hxxp://malvarebytes[.]com/

Analysis

user interaction
yes
max time kernel
139s
max time network
138s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/05/2026, 22:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://malvarebytes.com/
Sample260504-138lnads21

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
5024	msedge.exe

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	flow	ioc	pid	Process
Destination IP	330	54.203.171.68	5628	msedge.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_442396988\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_442396988\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_442396988\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_442396988\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_442396988\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_85252054\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_442396988\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_442396988\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_442396988\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_297543378\deny_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_442396988\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_442396988\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_442396988\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_442396988\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_442396988\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_442396988\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_442396988\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_442396988\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_442396988\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_442396988\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_442396988\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_442396988\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_442396988\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_442396988\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_442396988\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_442396988\_locales\tr\messages.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_442396988\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_442396988\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_442396988\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_442396988\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_442396988\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_442396988\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_297543378\deny_full_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_442396988\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_442396988\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_442396988\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_442396988\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_442396988\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_442396988\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_442396988\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_297543378\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_442396988\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_442396988\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_442396988\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_442396988\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_1146950986\regex_patterns.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_442396988\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_442396988\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_442396988\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_442396988\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_442396988\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_442396988\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_442396988\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_442396988\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_442396988\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_442396988\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_442396988\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_442396988\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_442396988\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_442396988\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_442396988\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_442396988\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_5024_849533838\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5628	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134224063123563895"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2397528088-2630719772-1129911217-1000\{A7E66702-2547-4E8B-978E-0E0C0D6C6B6B}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4384	msedge.exe
4384	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 27 IoCs

