512 d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c
TLSH
T17D31535723840B9306DA2B4566AEBDC4B0DDC02D7F27AE05186EF394537B52ED8B3443
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5104_335846248\manifest.json
Size 79B
SHA256 7ea98f2308a9c51d17a1ac71b64afbe2a41ff0a083a166a0e4cc428bf44f0715
MD5 817fea104100763cd1bf4f15a51bfe94
SHA1 589717cf98cf7e2d55fc0d6025a4b8e215ed13d6
SHA512 da7b959d93113c5a6be360f90d9c721989c5e7acad7fa592081b582c4c3a0c4a9066a71473fd8492ce7fe7b0fbfd6870d939428a67fbd508fcf6b2c6dc1a41ea
TLSH
T15EA0122058019233108407600360478243551C022015244809461041258813A12A3128
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5104_476970026\manifest.json
Size 113B
SHA256 98821f71a1973ac61b45967ce0c121eb598ac6e95abaa23c912d2f33e4237d8c
MD5 7ef3c71464d0fef472bc1d81fd363c62
SHA1 230e8ec0f849bf34d444c55ef548ba0c9c94d39b
SHA512 f74b96ec3b9569e360a02bfdd4fe237efad8ee2a5deaf46db891bcadd39dba22fd6d59a4e9aafe5511152625ce9f468519dadd53fc0c9b6c8826dc58cbe6cd7c
TLSH
T1C8B09262DC80D872693A93AC0E2246C4F228234B2558AA493630048C0A3A3F082A2321
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5104_974499731\manifest.json
Size 135B
SHA256 cb929ae2d466e597ecc4f588ba22faf68f7cfc204b3986819c85ac608d6f82b5
MD5 4055ba4ebd5546fb6306d6a3151a236a
SHA1 609a989f14f8ee9ed9bffbd6ddba3214fd0d0109
SHA512 58d39f7ae0dafd067c6dba34c686506c1718112ad5af8a255eb9a7d6ec0edca318b557565f5914c5140eb9d1b6e2ffbb08c9d596f43e7a79fdb4ef95457bf29a
TLSH
T1CEC09223CC019CB119743B642AB2AB82F7B41B0B6869705A3AB3148C1F7E1B48082680
MD5 SHA1 SHA512 TLSH

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 d1deab9733f817dfc5112faa123d2c58d408e54be333eb6e7fb6f86bf8c77e60
MD5 b5fd5f45a8dc2cd7635eb7518a4bf391
SHA1 5cbd1504dd61953f05a8b8e64b2d6dcfced0b7f3
SHA512 e8506780b82a49c07eb6da5afd10e167a851ffb0612612aa2bfe812a9e4479f701151fb15df040f61c9d8293749c4908eb075ec92aec56bb5c40dbd8afbf3a71
TLSH
T1A9E0619BCC22DC3B18FD071920955746F705135B2741591F3E3C920C8FB427A51CAC1C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000009

