Overview

overview

8

Static

static

3

Xeno-v1.3.40.zip

windows11-21h2-x64

1

Xeno-v1.3....re.dll

windows11-21h2-x64

1

Xeno-v1.3....ms.dll

windows11-21h2-x64

1

Xeno-v1.3....pf.dll

windows11-21h2-x64

1

Xeno-v1.3....on.dll

windows11-21h2-x64

1

Xeno-v1.3....Me.txt

windows11-21h2-x64

3

Xeno-v1.3....er.dll

windows11-21h2-x64

1

Xeno-v1.3.40/Xeno.dll

windows11-21h2-x64

1

Xeno-v1.3.40/Xeno.exe

windows11-21h2-x64

8

Xeno-v1.3.40/Xeno.exp

windows11-21h2-x64

3

Xeno-v1.3.40/Xeno.lib

windows11-21h2-x64

3

Xeno-v1.3....s.json

windows11-21h2-x64

8

Xeno-v1.3....UI.exe

windows11-21h2-x64

1

Xeno-v1.3....g.json

windows11-21h2-x64

3

Xeno-v1.3....-0.dll

windows11-21h2-x64

1

Xeno-v1.3....-0.dll

windows11-21h2-x64

1

Xeno-v1.3....-0.dll

windows11-21h2-x64

1

Xeno-v1.3....-0.dll

windows11-21h2-x64

1

Xeno-v1.3....-0.dll

windows11-21h2-x64

1

Xeno-v1.3....-0.dll

windows11-21h2-x64

1

Xeno-v1.3....-0.dll

windows11-21h2-x64

1

Xeno-v1.3....-0.dll

windows11-21h2-x64

1

Xeno-v1.3....-0.dll

windows11-21h2-x64

1

Xeno-v1.3....-0.dll

windows11-21h2-x64

1

Xeno-v1.3....-0.dll

windows11-21h2-x64

1

Xeno-v1.3....40.dll

windows11-21h2-x64

1

Xeno-v1.3....x.html

windows11-21h2-x64

8

Xeno-v1.3....ain.js

windows11-21h2-x64

3

Xeno-v1.3....lua.js

windows11-21h2-x64

3

Xeno-v1.3....in.css

windows11-21h2-x64

3

Xeno-v1.3....ain.js

windows11-21h2-x64

3

Xeno-v1.3.....de.js

windows11-21h2-x64

3

Analysis

  • geolocation tags

    brbrazilsouth-america
  • user interaction
    yes
  • max time kernel
    435s
  • max time network
    434s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-en
  • resource tags

    arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    05/05/2026, 01:00

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Xeno-v1.3.40/XenoUI.deps.json
  • Size 2KB
  • Sample260505-bcv57set8z
  • SHA256 2a4a8b4cef071138ddd4b3ab423dc8b70708597a600b6eae1a0fa88cbe49d030
  • MD5 SHA1 SHA512 TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 27 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 5 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 58 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 40 IoCs
  • Suspicious use of AdjustPrivilegeToken 26 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.40\XenoUI.deps.json
    1⤵
    • Modifies registry class
    PID:3400
  • C:\Windows\system32\OpenWith.exe
    C:\Windows\system32\OpenWith.exe -Embedding
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1296
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    1⤵
    • Drops file in Windows directory
    • Checks SCSI registry key(s)
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4696
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x2f4,0x7ffbf8d1c188,0x7ffbf8d1c194,0x7ffbf8d1c1a0
      2⤵
        PID:3876
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1880,i,11875890110534436435,2338394523473375398,524288 --field-trial-handle=2068,i,4739257484058121250,13410849700113472358,262144 --variations-seed-version --mojo-platform-channel-handle=2096 /prefetch:11
        2⤵
        • System Time Discovery
        PID:892
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1600,i,6402239609689568782,9680653881193829566,262144 --field-trial-handle=2068,i,4739257484058121250,13410849700113472358,262144 --variations-seed-version --mojo-platform-channel-handle=2064 /prefetch:2
        2⤵
          PID:5068
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2536,i,11592020394805097913,9843571010143451833,524288 --field-trial-handle=2068,i,4739257484058121250,13410849700113472358,262144 --variations-seed-version --mojo-platform-channel-handle=2412 /prefetch:13
          2⤵
            PID:2720
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3540,i,5794228972458931907,17937510364782169606,2097152 --field-trial-handle=2068,i,4739257484058121250,13410849700113472358,262144 --variations-seed-version --mojo-platform-channel-handle=3732 /prefetch:1
            2⤵
              PID:1008
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3544,i,12851951510861939242,17252160847800644135,2097152 --field-trial-handle=2068,i,4739257484058121250,13410849700113472358,262144 --variations-seed-version --mojo-platform-channel-handle=3820 /prefetch:1
              2⤵
                PID:3128
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4220,i,75945589004927088,8327374401192881781,2097152 --field-trial-handle=2068,i,4739257484058121250,13410849700113472358,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:1
                2⤵
                  PID:3784
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4244,i,3442386854083588668,14128773156495709808,2097152 --field-trial-handle=2068,i,4739257484058121250,13410849700113472358,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:9
                  2⤵
                    PID:4476
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4284,i,8785203474917233221,8692338960111821132,2097152 --field-trial-handle=2068,i,4739257484058121250,13410849700113472358,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:9
                    2⤵
                      PID:1848
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4272,i,8639076079579466986,11843310538998314358,2097152 --field-trial-handle=2068,i,4739257484058121250,13410849700113472358,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:1
                      2⤵
                        PID:2996
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5240,i,7364022036941730066,11313670287073388240,524288 --field-trial-handle=2068,i,4739257484058121250,13410849700113472358,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:14
                        2⤵
                          PID:3396
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5456,i,18283024796660325453,11457687874161838193,524288 --field-trial-handle=2068,i,4739257484058121250,13410849700113472358,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:14
                          2⤵
                            PID:712
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5448,i,14181465133184354144,1315031599800259786,524288 --field-trial-handle=2068,i,4739257484058121250,13410849700113472358,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:14
                            2⤵
                              PID:1284
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5592,i,1218076969444232619,1258176484445977411,524288 --field-trial-handle=2068,i,4739257484058121250,13410849700113472358,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:14
                              2⤵
                                PID:1704
                              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5980,i,16633871191669437175,10232097393778723801,524288 --field-trial-handle=2068,i,4739257484058121250,13410849700113472358,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:14
                                2⤵
                                  PID:3492
                                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5980,i,16633871191669437175,10232097393778723801,524288 --field-trial-handle=2068,i,4739257484058121250,13410849700113472358,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:14
                                  2⤵
                                    PID:656
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5376,i,2740084949584651664,13290472590805036078,524288 --field-trial-handle=2068,i,4739257484058121250,13410849700113472358,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:14
                                    2⤵
                                    • Suspicious use of WriteProcessMemory
                                    PID:676
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
                                      cookie_exporter.exe --cookie-json=1140
                                      3⤵
                                        PID:2492
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6380,i,15295332713852590543,10487365824678366688,524288 --field-trial-handle=2068,i,4739257484058121250,13410849700113472358,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:14
                                      2⤵
                                        PID:3192
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6404,i,15361668512714365713,18382613647582630350,524288 --field-trial-handle=2068,i,4739257484058121250,13410849700113472358,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:14
                                        2⤵
                                          PID:3820
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6480,i,1025196248398990960,16004301391029163803,524288 --field-trial-handle=2068,i,4739257484058121250,13410849700113472358,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:14
                                          2⤵
                                            PID:2364
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6484,i,17684572388700960351,15077601938859106555,524288 --field-trial-handle=2068,i,4739257484058121250,13410849700113472358,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:14
                                            2⤵
                                              PID:1304
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6668,i,5175287773296828416,4519467986591487907,524288 --field-trial-handle=2068,i,4739257484058121250,13410849700113472358,262144 --variations-seed-version --mojo-platform-channel-handle=6736 /prefetch:14
                                              2⤵
                                                PID:3224
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6480,i,17208616282545213301,6730913427988989247,524288 --field-trial-handle=2068,i,4739257484058121250,13410849700113472358,262144 --variations-seed-version --mojo-platform-channel-handle=6760 /prefetch:14
                                                2⤵
                                                  PID:3812
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=4424,i,2350461629988443810,8167055286105241638,2097152 --field-trial-handle=2068,i,4739257484058121250,13410849700113472358,262144 --variations-seed-version --mojo-platform-channel-handle=4588 /prefetch:1
                                                  2⤵
                                                    PID:1568
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7512,i,2237451668190738258,9044289687856593961,2097152 --field-trial-handle=2068,i,4739257484058121250,13410849700113472358,262144 --variations-seed-version --mojo-platform-channel-handle=4612 /prefetch:1
                                                    2⤵
                                                      PID:1340
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=4428,i,7795120527718959891,12284826021692445022,2097152 --field-trial-handle=2068,i,4739257484058121250,13410849700113472358,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:1
                                                      2⤵
                                                        PID:1684
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=7696,i,6910359014731179286,17371674605494433650,2097152 --field-trial-handle=2068,i,4739257484058121250,13410849700113472358,262144 --variations-seed-version --mojo-platform-channel-handle=7680 /prefetch:1
                                                        2⤵
                                                          PID:4948
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4356,i,14111899770297415237,11862581712344736986,524288 --field-trial-handle=2068,i,4739257484058121250,13410849700113472358,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:14
                                                          2⤵
                                                            PID:3456
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7820,i,11892665187955078065,8793691555383472255,524288 --field-trial-handle=2068,i,4739257484058121250,13410849700113472358,262144 --variations-seed-version --mojo-platform-channel-handle=7956 /prefetch:14
                                                            2⤵
                                                              PID:4976
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7936,i,11239608886717619630,6079061671322836393,524288 --field-trial-handle=2068,i,4739257484058121250,13410849700113472358,262144 --variations-seed-version --mojo-platform-channel-handle=7964 /prefetch:14
                                                              2⤵
                                                                PID:1844
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3544,i,5994185419435952896,16866269436038727988,524288 --field-trial-handle=2068,i,4739257484058121250,13410849700113472358,262144 --variations-seed-version --mojo-platform-channel-handle=3876 /prefetch:14
                                                                2⤵
                                                                  PID:1236
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5644,i,4927779636932339599,5166246618802115599,524288 --field-trial-handle=2068,i,4739257484058121250,13410849700113472358,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:14
                                                                  2⤵
                                                                    PID:5104
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=5540,i,8035843025153037988,11686849079061360078,2097152 --field-trial-handle=2068,i,4739257484058121250,13410849700113472358,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:1
                                                                    2⤵
                                                                      PID:3456
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=5092,i,12217265391433427598,16329459839487585653,2097152 --field-trial-handle=2068,i,4739257484058121250,13410849700113472358,262144 --variations-seed-version --mojo-platform-channel-handle=7612 /prefetch:1
                                                                      2⤵
                                                                        PID:2800
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=5848,i,11904699743798289159,2327294993289001675,2097152 --field-trial-handle=2068,i,4739257484058121250,13410849700113472358,262144 --variations-seed-version --mojo-platform-channel-handle=7108 /prefetch:1