pid	Process
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5024 wrote to memory of 896	5024	msedge.exe	79
PID 5024 wrote to memory of 5628	5024	msedge.exe	80
PID 5024 wrote to memory of 3212	5024	msedge.exe	81
PID 5024 wrote to memory of 3212	5024	msedge.exe	81
PID 5024 wrote to memory of 3212	5024	msedge.exe	81
PID 5024 wrote to memory of 2852	5024	msedge.exe	82
PID 5024 wrote to memory of 2852	5024	msedge.exe	82
PID 5024 wrote to memory of 4236	5024	msedge.exe	83
PID 5024 wrote to memory of 2312	5024	msedge.exe	84
PID 5024 wrote to memory of 4236	5024	msedge.exe	83
PID 5024 wrote to memory of 4236	5024	msedge.exe	83
PID 5024 wrote to memory of 2312	5024	msedge.exe	84
PID 5024 wrote to memory of 2312	5024	msedge.exe	84
PID 5024 wrote to memory of 3060	5024	msedge.exe	87
PID 5024 wrote to memory of 836	5024	msedge.exe	88
PID 5024 wrote to memory of 3060	5024	msedge.exe	87
PID 5024 wrote to memory of 836	5024	msedge.exe	88
PID 5024 wrote to memory of 4404	5024	msedge.exe	89
PID 5024 wrote to memory of 2864	5024	msedge.exe	91
PID 4404 wrote to memory of 5784	4404	msedge.exe	92
PID 5024 wrote to memory of 6016	5024	msedge.exe	95
PID 5024 wrote to memory of 6016	5024	msedge.exe	95
PID 5024 wrote to memory of 3248	5024	msedge.exe	96
PID 5024 wrote to memory of 3248	5024	msedge.exe	96
PID 5024 wrote to memory of 3248	5024	msedge.exe	96
PID 5024 wrote to memory of 1012	5024	msedge.exe	97
PID 5024 wrote to memory of 1012	5024	msedge.exe	97
PID 5024 wrote to memory of 1012	5024	msedge.exe	97
PID 5024 wrote to memory of 3124	5024	msedge.exe	98
PID 5024 wrote to memory of 3124	5024	msedge.exe	98
PID 5024 wrote to memory of 3124	5024	msedge.exe	98
PID 5024 wrote to memory of 5232	5024	msedge.exe	99
PID 5024 wrote to memory of 3384	5024	msedge.exe	100
PID 5024 wrote to memory of 5872	5024	msedge.exe	101
PID 5024 wrote to memory of 6044	5024	msedge.exe	102
PID 5024 wrote to memory of 6044	5024	msedge.exe	102
PID 5024 wrote to memory of 3948	5024	msedge.exe	103
PID 5024 wrote to memory of 3948	5024	msedge.exe	103
PID 5024 wrote to memory of 3948	5024	msedge.exe	103
PID 5024 wrote to memory of 5908	5024	msedge.exe	104
PID 5024 wrote to memory of 5908	5024	msedge.exe	104
PID 5024 wrote to memory of 5908	5024	msedge.exe	104
PID 5024 wrote to memory of 1900	5024	msedge.exe	106
PID 5024 wrote to memory of 6132	5024	msedge.exe	107
PID 5024 wrote to memory of 6132	5024	msedge.exe	107
PID 5024 wrote to memory of 4644	5024	msedge.exe	110
PID 5024 wrote to memory of 4644	5024	msedge.exe	110
PID 5024 wrote to memory of 860	5024	msedge.exe	111
PID 5024 wrote to memory of 860	5024	msedge.exe	111
PID 5024 wrote to memory of 860	5024	msedge.exe	111
PID 5024 wrote to memory of 5580	5024	msedge.exe	112
PID 5024 wrote to memory of 5580	5024	msedge.exe	112
PID 5024 wrote to memory of 2516	5024	msedge.exe	113
PID 5024 wrote to memory of 2516	5024	msedge.exe	113
PID 5024 wrote to memory of 2516	5024	msedge.exe	113
PID 5024 wrote to memory of 3676	5024	msedge.exe	114
PID 5024 wrote to memory of 3676	5024	msedge.exe	114
PID 5024 wrote to memory of 3676	5024	msedge.exe	114
PID 5024 wrote to memory of 5516	5024	msedge.exe	115
PID 5024 wrote to memory of 5516	5024	msedge.exe	115
PID 5024 wrote to memory of 5516	5024	msedge.exe	115
PID 5024 wrote to memory of 3132	5024	msedge.exe	116
PID 5024 wrote to memory of 3132	5024	msedge.exe	116
PID 5024 wrote to memory of 3132	5024	msedge.exe	116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://malvarebytes.com/
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x24c,0x7ffc0dddc188,0x7ffc0dddc194,0x7ffc0dddc1a0
  2⤵
  PID:896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1808,i,8848035446587289136,9471554129965697091,524288 --field-trial-handle=2096,i,11254555828081696577,14249618433943264177,262144 --variations-seed-version --mojo-platform-channel-handle=2132 /prefetch:11
  2⤵
  - Unexpected DNS network traffic destination
  - System Time Discovery
  PID:5628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1572,i,5155335955765621226,15858958328241277319,262144 --field-trial-handle=2096,i,11254555828081696577,14249618433943264177,262144 --variations-seed-version --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:3212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1768,i,14605196418847285305,12043437472788590523,524288 --field-trial-handle=2096,i,11254555828081696577,14249618433943264177,262144 --variations-seed-version --mojo-platform-channel-handle=2572 /prefetch:13
  2⤵
  PID:2852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3512,i,930615268865122169,11631078385627436329,2097152 --field-trial-handle=2096,i,11254555828081696577,14249618433943264177,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3536,i,6549273938872403280,12822248350685975035,2097152 --field-trial-handle=2096,i,11254555828081696577,14249618433943264177,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
  2⤵
  PID:2312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4916,i,2139056875864918087,63513118406518216,524288 --field-trial-handle=2096,i,11254555828081696577,14249618433943264177,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:14
  2⤵
  PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4924,i,5667185611053010127,9998873544672769726,524288 --field-trial-handle=2096,i,11254555828081696577,14249618433943264177,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:14
  2⤵
  PID:836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5636,i,12415135886613875403,11475103927683579769,524288 --field-trial-handle=2096,i,11254555828081696577,14249618433943264177,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4404
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:5784
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5684,i,17576226703212825055,10220790694846533419,524288 --field-trial-handle=2096,i,11254555828081696577,14249618433943264177,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:14
  2⤵
  PID:1876
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5684,i,17576226703212825055,10220790694846533419,524288 --field-trial-handle=2096,i,11254555828081696577,14249618433943264177,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:14
  2⤵
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6340,i,14172641889699270069,14143904540584941455,524288 --field-trial-handle=2096,i,11254555828081696577,14249618433943264177,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:14
  2⤵
  PID:6016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6488,i,16943362619166863633,4291211889521877551,2097152 --field-trial-handle=2096,i,11254555828081696577,14249618433943264177,262144 --variations-seed-version --mojo-platform-channel-handle=6552 /prefetch:1
  2⤵
  PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4796,i,12531965364350228976,17765887644439225156,2097152 --field-trial-handle=2096,i,11254555828081696577,14249618433943264177,262144 --variations-seed-version --mojo-platform-channel-handle=6684 /prefetch:1
  2⤵
  PID:1012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=3460,i,185206830461537150,13864505918557733775,2097152 --field-trial-handle=2096,i,11254555828081696577,14249618433943264177,262144 --variations-seed-version --mojo-platform-channel-handle=3816 /prefetch:1
  2⤵
  PID:3124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6524,i,329024448104714390,2933960638253024598,524288 --field-trial-handle=2096,i,11254555828081696577,14249618433943264177,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:14
  2⤵
  PID:5232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6692,i,1640523468711363175,16588745509060708574,524288 --field-trial-handle=2096,i,11254555828081696577,14249618433943264177,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:14
  2⤵
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6504,i,3720852585695530826,11510886804898065978,524288 --field-trial-handle=2096,i,11254555828081696577,14249618433943264177,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:14
  2⤵
  PID:5872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6704,i,6686724516784206435,6285965214917531642,524288 --field-trial-handle=2096,i,11254555828081696577,14249618433943264177,262144 --variations-seed-version --mojo-platform-channel-handle=6760 /prefetch:14
