hxxps://gamejolt[.]com/games/onaf/124881

user interaction
yes
max time kernel
1800s
max time network
1794s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260126-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260126-enlocale:en-usos:windows10-ltsc_2021-x64system
submitted
04/05/2026, 16:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://gamejolt.com/games/onaf/124881
Sample260504-ttfe7afw2v

Score

7^/10

discovery motw persistence phishing ransomware

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
4476	msedge.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1247	pastebin.com
1251	pastebin.com
1254	pastebin.com

Mark of the Web detected: This indicates that the page was originally saved or cloned. 1 IoCs

phishing motw

flow	ioc	pid	Process
349	https://storage.googleapis.com/script.aniview.com/ssync/62f53b2c7850d0786f227f64/ssync.html	4756	msedge.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4476_1294885026\hyph-ga.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4476_488157988\shopping.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4476_593095761\json\i18n-shared-components\fr\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4476_593095761\json\i18n-shared-components\pt-PT\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4476_593095761\Tokenized-Card\tokenized-card.bundle.js.LICENSE.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4476_593095761\json\i18n-notification\pt-PT\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4476_593095761\wallet-webui-792.b1180305c186d50631a2.chunk.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4476_589801433\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4476_2048292539\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4476_1294885026\hyph-de-1901.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4476_1294885026\hyph-mn-cyrl.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4476_593095761\json\i18n-notification\zh-Hans\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4476_593095761\json\i18n-shared-components\ko\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4476_593095761\Notification\notification_fast.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4476_2048292539\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4476_2048292539\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4476_2048292539\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4476_2048292539\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4476_38513547\Part-RU	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4476_593095761\Tokenized-Card\tokenized-card.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4476_593095761\Wallet-Checkout\load-ec-i18n.bundle.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4476_2048292539\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4476_1294885026\hyph-it.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4476_1294885026\hyph-ru.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4476_1294885026\hyph-sl.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4476_593095761\json\i18n-notification\nl\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4476_593095761\json\i18n-notification\sv\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4476_593095761\json\i18n-tokenized-card\fr\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4476_593095761\json\i18n-tokenized-card\zh-Hant\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4476_2048292539\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4476_2048292539\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4476_2048292539\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4476_593095761\json\i18n-tokenized-card\es\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4476_2048292539\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4476_593095761\json\i18n-hub\de\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4476_593095761\json\i18n-notification\es\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4476_593095761\json\i18n-tokenized-card\id\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4476_589801433\_platform_specific\win_x64\widevinecdm.dll.sig	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4476_2048292539\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4476_488157988\edge_checkout_page_validator.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4476_593095761\json\i18n-ec\ko\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4476_593095761\json\i18n-ec\pt-BR\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4476_593095761\json\i18n-hub\ja\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4476_593095761\json\i18n-hub\th\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4476_2048292539\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4476_2048292539\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4476_593095761\json\i18n-tokenized-card\de\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4476_593095761\Mini-Wallet\miniwallet.bundle.js.LICENSE.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4476_2048292539\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4476_2048292539\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4476_2048292539\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4476_1294885026\hyph-hu.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4476_1294885026\hyph-ml.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4476_593095761\json\i18n-notification\fi\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4476_1201747413\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4476_776688494\deny_full_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4476_1294885026\hyph-tk.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4476_488157988\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4476_593095761\buynow_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4476_593095761\json\i18n-mobile-hub\pt-PT\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4476_1294885026\hyph-la.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4476_2048292539\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4476_2048292539\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4476_2048292539\_locales\es\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ONAF1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Five Nights at The Loud House.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4756	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134223852597998607"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-903610002-708294114-949261322-1000_Classes\discord-1475022208807076001	Five Nights at The Loud House.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-903610002-708294114-949261322-1000_Classes\discord-1475022208807076001\ = "URL:Run game 1475022208807076001 protocol"	Five Nights at The Loud House.exe
Key created	\REGISTRY\USER\S-1-5-21-903610002-708294114-949261322-1000_Classes\discord-1475022208807076001\DefaultIcon	Five Nights at The Loud House.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-903610002-708294114-949261322-1000_Classes\discord-1475022208807076001\DefaultIcon\ = "C:\\Users\\Admin\\Downloads\\fnatlh\\FNATLH\\Five Nights at The Loud House.exe"	Five Nights at The Loud House.exe
Key created	\REGISTRY\USER\S-1-5-21-903610002-708294114-949261322-1000_Classes\discord-1475022208807076001\shell\open\command	Five Nights at The Loud House.exe
Key created	\REGISTRY\USER\S-1-5-21-903610002-708294114-949261322-1000_Classes\discord-1475022208807076001\shell\open	Five Nights at The Loud House.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-903610002-708294114-949261322-1000_Classes\discord-1475022208807076001\shell\open\command\ = "C:\\Users\\Admin\\Downloads\\fnatlh\\FNATLH\\Five Nights at The Loud House.exe"	Five Nights at The Loud House.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-903610002-708294114-949261322-1000\{5ABA9A6B-F5A1-439B-8B48-A0DB96F83DF1}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-903610002-708294114-949261322-1000_Classes\discord-1475022208807076001\URL Protocol	Five Nights at The Loud House.exe
Key created	\REGISTRY\USER\S-1-5-21-903610002-708294114-949261322-1000_Classes\discord-1475022208807076001\shell	Five Nights at The Loud House.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
5724	vlc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5892	msedge.exe
5892	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
5724	vlc.exe
4348	Five Nights at The Loud House.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 64 IoCs

pid	Process
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: 33	4284	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4284	AUDIODG.EXE
Token: 33	1984	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1984	AUDIODG.EXE
Token: 33	5724	vlc.exe
Token: SeIncBasePriorityPrivilege	5724	vlc.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
5724	vlc.exe
5724	vlc.exe
5724	vlc.exe
5724	vlc.exe
5724	vlc.exe
5724	vlc.exe
5724	vlc.exe
5724	vlc.exe
5724	vlc.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe

Suspicious use of SendNotifyMessage 48 IoCs

pid	Process
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
5724	vlc.exe
5724	vlc.exe
5724	vlc.exe
5724	vlc.exe
5724	vlc.exe
5724	vlc.exe
5724	vlc.exe
5724	vlc.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
5724	vlc.exe
5000	ONAF1.exe
5000	ONAF1.exe
4348	Five Nights at The Loud House.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4476 wrote to memory of 4460	4476	msedge.exe	81
PID 4476 wrote to memory of 4756	4476	msedge.exe	82
PID 4476 wrote to memory of 5184	4476	msedge.exe	83
PID 4476 wrote to memory of 5184	4476	msedge.exe	83
PID 4476 wrote to memory of 5184	4476	msedge.exe	83
PID 4476 wrote to memory of 5180	4476	msedge.exe	84
PID 4476 wrote to memory of 5180	4476	msedge.exe	84
PID 4476 wrote to memory of 1760	4476	msedge.exe	85
PID 4476 wrote to memory of 3824	4476	msedge.exe	86
PID 4476 wrote to memory of 1760	4476	msedge.exe	85
PID 4476 wrote to memory of 1760	4476	msedge.exe	85
PID 4476 wrote to memory of 3824	4476	msedge.exe	86
PID 4476 wrote to memory of 3824	4476	msedge.exe	86
PID 4476 wrote to memory of 5544	4476	msedge.exe	91
PID 4476 wrote to memory of 6040	4476	msedge.exe	92
PID 4476 wrote to memory of 5544	4476	msedge.exe	91
PID 4476 wrote to memory of 6040	4476	msedge.exe	92
PID 4476 wrote to memory of 1648	4476	msedge.exe	94
PID 4476 wrote to memory of 1732	4476	msedge.exe	97
PID 4476 wrote to memory of 1732	4476	msedge.exe	97
PID 4476 wrote to memory of 1732	4476	msedge.exe	97
PID 4476 wrote to memory of 4624	4476	msedge.exe	98
PID 4476 wrote to memory of 4624	4476	msedge.exe	98
PID 4476 wrote to memory of 4624	4476	msedge.exe	98
PID 4476 wrote to memory of 4264	4476	msedge.exe	99
PID 4476 wrote to memory of 4264	4476	msedge.exe	99
PID 4476 wrote to memory of 4264	4476	msedge.exe	99
PID 4476 wrote to memory of 5964	4476	msedge.exe	100
PID 4476 wrote to memory of 5964	4476	msedge.exe	100
PID 4476 wrote to memory of 5964	4476	msedge.exe	100
PID 4476 wrote to memory of 5768	4476	msedge.exe	101
PID 4476 wrote to memory of 5768	4476	msedge.exe	101
PID 4476 wrote to memory of 5768	4476	msedge.exe	101
PID 4476 wrote to memory of 3800	4476	msedge.exe	102
PID 4476 wrote to memory of 3800	4476	msedge.exe	102
PID 4476 wrote to memory of 3800	4476	msedge.exe	102
PID 4476 wrote to memory of 6108	4476	msedge.exe	103
PID 4476 wrote to memory of 6108	4476	msedge.exe	103
PID 4476 wrote to memory of 6108	4476	msedge.exe	103
PID 4476 wrote to memory of 444	4476	msedge.exe	104
PID 4476 wrote to memory of 444	4476	msedge.exe	104
PID 4476 wrote to memory of 444	4476	msedge.exe	104
PID 4476 wrote to memory of 5960	4476	msedge.exe	105
PID 4476 wrote to memory of 5960	4476	msedge.exe	105
PID 4476 wrote to memory of 5960	4476	msedge.exe	105
PID 4476 wrote to memory of 5332	4476	msedge.exe	106
PID 4476 wrote to memory of 5332	4476	msedge.exe	106
PID 4476 wrote to memory of 5332	4476	msedge.exe	106
PID 4476 wrote to memory of 5832	4476	msedge.exe	107
PID 4476 wrote to memory of 5832	4476	msedge.exe	107
PID 4476 wrote to memory of 5832	4476	msedge.exe	107
PID 4476 wrote to memory of 2108	4476	msedge.exe	108
PID 4476 wrote to memory of 2108	4476	msedge.exe	108
PID 4476 wrote to memory of 2108	4476	msedge.exe	108
PID 4476 wrote to memory of 1316	4476	msedge.exe	109
PID 4476 wrote to memory of 1316	4476	msedge.exe	109
PID 4476 wrote to memory of 1316	4476	msedge.exe	109
PID 4476 wrote to memory of 1800	4476	msedge.exe	110
PID 4476 wrote to memory of 1800	4476	msedge.exe	110
PID 4476 wrote to memory of 1800	4476	msedge.exe	110
PID 4476 wrote to memory of 3112	4476	msedge.exe	111
PID 4476 wrote to memory of 3112	4476	msedge.exe	111
PID 4476 wrote to memory of 3112	4476	msedge.exe	111
PID 4476 wrote to memory of 668	4476	msedge.exe	112