                                                                        2⤵
                                                                          PID:732
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=5900,i,5220290247802678798,14126627289173707715,2097152 --field-trial-handle=2068,i,4739257484058121250,13410849700113472358,262144 --variations-seed-version --mojo-platform-channel-handle=6672 /prefetch:1
                                                                          2⤵
                                                                            PID:2632
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=5516,i,6284741354767113401,17902308780080344226,2097152 --field-trial-handle=2068,i,4739257484058121250,13410849700113472358,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:1
                                                                            2⤵
                                                                              PID:1992
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=7616,i,8387440083312377209,18405560059534992592,2097152 --field-trial-handle=2068,i,4739257484058121250,13410849700113472358,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:1
                                                                              2⤵
                                                                                PID:4660
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,8376858418158517615,12578792155207970991,524288 --field-trial-handle=2068,i,4739257484058121250,13410849700113472358,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:14
                                                                                2⤵
                                                                                  PID:72
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5672,i,16497067694141037249,5146383663746829829,262144 --field-trial-handle=2068,i,4739257484058121250,13410849700113472358,262144 --variations-seed-version --mojo-platform-channel-handle=7020 /prefetch:10
                                                                                  2⤵
                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                  PID:2792
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7496,i,14468573761176167845,3763876109185461513,524288 --field-trial-handle=2068,i,4739257484058121250,13410849700113472358,262144 --variations-seed-version --mojo-platform-channel-handle=6660 /prefetch:14
                                                                                  2⤵
                                                                                    PID:4860
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=4992,i,6386105867625566070,8654074246923081524,2097152 --field-trial-handle=2068,i,4739257484058121250,13410849700113472358,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:1
                                                                                    2⤵
                                                                                      PID:4452
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=4968,i,13381911307178182261,13064568034184224778,2097152 --field-trial-handle=2068,i,4739257484058121250,13410849700113472358,262144 --variations-seed-version --mojo-platform-channel-handle=7316 /prefetch:1
                                                                                      2⤵
                                                                                        PID:2636
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=5848,i,12857455630137471351,7718363608071197947,2097152 --field-trial-handle=2068,i,4739257484058121250,13410849700113472358,262144 --variations-seed-version --mojo-platform-channel-handle=7612 /prefetch:1
                                                                                        2⤵
                                                                                          PID:4336
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=4344,i,3776857199018561962,3268228644689808093,2097152 --field-trial-handle=2068,i,4739257484058121250,13410849700113472358,262144 --variations-seed-version --mojo-platform-channel-handle=3292 /prefetch:1
                                                                                          2⤵
                                                                                            PID:4816
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=5472,i,15615284359717529100,15147669906302745586,2097152 --field-trial-handle=2068,i,4739257484058121250,13410849700113472358,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:1
                                                                                            2⤵
                                                                                              PID:2372
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7128,i,6701200510639351409,2120804319239817436,524288 --field-trial-handle=2068,i,4739257484058121250,13410849700113472358,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:14
                                                                                              2⤵
                                                                                                PID:1356
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6600,i,13395107752678054000,8671159273880806522,524288 --field-trial-handle=2068,i,4739257484058121250,13410849700113472358,262144 --variations-seed-version --mojo-platform-channel-handle=3904 /prefetch:14
                                                                                                2⤵
                                                                                                  PID:3412
                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5760,i,5267782707532584161,5461884729640305965,524288 --field-trial-handle=2068,i,4739257484058121250,13410849700113472358,262144 --variations-seed-version --mojo-platform-channel-handle=3964 /prefetch:14
                                                                                                  2⤵
                                                                                                    PID:1528
                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5768,i,4063445117604715038,10057529618977120262,524288 --field-trial-handle=2068,i,4739257484058121250,13410849700113472358,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:14
                                                                                                    2⤵
                                                                                                      PID:5008
                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --always-read-main-dll --metrics-shmem-handle=8056,i,3009944580784973057,5116836934876589785,2097152 --field-trial-handle=2068,i,4739257484058121250,13410849700113472358,262144 --variations-seed-version --mojo-platform-channel-handle=8052 /prefetch:1
                                                                                                      2⤵
                                                                                                        PID:4520
                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8132,i,10998742527309021729,3606329045441596742,524288 --field-trial-handle=2068,i,4739257484058121250,13410849700113472358,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:14
                                                                                                        2⤵
                                                                                                          PID:3824
                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --always-read-main-dll --metrics-shmem-handle=6204,i,11676362530765776237,14349707082284572017,2097152 --field-trial-handle=2068,i,4739257484058121250,13410849700113472358,262144 --variations-seed-version --mojo-platform-channel-handle=7280 /prefetch:1
                                                                                                          2⤵
                                                                                                            PID:4072
                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --always-read-main-dll --metrics-shmem-handle=6508,i,8188442088003712833,16798107325620899891,2097152 --field-trial-handle=2068,i,4739257484058121250,13410849700113472358,262144 --variations-seed-version --mojo-platform-channel-handle=7932 /prefetch:1
                                                                                                            2⤵
                                                                                                              PID:1100
                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --always-read-main-dll --metrics-shmem-handle=5804,i,7486874225448826759,3067756850801157583,2097152 --field-trial-handle=2068,i,4739257484058121250,13410849700113472358,262144 --variations-seed-version --mojo-platform-channel-handle=3812 /prefetch:1
                                                                                                              2⤵
                                                                                                                PID:4188
                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --always-read-main-dll --metrics-shmem-handle=6644,i,12324392344637690806,13827906727748958072,2097152 --field-trial-handle=2068,i,4739257484058121250,13410849700113472358,262144 --variations-seed-version --mojo-platform-channel-handle=8436 /prefetch:1
                                                                                                                2⤵
                                                                                                                  PID:1656
                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --always-read-main-dll --metrics-shmem-handle=8172,i,15054910420318861165,13883490153282582265,2097152 --field-trial-handle=2068,i,4739257484058121250,13410849700113472358,262144 --variations-seed-version --mojo-platform-channel-handle=8140 /prefetch:1
                                                                                                                  2⤵
                                                                                                                    PID:2840
                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5092,i,12636092331028659013,1606712633781577718,524288 --field-trial-handle=2068,i,4739257484058121250,13410849700113472358,262144 --variations-seed-version --mojo-platform-channel-handle=8484 /prefetch:12
                                                                                                                    2⤵
                                                                                                                      PID:1764
                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7056,i,14818021412954651253,14274661765356406167,524288 --field-trial-handle=2068,i,4739257484058121250,13410849700113472358,262144 --variations-seed-version --mojo-platform-channel-handle=7272 /prefetch:14
                                                                                                                      2⤵
                                                                                                                        PID:4328
                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --always-read-main-dll --metrics-shmem-handle=7196,i,12937238928227606921,3929428725281412561,2097152 --field-trial-handle=2068,i,4739257484058121250,13410849700113472358,262144 --variations-seed-version --mojo-platform-channel-handle=8060 /prefetch:1
                                                                                                                        2⤵
                                                                                                                          PID:660
                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --always-read-main-dll --metrics-shmem-handle=7260,i,4521418783776227779,11685838103569171279,2097152 --field-trial-handle=2068,i,4739257484058121250,13410849700113472358,262144 --variations-seed-version --mojo-platform-channel-handle=7980 /prefetch:1
                                                                                                                          2⤵
                                                                                                                            PID:2436