  2⤵
  PID:6044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6756,i,10918332441096172911,6998108545175561930,2097152 --field-trial-handle=2096,i,11254555828081696577,14249618433943264177,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=2016,i,9107258026995687781,18346206534140634563,2097152 --field-trial-handle=2096,i,11254555828081696577,14249618433943264177,262144 --variations-seed-version --mojo-platform-channel-handle=4956 /prefetch:1
  2⤵
  PID:5908
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7080,i,12559802752491710369,911722809604689095,524288 --field-trial-handle=2096,i,11254555828081696577,14249618433943264177,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:14
  2⤵
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7080,i,12559802752491710369,911722809604689095,524288 --field-trial-handle=2096,i,11254555828081696577,14249618433943264177,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:14
  2⤵
  PID:1900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3648,i,8544645144335606462,11115771606783825929,524288 --field-trial-handle=2096,i,11254555828081696577,14249618433943264177,262144 --variations-seed-version --mojo-platform-channel-handle=4972 /prefetch:14
  2⤵
  PID:6132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5976,i,14386224004066164475,15177457701809873209,524288 --field-trial-handle=2096,i,11254555828081696577,14249618433943264177,262144 --variations-seed-version --mojo-platform-channel-handle=7192 /prefetch:14
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6252,i,16650939506488272730,7639048482888208150,2097152 --field-trial-handle=2096,i,11254555828081696577,14249618433943264177,262144 --variations-seed-version --mojo-platform-channel-handle=7212 /prefetch:1
  2⤵
  PID:860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6628,i,12400347412097891435,14611930935894917899,524288 --field-trial-handle=2096,i,11254555828081696577,14249618433943264177,262144 --variations-seed-version --mojo-platform-channel-handle=6600 /prefetch:14
  2⤵
  PID:5580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=4844,i,12855318173140409793,13914168745123412247,2097152 --field-trial-handle=2096,i,11254555828081696577,14249618433943264177,262144 --variations-seed-version --mojo-platform-channel-handle=3736 /prefetch:1
  2⤵
  PID:2516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=5888,i,15245505460712999169,698496809120554504,2097152 --field-trial-handle=2096,i,11254555828081696577,14249618433943264177,262144 --variations-seed-version --mojo-platform-channel-handle=6668 /prefetch:1
  2⤵
  PID:3676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=3652,i,14532145799843587014,16121744908167903773,2097152 --field-trial-handle=2096,i,11254555828081696577,14249618433943264177,262144 --variations-seed-version --mojo-platform-channel-handle=3792 /prefetch:1
  2⤵
  PID:5516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=7228,i,9413206968581697410,4364336290010908694,2097152 --field-trial-handle=2096,i,11254555828081696577,14249618433943264177,262144 --variations-seed-version --mojo-platform-channel-handle=3744 /prefetch:1
  2⤵
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=6696,i,5710959240111844799,1965903447968639047,2097152 --field-trial-handle=2096,i,11254555828081696577,14249618433943264177,262144 --variations-seed-version --mojo-platform-channel-handle=7476 /prefetch:1
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=6636,i,5452346404697294821,10944742429518893681,2097152 --field-trial-handle=2096,i,11254555828081696577,14249618433943264177,262144 --variations-seed-version --mojo-platform-channel-handle=7024 /prefetch:1
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=7196,i,16219487953688138826,17693754511387556169,2097152 --field-trial-handle=2096,i,11254555828081696577,14249618433943264177,262144 --variations-seed-version --mojo-platform-channel-handle=7248 /prefetch:1
  2⤵
  PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=7452,i,14112708383558554995,12008305145605659405,2097152 --field-trial-handle=2096,i,11254555828081696577,14249618433943264177,262144 --variations-seed-version --mojo-platform-channel-handle=7476 /prefetch:1
  2⤵
  PID:1436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=6628,i,12628080406566952244,9643246287349620513,2097152 --field-trial-handle=2096,i,11254555828081696577,14249618433943264177,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:1
  2⤵
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7040,i,2393082644963907721,15576614376127692713,524288 --field-trial-handle=2096,i,11254555828081696577,14249618433943264177,262144 --variations-seed-version --mojo-platform-channel-handle=4744 /prefetch:14
  2⤵
  PID:2800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=7188,i,17150674673595126856,15548895478201107211,2097152 --field-trial-handle=2096,i,11254555828081696577,14249618433943264177,262144 --variations-seed-version --mojo-platform-channel-handle=7204 /prefetch:1
  2⤵
  PID:2148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=6888,i,7204052906570191623,16741356246685930796,2097152 --field-trial-handle=2096,i,11254555828081696577,14249618433943264177,262144 --variations-seed-version --mojo-platform-channel-handle=7100 /prefetch:1
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=3704,i,15844723484182638817,2880535804465447470,2097152 --field-trial-handle=2096,i,11254555828081696577,14249618433943264177,262144 --variations-seed-version --mojo-platform-channel-handle=3724 /prefetch:1
  2⤵
  PID:1772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=7272,i,10337069550951360050,10615975645729216486,2097152 --field-trial-handle=2096,i,11254555828081696577,14249618433943264177,262144 --variations-seed-version --mojo-platform-channel-handle=7484 /prefetch:1
  2⤵
  PID:3056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=7284,i,1775698430887800438,2502302571253569798,2097152 --field-trial-handle=2096,i,11254555828081696577,14249618433943264177,262144 --variations-seed-version --mojo-platform-channel-handle=7536 /prefetch:1
  2⤵
  PID:3280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=7120,i,13475943536543775605,15174965807125820520,2097152 --field-trial-handle=2096,i,11254555828081696577,14249618433943264177,262144 --variations-seed-version --mojo-platform-channel-handle=7412 /prefetch:1
  2⤵
  PID:3400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7300,i,2887788863605934803,16415782795266227242,524288 --field-trial-handle=2096,i,11254555828081696577,14249618433943264177,262144 --variations-seed-version --mojo-platform-channel-handle=7324 /prefetch:14
  2⤵
  PID:3576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=3696,i,9377984048812631648,16027643758383585344,2097152 --field-trial-handle=2096,i,11254555828081696577,14249618433943264177,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:1
  2⤵
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6776,i,14659458303314537423,2092988150992380603,524288 --field-trial-handle=2096,i,11254555828081696577,14249618433943264177,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:14
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=7276,i,18241566668622340108,8335561381396142726,2097152 --field-trial-handle=2096,i,11254555828081696577,14249618433943264177,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:1
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=6764,i,17867527255033243669,14683872701412663095,2097152 --field-trial-handle=2096,i,11254555828081696577,14249618433943264177,262144 --variations-seed-version --mojo-platform-channel-handle=7752 /prefetch:1
  2⤵
  PID:5940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7916,i,1105982869746177338,7256758851279075147,262144 --field-trial-handle=2096,i,11254555828081696577,14249618433943264177,262144 --variations-seed-version --mojo-platform-channel-handle=8008 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6008,i,3709440524745659129,6993485268439725361,524288 --field-trial-handle=2096,i,11254555828081696577,14249618433943264177,262144 --variations-seed-version --mojo-platform-channel-handle=3436 /prefetch:14
  2⤵
  PID:5592

