37ff328175acd45ef27d3d339c3127a7612ad713fccd9c9aae01656dfbf13056

Analysis

max time kernel
149s
max time network
146s
platform
windows11-21h2_x64
resource
win11-20250619-en
resource tags

arch:x64arch:x86image:win11-20250619-enlocale:en-usos:windows11-21h2-x64system
submitted
11/05/2026, 00:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
masScan_1.6/masScan_1.6/Massscan_GUI.exe
Size 334KB
Sample260511-adn8lsbx9n
SHA256 37ff328175acd45ef27d3d339c3127a7612ad713fccd9c9aae01656dfbf13056
MD5 7a6990bf78f3e2e835d3be85a2fea4ba
SHA1 9e2760e0c13d56cb744262b4fdef67e17ee08571
SHA512 ba2b8cd80613bff44c1624d6a17bae797b81fb53979f6a901850dac5e824483513cd312ff8a5aaa9d5eb3cf5c825785a7a53965692d2fb6274d22b6e62f9735c
SSDEEP 3072:eaxe0aX5Cw9Q56z456zB56zuIXk89V756zM:nanPj8X
TLSH
T13774BB30A2F6C554EB0A1570EBD192F480DD4CAEDC83020BC96F7E6576788DDAC2BA57
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4896_1719348780\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4896_625903301\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4896_55590674\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4896_1398448756\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4896_1719348780\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4896_1719348780\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4896_1719348780\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4896_1719348780\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4896_1719348780\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4896_1719348780\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4896_1042178933\deny_etld1_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4896_1719348780\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4896_1042178933\deny_full_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4896_1719348780\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4896_1719348780\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4896_1719348780\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4896_1719348780\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4896_1719348780\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4896_1719348780\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4896_1719348780\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4896_1719348780\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4896_1719348780\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4896_1719348780\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4896_1719348780\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4896_1719348780\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4896_1719348780\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4896_1719348780\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4896_1719348780\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4896_1719348780\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4896_1719348780\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4896_1398448756\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4896_1042178933\deny_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4896_1719348780\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4896_1719348780\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4896_1719348780\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4896_1719348780\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4896_625903301\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4896_55590674\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4896_1042178933\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4896_473066436\crl-set	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4896_1719348780\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4896_1719348780\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4896_1719348780\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4896_1719348780\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4896_1719348780\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4896_1719348780\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4896_1398448756\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4896_1719348780\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4896_1719348780\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4896_55590674\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4896_1719348780\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4896_1719348780\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4896_1719348780\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4896_1719348780\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4896_1719348780\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4896_1398448756\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4896_1042178933\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4896_1719348780\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4896_1719348780\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4896_1719348780\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4896_1719348780\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4896_1719348780\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4896_1719348780\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4896_473066436\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Massscan_GUI.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134229315871490603"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3534313381-4287935181-1066995225-1000\{9251DEB0-7747-4C83-A920-E8CCB666DE1B}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4964	msedge.exe
4964	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 24 IoCs