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://gamejolt.com/games/onaf/124881
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffca575c188,0x7ffca575c194,0x7ffca575c1a0
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1968,i,13486685139750504957,16664855722619178689,524288 --field-trial-handle=2276,i,11759256702215134795,6600569046241829112,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:3
  2⤵
  - Mark of the Web detected: This indicates that the page was originally saved or cloned.
  - System Time Discovery
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1868,i,8065093882120671065,14227393001704792406,262144 --field-trial-handle=2276,i,11759256702215134795,6600569046241829112,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:2
  2⤵
  PID:5184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2576,i,15198006775595248786,11652847980276880772,524288 --field-trial-handle=2276,i,11759256702215134795,6600569046241829112,262144 --variations-seed-version --mojo-platform-channel-handle=2804 /prefetch:8
  2⤵
  PID:5180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3400,i,12178594881771759377,3298608005064535209,2097152 --field-trial-handle=2276,i,11759256702215134795,6600569046241829112,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:1760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3404,i,10848569281803900206,16339562159628103407,2097152 --field-trial-handle=2276,i,11759256702215134795,6600569046241829112,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:3824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5228,i,1435843145493306731,16166539209137841494,524288 --field-trial-handle=2276,i,11759256702215134795,6600569046241829112,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:8
  2⤵
  PID:5544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5236,i,17184724120128061193,7059398172407824518,524288 --field-trial-handle=2276,i,11759256702215134795,6600569046241829112,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:6040
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6016,i,12154310808053219542,11325466006302504280,524288 --field-trial-handle=2276,i,11759256702215134795,6600569046241829112,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:8
  2⤵
  PID:1180
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6016,i,12154310808053219542,11325466006302504280,524288 --field-trial-handle=2276,i,11759256702215134795,6600569046241829112,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:8
  2⤵
  PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=6176,i,9352296975943114762,16287928324976749160,2097152 --field-trial-handle=2276,i,11759256702215134795,6600569046241829112,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:1
  2⤵
  PID:1732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=6376,i,17727232937636477873,12382957853315467239,2097152 --field-trial-handle=2276,i,11759256702215134795,6600569046241829112,262144 --variations-seed-version --mojo-platform-channel-handle=6456 /prefetch:1
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6368,i,235634432699706511,301558218646447483,2097152 --field-trial-handle=2276,i,11759256702215134795,6600569046241829112,262144 --variations-seed-version --mojo-platform-channel-handle=6536 /prefetch:1
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6668,i,12500702298190739180,9102777174191408665,2097152 --field-trial-handle=2276,i,11759256702215134795,6600569046241829112,262144 --variations-seed-version --mojo-platform-channel-handle=6680 /prefetch:1
  2⤵
  PID:5964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6816,i,13936859386797319622,15131453381894313798,2097152 --field-trial-handle=2276,i,11759256702215134795,6600569046241829112,262144 --variations-seed-version --mojo-platform-channel-handle=6832 /prefetch:1
  2⤵
  PID:5768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6964,i,4217409953043784028,4758451379524563791,2097152 --field-trial-handle=2276,i,11759256702215134795,6600569046241829112,262144 --variations-seed-version --mojo-platform-channel-handle=6980 /prefetch:1
  2⤵
  PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=7112,i,4260131555216422211,11151524399697315913,2097152 --field-trial-handle=2276,i,11759256702215134795,6600569046241829112,262144 --variations-seed-version --mojo-platform-channel-handle=7128 /prefetch:1
  2⤵
  PID:6108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=7280,i,5791953894170809438,9480621476841148715,2097152 --field-trial-handle=2276,i,11759256702215134795,6600569046241829112,262144 --variations-seed-version --mojo-platform-channel-handle=7284 /prefetch:1
  2⤵
  PID:444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=7416,i,1732475195454214659,527700300564403766,2097152 --field-trial-handle=2276,i,11759256702215134795,6600569046241829112,262144 --variations-seed-version --mojo-platform-channel-handle=7420 /prefetch:1
  2⤵
  PID:5960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=7560,i,1278159352549992826,7548890101373692874,2097152 --field-trial-handle=2276,i,11759256702215134795,6600569046241829112,262144 --variations-seed-version --mojo-platform-channel-handle=7572 /prefetch:1
  2⤵
  PID:5332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=7908,i,16142755263069934242,18103048277725121246,2097152 --field-trial-handle=2276,i,11759256702215134795,6600569046241829112,262144 --variations-seed-version --mojo-platform-channel-handle=7912 /prefetch:1
  2⤵
  PID:5832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=7408,i,14320929953769397936,12947763291400668143,2097152 --field-trial-handle=2276,i,11759256702215134795,6600569046241829112,262144 --variations-seed-version --mojo-platform-channel-handle=8024 /prefetch:1
  2⤵
  PID:2108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=8236,i,5646073937051706664,11479791103092741016,2097152 --field-trial-handle=2276,i,11759256702215134795,6600569046241829112,262144 --variations-seed-version --mojo-platform-channel-handle=8200 /prefetch:1
  2⤵
  PID:1316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=8372,i,2033592144478078586,3866676784397431991,2097152 --field-trial-handle=2276,i,11759256702215134795,6600569046241829112,262144 --variations-seed-version --mojo-platform-channel-handle=8376 /prefetch:1
  2⤵
  PID:1800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=8568,i,3601140817334793135,16592682322016417454,2097152 --field-trial-handle=2276,i,11759256702215134795,6600569046241829112,262144 --variations-seed-version --mojo-platform-channel-handle=8524 /prefetch:1
  2⤵
  PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=8732,i,9965998675358095287,15284572476531181380,2097152 --field-trial-handle=2276,i,11759256702215134795,6600569046241829112,262144 --variations-seed-version --mojo-platform-channel-handle=8712 /prefetch:1
  2⤵
  PID:668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=8892,i,2613492286555948096,16168277176628158270,2097152 --field-trial-handle=2276,i,11759256702215134795,6600569046241829112,262144 --variations-seed-version --mojo-platform-channel-handle=8736 /prefetch:1
  2⤵
  PID:5672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=9064,i,17581821167664300944,5541078821087000209,2097152 --field-trial-handle=2276,i,11759256702215134795,6600569046241829112,262144 --variations-seed-version --mojo-platform-channel-handle=9008 /prefetch:1
  2⤵
  PID:1960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=9208,i,13413938091923027616,6089514909387046673,2097152 --field-trial-handle=2276,i,11759256702215134795,6600569046241829112,262144 --variations-seed-version --mojo-platform-channel-handle=9196 /prefetch:1
  2⤵
  PID:5452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=9376,i,17873482870375639237,549254820520295243,2097152 --field-trial-handle=2276,i,11759256702215134795,6600569046241829112,262144 --variations-seed-version --mojo-platform-channel-handle=9364 /prefetch:1
  2⤵
  PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=9536,i,12719718197655260843,15887103572926447544,2097152 --field-trial-handle=2276,i,11759256702215134795,6600569046241829112,262144 --variations-seed-version --mojo-platform-channel-handle=9408 /prefetch:1
  2⤵
  PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=9700,i,10756189621074498337,6748857757035185206,2097152 --field-trial-handle=2276,i,11759256702215134795,6600569046241829112,262144 --variations-seed-version --mojo-platform-channel-handle=9748 /prefetch:1
  2⤵
  PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=9860,i,17390602417116651378,16383966797741379378,2097152 --field-trial-handle=2276,i,11759256702215134795,6600569046241829112,262144 --variations-seed-version --mojo-platform-channel-handle=9868 /prefetch:1
  2⤵
  PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=10008,i,1657866360146518822,9408320625010650716,2097152 --field-trial-handle=2276,i,11759256702215134795,6600569046241829112,262144 --variations-seed-version --mojo-platform-channel-handle=10080 /prefetch:1
  2⤵
  PID:884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=9988,i,11854469458381210997,16089233572795387760,2097152 --field-trial-handle=2276,i,11759256702215134795,6600569046241829112,262144 --variations-seed-version --mojo-platform-channel-handle=10176 /prefetch:1
  2⤵
  PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=10376,i,4370718214213709489,5293734417254338952,2097152 --field-trial-handle=2276,i,11759256702215134795,6600569046241829112,262144 --variations-seed-version --mojo-platform-channel-handle=10356 /prefetch:1
  2⤵
  PID:5656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=10496,i,3322046906182545842,14736135507682759531,2097152 --field-trial-handle=2276,i,11759256702215134795,6600569046241829112,262144 --variations-seed-version --mojo-platform-channel-handle=10532 /prefetch:1
  2⤵
  PID:5764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=10656,i,1755016999219746655,8159673883402985560,2097152 --field-trial-handle=2276,i,11759256702215134795,6600569046241829112,262144 --variations-seed-version --mojo-platform-channel-handle=10456 /prefetch:1
  2⤵
  PID:5424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=10640,i,13143922403526451419,15326475370227503838,2097152 --field-trial-handle=2276,i,11759256702215134795,6600569046241829112,262144 --variations-seed-version --mojo-platform-channel-handle=10844 /prefetch:1
  2⤵
  PID:5612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=10984,i,11987127094950248389,2764565015975917367,2097152 --field-trial-handle=2276,i,11759256702215134795,6600569046241829112,262144 --variations-seed-version --mojo-platform-channel-handle=9876 /prefetch:1
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=11124,i,8188900292467611353,12507827818011686185,2097152 --field-trial-handle=2276,i,11759256702215134795,6600569046241829112,262144 --variations-seed-version --mojo-platform-channel-handle=11156 /prefetch:1
  2⤵
  PID:4120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=11300,i,10630091075281759428,15653085036897720397,2097152 --field-trial-handle=2276,i,11759256702215134795,6600569046241829112,262144 --variations-seed-version --mojo-platform-channel-handle=11256 /prefetch:1
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=11448,i,3234081707524465523,5433237584675689994,2097152 --field-trial-handle=2276,i,11759256702215134795,6600569046241829112,262144 --variations-seed-version --mojo-platform-channel-handle=11496 /prefetch:1
  2⤵
  PID:1248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=11640,i,1915331677771955360,15989314408625587540,2097152 --field-trial-handle=2276,i,11759256702215134795,6600569046241829112,262144 --variations-seed-version --mojo-platform-channel-handle=11644 /prefetch:1
  2⤵
  PID:5508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=11760,i,11753331806404781446,810752841709960455,2097152 --field-trial-handle=2276,i,11759256702215134795,6600569046241829112,262144 --variations-seed-version --mojo-platform-channel-handle=11768 /prefetch:1
  2⤵
  PID:2380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=11776,i,9432875690335955704,2812162979359258534,2097152 --field-trial-handle=2276,i,11759256702215134795,6600569046241829112,262144 --variations-seed-version --mojo-platform-channel-handle=11136 /prefetch:1
  2⤵
  PID:6228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=11448,i,14837393640021625159,7028947021710572505,2097152 --field-trial-handle=2276,i,11759256702215134795,6600569046241829112,262144 --variations-seed-version --mojo-platform-channel-handle=10968 /prefetch:1
  2⤵
  PID:6268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=12136,i,5787887373786783261,16296493222090622840,2097152 --field-trial-handle=2276,i,11759256702215134795,6600569046241829112,262144 --variations-seed-version --mojo-platform-channel-handle=12164 /prefetch:1
  2⤵
  PID:6332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=12280,i,3606779696350861099,12234161444133733806,2097152 --field-trial-handle=2276,i,11759256702215134795,6600569046241829112,262144 --variations-seed-version --mojo-platform-channel-handle=12276 /prefetch:1
  2⤵
  PID:6340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=12464,i,7421038600203514525,264346831114816131,2097152 --field-trial-handle=2276,i,11759256702215134795,6600569046241829112,262144 --variations-seed-version --mojo-platform-channel-handle=12456 /prefetch:1
  2⤵
  PID:6472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=9232,i,2515014753884795338,8449420368309939769,2097152 --field-trial-handle=2276,i,11759256702215134795,6600569046241829112,262144 --variations-seed-version --mojo-platform-channel-handle=9560 /prefetch:1
  2⤵
  PID:6512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=12724,i,4585121753034565537,3579950916759931023,2097152 --field-trial-handle=2276,i,11759256702215134795,6600569046241829112,262144 --variations-seed-version --mojo-platform-channel-handle=12580 /prefetch:1
  2⤵
  PID:6528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=12916,i,6940856775995102725,5117268027905616420,2097152 --field-trial-handle=2276,i,11759256702215134795,6600569046241829112,262144 --variations-seed-version --mojo-platform-channel-handle=12852 /prefetch:1
  2⤵
  PID:6664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=9232,i,18322831870875092369,3164706770968158160,2097152 --field-trial-handle=2276,i,11759256702215134795,6600569046241829112,262144 --variations-seed-version --mojo-platform-channel-handle=12284 /prefetch:1
  2⤵