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000009
Size 30KB
SHA256 1b70461a221a5bc3d4d79de3e0461860534f3b07d70b4aac4d3d0eb371527d40
MD5 3864b4d951b48891001f9f00959f215e
SHA1 4efb6567d7f158e40aa5b5cb6baaee1464a2d552
SHA512 2d34ad6957730cbdcae0dd706a7ef4631b5908fd05446feadd4af786e7a310dcb25a82c3094dc14aa581ed3b5e22e98a18eca220e8ff7e14491d05221acf8b29
SSDEEP 768:xyLeb6L9MENxXnllSJx6Zbrv8ISArYEUaNZyEPHF1pQr9mkq9oX:cSuL9f7XnOJx6ZHvxSArYAZyKHFLQr9V
TLSH
T13CE2F1978B826203C6527870EC080FF5FBB53ED1F669253BFE7C06DC5C91998A399412
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 61713e132c6fe71ba4182755a4577e0c7bc7eb2ab3a561cc1a492b0e815e4092
MD5 500a7dc2d65c5633740019da26f81891
SHA1 1f32d1ce93efb3a134e1f74df6cbdd00a2c01b3d
SHA512 fc0d138cea8d67859388daa0d73abeb2ee6c1e3b38d7f1da38de6724279bec45080fc1cdbb342b3bed0a814182a17c8b2631530ac6d6453ba3089b66ddfc3eb5
TLSH
T1B3B0121125404107CAC00231E4D00CC930351C58013E0551C1D080DB42107E088016A5
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 bd33bb08902b83e7fff6a039d8ccf835ad12a8a80eddc69fb2ef174070e6e1ce
MD5 76be77635ce682decda71b48213ff110
SHA1 f3bf63d2ec040573f8891893762442ad830519c9
SHA512 8bd5de1ab10c27f8b90723f128ba35f79b832742fe72e17544c9a2265a16c4f6bbb16c628a833d5401385fac2beb4aa51712462690e49fc313d59bcb2b2bcb9f
TLSH
T104719CF783E48A7E851296E4AA256E2FCE6D0925531C3C5288D4AF4B53F2872D20174F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 9b5232ac99da865c0491bb9f12f2e2f6411b8c334ec77209f39b9193dcd68046
MD5 beea848166bf1cca74f068ddff9ed959
SHA1 1171f3ba0a54d557b9b13607b0066946258471c9
SHA512 fab2aef1d787eb28e30ab563c6435726befae6943a7bbe77aa73e0daea5da675eda7c14cd8a63a8e98ef01f905e2456d5d8c77771dd1d1f44614a8ebb9ad7d6a
TLSH
T1FB819FB3D3E48A6DC41256F49A256E2FCE6D0925531C3C528CD8AF0B53F6872D20174F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 0d5cc14b44e6d2b9cacd00d5692cb0083df866ce79523a7c6fa395cfcea14c27
MD5 2dbacb93dbdfcd417253c226c9ef8170
SHA1 029a6099ddcc221a6dd79e79135c271e28000c0b
SHA512 ccab9e6d1f7f65095ea9fa296e56cd3c43dffbd993a7ab858a7d1ea373b215c2eca3b3ad4d3f1c459beb004ce2b591743590ef3f56f8db16c07bf772003ecc39
TLSH
T148519CF783E48A7EC51296E4AA156E2FCE6D0925531C3C528CD4AF1B53F2872D20178F
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 4aeff5bdd1fc56c3890a4a8706333bc0f2b4c853d8a3bbd564bf054a08639053
MD5 e32c3a902d146d410c12d8cd10a0a587
SHA1 62d9eba63a51cf0a575b033ffb4abb210e5cf684
SHA512 2370958aa0b6f87204b30d768269581f75685122608a888e0612db129642b67ad8f056d64c327ec18d5c11af755311b5cc1993e181d457b225160693cba84856
SSDEEP 192:2Rrr7RhdO5Gxjv7rpAPRp2om9+Hsb+WNn0Fssl2Yrz/0kwgUaiVyIsnAUgtaJ:2RrrdhfbfUXCEwwx2m8AUai8
TLSH
T1B742D82EA9286A3BDDDAC21EF9117B53D7F61021B1842D84EAFCDA2C04D75CD235B427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 c2979dc2d4d0ff0f34858e45c16d6bb898729498b0143a70d7b6f7f5cd27d305
MD5 ece9b9aac83d1a120903f5df78f83fe5
SHA1 48f5ea8d7fa0805a467bea1920da152f250e9953
SHA512 199b4a05cbeed43fef7c9463e305d1f546ef43becd8a1e67c5bb9009d954c4358605e2b3a12706f00141c6817c00b0f01a14018638ded4ecb79f676f8b30a63e
SSDEEP 192:2Rrr7RhdO5GxVv7rpAPRp2om9+Hsb+WNn0Fs5+eUrz/0kwgUagVyIsnAUgraJ:2RrrdhflfUXCEww1eq8AUake
TLSH
T1DB52D82EA9186A3BDDDAC21EFA113B52D7F52021B1841E84EAFCDB2C00D75CD235B427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 0063f86e70b0219bde9b758f54946c5f95534545dab2f3a50914d4a144ed669c
MD5 5a5bbb182baa4e5bd301cb5c79d745a8
SHA1 13bc8bbaba1910d3b372616633a7c11433d76bb4
SHA512 478e0072b3140015bd4381389c3b279cffa12b87a6ebe6c10e1b844d9817e1e57438db09f22b557e4d621c530ad80edb470114107d94032a78b73a675c2f5af5
SSDEEP 192:2Rrr7RhdO5Gxcv7rpAPRp2om9+Hsb+WNn0Fs5+efrz/0kwgUaiVyIsnAUgtaJ:2RrrdhfIfUXCEww1ev8AUai8
TLSH
T1B942D92EA9186A3BDDDAC21EFA117B53D7F61021B1842D84EAFCDA2C04D75CD235B427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 4c5dbe3f3071c1cdd70e39a99dd2a8e7a0233b08f2fef9e58bef03d6b9f0f954
MD5 eaf45e095eaf8d2e1b455626d5895959
SHA1 23bbb40f8390c77932f41805e60e5023c08cbcfb
SHA512 92ecc61b66421f057e483c277097699444f9b664b973b2ed4406a72d4c026914714c5b5c5496330675ccc8e112b23772dfe4e83882fbc0b2de5ba584e72837e6
SSDEEP 384:Wcji97KxkXqKf/pUZNCgVLH2HfgslE27pLuLcifU1XODid+ErU3+NHGSdTFO:Wwi97KxkXqKf/pUZNCgVLH2Hfgs227pA