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2724

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4208

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

autofill_bypass_cache_forms.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\autofill_bypass_cache_forms.json
Size 161B
SHA256 f7510e38f81f8a84027304070205dd55127e3233fdf011411465ede67b5b5d92
MD5 4b1a79b1996f03fb926a97912835c881
SHA1 ca43e23f7bbb4ff3839751f722df3c38ef7bd8a7
SHA512 c2e07a1b311ab71d94c7b874d645fe1114fdccfe4468875d6b23318fbe327481a60b2782af105b7546b3c1e6c3a7ec67261b21a0587f914cc7bf77c55f1f568e
TLSH
T1E5C08C07ABB804230B414E0B590DEFC9990476F6D5C146FEAB75A5A98A3C6B0005B74A
MD5 SHA1 SHA512 TLSH

Submit Download

edge_autofill_global_block_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\edge_autofill_global_block_list.json
Size 6KB
SHA256 7d3c45c8207ba69066516e51e10a2137bc4f1fce070a692e0c65225f9856e04c
MD5 5d4464dabc1289c3a010e14c05b92c57
SHA1 d2d185faca1cd13a6d42dea68803a9941074707d
SHA512 f93f4b58efc0127946ffa1b2950a1cf71da6f77a6ab4cf98ad8ada6a751d6261be4818ff8c64fe1f1d45467aa070e0823d15be36c8259c1044fb2d1289df9994
SSDEEP 192:C73stL7O9FnLk25+tF4B8K5b+QiGoztWuDpR6lFuftdHAa4/i:nwJ2r
TLSH
T133D16A2BA91C54B32A044839128E5BE47DDD73B6DD6008D6D650C0B9AEDFCB8203FDA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v1FieldTypes.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\v1FieldTypes.json
Size 509KB
SHA256 611e7995ab7599a0c89f98d6c6152a42aaedf7449748109a465bb5b0badd0af2
MD5 b1c140ef49f01eea089d3957da1a529f
SHA1 de64781f20aac98b4d2bbc497e3defa83b25aa8f
SHA512 02ddfcbaf9eaff793f251bd983394cf473b1340182ac1f3217cb7258ddfbd2de066ab08af16b47a378644bcc1871ad6ed8c641f6a053802c90e77f648e4f4be8
SSDEEP 1536:jlKS/dYt+dtxX9U2/W++dGcUooTHR6rF1azQmkEMUmxralqDAtyttVJAC5c8KrVx:B
TLSH
T148B48E2BF9F25C634D822A32053E18996A30615F5CEC6CD4BB3E211F4F2C1791E797A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2172811336537a33607e0aadb9c5ba8cadf28b2a4fcb84d32213c685b1c34544
MD5 c6c88b3fb919f1f75228e4aff327fe5c
SHA1 70428f4ae69437730ef237674398113e1a3f3017
SHA512 1cda50c8b022751e3d3a7c73ffc9350fe02786e3000fa887544b774366bd092e165982f8e834c7eb67dc7a078a4dd76c0d5370912b7c3c7b95fc731b504ce5e8
TLSH
T19FD0803D1572BCB4C499DA714456372B6E1DCCE24DC65F116462356D4D9700186D72D3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1eac715bceeccb15cc45a13a9b914a80ac00eeb9f178f8c94511c17b32720b1a
MD5 b42dc01f081a5fcaa564011a4fcbf9f9
SHA1 8bcee7db87d1cadc63412a4981a1a46bc8ac9a01
SHA512 70a6ffe00e23a197554908a478c6e06671c1c239e2134c7e2eb172c03b4237bd91a7d62847a63e20268dbfb9c9b77ec1b8df3b9c0e528df0aaa3f9289c5d6452
TLSH
T101D0803D1572ACB4C485DA714456372B7F1DC8E24DC65F116462357D4DD700186D72D3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 017807222cffec37d127a92c059b9658f7c96561f5dcee72db2a1ec501738b5f
MD5 0171d7727cfd3d7bd4502fa0d575d20c
SHA1 363dac71675aa7882220e69942a0fa0d30b781aa
SHA512 fc2820fe0916fbd8d03ee04f9cd7324eda820c219226d18fc64451accfa1a7b7085e9c2218c06f339faeb121eb9d51e10feb45853f287f8d7010125c79cef276
TLSH
T12AE02BB6C821DC3718FD072850504A4AEB9013572B50855B3B3E860C8FF0B3B569589C
MD5 SHA1 SHA512 TLSH