  PID:6700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --metrics-shmem-handle=12100,i,1018112116100919139,17003415076221043625,2097152 --field-trial-handle=2276,i,11759256702215134795,6600569046241829112,262144 --variations-seed-version --mojo-platform-channel-handle=13180 /prefetch:1
  2⤵
  PID:6772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --always-read-main-dll --metrics-shmem-handle=12872,i,8258002618487149338,13893851348723194716,2097152 --field-trial-handle=2276,i,11759256702215134795,6600569046241829112,262144 --variations-seed-version --mojo-platform-channel-handle=12492 /prefetch:1
  2⤵
  PID:6788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --metrics-shmem-handle=13360,i,10972669982754229258,13546351735147724062,2097152 --field-trial-handle=2276,i,11759256702215134795,6600569046241829112,262144 --variations-seed-version --mojo-platform-channel-handle=13396 /prefetch:1
  2⤵
  PID:6900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --always-read-main-dll --metrics-shmem-handle=12916,i,10338365868918800484,12231351038062202288,2097152 --field-trial-handle=2276,i,11759256702215134795,6600569046241829112,262144 --variations-seed-version --mojo-platform-channel-handle=13580 /prefetch:1
  2⤵
  PID:6956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --always-read-main-dll --metrics-shmem-handle=13684,i,11702620240165003420,15713524890125104204,2097152 --field-trial-handle=2276,i,11759256702215134795,6600569046241829112,262144 --variations-seed-version --mojo-platform-channel-handle=13692 /prefetch:1
  2⤵
  PID:6964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --always-read-main-dll --metrics-shmem-handle=13892,i,2377684354109235389,13992464215560726301,2097152 --field-trial-handle=2276,i,11759256702215134795,6600569046241829112,262144 --variations-seed-version --mojo-platform-channel-handle=13872 /prefetch:1
  2⤵
  PID:7072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --always-read-main-dll --metrics-shmem-handle=12940,i,18325294899091153236,13502422904640002138,2097152 --field-trial-handle=2276,i,11759256702215134795,6600569046241829112,262144 --variations-seed-version --mojo-platform-channel-handle=13696 /prefetch:1
  2⤵
  PID:7160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --always-read-main-dll --metrics-shmem-handle=14108,i,8837594776686672723,11149048654227911939,2097152 --field-trial-handle=2276,i,11759256702215134795,6600569046241829112,262144 --variations-seed-version --mojo-platform-channel-handle=14092 /prefetch:1
  2⤵
  PID:6576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --always-read-main-dll --metrics-shmem-handle=14260,i,3740937655461696366,6093853053299830828,2097152 --field-trial-handle=2276,i,11759256702215134795,6600569046241829112,262144 --variations-seed-version --mojo-platform-channel-handle=14256 /prefetch:1
  2⤵
  PID:6592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --always-read-main-dll --metrics-shmem-handle=13752,i,3554081337163227153,12188040811868115600,2097152 --field-trial-handle=2276,i,11759256702215134795,6600569046241829112,262144 --variations-seed-version --mojo-platform-channel-handle=14456 /prefetch:1
  2⤵
  PID:7228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --always-read-main-dll --metrics-shmem-handle=14596,i,15836744862304399726,9339897276935939003,2097152 --field-trial-handle=2276,i,11759256702215134795,6600569046241829112,262144 --variations-seed-version --mojo-platform-channel-handle=14592 /prefetch:1
  2⤵
  PID:7292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --always-read-main-dll --metrics-shmem-handle=13360,i,13503232063428758289,10153025840370319563,2097152 --field-trial-handle=2276,i,11759256702215134795,6600569046241829112,262144 --variations-seed-version --mojo-platform-channel-handle=14436 /prefetch:1
  2⤵
  PID:7352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --always-read-main-dll --metrics-shmem-handle=14836,i,17063338131149669357,1816363740404916840,2097152 --field-trial-handle=2276,i,11759256702215134795,6600569046241829112,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:1
  2⤵
  PID:7452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --always-read-main-dll --metrics-shmem-handle=14940,i,10010608045164517258,2309449475165907296,2097152 --field-trial-handle=2276,i,11759256702215134795,6600569046241829112,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:1
  2⤵
  PID:7460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --always-read-main-dll --metrics-shmem-handle=11124,i,16094916475321608069,9450389316512177069,2097152 --field-trial-handle=2276,i,11759256702215134795,6600569046241829112,262144 --variations-seed-version --mojo-platform-channel-handle=12936 /prefetch:1
  2⤵
  PID:7740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=13752,i,1842835728191915046,16226728346013808236,524288 --field-trial-handle=2276,i,11759256702215134795,6600569046241829112,262144 --variations-seed-version --mojo-platform-channel-handle=14040 /prefetch:8
  2⤵
  PID:7928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=14068,i,2787920828947682054,7154367699783993364,524288 --field-trial-handle=2276,i,11759256702215134795,6600569046241829112,262144 --variations-seed-version --mojo-platform-channel-handle=14184 /prefetch:8
  2⤵
  PID:7936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=14036,i,16152462814240610045,3201787859384250851,524288 --field-trial-handle=2276,i,11759256702215134795,6600569046241829112,262144 --variations-seed-version --mojo-platform-channel-handle=14472 /prefetch:8
  2⤵
  PID:7944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=14452,i,13144515433449946982,9890068001878191803,524288 --field-trial-handle=2276,i,11759256702215134795,6600569046241829112,262144 --variations-seed-version --mojo-platform-channel-handle=14240 /prefetch:8
  2⤵
  PID:8140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=13716,i,971437608820095907,3809715612606581379,524288 --field-trial-handle=2276,i,11759256702215134795,6600569046241829112,262144 --variations-seed-version --mojo-platform-channel-handle=13284 /prefetch:8
  2⤵
  PID:6176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=12020,i,6041354137527348532,13696271213266478892,524288 --field-trial-handle=2276,i,11759256702215134795,6600569046241829112,262144 --variations-seed-version --mojo-platform-channel-handle=9440 /prefetch:8
  2⤵
  PID:7612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5684,i,1742978729201845166,6534715336384828767,524288 --field-trial-handle=2276,i,11759256702215134795,6600569046241829112,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:8
  2⤵
  PID:3872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=12072,i,1707622135783547746,7986838104065244048,524288 --field-trial-handle=2276,i,11759256702215134795,6600569046241829112,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:5992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --always-read-main-dll --metrics-shmem-handle=772,i,17488441198942147874,16831157672809315086,2097152 --field-trial-handle=2276,i,11759256702215134795,6600569046241829112,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:1
  2⤵
  PID:2692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9236,i,10125954397076464240,15660205817095157335,524288 --field-trial-handle=2276,i,11759256702215134795,6600569046241829112,262144 --variations-seed-version --mojo-platform-channel-handle=14460 /prefetch:8
  2⤵
  PID:248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --always-read-main-dll --metrics-shmem-handle=14228,i,2516830859182610894,17665553162670601931,2097152 --field-trial-handle=2276,i,11759256702215134795,6600569046241829112,262144 --variations-seed-version --mojo-platform-channel-handle=14132 /prefetch:1
  2⤵
  PID:6332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5968,i,3409142930300515824,3936741213350724896,262144 --field-trial-handle=2276,i,11759256702215134795,6600569046241829112,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,4880071347589612011,15907309193549613004,524288 --field-trial-handle=2276,i,11759256702215134795,6600569046241829112,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:8
  2⤵
  PID:6100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --always-read-main-dll --metrics-shmem-handle=5148,i,15744958337020420510,9241735115597522988,2097152 --field-trial-handle=2276,i,11759256702215134795,6600569046241829112,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:1
  2⤵
  PID:7780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=14284,i,12020228389049866542,8901302645964685457,524288 --field-trial-handle=2276,i,11759256702215134795,6600569046241829112,262144 --variations-seed-version --mojo-platform-channel-handle=14360 /prefetch:8
  2⤵
  PID:692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=85 --always-read-main-dll --metrics-shmem-handle=9396,i,2787417587468239181,3923637209259721696,2097152 --field-trial-handle=2276,i,11759256702215134795,6600569046241829112,262144 --variations-seed-version --mojo-platform-channel-handle=14316 /prefetch:1
  2⤵
  PID:3036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=12928,i,1014316361257827335,7456149428771858164,524288 --field-trial-handle=2276,i,11759256702215134795,6600569046241829112,262144 --variations-seed-version --mojo-platform-channel-handle=10480 /prefetch:8
  2⤵
  PID:6656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=10092,i,2974427045631574138,12680152157978155337,524288 --field-trial-handle=2276,i,11759256702215134795,6600569046241829112,262144 --variations-seed-version --mojo-platform-channel-handle=10132 /prefetch:8
  2⤵
  PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=14284,i,2272731500953670468,11839261005940789813,524288 --field-trial-handle=2276,i,11759256702215134795,6600569046241829112,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:8
  2⤵
  PID:5524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,7298278871958920119,5557594519249505929,524288 --field-trial-handle=2276,i,11759256702215134795,6600569046241829112,262144 --variations-seed-version --mojo-platform-channel-handle=14484 /prefetch:8
  2⤵
  PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9712,i,8782609257903228970,5196436071515056945,524288 --field-trial-handle=2276,i,11759256702215134795,6600569046241829112,262144 --variations-seed-version --mojo-platform-channel-handle=12800 /prefetch:8
  2⤵
  PID:7772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5552,i,15840749782940551060,8754540957930282152,524288 --field-trial-handle=2276,i,11759256702215134795,6600569046241829112,262144 --variations-seed-version --mojo-platform-channel-handle=14188 /prefetch:8
  2⤵
  PID:2084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4884,i,16001068898561020096,15173358487059024614,524288 --field-trial-handle=2276,i,11759256702215134795,6600569046241829112,262144 --variations-seed-version --mojo-platform-channel-handle=3732 /prefetch:8
  2⤵
  PID:1632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=12836,i,11158789762762837531,4036429738582114383,524288 --field-trial-handle=2276,i,11759256702215134795,6600569046241829112,262144 --variations-seed-version --mojo-platform-channel-handle=9708 /prefetch:8
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=10100,i,5871802272655185345,17685031239316926036,524288 --field-trial-handle=2276,i,11759256702215134795,6600569046241829112,262144 --variations-seed-version --mojo-platform-channel-handle=12824 /prefetch:8
  2⤵
  PID:7596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4884,i,13181582607175259683,15211294970612107861,524288 --field-trial-handle=2276,i,11759256702215134795,6600569046241829112,262144 --variations-seed-version --mojo-platform-channel-handle=2856 /prefetch:8
  2⤵
  PID:5608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3940,i,3288440154347813354,14895891805944731260,524288 --field-trial-handle=2276,i,11759256702215134795,6600569046241829112,262144 --variations-seed-version --mojo-platform-channel-handle=9368 /prefetch:8
  2⤵
  PID:2084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=13808,i,11376934409728094672,869265472400083277,524288 --field-trial-handle=2276,i,11759256702215134795,6600569046241829112,262144 --variations-seed-version --mojo-platform-channel-handle=3936 /prefetch:8
  2⤵
  PID:1056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=12776,i,13021654263124337843,297775618699228259,524288 --field-trial-handle=2276,i,11759256702215134795,6600569046241829112,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:8
  2⤵
  PID:5948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4844,i,17857871552931632426,8683090115411679420,524288 --field-trial-handle=2276,i,11759256702215134795,6600569046241829112,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:8
  2⤵
  PID:1232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=100 --always-read-main-dll --metrics-shmem-handle=5168,i,3410560469290888366,14125982249712925700,2097152 --field-trial-handle=2276,i,11759256702215134795,6600569046241829112,262144 --variations-seed-version --mojo-platform-channel-handle=3436 /prefetch:1
  2⤵
  PID:3576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=101 --always-read-main-dll --metrics-shmem-handle=14152,i,8836376277178571742,4581697162692874378,2097152 --field-trial-handle=2276,i,11759256702215134795,6600569046241829112,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:1
  2⤵
  PID:4156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=102 --always-read-main-dll --metrics-shmem-handle=9388,i,13935581464161119160,11213420930216153741,2097152 --field-trial-handle=2276,i,11759256702215134795,6600569046241829112,262144 --variations-seed-version --mojo-platform-channel-handle=12864 /prefetch:1
  2⤵
  PID:7936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=103 --always-read-main-dll --metrics-shmem-handle=14800,i,11107528844779893276,7052378350625303962,2097152 --field-trial-handle=2276,i,11759256702215134795,6600569046241829112,262144 --variations-seed-version --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:5464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=104 --always-read-main-dll --metrics-shmem-handle=4780,i,2314297826486456528,3052828232849793451,2097152 --field-trial-handle=2276,i,11759256702215134795,6600569046241829112,262144 --variations-seed-version --mojo-platform-channel-handle=12928 /prefetch:1
  2⤵
  PID:7376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9548,i,1328622579604542309,14351138885111198112,524288 --field-trial-handle=2276,i,11759256702215134795,6600569046241829112,262144 --variations-seed-version --mojo-platform-channel-handle=12760 /prefetch:8
  2⤵
  PID:8120