pid	Process
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3468	Massscan_GUI.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4896	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3468 wrote to memory of 4896	3468	Massscan_GUI.exe	79
PID 4896 wrote to memory of 4392	4896	msedge.exe	80
PID 4896 wrote to memory of 4972	4896	msedge.exe	81
PID 4896 wrote to memory of 4980	4896	msedge.exe	82
PID 4896 wrote to memory of 4980	4896	msedge.exe	82
PID 4896 wrote to memory of 4980	4896	msedge.exe	82
PID 4896 wrote to memory of 4996	4896	msedge.exe	83
PID 4896 wrote to memory of 4996	4896	msedge.exe	83
PID 4896 wrote to memory of 712	4896	msedge.exe	86
PID 4896 wrote to memory of 3588	4896	msedge.exe	87
PID 4896 wrote to memory of 712	4896	msedge.exe	86
PID 4896 wrote to memory of 712	4896	msedge.exe	86
PID 4896 wrote to memory of 3588	4896	msedge.exe	87
PID 4896 wrote to memory of 3588	4896	msedge.exe	87
PID 4896 wrote to memory of 2480	4896	msedge.exe	89
PID 4896 wrote to memory of 5476	4896	msedge.exe	88
PID 4896 wrote to memory of 2480	4896	msedge.exe	89
PID 4896 wrote to memory of 5476	4896	msedge.exe	88
PID 4896 wrote to memory of 5932	4896	msedge.exe	90
PID 4896 wrote to memory of 5932	4896	msedge.exe	90
PID 4896 wrote to memory of 6048	4896	msedge.exe	91
PID 4896 wrote to memory of 2808	4896	msedge.exe	93
PID 6048 wrote to memory of 3580	6048	msedge.exe	94
PID 4896 wrote to memory of 2536	4896	msedge.exe	97
PID 4896 wrote to memory of 2536	4896	msedge.exe	97
PID 4896 wrote to memory of 4124	4896	msedge.exe	98
PID 4896 wrote to memory of 4124	4896	msedge.exe	98
PID 3468 wrote to memory of 6128	3468	Massscan_GUI.exe	99
PID 4896 wrote to memory of 5172	4896	msedge.exe	100
PID 4896 wrote to memory of 5172	4896	msedge.exe	100
PID 4896 wrote to memory of 5172	4896	msedge.exe	100
PID 3468 wrote to memory of 3308	3468	Massscan_GUI.exe	101
PID 4896 wrote to memory of 4528	4896	msedge.exe	102
PID 4896 wrote to memory of 4528	4896	msedge.exe	102
PID 4896 wrote to memory of 4528	4896	msedge.exe	102
PID 3468 wrote to memory of 2040	3468	Massscan_GUI.exe	103
PID 4896 wrote to memory of 3180	4896	msedge.exe	104
PID 4896 wrote to memory of 3180	4896	msedge.exe	104
PID 4896 wrote to memory of 3180	4896	msedge.exe	104
PID 3468 wrote to memory of 1444	3468	Massscan_GUI.exe	105
PID 4896 wrote to memory of 5140	4896	msedge.exe	106
PID 4896 wrote to memory of 5140	4896	msedge.exe	106
PID 4896 wrote to memory of 5140	4896	msedge.exe	106
PID 4896 wrote to memory of 5840	4896	msedge.exe	107
PID 4896 wrote to memory of 5748	4896	msedge.exe	108
PID 4896 wrote to memory of 2284	4896	msedge.exe	109
PID 3468 wrote to memory of 4584	3468	Massscan_GUI.exe	110
PID 4896 wrote to memory of 1228	4896	msedge.exe	111
PID 4896 wrote to memory of 1228	4896	msedge.exe	111
PID 4896 wrote to memory of 1228	4896	msedge.exe	111
PID 3468 wrote to memory of 5012	3468	Massscan_GUI.exe	112
PID 4896 wrote to memory of 5060	4896	msedge.exe	113
PID 4896 wrote to memory of 5060	4896	msedge.exe	113
PID 4896 wrote to memory of 5060	4896	msedge.exe	113
PID 3468 wrote to memory of 2220	3468	Massscan_GUI.exe	114
PID 4896 wrote to memory of 5156	4896	msedge.exe	115
PID 4896 wrote to memory of 5156	4896	msedge.exe	115
PID 4896 wrote to memory of 5156	4896	msedge.exe	115
PID 3468 wrote to memory of 3164	3468	Massscan_GUI.exe	116
PID 4896 wrote to memory of 4124	4896	msedge.exe	117
PID 4896 wrote to memory of 4124	4896	msedge.exe	117
PID 4896 wrote to memory of 4124	4896	msedge.exe	117
PID 3468 wrote to memory of 4080	3468	Massscan_GUI.exe	118
PID 4896 wrote to memory of 6036	4896	msedge.exe	119