Submit Download

f_0000de

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000de
Size 29KB
SHA256 b0696a88e9a184195fb661e9d74048e921287149a9da8855828be12e978f05fb
MD5 fcdbb503275b508a4fe50b282fc1ca2c
SHA1 ab038f2de6c90c324ab85591b3bde022f5a62688
SHA512 afa828e21c0981c57e8fe49bb428847191cab9ef92f1c6b3be7681bbd8eebe66da197cd436341e95fbeabc75c42f29b48bd88ab4e9d32674c2009ce76cdacb43
SSDEEP 768:Q1oaMN8Yh2rT3jKLdLF9w2giEmaCSViitATr45Y5Ii:jaMN7h2udw+EmaCUuro0Ii
TLSH
T1C5D2E03D2F6F782361DE4890F1970D099C27505A9276AB5335E2C2E878326E758D42EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 6KB
SHA256 4168e91ab3fb121391a26d9ca37c9fb1c87da208fed700edbeacba16768af157
MD5 002d9e88cc356afb7cbca6d456daeb27
SHA1 816c29b722a7e3fa2fb102e8aadfcdfff884889d
SHA512 bfcb305067fa65f36c7e01891740109c73f730a688085dab972aa85e63653084c821669e5e1e80776d29b71120bfe7f0322b36db4f98708b8ec44175b197db67
SSDEEP 96:56YdFhftoVtjF+vgYySuqnvCCX6Xx7cvNx3ieDzU5UK9/HMBDmCkx:56YdFhftoQv/kKCCyxUBieDzU2s/HalC
TLSH
T1BCC1B7E4A7F558C4EBD4D930299E899A37E7828401730F0B0BE4906D6A3B7EC618A70D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 19d44959794f835e010e50140b1631c0fef1f0623ab78ce9761c75e68dca5042
MD5 acbcf1fb2838cf77bc8ed02501637ae6
SHA1 a7a1d170fdfd1ed1e5b8fcc9576554fc6d8dc174
SHA512 e7e61b5d863d5e597cc016b6c37bb8f7ce17ec7031cce3b5692f73a22ca5a7f1bebff20963b688a1fc3b719130e01cae0f3535c8ddb1244f6c2403526c7a8ec7
SSDEEP 96:vsGFhGrVtlF+rT6yqqnvkCXhXx8vNhgzDYUHKQBHMBDmCkp:vsGFhGrKrOPKkChxgezDYUH1BHalkp
TLSH
T158B1B9E4A3B554D4E7D4D9702ADE9A8A37E3828401731F0B0BD090BD567B7FC218AB0D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe594397.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe594397.TMP
Size 3KB
SHA256 9a4c19ac5655d7729a8632bec32cf35f94a701d04c437bf873530f181950dbb1
MD5 db528cf0120842c83b947afeaa745ce6
SHA1 88676296f1f5ddc78a676d3d0c57af5f38cf0f9e
SHA512 e75e782366670e57b3f9e474583391ba826f604eecc2c1d819061db12f1696bbd1ae755fbc1229920f6fce16d46cb3e4ab7f5bbc2fc22817adc4c8c830494ed1
TLSH
T114711CD4A37999D8E7E8C9B415DF1D5877F3429802B72E4718E8217C9BB7BE10049B10
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 39f7e799a865a3aad9e8e66f1a3599beeeac9c795ddff17c14a0936290d91143
MD5 2349e33d115692d013c78ab98c8b7aef
SHA1 ce8d34827318a6ab312ebd8b9b5054f49ecd502d
SHA512 4b35d409ae06adaacab72b5aebcc2e35502ffe7fd4f2d79632fe7af2bb7c401cb54a1401c0ce3bb62636f7a3dcd09f9e351034f40ddcbecd1c69a27f545a911b
SSDEEP 96:D1ANO+rSOUr1KzBj6F04wp5H2GO5HzcoUbG4zw:D1Ag+OOUrU1j6F04A5H275TcoUbG48
TLSH
T1C4A1BCF3C3E9862DD91196F0AA186E2BCF1D0551436C3D4A88E4AF4B93F2471E251B9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 20KB
SHA256 bae12afc4c25f2dab821ea3c90bdccdae07c49b0e4ed681923582a5d6ec0acfe
MD5 963895dd6a63a1acc035911e5a616b9e
SHA1 fd600e47e9a4af573b1b191e2ec01826ff4c00e8
SHA512 30509d6d6bd76aa3f87bd7f6f323b673fb5994b6cbcd624406c0431ebcdd017b31f651aed7646eae1457562ff2a874bac766494168af1f29adb55f4dd46a8b4d
SSDEEP 384:sxZfnplEO5/fXsaFEPhtLY5P/Mk1/5ofrWFqM:sHp95/f5FEf+/Me5ofMqM
TLSH
T1DC92F74666248977CCDBC518F9657F53D7F91062CA804E88A9FCDA0C04EBBED3602C6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 21KB
SHA256 133aefbe2f44e7263dff32394a2f608f9b4a5b6bb625c394d656c27fd076c572
MD5 4a625d2ef4d018f2200a319773b2ab56
SHA1 8044bf4b91f43befdfadb3a261f4a0e44251f48a
SHA512 382da3e46735ef5440d69662916791e16b59273beb8e5242909da2cc97e0acacccbe31fc7397482d0c5209c34776cbb2fc9c92173046c34596602a16d5f22376
SSDEEP 384:sxZfnqld5/fXsaFEPhtLR37F/0k5das11/5o4QrWFqM:sHq35/f5FEfdR/0k58sf5o4QMqM
TLSH
T119A2F8466624997BCCDBD518F915BF52D7F91062CA804E48AAFCDE0C04DBBED3602C6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 37ec2a76a17b64ca33e98091ac5694bbd33b9ae3d097a8cdd8813ef022d62911
MD5 f76419b4cfd08b564a1eff1a36a67b87
SHA1 a68fc9a865f6e7ef755066ced23fc500f45da887
SHA512 7dd14dfe5e4b9430de7acb553c441c942dc0ae79add2637b81ffea2d8107bbc0bfec89eee7fdc05c5185a7bbf7f39443a653ab13d80c928b98fea63d909a55f8
SSDEEP 192:sxZHRUyMqZ/K1Ml8MF5/fXsYxF6u6hIIDPg+zodphy/K/6+WNsrI/Y0ETSjcNJ+G:sxZHld5/fXsYxEPhtLa4/Zn/5w/rjoO
TLSH
T12C72E8066A389977CCDBD209F645BB53D6F9156392904E44AAFCCA0C04D7BED321382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 68a42599b756f06786fff928cf9cc4b3a1781fa5f4c3ce2d5ed52c76dea1e60e
MD5 869d1569187fd0b3c52e9e06c4b5f07c
SHA1 b29f09311e32123f14acfed65f05056bc5bec1d1
SHA512 f56e1d8234c4c93e67f6d43a412c4f656742dc057e1ad6f5a42165949610c6002a9cf704efecc62b9f4620098f4fe967ed87b66589a773b8f81a63e4f73c0377
SSDEEP 768:UnjXV8Zp2+m7pLuL/AAWRmAoQ7k8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3vDwvLlp:UnjXV8Zp2+GE/AAWRmAoQ7ku1jaKvDwT
TLSH
T13E030B3B280CCB7E4F844E9CEC27BE9E6DE8018B9698895447FA454C03C66EF551B1DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0fb5ef40-558d-48c2-a3a3-30db6f2b1f3e\index-dir\the-real-index
Size 3KB
SHA256 b93697083b1d6035ee30d6410115dbcece160e6f784491b6b677d34e244892bb
MD5 18fae69cba2f16b342aacc3248593e95
SHA1 8e4ddb8c04c9b34356624266e9b5c4522276ac78
SHA512 a4ee489a65513ef505f81197bd3599f410a5561dfb5d514aab58692ded377633426b4f11bff0f20d0569c14884c711957ccb907e6db26925b55fb39f68bd4a21
TLSH
T18551A58C1C435666DC7C89B368B2048633780ACC27A466136CAC6536A58B22E1E5A759