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3816

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1088

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x514 0x2f4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4284

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:7588

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\onaf1\msc_end.ogg"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5724

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x514 0x2f4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1984

C:\Users\Admin\Downloads\onaf1\ONAF1.exe
"C:\Users\Admin\Downloads\onaf1\ONAF1.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5000

C:\Users\Admin\Downloads\fnatlh\FNATLH\Five Nights at The Loud House.exe
"C:\Users\Admin\Downloads\fnatlh\FNATLH\Five Nights at The Loud House.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4348

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 69a1d6c2546f99910c6f349ddb665d530af289283332c1b54d92ff0340de7fbc
MD5 9dd12f0f7f7c020c27ee69da3c41ea58
SHA1 83e40ce506be9fab44d721ec8ab9f5af9722b38e
SHA512 b7f32c8b78e6734eebbbe7cf2944484340e3f32441ca6943b39c0a677d4424de3f45feaa48338f99996e31b46c55212827a384d66c07ed3571ba6ffd51c436ad
TLSH
T195D0C02C13B12C20C0D89938028C3B4F2E1CCC12054B47153C7338BC0C030103CC91D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 681328c8413fda75a51189b78f6379b1ee0309d75144ca8ff33a2656ec84cedb
MD5 0ff4eec6742c3eafb3e4d2b1be8a17d3
SHA1 87b776cff4e20b419791c0a7a5a49da8d91229fb
SHA512 525896cf68edf91db0d0dc681112ed436a3ebcab42ad2f03d796fa9e2472cd279feafba9b809dc18476c574b82a1f657dead8511e80a203527b2971ba86c4824
TLSH
T100D0222813B11C20C0C4993802883A4E2A28C812054B47152CA228BC0C430103CC9197
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 357B
SHA256 82e81c793594e083bd4b0ab3a760e1cd8d9dbc4cc8ae29461376f2d4593057a4
MD5 a02bb451dd6f70fbfa4dc4a65f683f58
SHA1 10cc05724ad770c4db43af11375325b6d240ef6b
SHA512 0eabbff058432c28d6199f650dce39a27bfc2ca6da41d61766cde5728d1ffa70a7752ac79984af4ce4647d6483c81b2824ce2527c41d623478f2d86216a6f0ce
TLSH
T14DE0D88802DAC5F4E90A94C7C2A67319C1C4320EDB8D4BF92225E4DE344188896196A4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 328B
SHA256 29b7f72b7396818bc19a4449b7884d52d2835935e237cbdfac4dbf3aced7ac6a
MD5 9683639c81bd5b1e51ae630dfea8ecf7
SHA1 ad0f007b0cf0a198a058f4bccfc860ff02c53eb2
SHA512 5d39a3f4646af556a631768b969807a0c1c4dc5eb8af7eb2b9eb2d96da21f747b3389055d1cbdcae02c68db7e214e28f767cee5f92ccabb455ff0bd1fd5bbfc6
TLSH
T146E020C945CFC36DD54464C74256930CC1E0374E97C45ED51714C4C83083044A3966B1
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 384B
SHA256 166ddfedc69139ad3cc3e324803dbf3113da6424a90edba5b2a9fe7ade6714ed
MD5 4a1478bbb35b9b6efe06def9e618e1ab
SHA1 9fec9dd021642fc854b6bbc565916c675f0defc8
SHA512 e4544c36bb8a3f3c95298b88047b1f563b635fa73953633338cb7dcb4dbe6f271a8a3a3d0c19af53c6d987efdbf140bbc473e005755736a8f0c0d94885f42115
TLSH
T163E022A9B8ECAA8EE3E44ABD53A7B0400F54029244169F230220BDC036912E01BA6124
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 07121674b34f1984bc1795bde04cf39b4aa69b12714c94b34f1410234bb11812
MD5 6c11f2b0024a3ea585c71c105f4580e2
SHA1 e42bbff2805cd68751e45d4b079008a16fe1f230
SHA512 72b9f911817f74719549927cd361c800d61f0c72d2c90ad87e5ca7efba2fa149e306da202287d7dce1f6153a33f9bc8b13dff88350b93653fe1617a6ee20feca
TLSH
T165E0E5BADD25AC3B19F90B2A60945345F621134B2B405A4B363CC3084FB163A0299C1D
MD5 SHA1 SHA512 TLSH