                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --always-read-main-dll --metrics-shmem-handle=8456,i,16022800900842164015,17601927431480880993,2097152 --field-trial-handle=2068,i,4739257484058121250,13410849700113472358,262144 --variations-seed-version --mojo-platform-channel-handle=8012 /prefetch:1
                                                                                                                            2⤵
                                                                                                                              PID:1056
                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --always-read-main-dll --metrics-shmem-handle=8464,i,10594641410724704785,10735634776063291006,2097152 --field-trial-handle=2068,i,4739257484058121250,13410849700113472358,262144 --variations-seed-version --mojo-platform-channel-handle=7160 /prefetch:1
                                                                                                                              2⤵
                                                                                                                                PID:1992
                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --always-read-main-dll --metrics-shmem-handle=6692,i,8223529787790649632,8028403412231682976,2097152 --field-trial-handle=2068,i,4739257484058121250,13410849700113472358,262144 --variations-seed-version --mojo-platform-channel-handle=8340 /prefetch:1
                                                                                                                                2⤵
                                                                                                                                  PID:4620
                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8160,i,3970283429424378690,1117221403209767618,524288 --field-trial-handle=2068,i,4739257484058121250,13410849700113472358,262144 --variations-seed-version --mojo-platform-channel-handle=8156 /prefetch:14
                                                                                                                                  2⤵
                                                                                                                                    PID:1672
                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8396,i,17380706237039199045,602101628725657877,524288 --field-trial-handle=2068,i,4739257484058121250,13410849700113472358,262144 --variations-seed-version --mojo-platform-channel-handle=8436 /prefetch:14
                                                                                                                                    2⤵
                                                                                                                                      PID:3288
                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --always-read-main-dll --metrics-shmem-handle=3956,i,13670443168458573954,12179130339514807140,2097152 --field-trial-handle=2068,i,4739257484058121250,13410849700113472358,262144 --variations-seed-version --mojo-platform-channel-handle=8520 /prefetch:1
                                                                                                                                      2⤵
                                                                                                                                        PID:4484
                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8300,i,10397933292282768956,11269528077935117885,524288 --field-trial-handle=2068,i,4739257484058121250,13410849700113472358,262144 --variations-seed-version --mojo-platform-channel-handle=8360 /prefetch:14
                                                                                                                                        2⤵
                                                                                                                                          PID:568
                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --always-read-main-dll --metrics-shmem-handle=8276,i,15474797765586309784,11172138009647529779,2097152 --field-trial-handle=2068,i,4739257484058121250,13410849700113472358,262144 --variations-seed-version --mojo-platform-channel-handle=8412 /prefetch:1
                                                                                                                                          2⤵
                                                                                                                                            PID:5164
                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6908,i,15247773610912041278,10120777444882043656,524288 --field-trial-handle=2068,i,4739257484058121250,13410849700113472358,262144 --variations-seed-version --mojo-platform-channel-handle=8544 /prefetch:14
                                                                                                                                            2⤵
                                                                                                                                              PID:5720
                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --always-read-main-dll --metrics-shmem-handle=7008,i,16402546278375397987,17435610343304277743,2097152 --field-trial-handle=2068,i,4739257484058121250,13410849700113472358,262144 --variations-seed-version --mojo-platform-channel-handle=6908 /prefetch:1
                                                                                                                                              2⤵
                                                                                                                                                PID:5924
                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --always-read-main-dll --metrics-shmem-handle=8432,i,11806152256571611130,7457584692662393173,2097152 --field-trial-handle=2068,i,4739257484058121250,13410849700113472358,262144 --variations-seed-version --mojo-platform-channel-handle=8548 /prefetch:1
                                                                                                                                                2⤵
                                                                                                                                                  PID:1328
                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --always-read-main-dll --metrics-shmem-handle=2716,i,12616887031221065816,12383378113861021549,2097152 --field-trial-handle=2068,i,4739257484058121250,13410849700113472358,262144 --variations-seed-version --mojo-platform-channel-handle=8620 /prefetch:1
                                                                                                                                                  2⤵
                                                                                                                                                    PID:6052
                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --always-read-main-dll --metrics-shmem-handle=7916,i,2793962957140580315,16044346190304628759,2097152 --field-trial-handle=2068,i,4739257484058121250,13410849700113472358,262144 --variations-seed-version --mojo-platform-channel-handle=8740 /prefetch:1
                                                                                                                                                    2⤵
                                                                                                                                                      PID:6100
                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9060,i,3237135861411992078,13555425470378914987,524288 --field-trial-handle=2068,i,4739257484058121250,13410849700113472358,262144 --variations-seed-version --mojo-platform-channel-handle=9028 /prefetch:14
                                                                                                                                                      2⤵
                                                                                                                                                        PID:4640
                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --always-read-main-dll --metrics-shmem-handle=8656,i,10312954754687925948,16571649194358641948,2097152 --field-trial-handle=2068,i,4739257484058121250,13410849700113472358,262144 --variations-seed-version --mojo-platform-channel-handle=4620 /prefetch:1
                                                                                                                                                        2⤵
                                                                                                                                                          PID:5540
                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                                                                        1⤵
                                                                                                                                                          PID:3692
                                                                                                                                                        • C:\Windows\system32\sihost.exe
                                                                                                                                                          sihost.exe
                                                                                                                                                          1⤵
                                                                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                                                                          PID:4780
                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                            explorer.exe /LOADSAVEDWINDOWS
                                                                                                                                                            2⤵
                                                                                                                                                            • Boot or Logon Autostart Execution: Active Setup
                                                                                                                                                            • Enumerates connected drives
                                                                                                                                                            • Checks SCSI registry key(s)
                                                                                                                                                            • Modifies registry class
                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                            • Suspicious use of FindShellTrayWindow
                                                                                                                                                            • Suspicious use of SendNotifyMessage
                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                            PID:3644
                                                                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                          1⤵
                                                                                                                                                          • Modifies registry class
                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                          PID:4296
                                                                                                                                                        • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                                                                                                                          "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                                                                                                                          1⤵
                                                                                                                                                          • Enumerates system info in registry
                                                                                                                                                          • Modifies registry class
                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                          PID:4552