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe591b5e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0fb5ef40-558d-48c2-a3a3-30db6f2b1f3e\index-dir\the-real-index~RFe591b5e.TMP
Size 2KB
SHA256 d68da5bc23143d93cb26d8ff8d5efdd77e42946fa832ebc7a612b4a29860ee20
MD5 5afac06e66ba092bcdca387659ec6324
SHA1 1528c56394c684fcc601271829aff9bc97cab4aa
SHA512 fd17f13ff27fac9690d0069c3c597ef86dc9c73c3339283147ddd4af75420c0dbeee078088755f540915b22554cfb503eca49bc35a3773200af12ec458232705
TLSH
T17251C95F9C430A31CDA091B359CA5469333E68954945AF0B35FCCA33ACC37AD3D66384
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\30ab9e9a-b976-4a91-8225-b38fef7fe052\index-dir\the-real-index
Size 72B
SHA256 f1659348d8bd7ad03e68b1995c1cc766a63de6822f0e8261285a37e64305594d
MD5 b2bc43cf6135ba11317637b7a3b378b5
SHA1 4f151b3bd96d90f879f30f249441a7b5dbc05377
SHA512 62e35a2f001ce78c7643bcaf4dd35a054101e3cc848aadf82cbb2b8254eaf27914532912d0023fe567abf3799a487aba03ee75b448de9b22ed26525e9d86eb0b
TLSH
T1DDA002615164C159C0210FF6558241712314DD256201434B45941595DE565696D110CA
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\6dfbd561-0d2e-4b09-99b2-a27e2e5a6f2d\index-dir\the-real-index
Size 144B
SHA256 74d7e12c699cc292ea67f5d0dd62135398fe3d110e3b1f4e3dda901bacd2945e
MD5 7ae511e3abcebd0c611f7e19c4342dcb
SHA1 3cebd4c836eff816a94123a346e6e6cd084ff001
SHA512 823109ff7c548dc1f3b5940552441f8f0bde426515ce474d0781a871bea97cd13875466418c60f143f50908d15d5b0676bb81fd5d1f5bcd594e88711cf2677bb
TLSH
T168C012CF41008E25E0027BFCA743F6E5E5108E436142311653D4B0F4B210A50804B09C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5936c6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\6dfbd561-0d2e-4b09-99b2-a27e2e5a6f2d\index-dir\the-real-index~RFe5936c6.TMP
Size 120B
SHA256 9bd6be69f7e5a7b825352f05d235040365c6e8a765d244fd6527345abc6c48f6
MD5 2c3d996f673c77b938f7ec24f16ed555
SHA1 8e455e58db829f4254fb007b334ed802a09156e7
SHA512 7cf7232234a5dec4a84cbbb2bceffba0cbaece2b2d5a3dd298d4f9a2db7d80554d9a397af069f7b6ede2620e01f3e72bdfc6cf1fde39d5d85c358cff873534b6
TLSH
T175B0126901488541D401077042521785568244021682351787C0D0F5AA104805617055
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8a367834-68d9-4a2f-8d23-8a5bf77e73ac\index-dir\the-real-index
Size 72B
SHA256 a9ffa3384f8d8d2a55585dbbe7402d17733c7f01353ec9f47db3ec321b8e6390
MD5 edbd85f1d2b3c6e0e4eef73776be80ec
SHA1 68a4184818e141ffc069f4629987daca5ed8736a
SHA512 f2c62c7764ff5b970b02fb65d71f1286a26543683a61ae0833099032b285af76f52024d2fb48926ff3876c5ae2d51d9304763dcf04ab923dcd8c1f83ccbb658d
TLSH
T1E1A0021542B04052C00692B036A611B37354C95143421347469194ACEE707CA4D4B61C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe590d35.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8a367834-68d9-4a2f-8d23-8a5bf77e73ac\index-dir\the-real-index~RFe590d35.TMP
Size 72B
SHA256 afa9961461a707b7a850589fd4129e61ecd339e043974be33373659b063760d7
MD5 6649736c1cd13c79c71b2c6abd3b8b8a
SHA1 558daccce8f271e90a3e622826863b574077d09b
SHA512 9eb9beea728914f00b39e2d5b74796cef5852d7de76694ce8087b388303a5dcb7354724953b780e40fdc214c40c384428ad27e4d4ed60f129f4056c27c1e2c0a
TLSH
T18CA002D003A7489DE02651B3159747412744C8152133921647D51044DC91C48E64904C
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 476B
SHA256 e5a596fbee2270de1d7ec39e2d9411124ee371217b5910ff6e64a55208b43673
MD5 659f501c38d9265502816a3086a9e08c
SHA1 eccec8c6e5f67a360cbed7ccb5df4c93cf3042e5
SHA512 f9c54a99b1ccba592cbe335384155a938825be35a9e86dd1dd758199c18429c8a6f9283413f511a74252f861955d2c8715e6e1e97fcce1110945bd5e7df1939a
TLSH
T1B0F0E2B73EF20914F9AAD3D560B142F10051B8498595EC8F145AB29784A1619245AC22
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 c67c269be6fa1405a340e87288811ec6777251e14f7bfcdb58b4a633c4807bd0
MD5 d413abe4dc1ee7b0e413c357e6d887fd
SHA1 df6c918b3686ef8767c507a4afa466a05da500ce
SHA512 9e38a2e48b1fdb04db364232200229b2eece284d8e2505d117b3549137536751585bfd4148c0ce92ce17cce6a0691d374264e0393d47f4f239f8af3b291680b0
TLSH
T1D7A002E78F748045D201037CB16D53C66224C8981F056E1181EC95649B621645596009
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe591737.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe591737.TMP
Size 72B
SHA256 40d891051d26b7a44b2ae5c0be689fc4f66262052113c5d8dbe68705e3cce194
MD5 cfb13fa1ffb40f42786cdb263cb30ccc
SHA1 30bde1fb3170a1547956d5d6f0e67084d1a2625a
SHA512 fdf5c8eb5b1b620bda50d84604e2769ccfdbf9d495297466d2811e098d9b02c0a740de452cef9e7c3a594fefdb5d61b530a3363446a25c83558ebd52fd07effd
TLSH
T145A00250A34A2844C40955B92605A6501360A85E401A16038E90A5DCEC910C46DC1347
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 6dea1f8cdd1529cb96ed4cecf1363e7144e2c4f86a503f26faeefde66faea4dd
MD5 d75d71b0c8f6ca94a42d840e380ff889
SHA1 77d017e30ad51961c7255e2eed241dde52a00cf4
SHA512 17b5b9c0b29e0eafe2a959d0d48ac2faee4c7032f5bf68fbef1eb06fdd3f40455d2436b8461c386177ab738a99c87502c98bb439bee87182b00832ecbad72e04
SSDEEP 96:KUQAK926Wh+KiQRYAKJq+2xWKqgZ8gKRuiqsQKJyy1aKGg/qQYKxqqvOKMMaa200:ardVTNBbfw8nM9fgzNJ9dvz9vsr9
TLSH
T183B22A11757B03803ABE259A81A1B9AF46C230A37118E53B3BF851E64F67E24DDFD4C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