Submit Download

f_0000ae

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ae
Size 272KB
SHA256 715585fc42dbcd082af7231bcbaa536b98ef5b53f5b5e7ed059e20dfe766d541
MD5 96ae5cc7db63a040926b72d2edc68069
SHA1 6ff7dfc8dd77b39c53a4b06af0fdef4ff4a4a110
SHA512 7cc253f43f384b3b6641313ba6f050740abac45d497a7e2968915bf770062227369f54733f4f2103eca5d87570ff2c24784b608ad111e16efc491020b9685345
SSDEEP 6144:3u5sMdVIvGxKj7Imlsl4CvhSyeo91VD7BOWXRJ8ji5Ufwymomr:3u5qMJhSQvBOWaYBNr
TLSH
T1C85423DC2C15AA25A5D833152D6DC4A261FDFFA3EA9D5F300D79BC802E3C9480FD69A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000dd

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000dd
Size 24KB
SHA256 6e21e91f8f1feffe52c37bf98dc3b1d31edbf7502502f7702e6eba719f3cc790
MD5 e47e4276e5f3c8f996d74260be43e8ed
SHA1 0773d4aedd0d5c3db7e6435e43cc04fa86271093
SHA512 95d5958d726df4c565dbdb15c80801a3de0926cca1d9433c7c625b3e045484cf415872cd2dcc6704bd15e9bc43e699779feddad42f7d50e818b3e48fe716112c
SSDEEP 384:IG4iN8oQ4qltvneBbANeQaKoZ5lgg7nbszqvBJy5ca5ugETE6Fs6HzHXjz4SLRHA:zWKqnneYCLbQz5cl1EKs6THXjz44Rg
TLSH
T141B2D0CB0EA743DDD18AD4B35114E85D0E87B292958DABB13AFDB538A76C781BD10E20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 7KB
SHA256 738d0e590b8a44e89d047930533db80c6ad427069788316af23377b7fdf86e4c
MD5 a20f49ab45764e44316fc971935e7018
SHA1 5e2e0af0194ac3bfaa5ca45f2ea1c2723685bd43
SHA512 e457f40fcffa9125f32b57aabf577f2c889938efedceea227f78954493edb131231c961d4ab7128739f8fd2c64113458c2a2910b050e0ed71c15de92a9aff9f0
SSDEEP 96:TzPjAQ954F27QiIvkccFOqbbImD60PRCalE06uSym9ZiqSlsR2z+:Tzb3qF27Qi0l9wbImDtCuOZ9YS
TLSH
T175E1B398C98C402BD308C87289E6E653BDF08112349B8FEE71E285FC75A1B994E84F75
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 ac6b6dcd51d0522eb1f447ac65ed933224ed5b4737502f711879c194b2e06ca9
MD5 d979ee9a130c02d3c280d16d9d8d5e0f
SHA1 57cbdf458ab1fb00177218118607c0ab9627836e
SHA512 831cad1c3dde7658728f726f514f97f57011b4abad85a81002ab0680bef5c88751c595092fb8679841e3bb69f893b97d5a79b6e73995030b75f38b722c818806
SSDEEP 96:czPjAV954F27QiIvuccFOqbbImD60PQCalEW6uSym27iqSlUR2K:czbcqF27Qi0r9wbImDWAul7dYK
TLSH
T175F1C5D8C98C502BD308C87289E6E553BDF08112309B8FEE71E295FC35A1B894E85F75
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 b881816ba672c12a05828704fb92a4a762e4633a883a3ba7290e4180bd6cf4d1
MD5 5b3b4589b9449b2683d2c100c0275479
SHA1 90e4d1ed86d77ecc6c5a0304790124f238b9dd94
SHA512 694ecd8d420a5671f900ea893b12407d82bc390420de70919eef627c00021e54dd302b256a69d4226fc0651fe1d84f3f1d6eeb3b140f41dc6430ff69e675234d
SSDEEP 96:RzPjAV954F27QiIvuccFOqbbImD60PQCalE06uSym27iqSlUR25:RzbcqF27Qi0r9wbImDWCul7dY5
TLSH
T195E1C6D8C98C402BD308C87289E6E553BDF08152349B8FEE71E295FC35A1B994E85F76
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 b5c4c8decac48cd9d818f50d4b254e5ca9be79e2449bd576f605213443e1a9ea
MD5 480244488bb4e450e8cbdef691fafb37
SHA1 c74731fdc0a1e2ce01f432d23a644bfc0ca4ebd8
SHA512 3e3544b6e5e76097008ff65e95ad908aa94baf8d8d92bf5c508fc040aef5af4804654b3becdbf877d99d254d05faaaacf2a866a5f8c6d84475fa7b676305c0f8
SSDEEP 96:nzPjAF9HnF27QiIv4ccFZjbbPmD60PQCalEK6jTym29iqSlURtK:nzbYHF27Qi0JavbPmDWwjM9dvK
TLSH
T1B4F1D6D8C99D4027D309C83288E6E643BDF08152309B8FEE71E285FC75A1B895D84F35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 b8c314ad046776141aa51a2e7a845ed165251cf49dedfa68fe0febe6d98b95ea
MD5 bf2c6250e9be6144e2a69c23ba73cd83
SHA1 cc6ed27a330d118de97dae7319105f0f4dae7ff0
SHA512 65de252ae082373937bb114e1f20f11e4d1c596bd60926ce0303146110476efd630493a9f6fd05ac37763eb889048ce6a012f6b80ee3a13ee542eaddc6bcdbbe
SSDEEP 96:tzPjAV9C4F27QiIvVccFZjbbPmD60PQCalEX6uSym29iqSlUR2N:tzbcHF27Qi0GavbPmDW7ul9dYN
TLSH
T1E1F1D6D8C98C402BD309C83289E6E553BEF08152309B8FEE71E285FC35A1B894E85F35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 4e835d8b4a9223b3615f8b4bf1e639602e6622640fb88a767ba30bd7e1483861
MD5 ee9e29051dd612ed62a96e24c47935df
SHA1 7f25af081d6bac4e8fe08dcb9e3d64d745eb0485
SHA512 73cb748a674351b7f584631a7de8aa4067cb3479a3d18acfddc795721d6d2b44a20a0ff8f4978d3319bb0ede7df0e50d6fb28b94bf298b1929f165118b16b1f1
SSDEEP 96:qzPjAV9HnF27QiIv4ccFZjbbPmD60PQCalEK6jTym29iqSlURtV:qzbcHF27Qi0JavbPmDWwjM9dvV
TLSH
T1FCF1D6D8C99D4027D309C83289E6E643BDF08162309B8FEE71E285FC75A1B895E84F35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe586d1d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe586d1d.TMP
Size 3KB
SHA256 0f3a79b1f54800e547b1291e9d591d12155e54d24f3fbb810d391ef729f50305
MD5 25c6ffbb2a447b4553555e351f9ccbba
SHA1 290f91315b1a1aefe25972f18a7a8eda2078862b
SHA512 7bda5d25b6224de95e0d248adb38b55b79298c60d9d66e2b5926bb695de21398a12dc68c9f6f4bd58bb6bca84deb47e956dea8e7dbef5d9001d231de3b036356
TLSH
T19B616398DE4D4829E3459972DAE9C01331F0825B70C7CEDE21F6E8F4AA01F621E54B19
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 29KB
SHA256 339e5f52b419bd0f46a67c83259ad2483d88feebd6216a71855a24d4670fdc53
MD5 18f829c4f2308dc3ee6329736584e913
SHA1 06063d9fc1ab6f7ae11f950550cab268cb783cfa
SHA512 fc2ec897ff911735dd719853183217de393849e9b98d3ebbb8bfc7560ae33b970c64d0da35bb3581e01f28e87605976ac463dbd2637303df047e5b8d8f43e362
SSDEEP 384:DxyMf2o8gwhe/B4dsEmbe9IRoLIrDmouB+SLWgBeFpe/z4hlQAXaUFt+GGDkxQD6:Y1MPlyDHb+TlT
TLSH
T1A1D25BF7C7F87B3D8D31A9F06A1A2E1FCE190D15671C782A85E45F1A93E2821E101E5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 29KB
SHA256 fa50c771b5eb1d76ef8bdad96259a1505c9cfa22c2406efaf1e4c2c4b87daf5c
MD5 a084556dbab0d0a80120a7609ddf1a45
SHA1 e1c607202921f609118f6732bd579771cd44f15c
SHA512 a4e6a12111b1b6eaf178834463eb9bfc82669ee7bbfd9d6bb443ce5ed4ae9c9ee8e71e9d85335baa20ba0e49c0074835feb2f3ae6b9161b7a1d8593abedba2c4
SSDEEP 384:DWhVH+U4gdtewPeDV+0uvRU1rrNOB8Ze+Be/wTjPrewezGNS6ya1wJ42XaqFtYGW:ph+k76HGl
TLSH
T11BD24CF7C7F47B3D9D31A9F06A1A2E1F8E190821671C782A85D45F1A93E2432D106E9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 31KB
SHA256 a803cdcfd1138066a4d87e1b018f3dba05391fee7b437766338dd291e7e7dcb0
MD5 5f940d6facf4599e07f7412a772bf28e
SHA1 8a999086113bb8eeafff5169a2fb6934c024410e
SHA512 71792b2087fc3edbd5123bbc33ffbe2fd64f201573569e2514338759cf2dec4aafcd80cc2c7af8f3b90e9ad01efda23de3a2d29cfa5864b0da171b6623299a6a
SSDEEP 384:DWH+UdtewPe+uvRU1rrNOB8Ze+Be/ay5vgW+N8semO+xOmIFpF2LeeROa1wJAXam:m23Qe6HYmK8
TLSH
T12CE24CF7C7F47B3D8D31A9F06A1A2E1FCE190C25671C782A85D45F1A93E2421E106E9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 29KB
SHA256 63596c3019d1e55f2997f440922272ef14fd9f86a10629d44f25d6219c2d5e7f
MD5 9e030290fe3618298e99c3ee37a55ba5
SHA1 eb2f98d40cc6746cd7cfca394fb9aa38d157f0fa
SHA512 ae9dc9a904506b8f4ca3c753f4bee8c2f0bf4d5192f674de93b092b644e467e06d3a7c66a8b42c0ce70cf8714087b9cf3b151465a6f34fdfe2c4436012f60069
SSDEEP 384:DWH+UdtewPe+uvRU1rrNOB8Ze+Be/wWatXeV7yys5vgW+N8semOWa1wJAXaqFtYO:mBpe6HJmS
TLSH
T1D1D25CF7C7F47B3D9D31A9F0671A2E1F8E190821671C782A85D45F1A93E2432E106E9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 30KB
SHA256 d2eb711416a22d27b066a11329aebebf03acdf2d97597984a637626672ab247f
MD5 d1a03174bae55d1196e7ab2f0d8fc1bb
SHA1 601391035f53717072c15405f8f535190829a68f
SHA512 fc154ee2b829442f7baa80cab30822bfba875dc5d8248527af7418b08ea1c8a0ba4ecc11b3494800eb7f272616f18a840acca8fc094ad6019e226c87aadc4874
SSDEEP 384:DWH+UdtewPe+uvRU1rrNOB8Ze+Be/atXeV7yy5vgW+N8semO+xOmUa1wJAXaqFt9:m+Oe6HJmo
TLSH
T139D25CF7C7F47B3D9D31A9F0661A2E1FCE190C21671C782A85D45F1A93E2422E106E9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 27KB