C:\Users\Admin\AppData\Local\Temp\masScan_1.6\masScan_1.6\Massscan_GUI.exe
"C:\Users\Admin\AppData\Local\Temp\masScan_1.6\masScan_1.6\Massscan_GUI.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.winpcap.org/install/
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2e0,0x308,0x7ffced32f208,0x7ffced32f214,0x7ffced32f220
    3⤵
    PID:4392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1808,i,2770645097808947965,9418986110769580548,262144 --variations-seed-version --mojo-platform-channel-handle=2592 /prefetch:11
    3⤵
    PID:4972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2564,i,2770645097808947965,9418986110769580548,262144 --variations-seed-version --mojo-platform-channel-handle=2560 /prefetch:2
    3⤵
    PID:4980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2192,i,2770645097808947965,9418986110769580548,262144 --variations-seed-version --mojo-platform-channel-handle=2608 /prefetch:13
    3⤵
    PID:4996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3472,i,2770645097808947965,9418986110769580548,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
    3⤵
    PID:712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3488,i,2770645097808947965,9418986110769580548,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
    3⤵
    PID:3588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --string-annotations --always-read-main-dll --field-trial-handle=4744,i,2770645097808947965,9418986110769580548,262144 --variations-seed-version --mojo-platform-channel-handle=4880 /prefetch:14
    3⤵
    PID:5476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --string-annotations --always-read-main-dll --field-trial-handle=4768,i,2770645097808947965,9418986110769580548,262144 --variations-seed-version --mojo-platform-channel-handle=4900 /prefetch:14
    3⤵
    PID:2480
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=5400,i,2770645097808947965,9418986110769580548,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:14
    3⤵
    PID:5932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=5456,i,2770645097808947965,9418986110769580548,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:14
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1128
      4⤵
      PID:3580
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=5444,i,2770645097808947965,9418986110769580548,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:14
    3⤵
    PID:4520
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=5444,i,2770645097808947965,9418986110769580548,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:14
    3⤵
    PID:2808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=5964,i,2770645097808947965,9418986110769580548,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:14
    3⤵
    PID:2536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=5544,i,2770645097808947965,9418986110769580548,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:14
    3⤵
    PID:4124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=6260,i,2770645097808947965,9418986110769580548,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:1
    3⤵
    PID:5172
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=6252,i,2770645097808947965,9418986110769580548,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:1
    3⤵
    PID:4528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=6660,i,2770645097808947965,9418986110769580548,262144 --variations-seed-version --mojo-platform-channel-handle=6616 /prefetch:1
    3⤵
    PID:3180
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --field-trial-handle=6740,i,2770645097808947965,9418986110769580548,262144 --variations-seed-version --mojo-platform-channel-handle=6680 /prefetch:1
    3⤵
    PID:5140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --string-annotations --always-read-main-dll --field-trial-handle=5752,i,2770645097808947965,9418986110769580548,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:14
    3⤵
    PID:5840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --string-annotations --always-read-main-dll --field-trial-handle=6412,i,2770645097808947965,9418986110769580548,262144 --variations-seed-version --mojo-platform-channel-handle=6736 /prefetch:14
    3⤵
    PID:5748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --string-annotations --always-read-main-dll --field-trial-handle=6076,i,2770645097808947965,9418986110769580548,262144 --variations-seed-version --mojo-platform-channel-handle=6908 /prefetch:14
    3⤵
    PID:2284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --field-trial-handle=6204,i,2770645097808947965,9418986110769580548,262144 --variations-seed-version --mojo-platform-channel-handle=6896 /prefetch:1
    3⤵
    PID:1228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --field-trial-handle=7052,i,2770645097808947965,9418986110769580548,262144 --variations-seed-version --mojo-platform-channel-handle=7036 /prefetch:1
    3⤵
    PID:5060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --field-trial-handle=4868,i,2770645097808947965,9418986110769580548,262144 --variations-seed-version --mojo-platform-channel-handle=7096 /prefetch:1
    3⤵
    PID:5156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --field-trial-handle=5204,i,2770645097808947965,9418986110769580548,262144 --variations-seed-version --mojo-platform-channel-handle=7196 /prefetch:1
    3⤵
    PID:4124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --field-trial-handle=7332,i,2770645097808947965,9418986110769580548,262144 --variations-seed-version --mojo-platform-channel-handle=7388 /prefetch:1
    3⤵
    PID:6036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --string-annotations --always-read-main-dll --field-trial-handle=7576,i,2770645097808947965,9418986110769580548,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:14