domain_actions.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Domain Actions\3.0.0.18\domain_actions.dll
Size 83KB
SHA256 d35c8efcb710239f009633bcc5ae904ac6dafa985d451bedf791cf6909f014d4
MD5 956f610121cd5827fd5549097b79cd9f
SHA1 dbd23f99895a3a92fbe04c3c35d475a6f6998fd0
SHA512 3cc4712f64474497495d229ddd743c6bf25c30c3fbfca2525f46227d99a59a0f9e80e2119ffb40bc8a707b539f65f907e2e1565ea937e0387db47cf7269944e6
SSDEEP 1536:sNGnmI1FOxAdgxBf8paY3JQzQik428fKagFVbydki8yyafuzWk:sNG91FPgrfrPza428fIenya2Sk
TLSH
T16D83F180DF58411BF86F4835E0B269857A78E6B50FE092DF2376C9590E12FD1AF39705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 0f177880d38fa5085ad0d2268f781251494a1932d482824a4ea49f98d93de648
MD5 b1545b114e88cb3f85e7aeacb44bd059
SHA1 e095aa0565b04b7c5b3037ff58d8a57e2a06d2df
SHA512 f514dc3d11b5df60ff5b60606e227214a424c1fe864da64905ac027cddba2a3e433857fcfcda5804c88e0182b11322a3192cffdc870e2076d1d78ba6754903ed
SSDEEP 384:nRiFscXqnn8NE8TUNTUlIRFTRHb+UxL+2BrfPKCCxreRj+UMdfx53S0rNlk+5vI3:4FunDwg7+SKDwjrMdfr1M
TLSH
T11DE2B2F598D79976E9EE4B8BA33E6D029AFCD113B5884980F7841C0CCC961BFE306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 291e3acbdca89a00282f92542ce75ec0303f90f82240c8dd5afe607ea01cab52
MD5 c83a351665aaa5a6c969ba9370ed3488
SHA1 5e1837a1f8b59b9df0ab0cb5ce8c93faee601ea3
SHA512 6003d97f33433ee5527aea22d798ce0107d74ee2ec97e2b05486ef9b5a8eba6afef626801bcb175bf91dde38b5b71cf8cf101b1c47932b360d33f608d3bc9a42
SSDEEP 384:ngiFavqMg38NQ8TUNTUlIxBvHVOWBrfPKCCxreRj+UddfdnS4mtmO+yrNlk+5vI0:7Fayv3TwgkyKDwjrddfdS4smtyB
TLSH
T129C25B35E868D9ABFDE68F99EB497A07EEE00157D58C4AC4CAD81D0D00D75DE234BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 beb7a06beea1e82aad6dee09a2b25e5f3ced8b17897120cfca61719880ec1d64
MD5 b971c83cbebf43d57a54a781c55b1e31
SHA1 b9e6ffb1ca24d518959020c7299c0414c8248cbe
SHA512 4f6eda929a4da64f62548546705aea76efd9a4c15d082138457fccb90ff756afb2abfe3614da7b4ae7ab6b3fa7de2c3660d4ff783836d0a9a5311e087a7286a9
SSDEEP 384:n+iFscXqnU38NE8TUNTUlIRGvH10VBrfPKCCxreRj+UGdfx53S0rNlk+5vI+I:VFuU3DwgDjKDwjrGdfr1M
TLSH
T144D25A36E8A9DDA7EDEA4F89E71A7603AFE01157C58C4AC4CAD45D0C01D76DD230BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 e0d74a6ad6c15c0958ac278e5ad6b459950dc4b75c782d011cfd16b0f4e46ba5
MD5 efe73f1401147a188948b2485f73bf86
SHA1 0e8437842c1013cc30ce73bef6bcca4032beeb2b
SHA512 5e3e90a36a9d362da22c2d7c371db8780fd891785355a974756e2b704e15bbb963e4a8200f68b2dde8fca1a91b5ab5604d6f2a633a2da73013552b2cbc5c7a12
SSDEEP 384:nWiFscXqnI8NE8TUNTUlIRFTRHgUxI+2BrfPKCCxreRj+UGdfx53S0rNlk+5vI+I:9FuIDwg6+SKDwjrGdfr1M
TLSH
T147D24A36E8A9DDA7FDEA4F89E71A7603AFE01153C58C4AC4CAD85D4C01D769D230BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 87ee3eec6c22d24267b79b92013e6fa3fc067ae320e61fcfb5de91259ee04c46
MD5 585eb71718941adad59dcbcd461aa3c3
SHA1 26ecd0ab933b28889718523dc39aa50c834b964c
SHA512 089b7894a114132418d5ef4f7655a6a37901b1a7934fd51a3875032a5ec773e3c69c3877da323531f770c5884a75866539741967db06f6f56236901da73a2164
SSDEEP 384:nziFavqMg38NZ8TUNTUlIxBvHTJ6GBrfPKCCx6ldnS4mtmO+yrNlk+5vI+V:eFayv36wg16iKCldS4smtyB
TLSH
T176C24A35EC68DAABEDEA4F89EB497A07EFE00157D58C4AC4CAD81D1D00D719E134B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 7aafaee9d0d4d6ae635ef6580f41234693cbb90a228c150ca9f892b17bf16813
MD5 56241e6e8bbb3b3dfbbe021cbf4b2702
SHA1 b9ae58a126ec04046a6daa3484edd125dd28317a
SHA512 f1ef91924b2327bffa92fe49e2b431b4273452bd2a2eb3e6929716b39f75c4ffe31c49ceaf3fa011da09fbdfb1793af582e67f10fe38dd227d51992c021ddb0f
SSDEEP 384:n+iFavqMN38NE8TUNTUlIRnvH3OVBrfPKCCxreRj+UOdfdnS4mtmO+yrNlk+5vIR:VFayq3DwgEjKDwjrOdfdS4smtyk
TLSH
T1D3D25B35E868D9A7EDEB8F89EB497A03EEE00157958C4AC4CAD81D1D00D76DE134BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 d3c68652df01c203f06398fc1b64cc29d40533b8bbc16baf7f94dc5243268989
MD5 717a6a7a3157fdccf260ce779b276fef
SHA1 04757172ad424fc80e8b2eec355667aceeefec16
SHA512 f1510220602fc1f70da619ee2fea9bc06696944d03101eb7b8f987cc9c3a3b9af29b8dc6cac73c18556f97736d8c48bf63bb8c6fd74fa26224c1276c00ead98b
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 1f748334c5d57044b1c431a98444b988e576d3e48ebb7988dcbff148f02b94e7
MD5 82d85f52f96c2a9427c1a89647d475b7
SHA1 38b25c2272541f84089e08c8afc35228f56a9c1c
SHA512 0d3b9dbb82c7c6c20872c75071dc69acc093f74a06b5a3c45e2e43c38e89903394b2ab2ca5a9f93c6cd9d65ea7e54219542938ffb5ed682ac8c8ddd17aa27bce
TLSH
T1D5E00203238004FDE02C533101435F2557E3C03012B242066D1001A82C122001E34FD0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 27d16fbe05ebf0c9ef21ceec40275e5af061142cc9bbf053c64acc55ca892df1
MD5 8acaab1ccedaed423c841907bdca149d
SHA1 5ac12dfd589c0d94568130d1e5630550f1d401c2
SHA512 1512ef3fd79956c3a400064571ff17c6a86105468a73da0ffb4a653707537fa06cbaebf26ade066fa9d88ea74ac8ed3d9832c97ab8aa5bdf92d884074f730a42
TLSH
T1CCE00207E38041FDE02C533112835F2557D3C03012F242066D1001A93C126041E34FD0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe59017d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe59017d.TMP
Size 392B
SHA256 c170f428820481608f474fdd5810e670cce9d2784eccf70aa248dae7d26a296c
MD5 e11e14db56e877b71ab3159c8f15e485
SHA1 44fc9ea1fe303b8911cf4df7af65783d3457731d
SHA512 fd619eacfa026f2b9dd29a6c966c8e39b8357f12416eb12bc92f152c4259fb5c85f07d1294e3b3173f81eb130864228f62f5f15a401fd634b2e58e47021df6d3
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 9ab984842f0baa832b53bd8d3a1d42dfdf7ad335609e65722cecc3b0b729b8c3
MD5 68f0102840dd2af75c4920c248cf24e0
SHA1 4cd4135cc4367d2153affc5057f9e9513f0f4d3f
SHA512 55e03402b24f0c78e1836893ae365b98d3ece05b011eab45bd1478f59e7ae18e279bb066a1de6e5e96b54cbc5ead89758334b677eb0f824c7aed9c9a75c22b46
TLSH
T1865140D18C3D2AD1D4BD0A2EA48B38FC95ECC62AF4A4347D6828E998063A61D608043F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 db393ff82aef84ce474c2a50a0af0cdd1a5387a01ac2a809516d8a0304d3ba5f
MD5 1824848c3e414bdb96f4a054280e453d
SHA1 18cec4add89233a03c2e7c7841588655ca28eade
SHA512 427e71174a916b99f31cd4fa8a3182eac098a97d8b6fbb400405a998d44a778ba6ae4fcb898cdb32ef905aede5260e6c778b50cc2d5bb012018b661ccadb10e3
TLSH
T16F5151E05C3D2AC1E0BD1A7EB48B38FC95ECC72AF4A4347D2814E998467A60C648447F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 bee95520a6b5f3e628f3d00d879ca3571b3971c35abb580be2f448b52470707b
MD5 24b5f513078f65870d0ac29a479d81fd
SHA1 4081d0b8f59987d0130379fee05324b6d8c395dd
SHA512 1a20170f0ea89deaa7dc83216fef110a5a12d1b3a0dcf37a37e36af2c6e7f65bf2d238c1190db8847515b0973cbe7e0eb645a529915a9b9cf32608c0588069c2
TLSH
T1B25150D15C3D1AD1D4BD1A3EA48B38FC95ECC72AF4A4347D6824EA980A7E61C608443F
MD5 SHA1 SHA512 TLSH