SHA256 9ae2a17d70f3569b3be5b776c20a66c5411574c727af150caff845deef19e80d
MD5 bd31c3f13d26381d37e28da1588fb203
SHA1 333293efb89b5b77bb975ca96b51fc358dc22069
SHA512 3a819686164e07093e068290a0a9536bf25cb1381184a809e3b8e9e36acb6c537a2463ed9238bfb98ac26b65c79a23b737bf85a266bccf0d4441f066b2ee090f
SSDEEP 384:sxZOWqXb/fXsudiztp8ptHbOF/BO3TQy3X4tij9:sG5Xb/fZdi8Hby/SPn4tO
TLSH
T178D215D3B23C0A7B4ADA5931F095F33DD7A1045696A45EC26AECC91C00DB9FD7541C8B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 42KB
SHA256 7c165d57cd51d955611c1799f4d42307153c10c8c904e7aac7370f03afa6a2b2
MD5 d53d959f8cee0591f8b063344f859e6c
SHA1 bd0dad5602b1901dae37d4d55b0dcd23d5cde8d6
SHA512 e3b1502fac104eaa1f2487a1fd98249f9a6b6bd1b1c50c5462d2fc202ddd7cd280fa39df99ef80964b6359ee129684acca33e7fe11f741bf6d2b3eec5a9dc6da
SSDEEP 384:sxZOWqmb/fXsu966s8qMpRiYnazAW8pZS15posJWeT+Oiztp8ptHbS6hjd/BO3TQ:sG5mb/fZ94Mnc7WeT+Oi8Hbj/SPnEph
TLSH
T14D139693A138C96B8AC75C35F0B8FE3ADA9404565694DEC75AECC90C00DF5FDAA42C87
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 42KB
SHA256 a812e2b56f12f6734c8d29e4f861455482f39512bda6f9f074d345981bc12074
MD5 8a29cd15f262bbe02b44a46d46da25a8
SHA1 6ceaffe49cb1e9bb07805038c4f9013f66941faf
SHA512 0599289d2a39f92cf46dc3eaba0b5ba2f804eae1d95d2a7153e9c1f62574d8aca75dcae28689105bb6148786c6de26b68dbd075d57bcca4096793010b19f3e68
SSDEEP 384:sxZOtqmb/fXsu966s8qMpRiYnazAW8pZS15posJWeT+Oiztp8ptHbg7/BOnTQy3i:sGcmb/fZ94Mnc7WeT+Oi8Hb+/iPn6ph
TLSH
T1AF139593A138C96B8AC75C35F0B8FE3ADA9404565694DEC75AECC90C00DF5FDAA42C87
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 8965e86034610b3d6783e46fe41201dd9c89763ac05bb6aabf1b0e69d71e1dc2
MD5 35c9af155152a42e02c242e9c93f8795
SHA1 cc7abdd148d4c2e0ecba007c398e08fc8a24a2ee
SHA512 5ced36c8920febc968bf572c7210516e09aae9db775fb407a34cc81d116fed9f7c466a289919acb57a076470740208a0658997abca6ffb7517fc57f1d14296a4
SSDEEP 192:sxZOR5yMqZ/K1Ml8M7b/fXsNm6+W27l/Do6zodppFXHW6+WNW4p/SNBmf0IF+UT2:sxZOWjb/fXsNmnWMp8ptHbn/syCijh+
TLSH
T19072F8566B385977CCDBD619F645BB53D6F9056392805E48AAFCCA0C00EAADD2203C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 fadf6c1576adfc3384213dd31c23598b378c3c403e42cf6a5a76c95e852be5ce
MD5 dacb64c34db8d9495ad74c463cea33b0
SHA1 d948489b6bb497597901236a4115e109c414a3cf
SHA512 8ce62e4804edc91d791ef84df42773289ce8fa2e6fd9311ac4f92c68173a83c13d89219f86dd433d149f3360e02f5f2b300b85adc9f26e35caebd8f118a3f13d
SSDEEP 768:v4IL+AI7pLuL/GeWvGSnq8F1+UoAYDCx9Tuqh0VfUC9xbog/OVWD2JLlVzetYron:v4IL+A0E/GeWvGSnqu1jaPD2JLrCtj6m
TLSH
T191F21B7B6C0CCB7E4F804E9CDD2ABE8A6DE801CB5698C9544BFA480C03C66EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d6fa845c-cb68-4123-9f5a-d02b08cc2ba2\index-dir\the-real-index
Size 2KB
SHA256 42e268c77bb27315b6a2ec12015cbc120f0349e8632430dcf3d64a27d43e42ab
MD5 8f7680f9e2b1cc719c3c1f22b90ee2d6
SHA1 2840d686814194e0723df6be292b208acfb65e5e
SHA512 0405500b89bd255a054a7f82affb3423f43db89f80a2c4a787f19b61df9fde436ab6bc6586eaa0842c0883a543c29b999e9f8f6c4e1759042d3c6f415fe5bc2c
TLSH
T16251C80E1C8B4B73E85C967224F60429333528CD5A6857076DFC4535B84B66D5E6B219
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5c5e06.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d6fa845c-cb68-4123-9f5a-d02b08cc2ba2\index-dir\the-real-index~RFe5c5e06.TMP
Size 2KB
SHA256 c262106de680826e63e13ff940061d8790b56e98823d85a4daf742a9e6b760da
MD5 d0f616bae5aecb6fe0a7f7f17549f393
SHA1 e9a74b452d042c89d4caefb155a76b98be98afd0
SHA512 39449b668a1c0e277929ec4f2191a7e2d72ce69bb8805cfc24fb561b725eb6f8ee5fad23f89c68f46b8b3ff85480fc9d2e3a54e3cab49aa5e04dce8b4f62d9c5
TLSH
T1F0510B1F6D420731CD9482B318C64469373A64568919AF0B31FCCA33BCD767E7E1A385
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 d5feb0143a88952629af823107b49c6d3fd803724dc632f283013a9c2df7c3b1
MD5 2340a5927ac5a79e62877c4475271599
SHA1 c675253cb7ac8b2f7f1a41683e2b65618c3d0c71
SHA512 6cfd36de87584023975dc9eb652f5c3451b66cfcf1072dc7d4ae31414f8baafbef293d167d7f5e498bee94708e31a7e8f1bfd96d15ddcd29a756fcd81b6bad0a
TLSH
T16FE0C6FB2EF72C28EC6F83E620B084A1024178588A85FD0F10DAB3C390B23303056C72
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 8beaf8af0016f4e83cd0eb340cdd7c5196fc584f621af49ce97c2d38f103516d
MD5 b05747caeb73a93ccd1e719a0208eb50
SHA1 d96c173d5e4860630e0a19d125be1887eb67f7b9
SHA512 7f21d598b4671e77f25037c6156c080abc674817651da71ea38581638a6e7323d25d87460d561f507afa4cada479e3dc37851360fde13a40b0cecb09a96e9bd1
SSDEEP 192:W75v/AjXMvdf93ElPpR8VhT/jyneVJ91JLKZJOrxt5f39hdLS:WdHAzMlfNE9k9fthJS
TLSH
T1C3B25D3071BEC2113A7D3AD89599BC27434230A27058E47B3FE804A64F6BE245DFD9E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 a1dc4cdab245f8c02d28799d646ec11ad6091502870dd6f15b255853f938f012
MD5 086bc6d0fb78f24902f559e1961642a3
SHA1 9451a310ce80013ca3eee9e5c7671af280b83ac0
SHA512 10e627fffe0720765f9062bfc5255e550fdd3e17c0cbaa73fe370462d97f0405bd91ef9dbc05d1cdcfc96be1113af1459c27d2844ec246050f83f8b52d58b44c
SSDEEP 384:n/iFavqMg3sNQ8TUNTUlImkrLFzXABD4fwKtDFsi10BdYE4g3CIn+5YLNjk+5vI3:KFayv3vwgxKFKtDD10Ang3CIn6+a
TLSH
T15EC25C76EC94D9ABEDE68FD9E74A3653DEE00267C58C4AC8D6D82D0C009B1DE530BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 97e656161c6cdc194e7b3eb13ee96e98f8957bae282937655ac0e16660207a00
MD5 6651de72f99b897c87e4da7f3be51deb
SHA1 2f7b5a78bd5693a263d0dcc3a97c9f3e26ee677c
SHA512 19ad43451c72309701844692a0148ebc26808de1f18a1035b4bc15993ca7fe06161c2b4e562ef6c986476e74272e0e81e293d7fbc62635eff614f5b9ff01693e
SSDEEP 384:nNiFavqMg3sNS8TUNTUlImkrLFz3UsD4fwKtDFsi10BdYE4lPZZCIn+5YLNjk+5C:EFayv35wgxqsKtDD10AnNZZCIn6+a
TLSH
T1A2C25C76E898D96BEDD78FD9E74A7613DEE00267C68C5AC4D6D82D0C008B1DE530BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 77fb577944de773277f81498203af6072f563e85815c469b72bf8f0ec4565308
MD5 e5c00bf5ed705c2c2e8719d820422cc0
SHA1 3f4a680346df53bd1fba0e8439f285dce0a14141
SHA512 5c897866feb8fb60a129bd5a87369eefb78898acbb315bd0172cb9231edbdea55c5f993e05b404f5f58415f48d9cf76fa8d779b92ba3a24a6c82851f1438a3a0
SSDEEP 384:nTiFrcXqn03sN28TUNTUlI4k9LFzkkvD4fwKtDFsi10BdYE4lPKZqFvvmNLNjk+D:+Fz03pwgdRTKtDD10AnNKZqVMt
TLSH
T192C23B76E898D9ABEDD64FC9A34A76439EE04263C58C5AD4D6C82E4C00CB5DE530BC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 4002f94c9fb2149369ac2abc9a79a20a059549ad19bd4dddfc03fd7ac3903fab
MD5 e5c4a961e647018c1ca8ab5686bc4631
SHA1 e9638656efabed200e2a59859e0d03d0f0ecb17b
SHA512 5eed19771841528575ab6ced13e67c9b1ea6a2631f63810297b54dc9090c8188d85633e0eaf22ffbcee9697f677543a021689954a18ff8931988549585330bf0
SSDEEP 384:nsiFrcXqn03sN28TUNTUlI4k9LFzMkvD4fwKtDFsi10BdYE4lPKZqFvvmNLNjk+D:XFz03pwgdZTKtDD10AnNKZqVMt
TLSH
T1A3C24C76E898D96BEDD64FC9F34A76439EE04253C58C5AD4D6C82E4C00CB5DE530BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 e46ea63f5a2054abf295deff0e1d257fb0c49659b1369f653ddcd4d57d4c2d37
MD5 bbef9a7bad98f9340d96be8264840a4e
SHA1 7ba9306387e943055476c513bb1e89dbea82ba63
SHA512 4b26d1fc59c5a4e5fb9966e1bff9e9c4830e0dff3775f40a5de8fee0e098f672d810138f295e7347334685407d0b214366913047271cabcdbdb75803e1c8706d
SSDEEP 384:nsiFrcXqnj3sN28TUNTUlI4k9LFzk2vD4fwKtDFsi10BdYE4lPyZqFvvmNLNjk+D:XFzj3pwgdHTKtDD10AnNyZqVMt
TLSH
T1EAE2C5F698D78976E9DE4B87A33D6D025AFCC253B1881984B7C81D4CCC865BFD306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 13efca17105339119bd3ee3dfc539d658b694abd20176a10abd6814c7435e0b2
MD5 b995ea01a0932c37c4a170deaabd1d9c
SHA1 426c5680b7821238dd0090e32e98e1160530de6d