    3⤵
    PID:1096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=7856,i,2770645097808947965,9418986110769580548,262144 --variations-seed-version --mojo-platform-channel-handle=7932 /prefetch:14
    3⤵
    PID:1892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --field-trial-handle=7888,i,2770645097808947965,9418986110769580548,262144 --variations-seed-version --mojo-platform-channel-handle=8012 /prefetch:1
    3⤵
    PID:3076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --field-trial-handle=8112,i,2770645097808947965,9418986110769580548,262144 --variations-seed-version --mojo-platform-channel-handle=8148 /prefetch:1
    3⤵
    PID:3348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=8256,i,2770645097808947965,9418986110769580548,262144 --variations-seed-version --mojo-platform-channel-handle=8232 /prefetch:14
    3⤵
    PID:4216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --field-trial-handle=8344,i,2770645097808947965,9418986110769580548,262144 --variations-seed-version --mojo-platform-channel-handle=8300 /prefetch:1
    3⤵
    PID:2840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=8416,i,2770645097808947965,9418986110769580548,262144 --variations-seed-version --mojo-platform-channel-handle=8388 /prefetch:14
    3⤵
    PID:3212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --field-trial-handle=8424,i,2770645097808947965,9418986110769580548,262144 --variations-seed-version --mojo-platform-channel-handle=8580 /prefetch:1
    3⤵
    PID:2052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --field-trial-handle=880,i,2770645097808947965,9418986110769580548,262144 --variations-seed-version --mojo-platform-channel-handle=8480 /prefetch:1
    3⤵
    PID:3216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --field-trial-handle=8236,i,2770645097808947965,9418986110769580548,262144 --variations-seed-version --mojo-platform-channel-handle=8768 /prefetch:1
    3⤵
    PID:1080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=8864,i,2770645097808947965,9418986110769580548,262144 --variations-seed-version --mojo-platform-channel-handle=8876 /prefetch:14
    3⤵
    PID:4696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --field-trial-handle=9020,i,2770645097808947965,9418986110769580548,262144 --variations-seed-version --mojo-platform-channel-handle=9024 /prefetch:1
    3⤵
    PID:2904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --field-trial-handle=9156,i,2770645097808947965,9418986110769580548,262144 --variations-seed-version --mojo-platform-channel-handle=8884 /prefetch:1
    3⤵
    PID:944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --field-trial-handle=9284,i,2770645097808947965,9418986110769580548,262144 --variations-seed-version --mojo-platform-channel-handle=9144 /prefetch:1
    3⤵
    PID:912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=9384,i,2770645097808947965,9418986110769580548,262144 --variations-seed-version --mojo-platform-channel-handle=5732 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=9460,i,2770645097808947965,9418986110769580548,262144 --variations-seed-version --mojo-platform-channel-handle=9420 /prefetch:14
    3⤵
    PID:3712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --field-trial-handle=9424,i,2770645097808947965,9418986110769580548,262144 --variations-seed-version --mojo-platform-channel-handle=9524 /prefetch:1
    3⤵
    PID:5804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --field-trial-handle=9576,i,2770645097808947965,9418986110769580548,262144 --variations-seed-version --mojo-platform-channel-handle=9652 /prefetch:1
    3⤵
    PID:4600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --field-trial-handle=3088,i,2770645097808947965,9418986110769580548,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:1
    3⤵
    PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.winpcap.org/install/
  2⤵
  PID:6128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.winpcap.org/install/
  2⤵
  PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.winpcap.org/install/
  2⤵
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.winpcap.org/install/
  2⤵
  PID:1444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.winpcap.org/install/
  2⤵
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.winpcap.org/install/
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.winpcap.org/install/
  2⤵
  PID:2220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.winpcap.org/install/
  2⤵
  PID:3164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.winpcap.org/install/
  2⤵
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.winpcap.org/install/
  2⤵
  PID:5912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.winpcap.org/install/
  2⤵
  PID:3556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.winpcap.org/install/
  2⤵
  PID:2620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.winpcap.org/install/
  2⤵
  PID:5224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.winpcap.org/install/
  2⤵
  PID:5588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.winpcap.org/install/
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.winpcap.org/install/
  2⤵
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.winpcap.org/install/
  2⤵
  PID:3212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.winpcap.org/install/
  2⤵
  PID:5556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.winpcap.org/install/
  2⤵
  PID:5912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.winpcap.org/install/
  2⤵
  PID:5476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.winpcap.org/install/
  2⤵
  PID:4644