TLSH
T1EB72F8676C0C9E3B4F98C68CD9267F4FACB5014B65EA885493FA982903D5BCB11061FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 36b4d43e76d61d334c991df0c9a9084c608f1038e1318fc69eb6d4dfd4788584
MD5 ab89e37f55e8710c64cd52eb451daab1
SHA1 45388fbbde7f98e2ff03e26bdbe166596b1efc1a
SHA512 c8c05115a7d6d55296e63a79cd36b6df630bc828822e27d9ed0a9b794149c8ebe59d056c1fb9f5a2836d89539ac55a2858a68de519649be2b9f8d1c01c1bb964
TLSH
T1FDB012D090066501C60306F9198208883114DF108F09130153F06EB398275904014190
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59d44e.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59d44e.TMP
Size 96B
SHA256 e39e7a5a94cf128db9cea3e8f499b86a1fd784287a36efb759578ed4d83fc01e
MD5 02446adb752afdd0118eb595d9e324df
SHA1 db14aba17e958b38e8c3b8837c66915da45a48f2
SHA512 5bb7e710c0385dd2c806e2843d74867e1fa02038d0ead3429b567bfdcb47653c0d4b77cd9e98b2530f3b99196ec0c9aaff0a7f2679211cdecbc50801d5e9b08d
TLSH
T1C4B02220C0022323C20203B02C8082ECB030CF23CA032202C2E80AA3EE202300820AA0
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 89KB
SHA256 8522acba3814f66b35612eb920fa29002bdbc014d6392cb48cddfe8689085ebc
MD5 1695d8e94970215ad423fa8b41fdbc07
SHA1 239e2d3784f08218d28a577db8696a0721d1de3c
SHA512 1850e08edd470eecff7b0f985ff8338ff996217649e9796e95d7d96f7d0806a46e74c876b03a5ba509fcc810244e098ff493eab2bfab3beaed6cba6fa88277ce
SSDEEP 1536:jVicYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YEm:xi3Qw/xLANk0mUW5GmRntSFCjEENQ
TLSH
T1B49302BA5E174AE7957D4A9176AE7809CE12630D706FA8CC315C638C61D01C92F73E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 197KB
SHA256 ebe8535140575bf2dff0a8fac462268bab4ab502ad2b45f94073388a38f6fb3c
MD5 22b94a3d646dd9724ac79113186cd96f
SHA1 ee27b0ae9cf3fe0e8cccd13c8bca7144e8eb25e4
SHA512 6f1f7fddad8993bb7cc810c69798cf866b70141f50e1096d172d767de8197152320c8b7c29cbc8c68e503eab0732bb4bb626955834fb07ed2e6d079ec32696b6
SSDEEP 3072:22SKwHP0IbJsuz+QBPeDE/VqNGaQcuON3Qw/xLANk0mUW5GmRntSFCjEENZ:fS5HMSJlqIPrNqNLrOk0HOGm/SFyEEf
TLSH
T1711412A52E1B8AFE1F360932A75FF50ECD378646A15BAC5C1768F79E12C02860753E70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 197KB
SHA256 e2cfba0efd4e3230983e319165549b99506666232486335bac100cd42709b663
MD5 1122553f3840a3d84f124e5f5a238217
SHA1 c29f248eefafa014fd77fed3b2c5117fc3da3aa3
SHA512 4e96bb5b169d0761ee374308c4c57aca5fc65300422121a24c1f39d208092579be4d36e39edec2a579d41c3d7483d22c2261f018e990cf43bb50e609ffe1e22f
SSDEEP 3072:H2SKwHP0IbJsuz+QBPeDE/VqNGaQcuON3Qw/xLANk0mUW5GmRntSFCjEENZ:WS5HMSJlqIPrNqNLrOk0HOGm/SFyEEf
TLSH
T1C31412A52E1B8AFA1F360932A75FF50ECD378646A15FAC5C1768F79E12C02860753E70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 198KB
SHA256 f9d575a28afce37181a8e42b4d33ca5b95b6bb4f230a3c40062b9b5706a62daa
MD5 5a4c8b98a1ef759b4c7e0722eb9c86e3
SHA1 47051ebaf96fec883ea8d398f23722c13d05519f
SHA512 233a11efc09cf732fa509984781101ba7fb5d79d0a2926eee8b97474539d0c0800e23e37c49090d4d8c7c8671a5236ca30bb6f6887ce52f29c1a4fc9dabb0573
SSDEEP 3072:TGbSKwHP0IbJsuz+QBPeDE/VqNGaQcuON3Qw/xLANk0mUW5GmRntSFCjEENZ:abS5HMSJlqIPrNqNLrOk0HOGm/SFyEEf
TLSH
T1B51413B62E1B4AFA1F360962A65EF60ECC77D64BA11BBC5C1718F74E12C11460753E70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 198KB
SHA256 8e160e08694aa24732abee9ffc0b80bef2e6395a774ef2902f6d2dc337302f33
MD5 b232a3735421d5b3ba24f9857e494fcb
SHA1 62e1ccf16aefd8383dde114cdde0e92f29465508
SHA512 602c24916d534ed328b04443412ff48b27178eae45e29184e8787766190c5102a91a51031cf3e973670fe93145f09b28fb8d5ae3e2b5618753d950e3cfa15b4f
SSDEEP 3072:HGbSKwHP0IbJsuz+QBPeDE/VqNGaQcuON3Qw/xLANk0mUW5GmRntSFCjEENZ:mbS5HMSJlqIPrNqNLrOk0HOGm/SFyEEf
TLSH
T1411413B62E1B4AFA1F360A62A64EB60ECC77D64BA11BBC5C1718F74E12C11460B53E70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
Size 3KB
SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
MD5 1de85fec2dfcc28011a7c2aaab95eb5f
SHA1 80e8c954bfbe8f7ee5a2335c8d969ae033935dc3
SHA512 9c7dd37eb0c094b6aa05201e7c71a8f33b9db81284223bcfa595a44a6ac95d5a6820ab6f07b7aa8d26bf207454e94277bf35332e9c009ee63f083752b6b51750
TLSH
T1D1611DB79A3048090E3412B86B19B35DF63E029F1AD598EB76BE568F1F710F7245C54C
MD5 SHA1 SHA512 TLSH