SHA512 643659f85c4cbe08ff6c0fccd011000a9f13999c95a5a88d7a44b60376266a4fdf72b82781097c6f7447656d222ea4fdc981e3860e61a971afe57897e7db1796
TLSH
T15EE00102630040AFC068063004875F343E628236068203469B35126C2C313043F288C0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 a3b8b5100c50216e802d60dc1b9e7503816f7c83cd503c1649c11256f16e9a02
MD5 6b5ab30465a45fa6c7255cb2b3b9370c
SHA1 36ae08eef538eaf1fc1508fa6a17a0a501fba090
SHA512 24e30d0b67d1695bf2179e1377de3ef16066e705a9077b677dd62de8920e2d352f66a6572f0f33bb942fea35347d9527633546cb9eb3de9ea0c7319eb280151c
TLSH
T19FE00903630040EBC068063004C76B343A638236068203569E2512682D213043E288C0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 c4942461c01a1b617e17cbb7c4eaafe2759bb005e2b24591a5a9e2f59f833f78
MD5 88996bd7895e8ccb91e6526a508cbbda
SHA1 db119f1443cb4e449ec641cfeefbdf129b211636
SHA512 c3345ef2bf28f724d2cce4394f6d6b3a23cec1b7bf9c93b8522c1aabf1a04d6bf31ee252f9c9aabfdfe74373cfd11019f090e0cdd7485b2479a6c2947cf182a0
TLSH
T12DE00903A30140EFC068063004876F343B63C236068203579F35126C2D613043F288C0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 c162261f19c823e1aedcdea7571e318b84e9b761d345cd630bf772f07073aef6
MD5 1480ac3c7db3b118e611736afe606967
SHA1 28a35a5969bc2930fef0ff1495c669c7d0bc46a3
SHA512 92f5c6c1ccc382068f54c5451b1c8c6893a9c3f76639ba354f61427b87e3b00a95d540b336b18bdbe7d0790be29c6a5ebdd631f66cb451e431e9de76a0ff06d3
TLSH
T1BCE00203630040DFC064063004835A3439634236064202449E2502682C213043F284C0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 caef67339cea0e3ecc18fa37a7621449b0b7532f38d21fc6641c660a947c09dc
MD5 e9c0995b9e8e8d83ec51e9debc695629
SHA1 ff68d0a2c20ea467914830333d82f1b51fb4c1a9
SHA512 1663659d01ad8e227049d1941dc341c8c658b437feacd0bb40ad7033bdec551ce8e248822f28100f4d669e7cb1540c2d7b4080933bcd7d18100a7c225875d85f
TLSH
T172E00903A30140EFC068863008836F743EA3C276078213669F35026C3E767183E289C0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe6b68bb.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe6b68bb.TMP
Size 392B
SHA256 8a4cc2b1021e86877c8bd2577ab2123981efe033af849933444a2237f99e466c
MD5 c08e3c865c9273d19d781853cd512424
SHA1 8c7de599b750d60d69cd740f3eca18d02668e73a
SHA512 64173ca549afc3fe9f675453b39a25bee14a91bc64e8ba0fece72ad1f3a21cdb4b73dce64e41713ff2ada2490532311a46c485328786dfe7223ff6afaf521d16
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 fcbe123dc88ccc9a27dbe587fd150acbd797c461b55f0b6f9c7486215066bea9
MD5 1f54a37f5c6fd7a0e92239e3829f1fa2
SHA1 e934a1c422b02208701e47e5a8c2b5049f3bf2f1
SHA512 caefcf6c0a3a5ccde779d5e768c58ee1ad10116a968ac6b19462f81b6b9e4ec063fee2760cd9f297dbfb5c59cc6d22a7f7ef4b2a2d9ff996cf01f07ee86d1516
TLSH
T17F413EE14C3D2AD1D4BD0A2E64AB38FC91D8D729F464347C6824EA94063E51D648443E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 95a369db4aea881a8a73f00150d172ac70db06ed0275a74befa46b6569e9f3a2
MD5 dcb448a34a32d9f117cf12968f830343
SHA1 a31b78931caac10988690b3e5d1d565699a25c30
SHA512 632cb5bac9072d30161681de365f9dd8dbf99cdf817f0b04c3be3cd7b64404a73714e579df9de103c8fa4e34dd169af36b813b1eb86bd48506bc540ee5dda5e9
TLSH
T167413EE08C3D2AD2E4BD0A6E785B38FC95DCD725F468343D6868EAD8067A11D788443F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 963690674a7cc20aeb78f908f157fc69b6cdaa2a47a10822cc95df158f72e85b
MD5 b33350c7386c242f3f194c3adaf10d4b
SHA1 ad7fff2e6dc161fc1a8df1317bd9522f0f7ecb95
SHA512 7034f79b3ea6a1412885ac98bee9a17d118a6c50630290cf7af717b77e511c448d4dfee6eece9c8e4d2c2f966dae4eb965d1cf21a4ab3f4df2c920588ba7d0f3
TLSH
T1944140E04C3D2AD1E0BD0A6E749B38FC95DCD725F4A4343D2824EA94063E51D788443F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 fbafbfcd4b2bbf9bb493538dfac57f5cdda7e86b418847cfccfedf244362aac0
MD5 c784a08d73636cac3e1d06dd4707a5fe
SHA1 4fa1f97589a9a7295c3b744a69b457dc92f75c1b
SHA512 68db7a92048afeef3e05933ba3dc230bb07344209144c30ab847aaea0f153c1ef9af3c7f99d8c7a7fbbe7c8df63218d5b2c5968cf4eba0de179833f082e431c7
TLSH
T1D5413EE14C3D2AD1E4BD0A6E745B38FC96DCD729F8A4343D6828EAD8057E15D388443E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 bb5737689045748527e7a696db0ca6dd2852c8f7c1ff427ea2471219aafd6518
MD5 57ca3066380df0dfbde033d87ee19661
SHA1 a4b500345c928eb8d9b59be510c350e7ee6815db
SHA512 76d9b75d781eab37cc9f3fe5f080ac74c22633de65dc93ef9e14b5d553052bc3f09bde927a2c5ab3096838870fb8a571f50faaef82ba44d9479def8295f93879
TLSH
T1704160E04C3D2AD2D0BD0E6E748B38FC96D8D729F1A4343C6868EA94067D20D748583F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 07b3f291a4e7a02ecf9817ad86f1cdebb67afe227eb72da51ee38c1cc3ecde28
MD5 342b896af4dd186a4e18ec6a333414dd
SHA1 ea44e650c42183d0f6c12826ab52decef3c92207
SHA512 61480e29432cc3e308d103db8077dcd86b75e4b5f7b779909aa6ad0dadfb5bc9fca254a32cfabb911f9af6c27d1b67c5d82ab78864b9a19e958fa6acc5b9e0e7
TLSH
T1844141D14C3C26C5D5BC0E6E748B74FC92E8D729F590353D6858EA94067921D748583F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 b839b3b9b8ca88c94d4ada68fd537f26e26b2651b74bef51ac856ad3652a31df
MD5 63405f21d65bfa9ff955c923e71d16e6
SHA1 2caafdf4e57562cad5f54202f56deaf1a0a0c208
SHA512 141b9916ca771121fd3a0a63e6dffce23d64af5075247c2162ab7b2ae8258938b5ba8833ae5900e734812eac25b16a613ca7ff58f41ddcd0fadca146b972ee74
TLSH
T152413EE04C3C26C1D0BC0E6E748B38EC86E8D729F5A4353D6858EA940A7961C748583F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 18d73ab05c2f815f7f2732d4e9cb17db97e5702b230403758b1eacf44c733410
MD5 98a135ec1e3f3911106f57af8e8913b2
SHA1 a3dc04cbec71fea4bb34ec063de23feac2324c12
SHA512 d5fa46558deb560687817f4f0746f89ee8ed6689c49b7590a25d79d16dd6e389979beaf9a853e27c80137e525ea2b7002ba3f3ebbc86c4e1fb53e2b2bc6bf553
TLSH
T1924150E04C3C2AC1D0BD0A6E749B38FC95D8D725F494343C2868EAD4067A21D788443F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 f792dd7bab49148a80a8e7192ead5fda6e58b57ea01ff95ebf30023a83b79845
MD5 d979264271698954da3f5874b35f3ae9
SHA1 8970cfe23a909d4866f3ee4df4ece0c23200a9dd
SHA512 42528e669693188bfdcd50ceabab8796806814e80ae206a133cf55569d77445045ef3b8e06a1409f8d265f548ca2530bbef0f2bf046948ba9ab4a797f082ad92
TLSH
T1E75160D18C3D26C1D4BD0E6E648B78FC86E8D725F5A0353D2854EA980A7961DB4C983F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 3b57e0d67a4648c0c11d250e8cac595fd2e418968744a03c17f0c8abc1f986fc
MD5 34e4f08e12640532bd3671f1dbf2a1e1
SHA1 926cf96ba2e07183779c24a4387f5fdbe07331fe
SHA512 336fd6d5ff7695e28b544b59ff247a1e587686a0f710b30a4e1dda30258c0e5c7bf252ff2ad3e06695d4d784053a72f2a088ab3da52fddd783a75b26b0ae56f9
TLSH
T12D414ED14C3C2AC1D4BC0E6E748B78FC92E8D729F5A035396864EA980A7961D748583F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 27774e79f3f68d062d6bd14954025552cf715526720e78758d1203977053b584
MD5 35d5688871c89a349afa208766b8498b
SHA1 8354e6cc4a71157ec66c451c975b93831f20b4ae
SHA512 f88725750ecc0ba0e958e620a934fe0b99e37c54e04716dbe25d54838a2dc370f60c23da157a519df77f6eac43cadd24fd556bac7610aadda14a1ed65078308b
TLSH
T1604172D18C3D26C1D4BD0E6E748B78FC82E8D325F4A0353C2828EA980A7921D74C583F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 e7217bfe3521812c8c337692f7f7929d29a504b0d85677d613514381029c51d5
MD5 f7503e753d7c46b57b3061d43d39530a
SHA1 a57cd90274c2661edd09b0418f4faa48f262e1e3
SHA512 2e6e0ab6a750d13353b0dbd6167f4655eb026ec5e55eea793e848d56972168909bd712cc3fb88d9d07dd0c472999041a231b45eeb62cd0a063c61c6e41debd14
TLSH
T1394120E18C3D66D1D4FD0E2EB09B78FC95D8D329F4A8347D6828EA98053E51DA48543E
MD5 SHA1 SHA512 TLSH