                                                                                                                                                        Network

                                                                                                                                                              MITRE ATT&CK Enterprise v16

                                                                                                                                                              Replay Monitor

                                                                                                                                                              Loading Replay Monitor...

                                                                                                                                                              Downloads

                                                                                                                                                              blocklist
                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
                                                                                                                                                              • Size 105KB
                                                                                                                                                              • SHA256 603fc41ddf92ae45b0bd2148b26fe66963c544c3714347b7d94a1f044ce0bede
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              protocols.json
                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
                                                                                                                                                              • Size 3KB
                                                                                                                                                              • SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              settings.dat
                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                              • Size 280B
                                                                                                                                                              • SHA256 72b205beb453f50e17a365601deeef9544c1fb0a6c7471fff4fe6b93111db2cf
                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              settings.dat
                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                              • Size 280B
                                                                                                                                                              • SHA256 717eb4940c7fbe87ab8f0b600d1104c8a67cd4b09b0beada521544a45bbe175d
                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              39d13c38-32a0-497e-af48-7665586afc0d.tmp
                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\39d13c38-32a0-497e-af48-7665586afc0d.tmp
                                                                                                                                                              • Size 36KB
                                                                                                                                                              • SHA256 441c63c614fe9c749fb76de17972379c5ec209981beb70ac506fea99a8a26751
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              LOG.old
                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
                                                                                                                                                              • Size 352B
                                                                                                                                                              • SHA256 ae437c5999aa25d7dc42d66909c255fb1665641eac3bdead71f02f7b2bc6c4ea
                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              LOG.old
                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
                                                                                                                                                              • Size 331B
                                                                                                                                                              • SHA256 03c906acf0acce993d7f99ec04d233057515610f074c2abc62923b7cfb087692
                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              BookmarkMergedSurfaceOrdering
                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
                                                                                                                                                              • Size 6B
                                                                                                                                                              • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                              Submit Download

                                                                                                                                                              f_0000b8
                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b8
                                                                                                                                                              • Size 30KB
                                                                                                                                                              • SHA256 bfd09caa066745349335d0cf1968175f60bde6f497842ebd8e89eb6d737a352d
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              f_0000bb
                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000bb
                                                                                                                                                              • Size 23KB
                                                                                                                                                              • SHA256 4d374f815118157d4ec62c285937df74fec28c75d9eec110f48d3e04cb321ba8
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              f_0000d1
                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000d1
                                                                                                                                                              • Size 54KB
                                                                                                                                                              • SHA256 fc41355205903037db326bcf64c04398069e277745a5f809818caf862559de4c
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              f_0000d5
                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000d5
                                                                                                                                                              • Size 250KB
                                                                                                                                                              • SHA256 bc262b586644dee86417a1161bcb48c7bf5007d94842c157d3b3da26f90a7936
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              f_0000d9
                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000d9
                                                                                                                                                              • Size 16KB
                                                                                                                                                              • SHA256 3607aae1d9a59b8b99389efafc21068b789b75f0b0f3ded793ef2dced4f3fc8d
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              f_0000da
                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000da
                                                                                                                                                              • Size 363KB
                                                                                                                                                              • SHA256 5ac6c3c8c9045405f3a89ef0e0c80536a989becb552e97bcb94a80cdf090f0a4
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              f_0000df
                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000df
                                                                                                                                                              • Size 183KB
                                                                                                                                                              • SHA256 9e9592f40dfd81f3b8571d240bab5e0a4d782d284f942b49c1cf4b0c5f120b93
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              f_000111
                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000111
                                                                                                                                                              • Size 19KB
                                                                                                                                                              • SHA256 1bfb3fa3f7f90d587fe5e59a817f1b243606b09db7d58c93160ff428129e68b4
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              the-real-index
                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                              • Size 5KB
                                                                                                                                                              • SHA256 ab0cc5184546877f5a218e53c98b61637a1c1ab1879ea15fd6a3268436abcb0b
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              the-real-index
                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                              • Size 5KB
                                                                                                                                                              • SHA256 c73375f499f34c07233f69a69a68d78de3a5364040b33d65e9a993a87be78f24
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              the-real-index
                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                              • Size 6KB
                                                                                                                                                              • SHA256 fe0af01066b16d9ec98cff5803b2b74aaa84516902e6667e0509e01ba0b6ee87
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              the-real-index
                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                              • Size 6KB
                                                                                                                                                              • SHA256 03ea4afaf8b79f273004d2709f064866d9c2065b46e137ef8d1a38748e865f6a
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              the-real-index
                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                              • Size 5KB
                                                                                                                                                              • SHA256 c6a7842e9937f88bc63c51090f9d79123a28602f10558cbb0d32ae7c1ddbb2b1
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              the-real-index
                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                              • Size 6KB
                                                                                                                                                              • SHA256 8af84bb2c0764f5481fd65feb73150ec9d62c0ea0e5e2e79dc69cce43774f7de
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              the-real-index~RFe5a3e33.TMP
                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a3e33.TMP
                                                                                                                                                              • Size 3KB
                                                                                                                                                              • SHA256 88ad4bad611bbc3e6f27ce2ebe755b974b111a8c3745808ec937ba21232e899a
                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              SiteList-Enterprise.json
                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                                                                                                              • Size 2B
                                                                                                                                                              • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                              Submit Download

                                                                                                                                                              Edge Profile.ico
                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                                                                                                                              • Size 70KB
                                                                                                                                                              • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              HubApps
                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
                                                                                                                                                              • Size 106KB
                                                                                                                                                              • SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              MANIFEST-000001
                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\MANIFEST-000001
                                                                                                                                                              • Size 23B
                                                                                                                                                              • SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                              Submit Download