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:4268

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3856

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
Size 3KB
SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
MD5 1de85fec2dfcc28011a7c2aaab95eb5f
SHA1 80e8c954bfbe8f7ee5a2335c8d969ae033935dc3
SHA512 9c7dd37eb0c094b6aa05201e7c71a8f33b9db81284223bcfa595a44a6ac95d5a6820ab6f07b7aa8d26bf207454e94277bf35332e9c009ee63f083752b6b51750
TLSH
T1D1611DB79A3048090E3412B86B19B35DF63E029F1AD598EB76BE568F1F710F7245C54C
MD5 SHA1 SHA512 TLSH

Submit Download

crl-set

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CertificateRevocation\6498.2025.9.4\crl-set
Size 22KB
SHA256 6ddcaf50aaff98b960d067054ce2ce17872ac0719d02abbb7fe56b9eabc818f2
MD5 d01869348d5a783f61f90cbb27b82a78
SHA1 d4eccc91435adaf01f8589cf7f3589cf65425de2
SHA512 7ad7f27d1f559d1f50f1f009518ccca5d6d01696cd70657ad94c9fe37db7bbe06e4afc13170bc5c065cf72d69a92c3df78f637b7faa2f968bb89aa154fe371da
SSDEEP 384:2t71+UygzeWhU6yVS2Ddc0fp/9yYoIJgWUeJuDzeG0LOsr2h9ltQYX9hVPz/HG1y:m4OBwVPDdFhVyYoPWUiuXeG0K5dQYXFr
TLSH
T1B8A2BE9FAF48F112E211523D94245F40DD24D54A23996AB74F943F30ADAE42AAF3CC7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d42af73b53ac9ac969b2a7847dd50295d23541efbe3e7a201d570995913f736f
MD5 b0d76937840f1bf3341ad1a83cd7935a
SHA1 5eea9891f9df35b3b3aa69f1366b7c5b0def5f2b
SHA512 9021c5e31c1ec851307517c747c7f33c132c434fc1c18369c6bba2cee4993e2fe2635023f6f80f03a9f22bd3c4f7ed71548282f877baf476a6f52c215281702e
TLSH
T1C2D099A33F28A282E08A08B0A3320AC8AB008080300002E8CA020808280B2C22EF80EC
MD5 SHA1 SHA512 TLSH

Submit Download

f_000058

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000058
Size 55KB
SHA256 c8370a2d050359e9d505acc411e6f457a49b21360a21e6cbc9229bad3a767899
MD5 bb381e2d19d8eace86b34d20759491a5
SHA1 3dc9f7c2642efff4482e68c9d9df874bf98f5bcb
SHA512 abb2ad8b111271a82a04362940a7ab9930883ecb33497a1c53edcdc49f0634af5bf5b1bc7095bd18db26d212b059aece4577f85040b5f49c4982b468fe973c12
SSDEEP 1536:+vnXSI+9Escogo5uW8xbm5sIacSs0DEHUjnqTDUBu6VCdZWa:w8gdzIF0oDUstZX
TLSH
T1B743E8D972C2753247EB6029347F930AF2B664AA294D8454F078D8E5BDB0E04987BF7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000059