Submit Download

crl-set

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CertificateRevocation\6498.2025.9.4\crl-set
Size 22KB
SHA256 6ddcaf50aaff98b960d067054ce2ce17872ac0719d02abbb7fe56b9eabc818f2
MD5 d01869348d5a783f61f90cbb27b82a78
SHA1 d4eccc91435adaf01f8589cf7f3589cf65425de2
SHA512 7ad7f27d1f559d1f50f1f009518ccca5d6d01696cd70657ad94c9fe37db7bbe06e4afc13170bc5c065cf72d69a92c3df78f637b7faa2f968bb89aa154fe371da
SSDEEP 384:2t71+UygzeWhU6yVS2Ddc0fp/9yYoIJgWUeJuDzeG0LOsr2h9ltQYX9hVPz/HG1y:m4OBwVPDdFhVyYoPWUiuXeG0K5dQYXFr
TLSH
T1B8A2BE9FAF48F112E211523D94245F40DD24D54A23996AB74F943F30ADAE42AAF3CC7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d250b5ebb9e957080a6cef5b2102f4a7c36ed2f08e9336c4ee97927b024c3858
MD5 d17e43a3f86153e289c2c00175c9004a
SHA1 027793ccd7bb5b73af26845cb7b7aa5c7e784ee5
SHA512 4e12f808af5d24151b07095f384ee3b3c21587649f457f3e01cef45259e24d98e8e7b8d852bc93fb8c15d23382c2035bbab82d703edea2ef724f494b956576d2
TLSH
T150D02B0CF3011C21C1DD983100AA470E0414C86446014280843A06047EC0080418B0D0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 564B
SHA256 af681b9b56f3fee0e5c7ee04062ecd5c2673922743027b3f9583efaf3dcd2170
MD5 7928e378b1dbce58b2888af201845e97
SHA1 ad6bc860d93a9c85bcf544354fba39142b7b8750
SHA512 3c5eaa87d80c2b95c20a228c27facac24cfe4faab25b574cf69673e95d8b148d69049d3244cc881b6e7280adce0e723120599b74f51b210dbd5437eb945f7eb8
TLSH
T106F046CF6AE1C2ED8708E04FD27C631E0051B717FBDCD99AB308A59628A294095D57C4
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00006f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006f
Size 30KB
SHA256 b7822481dbe290b28ce433843c7c3f283def927ee6bd1610196de71fcd9bc152
MD5 cb803a43f1fd3c541f619f8ad1a97948
SHA1 461b1aad123c1764de31968041832f866e397d7d
SHA512 8388f7b12a37a6bdf50fca5e3d62c87ef31c12c9c39c7a87ff093f46bb6ce3906d6420855ae6b4f525a980fba2477f342a36adf97f8e13dd0415170017577d15
SSDEEP 768:bwWTARrTe1gHJ5F/g4HGKFvTKdnFfxw2IUY50GZiHmOAPxa4:yKQJ5Rg4HGKsdFfi2Il50hmR9
TLSH
T15FD2E1E6CB9DEC3252EC023103216D479E7CED2A0F90559B8D58A4E660B8B056C20AFF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000070