                                                                                                                                                              Network Persistent State
                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                                                              • Size 111B
                                                                                                                                                              • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              Network Persistent State
                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                                                              • Size 16KB
                                                                                                                                                              • SHA256 da33217918d010db054104e932e560b759cdb0c5b725de81d3124518f0b1af2d
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              Network Persistent State
                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                                                              • Size 6KB
                                                                                                                                                              • SHA256 90bb4e39acbab29f2d8dbe85df1499bcdf994b44654d0969a27b1942752c7959
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              Network Persistent State
                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                                                              • Size 111B
                                                                                                                                                              • SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              Network Persistent State
                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                                                              • Size 20KB
                                                                                                                                                              • SHA256 4e23f3d511104addab9a68b91306703f3b58e4b2d192f504ab98964cda30a6e3
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              SCT Auditing Pending Reports
                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                                                                                              • Size 2B
                                                                                                                                                              • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                              Submit Download

                                                                                                                                                              Preferences
                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                              • Size 17KB
                                                                                                                                                              • SHA256 bffbc7086a9e5bab43b01b9cc06c2e71a2581fb73b23a73b51b9f1976524d62a
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              Preferences
                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                              • Size 15KB
                                                                                                                                                              • SHA256 a85050895049315fa70ba06f87f7c5b07bfdff950421245325f8ec5d2f8034ea
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              Preferences
                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                              • Size 18KB
                                                                                                                                                              • SHA256 86aebec9cbd1f1a6da6d8d824ccc0b8a23b3c4a85053b0960c4121f7c20eddbe
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              Preferences
                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                              • Size 15KB
                                                                                                                                                              • SHA256 27d4895d98eebd2a802e73d983b752f220eee6b8f428a6a9c9845a1d6a7235f1
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              Preferences
                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                              • Size 16KB
                                                                                                                                                              • SHA256 8d8d943c4e3b75bc40f3319ecac729db958e7703f49c0c5ad923e4893db4dcaf
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              Preferences
                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                              • Size 19KB
                                                                                                                                                              • SHA256 817d51aa28dc68786382485f8399c3ef0c1c81ccc9a02c551878e6e1305d3710
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              Preferences
                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                              • Size 20KB
                                                                                                                                                              • SHA256 8d4e787d7d175589fdcbf2fea93b00006c79a5c4872cf071cce70b060c6fd650
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              Preferences
                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                              • Size 20KB
                                                                                                                                                              • SHA256 09cf360a41886d4f94b10e44a6bfd1b851e6086a66856b7f0b2d8a44abaece8f
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              Preferences
                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                              • Size 20KB
                                                                                                                                                              • SHA256 103d36e7e6392b3dc1cd69da07c60f7831546de97b127f10f052b2834ad7854a
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              Preferences
                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                              • Size 19KB
                                                                                                                                                              • SHA256 6a7868ad627454ab2e0ad786a8903149dbefa7342e8348cfcdb7af2eeb653dc7
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              623cd082b6202da0_0
                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\5afae500-fe9b-42d0-a795-36bba5dce15d\623cd082b6202da0_0
                                                                                                                                                              • Size 64KB
                                                                                                                                                              • SHA256 7b769ae42622c5f04bdc9cabca51211dcdde687181c0310b10416a8ad0929f5c
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              the-real-index
                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\5afae500-fe9b-42d0-a795-36bba5dce15d\index-dir\the-real-index
                                                                                                                                                              • Size 72B
                                                                                                                                                              • SHA256 d92d56bf17d42be03c06211350f83aa779f482668862c6f96292f84b91c063b7
                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              the-real-index
                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\5afae500-fe9b-42d0-a795-36bba5dce15d\index-dir\the-real-index
                                                                                                                                                              • Size 72B
                                                                                                                                                              • SHA256 8715fe72181b60769e72bac1766b7b7224b4a60d99d0ced5103a89787b4b4e4a
                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              the-real-index~RFe59db24.TMP
                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\5afae500-fe9b-42d0-a795-36bba5dce15d\index-dir\the-real-index~RFe59db24.TMP
                                                                                                                                                              • Size 72B
                                                                                                                                                              • SHA256 23bf02a72caf0c17769e3f01c82f1c797f0514e9ff72f2509e72354c74a5ba5d
                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              the-real-index
                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\98478482-9884-40e1-bad7-0eff3185aa4b\index-dir\the-real-index
                                                                                                                                                              • Size 72B
                                                                                                                                                              • SHA256 601ed0dbb4b4865e7d6286a4e422f673abea44d91d8440506e7331a496ae507a
                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              the-real-index
                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9ede9d35-45d6-4625-9ca9-0cdd3c79a06f\index-dir\the-real-index
                                                                                                                                                              • Size 120B
                                                                                                                                                              • SHA256 525ab97da4a64b23275ff7de9bf122cd6d61c2b833612aed862df8a9272a2d9a
                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              the-real-index
                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9ede9d35-45d6-4625-9ca9-0cdd3c79a06f\index-dir\the-real-index
                                                                                                                                                              • Size 144B
                                                                                                                                                              • SHA256 5a8b9698b0085a4dfb03a853424d92600c62e44cc8eaceb79b855c6a8d34e616
                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              the-real-index
                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b3dc032b-db74-4f99-95f8-e190726495b6\index-dir\the-real-index
                                                                                                                                                              • Size 3KB
                                                                                                                                                              • SHA256 a4f9c9ddd3feefe528ae9d966df0f88c737a129a6d19eff7eaef883f3699cf12
                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              the-real-index~RFe59f4d6.TMP
                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b3dc032b-db74-4f99-95f8-e190726495b6\index-dir\the-real-index~RFe59f4d6.TMP
                                                                                                                                                              • Size 2KB
                                                                                                                                                              • SHA256 e442596af7a65b55523ae44d4475cd60d39925703cfdc774cebc85d2e38b3366
                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              index.txt
                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
                                                                                                                                                              • Size 474B
                                                                                                                                                              • SHA256 b222658679ea09a30d712f7e3b9f7a254a8db26565b5afebbb309aa924b81108
                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              index.txt
                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
                                                                                                                                                              • Size 476B
                                                                                                                                                              • SHA256 edf62c59f96c786981e4b49649a8f923d30af89df9d2a51ef552b5cf01930ea0
                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              the-real-index
                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                                                                                                                                              • Size 72B
                                                                                                                                                              • SHA256 0c4afc1a4c0f1ce062b62e5c297e741c995492801608fdc468bc763bd6608788
                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              the-real-index~RFe59f0af.TMP
                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59f0af.TMP
                                                                                                                                                              • Size 72B
                                                                                                                                                              • SHA256 a418c11974275e1f68b2d7ffa79c02c087cc52d8938e72c75bc267ffa832da68
                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              sync_diagnostic.log
                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                                                                                                              • Size 6KB
                                                                                                                                                              • SHA256 52caa05e9078ac40a3549dc3f133e22b2475f4dc66fa993ff2fa945d3cfaca8b
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              CURRENT
                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
                                                                                                                                                              • Size 16B
                                                                                                                                                              • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                              Submit Download