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000059
Size 23KB
SHA256 95ea16b805310ff4170dc6403825fb2374234ef5e5446b81ec8ea32bce09943e
MD5 bdb86e02a819bf88b68c1b15b8c8be72
SHA1 e4c426426cf26ac277470efe32efa7ede929b70c
SHA512 4801c9094f1a3061e73edf9fe6825127d91270ab9e20f13b2f25a29f66708499b6215d470520319df8907bf1703536978a2ab19f74ea307a95ea0dfc276e9bfe
SSDEEP 384:VPNWDVFEAtGuxdd+zN7v1bYinQpG0gyDi1PeSf2M/zEZQrpn4Uz3U2CCiFFQ:VPNGVFTzxdd8l5ntntXfoZcpXEzCiFFQ
TLSH
T135B2C0D91C1C9870A30555F92922E7748FAA32A538980FFC9B1765B5BCEAEC83C3C159
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00005a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005a
Size 159KB
SHA256 8043388a2dab09e99312718015be8d00477d95034e5b59fba9256fb8d07d20f9
MD5 957e474466de06ceacdad09da2bb5b90
SHA1 b581d3425e42797e792e26fdcb62fe7d265e72e1
SHA512 29bff8d61a11587972b2ce958cd62edc95c45a97f90a7b3ee60d4fbb67d730b6f07039111d8a8469e73e68021660595451243f733c276db84e1115dcae6d1283
SSDEEP 3072:Ouoj3U+OnlInVAnfVDJMWOuJt4W3jEi+gYNlZeR/kuuOYuDWxGoX:X035OnlqVi19OuX4yjEPNlZetk9O0xG+
TLSH
T18BF312E3EE78D6AC98908561414778D94683BE4EF4D2028BF3603FD7666EC32DF24606
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

16270cd934201926_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\16270cd934201926_0
Size 735KB
SHA256 94779b6433c9c71a7b47cbe02782c24789ec333eb50172761eece3b7ca3dffe1
MD5 889df27bef2fe617dbde6b7dd225a46c
SHA1 ee7ce0e5a156bbb70c56df9175e61e070722a023
SHA512 01bcf8b37656d705bdf0b5b48519d849cbbb8b85d14c8af606a39b8cd557070937a6397b80774638e7695ffff6d529abbb59384964cd63904fa07942389f625e
SSDEEP 6144:vnr5byVdHGbQcNrBDsP0VeFpu6DwUsmwhKOvjZ7JQR7CIlRT6KLSPWoeci0NuGCF:vndb8Wrdseex0UsmCrR2wemB1EI
TLSH
T13DF4B600DF81BF31CBBA45B4E7D3D61626B5425F3E8711472FA4AA196C1E5C8AE93C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

73cf9f3eb0b72769_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\73cf9f3eb0b72769_0
Size 76KB
SHA256 075173c6706084ffd738dd04b55dfb31cfce386e1d4ba69b2ad5831434a534ee
MD5 9eacfe8bf337c53961f49a1c0a284939
SHA1 430d634af1e9b920f82437d5d8e59c03616a6e0b
SHA512 0e0df966173be63d02a909399fed3a32fd7c99094a81f9f56cc42031a0f16a397da31e5607455840a36de7822912ad20f87fdaeacd2ae78159500e336482f833
SSDEEP 768:Z5B20DPa3yBO6jzDeNXA9irymImj+5ceRb29s2qEXHe7X4GvX/P/oYODsQkCOPuV:Xq3KjaAsrsanelTvvPvskBPc3ag
TLSH
T189730930E7548E35CE7E1EF087A299272679824C7E8347036BA59337386E7C89F55C89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

966fbb243ed24b7e_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\966fbb243ed24b7e_0
Size 262B
SHA256 40fe9517acc98d7a1c5355d63008aaab9e1be0437f9b5ba2428d56a42637edc8
MD5 acd2aa1974358ef2eeac1f9102320c52
SHA1 dc0d18767043ea6297d810c89eeae2fff5e8479e
SHA512 f5291ed9b5d85e59a3ca639a2b2b63319f64b21ad813fb8249dd61a646d9dc7a21d4076e51c06aa1515837c003f83784c70bb31b90644af48130b938fe0d3e56
TLSH
T1D5D09783241A2E24C24882F9FA36DFA3D427E0D418EAA19180A6E23E02039F34308823
MD5 SHA1 SHA512 TLSH

Submit Download

bdf03e2aff6a2d9d_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\bdf03e2aff6a2d9d_0
Size 264B
SHA256 d303051f2d8f8d562963b0ae73094b40ec8b4308523c90acc31fcfac5cfd4127
MD5 26d22aea1e1c781ec6d55c0fff7a1258
SHA1 d241912e7b90ef684a8b29f5a43bb3f364e490d1
SHA512 2a2b0c34a5f9fedc0bc126d085315c5ce45c88000896474b96681cac8ff787e0f49e1354da898ea975579bcfa2a58f6960782aa78093bd949ac10f1c28dd88f1
TLSH
T1D6D02BBB84166006DD7838F2CB71B149B362D24A1C8E6194856B14928233A609950825
MD5 SHA1 SHA512 TLSH