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000070
Size 80KB
SHA256 39595a1806156cfcadf3cc4e20c5c3f3eec721386a0551790a15f025ba9402bd
MD5 14e39be019da848a73da7658165674cb
SHA1 e016473c4189a8cc3dbff754a48b3e42d68af25a
SHA512 828a383de549871aa80ec960a7e371ef47da96d01ebb9628d1484ceed9eb698aec5109b3de0b24ff8000610a2c2d633616c9fd28d380656fecbaa930cffed029
SSDEEP 1536:kAXTJvOGTDbA80pK0Mdq3wUAVa6BGS8EE/c0Psh6lufc4Ap7QgqHM7zxFX3xzOEm:kAXdJDn3QRoag8pcM6fdAOgq4xNu
TLSH
T17A830296752BB1D4592B012A9EC1F20294222F713DE7D02C15EE4F6E27DBD21698CEA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000071

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000071
Size 22KB
SHA256 6b775799296a8870bf95913f493e5d95b7d8ca0b48c9896af18a8c7fd9caa0bd
MD5 660f63688956312f53d8718281973a89
SHA1 e9eba2bbad0c9b50493f7d887a7c41a6aaa0bc32
SHA512 6ed9cb1dc2c6e5883252797d6197fc943c8d2431edf7186b1e21d2aa430f93c049c40f377292559b5c946021dde3c0387d0aa6d2dadb1822becc739861e6e867
SSDEEP 384:nRWZBwvDhoQy3plNoJaMbrJmnIpbWCBwayvDtje1qo0Q2bFOalpUe5giM36F4eIo:nRaQDhopwPrb19CE+UFd6FNkA
TLSH
T100A2E19C906F6DE1079279A3A244285233CCF9FD6A2D062D287A314D6104DEDF6256FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000072

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000072
Size 26KB
SHA256 4ce3b02e8644ebd77df5193b1c79577b5bdd1bcb86b46749e1368d47f6d041d3
MD5 3ff089d1e7c15e8f3427e9a7b1534be6
SHA1 390c78cd8111d9f69f5f8ff827f001ebbb10a96b
SHA512 6043f6ef22b073e4d9169775c0d2ae955dfbde590ea0da7d8a50755dd23f54caec4a49bc5b01e1a526a3774aac04d120c64fd9f8da7ad760c9b0ecfdc3a14539
SSDEEP 768:76XJJzewLtkQHbUiBELP/I212Chn9sufX6vM0yKEojqS2+FXOx15Vzu3T4:2ZdgytBkP/Z12Cd9v6vOKdz2+Nw5Vzek
TLSH
T142C2D0D383CB1D22091605F3EF2807530DA4E543CD2B2AA6291617B8A53D6C7D25A5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000081

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000081
Size 30KB
SHA256 32339f355b5b9b8693f9f6370dca7b05fe6042e3b2d94546afa05d569dd6b66b
MD5 348c832a4560adebb39e32b91f392e20
SHA1 5f8743e97e3d0c418d90998072416705f17eb720
SHA512 c225d7794c5c01872bb1af8a0c6af443f54e07f40cb8c03ed79c77a092ab35e03cbf29e2672cd070e93c998f54fe7776f4ff4e948dfd67af8d77039af6638cb9
SSDEEP 768:5q2yiiih0/n1a/WAfZXxZbFtjd3iXn24He5UKnCljV4fx:k2yOh0da+qZW24Ha3n4x45
TLSH
T10EE2F12E4C58BDF8AF09B230D8C62E76CAF216D7C6D2EED0543DAAFD2529590D18C5C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000083

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000083
Size 151KB
SHA256 a8e7368f03b24867920b42fe31331acf8bde1626336affcee9bd6a9d7daf0692
MD5 c798737fd303ec814cf40d8076bd5d5f
SHA1 0d18fd05f16c17652468175fcc41423a3d99170c
SHA512 31ad0a4e439b706ce0da3a541bad7ed5e5340d086bac526b7872ecfeb722edd9767d99baf72307ae6f79649e3be90542e9034b618dd75db7fc46c19eca72da35
SSDEEP 3072:0EqzX0mMLYGYjNWkUBgpF8djK+nrXXfmlCPaPGOZOaO9TMunLe6EatD:0EoX0mMLYR978dW+njXelCPa3bAYualw
TLSH
T1C8E312AA520A418C573142C80BEF712E499FD0C619DF829B35B4DBFA9974D17270CAAF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