Submit Download

3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 54f761e00d363bd15db7bae3cc55144c80148a5fa1db7c3c2049e0e406a9142c
MD5 b1ac780361002049b0a10a7fd30fd809
SHA1 0ee0a7dc27fd175ab7abd6e5649890be3e2795b5
SHA512 1bd8b1d2dc30bc62728d3d08085a446e8c037b02499687affa9a0bb18c6bdfee19104eabdcd8a52c2d0b542046abf26b7fdf81815037d4923e31231b0dfb7d60
TLSH
T156C02B5538F9488C2FA5257ED238092E12E4C912310022B0002ED804103465C13A0C2F
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_1146950986\manifest.json
Size 119B
SHA256 7169d86e87f904218238cd293e043e20b7828afad9acd1ff2e5d64188530b9d7
MD5 7382260298fc06c135b7c7399e9acff9
SHA1 6a829f795a3b8be25200675e00abfa1908fdefdf
SHA512 f0ce77f9f72fb6721bcfa9b03f77b0771e8217988183787c00dba4f9d9f19cdba252ddd656422336035f81939cb97c8b5dcb4f036a39280198c17cd04faaaed4
TLSH
T191B09273A800E83830E9EB91093A8243F320AB4BA585640A3625485C0B2B9F990606C4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_297543378\manifest.json
Size 177B
SHA256 096e772e0f2e8c15e6dec9087ee0a1fb8b0c56b25061626aedc9e7e705adfc2e
MD5 2714a51ed8c2a891ad73b7488ab655b9
SHA1 9a8cc479aec8de1b4eb678e5d68b23b16a39dc99
SHA512 4811522c06ad6946626a9f4d12eb62a1d623825d18a1cd0ad7b628f4c059f37d299b5857abffd959e4ea53239412490539f5705b4aa6c6951d13c68e6d5b72ad
TLSH
T1E6C012EFDC509DB215EB4323156D43C4E733CF4B1546490935FB66082A25981C193500
MD5 SHA1 SHA512 TLSH

Submit Download

keys.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_85252054\keys.json
Size 8KB
SHA256 ae6e69a145f84c0a261b4e82888779fbf137f193881d687588e1af71609ae947
MD5 d3ebc1cb4b692c6e2d29a4625420fe73
SHA1 4ce74c1e9af6fd34d6379ec0fec6afb24082a7c1
SHA512 e34b855615e6a3bf770f27d85aa29ca57a324c08bd8f8d9c0130e2a142c0e4a5f17bffd0861b725acc8a2316f73b7fe50406b0af26264a5c2d8f37599b260860
SSDEEP 192:uNtGbR+mFGfvPNyR9Pm4lOvMwkoR9PuGMXcy:ORmqwKjA
TLSH
T18402A57F14A41181CE7FC1698F0B78B78FA038065BCA3A83539BFA49494296D173B5B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_85252054\manifest.json
Size 79B
SHA256 7ea98f2308a9c51d17a1ac71b64afbe2a41ff0a083a166a0e4cc428bf44f0715
MD5 817fea104100763cd1bf4f15a51bfe94
SHA1 589717cf98cf7e2d55fc0d6025a4b8e215ed13d6
SHA512 da7b959d93113c5a6be360f90d9c721989c5e7acad7fa592081b582c4c3a0c4a9066a71473fd8492ce7fe7b0fbfd6870d939428a67fbd508fcf6b2c6dc1a41ea
TLSH
T15EA0122058019233108407600360478243551C022015244809461041258813A12A3128
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5024_954455131\manifest.json
Size 165B
SHA256 daf50c160ae8f5935baa4a7207e9d04afbbc81a6dd9ed02d99de12056743eeb6
MD5 8ff4c35081337b1ba6731cc36163c2a8
SHA1 31c80c4a98e5492fbf1b6b3e050446e7240c24a6
SHA512 1a616b9b797441fb438c89864beae36c1a151b1c85e1288481dc61d9f82df2c1fd5e002dbacc05d3070323f56325ed960df3e353d314eb2ee218f8e93aea3fac
TLSH
T1D6C0805294011D7419CE47150D5CE3889723D7152980B0155BD7C218DC3DC8B68F3B4D
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1900-1434-0x000002D18CA00000-0x000002D18CB1E000-memory.dmp

Download

memory/2864-194-0x0000020C3CA20000-0x0000020C3CB3E000-memory.dmp

Download