Submit Download

f059e20cd0027294_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f059e20cd0027294_0
Size 7KB
SHA256 f2d29ed5d9a89418aa897a3ba6b993de747dcb122a1fb299515fba119bddb92f
MD5 6e797cc9cc9e7aa75da5ae17d5724f3c
SHA1 7852df9b276a114d64cc274fa3cb82e38dddb67f
SHA512 849984f1f93f034f4aa122672e1a96b193f39bcfe102edf627a35ec1d709de79594329e882d0a54430cd5b525cd568bec29a1445c3739e98ca9fbdee281d3cda
SSDEEP 96:C1Rb2Tf2nOx1PJQU5E3gDPNyxjdUxzc3ajjKXXVsuTMqSlXQWHG4vnc5EZDz8g:C1Rb272OHPiU5EVjd+I6XeppkB
TLSH
T1EDF1E926A7459D35CEBA0BB09372A21333768189BEC3560B366253232C5D5CC8F59E4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 12e9cd1d77c6efaa13c23e5fba437bfb447a002c849ff7bd0b2278f158dd41c2
MD5 d31861c7f12db4387e73cb965ff789f9
SHA1 092387751595ab7bc278d4a93d3ea59045220335
SHA512 e08837effc86fe52fce16a1fbbd0f18d8c5501e9205079c3f364d007e7868bc9dce5ff1170d8e1f87fa62eec06a3f63a1917d54b79eef38e9550433c79fb069d
SSDEEP 1536:IfEEvnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BkHSRhPjU1
TLSH
T1FAB35327D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F6C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 d14e20f4fab88453bf6f06d617a930943945999d43548cc7d156bf8d17bb5f53
MD5 ab1f5456411a1ce420345839245de091
SHA1 d5e28d72f1293d2a64dea27e2f5cf8dbf3c806e2
SHA512 40123a118d32b8cf5832bc22114d071d15bacfed2da31c84b02e5469b261d1a49a0f63b0146ee1fdbb2bacc67a2da7a05073fcfd60ee510bfd91ce37a35cd408
TLSH
T18B71CCFBC3E4466DC95195F47B242E1FCE1D0914436C3E6AC9D4AF4BA3E58B0D24065E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 c0e34a4f5feff0fb71e82b72e31476b70c1dbfc8d4c0e131ec71021f7a0e7dc6
MD5 8affb26e11ea07e86a3c86eb842719cc
SHA1 198b153710e97047d1902d6b21b7387b4a03da29
SHA512 025a85fd4893589837e5f559ee1a2d7ddb28d5461dcb6c32beb32327c70a380e0da5d5bd5e4c52268641c927a9ff0f2e85f193faf86d16cd9318b572ebadaa0f
SSDEEP 384:sVi1xLqpp12svzejEUssj/SxSeVsGeIII3WI:smIPvzej+a/SYemGeIIIB
TLSH
T18372E91A7A64497B8CDBD219F9517B67D7F81523A2805E48A9FCCE0C10E7AED2113C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 88ea95c4626007b857eaed9e1b085c382ceb5da1891ac4ce6d44b3a0f272fe10
MD5 541951957ea0daedd5a674e6ccf8d283
SHA1 2d235662221e9448ce1dd8184680bf680f57c704
SHA512 3dc16075789f4949283773e400b20c96c5ae522027250280b7df47923f8d1308788a59c4c10664d6cea28316d8e3656e93cfc1d199fe665264f6965b73597717
SSDEEP 384:sVi1xLPp12svRjEUsba/SRQVVcareIII3WX:sm7vRj+O/SuVqareIIIS
TLSH
T17F72FA167A68497B8CD7D219F9517B67D7F81523A2805E48AAFCCF0C10E7AED2112C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 37KB
SHA256 6b3dc79bf59155d5ce34753e1ad1659d14bdd63aae99c24d59312f044efc1c86
MD5 46d1a298a041de622b984ec2b5d518ef
SHA1 7d9550eec1fafc39b8c46581b3d81026cd7485bc
SHA512 d890e4d73cd79e893530af5d0c163cb809507521a9f87a3c9849d32cb28bb0306401390b55f28cb3b9c398c5e8527d6aceb84e9f4a575eb4cb76deafa9d63a81
SSDEEP 768:sgnrwBw8rE2s57pL/Ln3LWRWLFQn58F1+UoAYDCx9Tuqh0VfUC9xbog/OV3cG1q1:sgnrwBw8rE2sPDn3LWRWLFQn5u1jaKcp
TLSH
T1C8031D3B284CCB7E4F805E9CDC2ABE9A5DE8028B56D8895447FA840C03D66EF451B5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ahokoikenoafgppiblgpenaaaolecifn\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ahokoikenoafgppiblgpenaaaolecifn\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 22KB
SHA256 6075ad9d6777565d2499257b110d9f8a59878f43634b1db499e27319f6417ebb
MD5 aeca36a421b1c412b8550815e7c7ebc4
SHA1 ab75e150b03a92a0fddb7a98072b436e7e55b7d1
SHA512 f30ed2c186b98208734a6cb85d15806935bf4eab0230d906ebce36512e28916f49ca2fa49cd97e43f161ee8beecb857909187da733e2bb3d9ba54a6f3d2c4bcc
SSDEEP 96:NNKL26KmxKDG+K6rKvuIKfQKNS9mZdTbL2lb8dd2Kjff90P04RAv7ZLvzwf+LTz1:kg6iS9mZdTbLQb8ddtff90P0ihShnb
TLSH
T12CA22731707E221C387D2A9871B8926F965160A37050A4AB7A6934E6CF67E304DFDCFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CloudConfigLog