efa986235cc38916_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\efa986235cc38916_0
Size 6KB
SHA256 015ac4863eec690ac66d8a253b8573e47e50c6e0905400d5d053c88537da3d34
MD5 70b280959458a539807c616163403ab5
SHA1 281800dd6eadf5cf1b574318b7b79bdcc2f0c06b
SHA512 b0bb76e24385ce6ca958309281df23236aafa95ec403983ddbefc817c2407b06ffa8c6f47b8ea98ae226cb203e4014ab4c23767a735f9a82698f44c78a3c6614
SSDEEP 96:THLTHEejPL0zHkgnrZ74crfGnZ2Lb6CIOaaeyzjoOjaN33PxFVSCeM1zItl:bhjPL6x174crGnOFaEtaZ3VD1zI
TLSH
T1E2D1B7535BAABE3BCE1153F811D65917E23281283BE38E130E90C7313D942F61E1AE5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 0c31cd0edc2efd170d5a7fc1c2b5a7154698ec4a767b8850ed73317aa9c05b55
MD5 7522a85e2280c4356899c0d57c668d4b
SHA1 18d346c039342082fa05227f4043448de3ffd970
SHA512 9385d05533e306f8f0d9dbf37faee22b4c7f4031d44db478b5736b6b382e25f80348225766692bce8adab75c4bede8442bb34e7ccf6ea901290b2449db6b470c
TLSH
T1F7611D2CF798C5AAEBE040B15AE4349D313C071AA6B31E5939FD113DB61DF2D40CD418
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 416d61efb166a698b514f203acbc06870095d926413b288085cec15ab52af011
MD5 fc1a9cec5908683c7e30583cc5d2a163
SHA1 c3da69e28fb3b4bb4290e03eaae06241b08d1609
SHA512 0d96b031fde4d1ee6ceff03042e2b395222e40c665378be34b10b969b092a6fde5d7ea94c1c4d5ec7987bff4bf4ef7c29ee6551f5b82995a1abfa29dd29f2b64
TLSH
T16B610C2DF2E8C5AAEBD040B51AE4389D353C071AA5B31E4935FD113DBA1DF1D40CD814
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 109ee1e4ea32bcacd13bd62eec02e020624d455b3b09f1f4bedc0ab22133de16
MD5 cd1bd420b157b6ba9b1441a42c362f98
SHA1 030a0661563ffc8f0ac09d5ed9ca5a072d8d004f
SHA512 f448c07099efdb1b4808335d78c130e78efe13d6f06198d85016cd19675522ce815bd529a2157ccdbff7a6c416db414281ad10c037cf7ce02b088c4759a06753
TLSH
T15F51B0F783F4462DCA1296F0BA186E2BCE5D0516432C3D9A89E4AF5793F3470E101A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 3b49f230ffbc7d9b37143ac31f31b3ab12ba15d6b87ecb2e90eafe60692ab5cf
MD5 e2d7ed3c4ab2eea9f190550f9260b805
SHA1 a420c9fc9997285d00b3bd3bf6b2c6e50b74b8c6
SHA512 87a5254b0cd422cb6ebe436ea536ec915bc2ade2d23f5d89365b283af15f42c3e274c983585266bcee9e34fbb0d0cd07aa5cd04fcce8306f1411f7622f3fb2fa
SSDEEP 192:sxZORLyM//K1Ml8MkM2/flsgqK7zI2NCmIdpXXHW6+WNco//YoFJayrIg4J:sxZOpMM2/flsgqKnIyCHnHbT/s0c
TLSH
T17252F8066A34997B8CDBD609BA157B53D6F90562E6840D44AEFCDB0C00E6ADC2317C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 29KB
SHA256 a5873da904af160631badd7a41649c5fa3632910e5529e65238f47ba2f1c5b40
MD5 d6e1224ee7b979b64f39cb530c1fa9ba
SHA1 9de16facf23353fbad7d4eadcf80caa5d7737ae7
SHA512 3ac8943a3cf77b726145fba9e4a14dd7af0a2ad198c3d4be13047f9afd6a015be84796133e05a8e2849d6cb68ab909dbbf6271f907742ddff30a02fb328aeefa
SSDEEP 384:sxZOEquM2/flsmqC66s8qMpRiYnazAW8pZS15posJWeT+UnIylH7HbRkdGAr:smTuJ/fHqC4Mnc7WeT+UIAHbRQN
TLSH
T1A2D2F806A924C87B9EC35D19743C7E33D9EC5052A384CEDA1AECDA0C019D6FDAB47867
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 997cff82227900cd4b24e615ce21b49e376e4d795fddf4491d76e01b8144e347
MD5 5b9a6b23f330a17a3e8a99d0a41da9de
SHA1 f3ed7e929cc2d17cfbdd63d6ae371faf24f564c1
SHA512 e4af9f6738a675c641db5f7449ee7b4249ac68d1cc4467361bfc287281ef97bc1621770829d4434809b68ffa8fde1ff59eca3221c82918002694c66332e5354e
SSDEEP 192:sxZORLyM//K1Ml8M9M2/flssqK7zI2NCmIdpXXHW6+WNco//YoFJayrIg59J:sxZOp1M2/flssqKnIyCHnHbT/s0J
TLSH
T12352E7066A34997B8CDBD609BA557B53D6F90562E6840D44AEFCDB0C00E6BEC2317C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 3e288103e85055022d1632d6b423cfeaddca538178a0e9b840363282a01a8c0e
MD5 8ba2e7b6932004a341955b1b7db0a427
SHA1 8af83b8485015050fa2010c2b08304ae74fe7f5d
SHA512 26b75598ffbdf987bb1ea040d3f5787874008d0615ae9c27d5f3daa0f42245836e4786878d49b8fe8ecdf55c6f99a44557f507801e237afdb356540260acc734
SSDEEP 192:sxZORLyM//K1Ml8UQY9M2/flsmqG7zI2NlmIdptRoqHW6+WNFLALvdYotyzyrIgr:sxZOpquM2/flsmqGnIylH7HbRkdG0r
TLSH
T18B62D706AA34997B8CD7D60EB5157B53D6F94562D6840D446AFCAB0C00E6BEC2317C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 10a8e136056643aa9260ed196529c9830fe7ccd841ab8ba1dc5432f55b337642
MD5 e50320308f41a5013e34cb58ca31a88f
SHA1 f9f99c6d0e1093638f22bb383f69f311a8d24e75
SHA512 947411204a7fef56fe3a5ab4e69226b5f3ffeb51087e5271c47e39464d847777f93f77e92e2ef536015479df14354cf6b6c8905c0b5bae7d2a47eb56752becd6
SSDEEP 768:VJsaldM7pLuLnNVWvNT6D8F1+UoAYDCx9Tuqh0VfUC9xbog/OV9H9oLl6QF5mroZ:VJsaldwEnNVWvNT6Du1jacH9oLIs5dfh
TLSH
T129F20B3B680CCB7E4F804E9CDC2A6E8E6DE801CB96D8899447FA845C03C66EF55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4677cc91-ced1-413a-8605-093b28e5e05c\index-dir\the-real-index
Size 1KB
SHA256 cf2f02c4801e98ab5245dd2b87b4194b8630560971378c5752e08636874ff518
MD5 36c3fdd713ca553caa0e315641bec2e6
SHA1 2d2cac389d31f2bef16f0fdea7d79cd8c6fa8f57
SHA512 9d2c0d82344b6e6ea751cd1135db395bb51f7dab84de1373a96f83cdccaa658ad5f8638fcb5e56d69ba24512f901cc7f2f8d89bc19b85685145db640477f0644
TLSH
T14621549CAC914C4BD992C1F45479267C3374C9FE2E05E30BA57D62B61C2BB966993004
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5c9ad0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4677cc91-ced1-413a-8605-093b28e5e05c\index-dir\the-real-index~RFe5c9ad0.TMP
Size 1KB
SHA256 f8c2e37442c70c0a0d5557c73e1c297c4ad0f09316e7ef03c3e9d75000a13f22
MD5 bae3f3be8cc121d615173abd67169644
SHA1 7b22880fb0f412c10488ed1d17895b9e22acbce0
SHA512 aaa11ba9fff9520a8396b4f29f9bb9475996ea8642c23f510aff3a8c5ee7bc4657630ec7e2dabf84f46bd2cd6e5e82b6fa03a27ab0855a9b214b81f5d3ffa25a
TLSH
T17D21639E60D51E03CD61E0B8958DB16C3379D8E42A00E30B66BD87735C2BF802E93004
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 601f60fb93f2fe0a4d5503318a32e234c59a61410820931dbc9c12d50c336361
MD5 30ca1b9e06cb4183adaba5bf55bb551d
SHA1 9d718b27da0a46458c9711b7b9cabe26c528a582
SHA512 c6de92bcea2ca00d3c110f84b62c8d3601769a26196cb8e089dab7889f8dca31143cd0755c1c839fc00ec0deccc50d15c9f7b9c1d8b2568e6c39d502783a851c
TLSH
T136E0C0F32EA72C14EC6FC3E6687094E005017418C700DE5F203AB3DF51B13512449C71
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 60ee564477f8be642c8bd7c02b6c4d1a8e153bb50582c2287df677aec5c928eb
MD5 fa25d1e3e24e36bb07ac069dd7ec37fb
SHA1 13b5aa1a962d3d65261d251686095e7dcb148de6
SHA512 12923b372decac5f9530610c1ae3bb33eb723467d42b12ffa756f19ff4023649d5ff320cc212649251e1e07a16739002e8c443f0ec895d3d4b3b32e3b922d66e
SSDEEP 96:KoleKm8q3a7H1xFgRJYzffgKH1f9grvfIdXt6yAKjykHSKoE22BSKasrWNgs+m:El3a7H1xF8JY7fT1f9kvfIdXtnwR5z
TLSH
T185D1B670327A52903A7F295A82E4B51F96C271937055A43B7BBC00758F67E21CDFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