                                                                                                                                                              MANIFEST-000001
                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
                                                                                                                                                              • Size 41B
                                                                                                                                                              • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                              Submit Download

                                                                                                                                                              9ff6cbce-9280-475e-9dad-c547e4ce1320.tmp
                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\9ff6cbce-9280-475e-9dad-c547e4ce1320.tmp
                                                                                                                                                              • Size 22KB
                                                                                                                                                              • SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              office_endpoints_list.json
                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2.0.0.0\office_endpoints_list.json
                                                                                                                                                              • Size 3KB
                                                                                                                                                              • SHA256 8480f3d58faa017896ba8239f3395e3551325d7a6466497a9a69bf182647b25e
                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              Local State
                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                              • Size 23KB
                                                                                                                                                              • SHA256 54e74cc821cb130c42663a731b2f3ca8f177ef3ce1c697754b275f62c35d2612
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              Local State
                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                              • Size 18KB
                                                                                                                                                              • SHA256 08599d9eb680abebf0423537698a24a3665b51c3cbdae1514965e720ba79b402
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              Local State
                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                              • Size 18KB
                                                                                                                                                              • SHA256 85feef935a81ae381b5761dbbc368387f284c561d9644b9c315b19fb6eefbed1
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              Local State
                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                              • Size 8KB
                                                                                                                                                              • SHA256 50e115c959ecf65e9ef2cfc24a55f82f753c8ce6eaefb10b2456b769d4dceefd
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              Local State
                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                              • Size 8KB
                                                                                                                                                              • SHA256 fce7090a36774f0a4ab5dba04ce4a3a9c33e4cd1c61b3c9d2a109a1ed5f3133a
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              RevisitationBloomfilter
                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                                                                                                              • Size 392B
                                                                                                                                                              • SHA256 607c6932b832fbb0edf52d612a16cfc5f87a1d8bcdb10dbb431161afd067f6fc
                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              RevisitationBloomfilter
                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                                                                                                              • Size 392B
                                                                                                                                                              • SHA256 e77bedbeece352290851e7a553d5c0cc69b8abd643b2b2c72fe6429926a3a5b8
                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              RevisitationBloomfilter
                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                                                                                                              • Size 392B
                                                                                                                                                              • SHA256 c297cef0ce0f62417ba31d98b5fcfa9acdf8cc3ddc39bf3ea0b842d41fc8b7d1
                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              RevisitationBloomfilter
                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                                                                                                              • Size 392B
                                                                                                                                                              • SHA256 44ac87f75bc3b990adeb0d3d35ab1548aec6c52a7b3e6ffc26c1e2df152ab7f0
                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              RevisitationBloomfilter
                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                                                                                                              • Size 392B
                                                                                                                                                              • SHA256 d624309058954f918ae49cb2937b963eca7e4c1ee8be512f9f671e6f8aa2e079
                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              RevisitationBloomfilter
                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                                                                                                              • Size 392B
                                                                                                                                                              • SHA256 81a45a412600154048678eb5a9f7e8fba2caddc7c33edfd32292e5c6a2e5b808
                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              RevisitationBloomfilter
                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                                                                                                              • Size 392B
                                                                                                                                                              • SHA256 d6f7c16ee3e9f22925b593b74618bc39edd59beb69b3d9b0422a8e32a1ebd04c
                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              RevisitationBloomfilter
                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                                                                                                              • Size 392B
                                                                                                                                                              • SHA256 0858f2bbf32f7338d540ed5357de160b3cb4bd110dd1472023341084e4f48382
                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              RevisitationBloomfilter
                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                                                                                                              • Size 392B
                                                                                                                                                              • SHA256 baa86b8119631525b74516b03482d4d8dd65fd8f5b8cdb771d3fa8e2526fafcf
                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              RevisitationBloomfilter
                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                                                                                                              • Size 392B
                                                                                                                                                              • SHA256 a60b88d47f10671c988add5123afd21f3c1797e0cd1e16b8e2dbf5081b8ce9a7
                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              RevisitationBloomfilter~RFe5a0437.TMP
                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5a0437.TMP
                                                                                                                                                              • Size 392B
                                                                                                                                                              • SHA256 133dbfa04db54201256b7c5bb682886d79ec2c7075205b11129e45c04eb2be71
                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                              Submit Download