Submit Download

3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 54f761e00d363bd15db7bae3cc55144c80148a5fa1db7c3c2049e0e406a9142c
MD5 b1ac780361002049b0a10a7fd30fd809
SHA1 0ee0a7dc27fd175ab7abd6e5649890be3e2795b5
SHA512 1bd8b1d2dc30bc62728d3d08085a446e8c037b02499687affa9a0bb18c6bdfee19104eabdcd8a52c2d0b542046abf26b7fdf81815037d4923e31231b0dfb7d60
TLSH
T156C02B5538F9488C2FA5257ED238092E12E4C912310022B0002ED804103465C13A0C2F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 9c76b83ee86bc3117885b28e2cf81f688e1b88760bac3007a9efca1e2b3d367e
MD5 4ea14679d9f326675428421f0c1c0806
SHA1 62bf533a50362c340cfbc9f22f45c043211658ff
SHA512 1566ae135cd3def4e2395e6d60e4ee69a532cde4454f024647ec905874a2919afd0cb9e78f46db8313437e8a5f407e86053c0c8d99c61e4ca657ec5b90199b39
TLSH
T18041FA5876FE1148B7B77E5AABF6A86D447FB9372E06D55D10010E4F0A72A00C862B37
MD5 SHA1 SHA512 TLSH

Submit Download

savedata_onaf1.ini

Path C:\Users\Admin\AppData\Local\ONAF1\savedata_onaf1.ini
Size 31B
SHA256 c165dedea2ab60a81ebfae8e991541cebe4a150f9403fe32819e927a80e6a10b
MD5 3ac1fdb3472559b9e191a8955c58188f
SHA1 2517a42b9453c3bc826091d104345574f539c976
SHA512 9ee0f960c217fccd7866d328dcf1b723a49784aff8a92248d1b8e9da2dcb7815c0a990c68c919c77eef70acca31de673f79978d70eb43c2df38c07da93c49520
MD5 SHA1 SHA512

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

hyph-bn.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4476_1294885026\hyph-bn.hyb
Size 703B
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
TLSH
T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-mr.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4476_1294885026\hyph-mr.hyb
Size 687B
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
TLSH
T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-nn.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4476_1294885026\hyph-nn.hyb
Size 141KB
SHA256 5bcbb58eaf65f13f6d039244d942f37c127344e3a0a2e6c32d08236945132809
MD5 f2d8fe158d5361fc1d4b794a7255835a
SHA1 6c8744fa70651f629ed887cb76b6bc1bed304af9
SHA512 946f4e41be624458b5e842a6241d43cd40369b2e0abc2cacf67d892b5f3d8a863a0e37e8120e11375b0bacb4651eedb8d324271d9a0c37527d4d54dd4905afab
SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgY:p73HEUP8dsiinTThjy90VKY
TLSH
T1C1E319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

edge_checkout_page_validator.js

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4476_488157988\edge_checkout_page_validator.js
Size 996KB
SHA256 65a91c695553a3535c6df406e4b00c51b8fd7ea237bf24dcbca52dd3734278c6
MD5 8ff56f0810dd4bd46186349b66d328a7
SHA1 14fb3ad9b4b5905705db300fa6bf0ba32f70c40a
SHA512 2a2f8fc266ab748921bc6b92285070059d12b1e3a0f9e57f4e2293366684a2d3ff0d2fb6a86d3d701f0f64640319ed41c09d0f0d7aa4f7b7b1603a9b288f2153
SSDEEP 24576:cs4imRAbs1vGrkJUA5jKQmwzErc9Ot3LYVfik0BwrpiUWLRKLRzMEiJsfaGx1huq:cs4imRAg1vGrkJUA5jKQmwzErc9Ot3LS
TLSH
T140253C84E1E2253466D74CB960B7D2C4B5DC04583399F1E8FA6C588ADB0FD4723F663A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

miniwallet.bundle.js.LICENSE.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4476_593095761\Mini-Wallet\miniwallet.bundle.js.LICENSE.txt
Size 551B
SHA256 38ed54eb53300fdb6e997c39c9fc83a224a1fd9fa06a0b6d200aa12ea278c179
MD5 7bf61e84e614585030a26b0b148f4d79
SHA1 c4ffbc5c6aa599e578d3f5524a59a99228eea400
SHA512 ca5f2d3a4f200371927c265b9fb91b8bcd0fbad711559f796f77b695b9038638f763a040024ed185e67be3a7b58fab22a6f8114e73fdbd1cccdda6ef94ff88f3
TLSH
T108F08B5A31E12673416285A1270B52DE7F0C10BDB0AF39779444C3386C348EE82D0EE1
MD5 SHA1 SHA512 TLSH

Submit Download

notification.bundle.js.LICENSE.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4476_593095761\Notification\notification.bundle.js.LICENSE.txt
Size 1KB
SHA256 363f376ab7893c808866a830fafbcd96ae6be93ec7a85fabf52246273cf56831
MD5 8595bdd96ab7d24cc60eb749ce1b8b82
SHA1 3b612cc3d05e372c5ac91124f3756bbf099b378d
SHA512 555c0c384b6fcfc2311b47c0b07f8e34243de528cf1891e74546b6f4cda338d75c2e2392827372dc39e668ed4c2fd1a02112d8136d2364f9cab9ee4fa1bd87f5
TLSH
T1A2313A5B32F53673416245A1670B52DEBF0C24AEB56F38B79495C3387C388ED82D1DA1
MD5 SHA1 SHA512 TLSH

Submit Download

strings.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4476_593095761\json\i18n-tokenized-card\fr\strings.json
Size 2KB
SHA256 c67b555372582b07df86a6ce3329a854e349ba9525d7be0672517bab0ac14db5
MD5 cd247582beb274ca64f720aa588ffbc0
SHA1 4aaeef0905e67b490d4a9508ed5d4a406263ed9c
SHA512 bf8fa4bd7c84038fae9eddb483ae4a31d847d5d47b408b3ea84d46d564f15dfc2bae6256eac4a852dd1c4ad8e58bc542e3df30396be05f30ed07e489ebe52895
TLSH
T17251EE3D88F4489B60C7921B6B1142D7C9704E36D704F3848A63828A035BDEFB0BF69D
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1648-436-0x00000241544B0000-0x00000241545C4000-memory.dmp

Download

memory/4348-2664-0x0000000002A50000-0x0000000002A66000-memory.dmp

Download

memory/4348-2665-0x0000000002B00000-0x0000000002C12000-memory.dmp

Download

memory/4348-2671-0x0000000002F90000-0x0000000002FA8000-memory.dmp

Download

memory/4348-2672-0x00000000066C0000-0x00000000066E4000-memory.dmp

Download

memory/4348-2669-0x0000000002D00000-0x0000000002D3E000-memory.dmp

Download

memory/4348-2657-0x0000000000930000-0x0000000000989000-memory.dmp

Download

memory/4348-2659-0x00000000009C0000-0x00000000009CC000-memory.dmp

Download

memory/4348-2660-0x0000000002980000-0x00000000029B0000-memory.dmp

Download

memory/4348-2662-0x00000000029C0000-0x0000000002A03000-memory.dmp

Download

memory/4348-2667-0x0000000002C80000-0x0000000002CD9000-memory.dmp

Download

memory/5000-2123-0x0000000001160000-0x0000000001737000-memory.dmp

Download

memory/5724-2098-0x000001B61C2D0000-0x000001B61C3E4000-memory.dmp

Download

memory/5724-2097-0x00007FFCA2230000-0x00007FFCA24E6000-memory.dmp

Download

memory/5724-2096-0x00007FFCB2360000-0x00007FFCB2394000-memory.dmp

Download

memory/5724-2095-0x00007FF6FF720000-0x00007FF6FF818000-memory.dmp

Download

memory/7588-969-0x00000206C8AA0000-0x00000206C8BB4000-memory.dmp

Download