9a1d4eb2-7114-40b2-b204-9b2e88de79f4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\9a1d4eb2-7114-40b2-b204-9b2e88de79f4.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

office_endpoints_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2.0.0.0\office_endpoints_list.json
Size 3KB
SHA256 8480f3d58faa017896ba8239f3395e3551325d7a6466497a9a69bf182647b25e
MD5 94406cdd51b55c0f006cfea05745effb
SHA1 a15dc50ca0fd54d6f54fbc6e0788f6dcfc876cc9
SHA512 d4e621f57454fea7049cffc9cc3adfb0d8016360912e6a580f6fe16677e7dd7aa2ee0671cb3c5092a9435708a817f497c3b2cc7aba237d32dbdaae82f10591c3
TLSH
T1F681BE27C5B58E2796F060119750E654F53D43AFA600C6AFB5FC825C2F373ECE88A4A8
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 95bb42c9d5e280f7caea84a02c0c6a7aeaecf5be60edf041803bb4de336c3412
MD5 01799435b7da32b680c5461fd433f82f
SHA1 22ce20ff7343e27ff3c5b5f11ee1ea5f521335be
SHA512 b0334fc4e841baddf9ccf7ca37c43d33df5cbb6a3c595e3cbf8231543dd397222ecfed594ee6caf5766d14433df0c30b5de352c90ae89e7e43243ab757dc720e
SSDEEP 384:nYcXqn6sNNn5RYuHZlE/nOv2b+vjcmTfPEGR76ay5ay:K6qDCfOW5mTfPZRA5r
TLSH
T199827C36AD381C7A9EB64E06F00B27135FF920A7D6892E94DDD85F0C04C77DC130A825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 c6ddcad0aa45ad411823723893f155615b4fbb0bc83dbbaac24fdf4890031c0b
MD5 c72f1175b6f12828b297f150441a9fa2
SHA1 2ee9091186a6fc32504cd46523d6bbd726947769
SHA512 56aa534a5c8bff3c5eaa9315c6af375f93ef46a9cd0b11025991c87d01b66590a24356cb32c8055e715b8b45a5930a1aa13738749e8cc825051806d0ee59af3f
SSDEEP 384:nWiFNcXqn6rsNg58TUNTUlIlkRYuTZN0ifpP/nOv2b+vjccWfPEGR76ay5ay:9FxG5wgIDnPfOW5cWfPZRA5r
TLSH
T110D2B7F598D78976E9AE4B83A33E6D469EBCD153B5491980FBC45D0CCC821BFC30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 8f8a2920584acb8990f8cee95a42af1d8258c8b7858d498b56fe4bb21160f24a
MD5 a08b1da3c6398d4bd0d03ade80f66db5
SHA1 a88b41ace9f7851ef25fd427f40161ab8c9e7bd3
SHA512 ab51e59e4a8d42d2b11a822976aa0ed0aa6b6671aba380927cbb2184fde8ff9700c1f1a2d9c8d76ef8722e697b574e749cfd43ffce4ac48427e16f3fd9d1add1
SSDEEP 384:nWiFrcXqn6zsNN58TUNTUlIlARYubZN0DfYP/nOv2b+vjc+ffPEGR76ay5ay:9FzSKwg4H9PfOW5+ffPZRA5r
TLSH
T14AD2B7F598D7893AE9AE4B83A33E6E465EBCD153B5491984FBC45D0CCC821BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 54d48b3843029f75b1de9ad27fb89b35c924bdc3a232a5f118dc33f772849d66
MD5 5d623da1549474196336231188e0f719
SHA1 1e71fc929db3248f2c5bbb5b037a93e832810369
SHA512 1eaab6247a96b4d0acea3606c7a7b6ba5414c3a6ebafccb9421bf7c485895b586a7b7d420e3a2df5af33e7a5d50103514498228ceee4e5f4f176dfd2715c4337
SSDEEP 192:kONpYV6QMQmiUy7RXZ/nOQy2b+vjcymRtnJqcPU6:kONpm6FAXZ/nOv2b+vjc3XfPU6
TLSH
T1DF12F839793C2C7B5EB26D46F44727179FA8106BE9866F84E9D41F1D01DBA9C230A832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 b4960885b778ef90701caa31b1ac56bcb8f8b71ce5e88826f43f6af5b0e8dcc3
MD5 a1fa793cbb2a0bdf82737fb9d7d3eec8
SHA1 0ac97f4359c9b43597568e4f3848fd5bc87a756f
SHA512 1a86ad69969e4a1db36d3e6e618cf640ecacd43fabfbaa86da79554796525d25d843ad399b32e4efd8e7b341dc997d4810d51405e5d32053961f9db335fcb615
SSDEEP 384:nJcXqn6sNNnARYuiZ5E/nOv2b+vjcmTfPEGR76ay5ay:96Rc+fOW5mTfPZRA5r
TLSH
T12B827C76AD381C7A9EB65E46F00B27135FF960A7D6892E94DDE8AF0C04C77DC130A825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b1c3978c5136c23d661864be8117673eaed3272d9ea9b846f9cf8ba617a93087
MD5 785e0008120f315a912a7d440fe7cd60
SHA1 8d96833510108c96006f13959488439b021000b3
SHA512 ca5d275b0c9da9f222c25094aadffda0baad7142b4e515e409ade065b1e5c97f455ed8fc2cabb30ccc7eaef09dbd8955e15c5b169f1b5c2cd75174952e9a5dc7
SSDEEP 192:gONV6QaQmiUyJRwZ/nOQy2b+vjvRxMH2TU6:gONV6vqwZ/nOv2b+vjvoWTU6
TLSH
T19802F839AD3C1C7B8EF26E49F4472727AFA4116BE9556F84D9E81F0D01D7A9C2306832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 5c3c86113e57f94993c41c370c7d9b58ffc217a5d10f9517f313f65bfbe06a33
MD5 ee62c29c08f413a0367d8178a4a506ab
SHA1 c5df3c9c241f105079f38f27fa0bdfe076015eea
SHA512 37497fe8e545801c9b073d5c4bc431020972cbf48fb4191b1b9d5376480e7b473c3a36de77e6b69855361560c470b38f0e24e54a5b341929c6da17f2a07ee8be
TLSH
T1C2E00243334114DBC834033000C31F343FB7C031035383075E2002782C323442E586C1
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe58ae2d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58ae2d.TMP
Size 392B
SHA256 8ff05f6c092af9b422f9a35152892bd990a884ab8ed51a2fb99b06533a47b188
MD5 d22d2c53233f891356925823e5c0c32b
SHA1 617a4662f0222b0828731f92bfed7379066dddc0
SHA512 c6fa94e9ae13cde4b1f6d9307ffb8c7400a457b3e9ad55f6df4b81fc519d4d357b33191e130ce9e33f0d72bfcdd03534ebaeb63c08495fa925388edd1a0eecf3
MD5 SHA1 SHA512