                                                                                                                                                              keys.json
                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2026.3.23.1\keys.json
                                                                                                                                                              • Size 8KB
                                                                                                                                                              • SHA256 ae6e69a145f84c0a261b4e82888779fbf137f193881d687588e1af71609ae947
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              nav_config.json
                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json
                                                                                                                                                              • Size 2KB
                                                                                                                                                              • SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              metadata.json
                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                              • Size 132B
                                                                                                                                                              • SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              metadata.json
                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                              • Size 372B
                                                                                                                                                              • SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              metadata.json
                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                              • Size 252B
                                                                                                                                                              • SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              metadata.json
                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                              • Size 492B
                                                                                                                                                              • SHA256 30e8b5d48a130d6bf81847b89c208c7a087525e9b7d9a0a97bcf21598332b63b
                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              metadata.json
                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                              • Size 972B
                                                                                                                                                              • SHA256 46c96e720b20237d9768e9cb90aaa62c9c7b0c8f15fddee836a76d41dfa420cd
                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              metadata.json
                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                              • Size 732B
                                                                                                                                                              • SHA256 0c1b4dc8f72139abc5b2e25e5d0097c1d3529ae18001b1a64ff535e345378b32
                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              metadata.json
                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                              • Size 612B
                                                                                                                                                              • SHA256 ce7879978d6dc1ebc353b93e509ab0dcd980bc78615af00080f3db1cb23e79d4
                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              metadata.json
                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                              • Size 852B
                                                                                                                                                              • SHA256 453a08edb83095062ff59beb4f28403a177007ecdc5b93c88074cf8ae24c9b39
                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              c962b119-6002-4054-81fa-2a40f814257b.tmp
                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\c962b119-6002-4054-81fa-2a40f814257b.tmp
                                                                                                                                                              • Size 13B
                                                                                                                                                              • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                              Submit Download

                                                                                                                                                              www.bing[1].xml
                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\QDULF0A1\www.bing[1].xml
                                                                                                                                                              • Size 13KB
                                                                                                                                                              • SHA256 363f8c40a51ed912ecbfe544bbd4a079f797d5a3d32603eda1065b9f7bee48d1
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              65fd940b-5249-4484-8eef-f3938203128f.tmp
                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\65fd940b-5249-4484-8eef-f3938203128f.tmp
                                                                                                                                                              • Size 10KB
                                                                                                                                                              • SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              b870b5cd-ac3f-4b13-9f31-3430950b86d5.tmp
                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\b870b5cd-ac3f-4b13-9f31-3430950b86d5.tmp
                                                                                                                                                              • Size 1B
                                                                                                                                                              • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                              Submit Download

                                                                                                                                                              64ec459e-d18e-405e-80f6-2dbd35eec3c9.tmp
                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4696_1486900923\64ec459e-d18e-405e-80f6-2dbd35eec3c9.tmp
                                                                                                                                                              • Size 147KB
                                                                                                                                                              • SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              content_new.js
                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4696_253452861\CRX_INSTALL\content_new.js
                                                                                                                                                              • Size 10KB
                                                                                                                                                              • SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              ccba5a5986c77e43.customDestinations-ms
                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
                                                                                                                                                              • Size 8KB
                                                                                                                                                              • SHA256 02e79a9e35105866a1d6137a8aefbeb170a1b54ac95f20e7984b38936258031c
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              ccba5a5986c77e43.customDestinations-ms
                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
                                                                                                                                                              • Size 10KB
                                                                                                                                                              • SHA256 4b406ce97ee0166e7843d631cbc665a05cbc2812e001c3443424d05918c7586d
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              ccba5a5986c77e43.customDestinations-ms
                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
                                                                                                                                                              • Size 10KB
                                                                                                                                                              • SHA256 0de0361910d21ac3842a09e1b3507ea311617191023ab03cb36fc5f2926b07f5
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              ccba5a5986c77e43.customDestinations-ms
                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
                                                                                                                                                              • Size 10KB
                                                                                                                                                              • SHA256 4355f470653ebb98765121caa5a80230a8689e283b2daf3ae0b92ef3126b3704
                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              manifest.json
                                                                                                                                                              • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4696_1021519185\manifest.json
                                                                                                                                                              • Size 135B
                                                                                                                                                              • SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              LICENSE
                                                                                                                                                              • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4696_1317526756\LICENSE
                                                                                                                                                              • Size 1KB
                                                                                                                                                              • SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              manifest.json
                                                                                                                                                              • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4696_1317526756\manifest.json
                                                                                                                                                              • Size 79B
                                                                                                                                                              • SHA256 7ea98f2308a9c51d17a1ac71b64afbe2a41ff0a083a166a0e4cc428bf44f0715
                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              manifest.json
                                                                                                                                                              • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4696_1554836510\manifest.json
                                                                                                                                                              • Size 43B
                                                                                                                                                              • SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                              Submit Download

                                                                                                                                                              manifest.json
                                                                                                                                                              • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4696_1614321250\manifest.json
                                                                                                                                                              • Size 160B
                                                                                                                                                              • SHA256 2a7fe18a087d8e8be847d9569420b6e8907917ff6ca0fa42be15d4e3653c8747
                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              manifest.json
                                                                                                                                                              • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4696_1720650814\manifest.json
                                                                                                                                                              • Size 177B
                                                                                                                                                              • SHA256 096e772e0f2e8c15e6dec9087ee0a1fb8b0c56b25061626aedc9e7e705adfc2e
                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              manifest.json
                                                                                                                                                              • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4696_21136693\manifest.json
                                                                                                                                                              • Size 135B
                                                                                                                                                              • SHA256 cb929ae2d466e597ecc4f588ba22faf68f7cfc204b3986819c85ac608d6f82b5
                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              manifest.json
                                                                                                                                                              • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4696_270846531\manifest.json
                                                                                                                                                              • Size 85B
                                                                                                                                                              • SHA256 2d905d7b28b1afd313753d14f6a916a2e56ec4c1316bfa43046b09214ceb6090
                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              manifest.json
                                                                                                                                                              • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4696_541494247\manifest.json
                                                                                                                                                              • Size 160B
                                                                                                                                                              • SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                              Submit Download

                                                                                                                                                              memory/4552-2514-0x000002517EA70000-0x000002517EA90000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/4552-2513-0x000002517F140000-0x000002517F240000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/4552-2410-0x0000025079AC0000-0x0000025079BC0000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/4552-2495-0x000002507B630000-0x000002507B650000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/4552-2492-0x000002517E010000-0x000002517E030000-memory.dmp
                                                                                                                                                              Download

                                                                                                                                                              memory/4552-2480-0x000002507B040000-0x000002507B060000-memory.dmp
                                                                                                                                                              Download