Submit Download

keys.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2026.3.23.1\keys.json
Size 8KB
SHA256 ae6e69a145f84c0a261b4e82888779fbf137f193881d687588e1af71609ae947
MD5 d3ebc1cb4b692c6e2d29a4625420fe73
SHA1 4ce74c1e9af6fd34d6379ec0fec6afb24082a7c1
SHA512 e34b855615e6a3bf770f27d85aa29ca57a324c08bd8f8d9c0130e2a142c0e4a5f17bffd0861b725acc8a2316f73b7fe50406b0af26264a5c2d8f37599b260860
SSDEEP 192:uNtGbR+mFGfvPNyR9Pm4lOvMwkoR9PuGMXcy:ORmqwKjA
TLSH
T18402A57F14A41181CE7FC1698F0B78B78FA038065BCA3A83539BFA49494296D173B5B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nav_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json
Size 2KB
SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
MD5 499d9e568b96e759959dc69635470211
SHA1 2462a315342e0c09fd6c5fbd7f1e7ff6914c17e6
SHA512 3a5922697b5356fd29ccf8dcc2e5e0e8c1fd955046a5bacf11b8ac5b7c147625d31ade6ff17be86e79c2c613104b2d2aebb11557399084d422e304f287d8b905
TLSH
T16B51DB73D5988C4B9BF4A29CE919A309F11107CF75D48C0B76BE010C1F7757AB5C6588
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 692457b7a9a71da2f86a2d9c00ee5e439ede0bfca8d82ca033d6f592dbfa5469
MD5 91c80c5508982eaf5438e9211fb2a52a
SHA1 78c965a36a9f74d71dd94601ae92afdbc93f5f95
SHA512 7bc90c935ea510bef580cd0117ca240de86a2985549ab9e15e6f5b819635d81825fd42e6e9a251214ac4b6e9ec2411d9c4cdedde28bc5552970d614f0053e74f
TLSH
T1251112D25D6D2AC2D1BE0F6FD08779FD40D8C216F2A8707A1854ED54423890E144187F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 732B
SHA256 0c1b4dc8f72139abc5b2e25e5d0097c1d3529ae18001b1a64ff535e345378b32
MD5 0ad641099b286eebf58a290b5bde86c0
SHA1 922d3e17ccc238f1bf276051af3ad5cdffb20397
SHA512 8661612608382058967a1f2ef25c7fbee41a3c2c748838346c044a48058ba081e84750e4a0de424903813499876fa7f69beba345d8ebc396340d830f1a7c81e0
TLSH
T1220110D29D7E26C2C1AA0F6ED08B26EC40C8D106F19CB07A0C8CF9D4823880E188283F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 972B
SHA256 46c96e720b20237d9768e9cb90aaa62c9c7b0c8f15fddee836a76d41dfa420cd
MD5 2a769156fb0cdd33783892c7340dd22e
SHA1 4b7d27850b335fc293c0ac5f52ed9cf1604cb52f
SHA512 3bb6cd746bada6a1370fd3186f3c8ded4319de162f80beb35ac87e73d46ede19407f4cb1d05ec658f6072f3e42a5681f64d8b69a136afadbc7534d3074670bac
TLSH
T1801114D25C6E26C2D57E0F6F904B75ED54C8C216F258707A0C58ED94413840E144287F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 852B
SHA256 453a08edb83095062ff59beb4f28403a177007ecdc5b93c88074cf8ae24c9b39
MD5 96814d4ed361ec8de1547566e582b0de
SHA1 f9588e0a74d9790991b254bfb0650af55810f778
SHA512 bebc0e98c4485bde4609e0a92f0a27ac1e621a63e154f220c2b8c3b11bfb2d4cc2443d6274f6046d42e28b28478f719f28917112090b3cb14fb6adab24770b93
TLSH
T12401C2D25D7D36C2D57E0FAED04B75EC54C4C11AF29C71BA0C58E994523890E244283F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 612B
SHA256 ce7879978d6dc1ebc353b93e509ab0dcd980bc78615af00080f3db1cb23e79d4
MD5 a15cd0a1e68c6b9c3945d3192091dc4a
SHA1 5162188f19a245162594501e5febb31a7626aeb4
SHA512 a7ec103cf7c6fa801e1850205c4c06cadf96c21b1fd56db058a2980c472b1ff2f25c69a73f943de8dff815d69217995ad880e85ca7b8ced8cfa1c506315f7368
TLSH
T18DF0ACD29D7E35C2D5AA0F2ED44B25EC54D89606F49CB57A484CEAD4913940F248287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 30e8b5d48a130d6bf81847b89c208c7a087525e9b7d9a0a97bcf21598332b63b
MD5 bf165c172af1f75083dd4c7e8915ad0e
SHA1 2eb27e18672fd0a1816ab00d00078a570eb62711
SHA512 a58ad7ee2e18750242b9c5d53224218bef54ecd50e067170da12510559c455979fb0523044d4c23d5d5a523562165e471f95d939376df623bfdea9228ca25256
TLSH
T181F09ED29D7E36C0D6E50F6ED44B64FC40D89506F05CB579484CEAD8913950B254287E
MD5 SHA1 SHA512 TLSH

Submit Download

c74e0c80-e825-4b72-a384-d8f3d3c6a715.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\c74e0c80-e825-4b72-a384-d8f3d3c6a715.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 0b82a10ded395d403f22e713b5e8accc1787705a91b2d61f887b0e5fb6548fab
MD5 36562fcbeb87151d420768e4f80e1941
SHA1 2478b31083bda324762bcfeb5ef8b68cd2fe6470
SHA512 1cba609054fe6154f9d826d7993e0e616cc30619ca85b37f8c8922e0ed6d3fce7f97041eebd2965f4a5aa216287255b2ce0072df7142950173e32df4ab73d5df
TLSH
T14F41064CA6FA1148B7B7BF56ABF6A86D487FBD372A0B945D00110E4E0666E40CC71B33
MD5 SHA1 SHA512 TLSH

Submit Download

12b7083d-4419-4d82-8afe-f771fc940ca3.tmp

Path C:\Users\Admin\AppData\Local\Temp\12b7083d-4419-4d82-8afe-f771fc940ca3.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

63d936c5-da2d-4715-ad4c-86b0f14d3ae4.tmp

Path C:\Users\Admin\AppData\Local\Temp\63d936c5-da2d-4715-ad4c-86b0f14d3ae4.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5104_1064768432\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ce89fd64-813c-4fc8-90ba-2696a75392e4.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5104_1253479304\ce89fd64-813c-4fc8-90ba-2696a75392e4.tmp
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download