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog
Size 458B
SHA256 29b7352e3a967ee7efa53d520070f6b656824548aee5ee0b7e34c6ffb9af5fff
MD5 0cdb3c0429d1e31f0833ae8c893ac565
SHA1 66f00a166a715e19c434dfb59c43f1f7f64719b7
SHA512 b85068a68a8519994d6f0f48b71eea5bd44b93a4366004a2f1112f0ce2bdc209ce190ce6cb36d9f4e5c42ec2637cc72868720368862cae4eed51fbe009d0a2cc
TLSH
T1A4F0AB97940A3CAB08B2222405622ED1FE15034F414554DE3ABC004C6FBAC3905CFB65
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 45KB
SHA256 5f9974157b3fafc04e543043a8007c1548eb05c16f088c8a56ffcf6af254562f
MD5 e0dc0688063e643bc8a6058d3d0d1439
SHA1 606da503475eb871e743d78ba24c888b67ffdfac
SHA512 4fc51ed60190b99d3e37620c16adfd53af380096a8bef2e59b0fe86b35019348f69822847a03510804e75612fc318a1fb5c72acac64e7d47dc1b4d1deacfaebf
SSDEEP 768:9F90raxyp4sQe6WGfvE3/CgufDlUYqu5zu+cqG6dhJE1SovGqsW7iIKu8fqGodE:qb0e8fs36fDlV92zWbE1SWGeiAhGd
TLSH
T1452339F554D38973D89D8B87977E2D56AEBCD063B9880A84B3C05D0ECC421BFE60B859
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 2a3cf52343eb99bfa0c4e904196d46b0da261258d25fc6271205f4e67d9d77de
MD5 e2a78b3e854bfd3d4d69507ae0f5bbd6
SHA1 8b7f98f39ccbe236668c85123723c59de80770f9
SHA512 3e58aaf60584566f12c2588aedc692319a4121482b1505b8ac7f3a0a9d167366fe649c6c0fb180712fdaa1d8b966cb0a03517d97bf75445899c8f76f56974f2f
SSDEEP 768:UFiE6esE8lDldUGz3UCg6lZZ/Qu5zugo6JCgEooovGqsW7iIKu8fqGotE184r:deB85d73nlZtne68gRoWGeiAhGiE1L
TLSH
T1E3037C3DDC84CD7B18DE9B48930E366BAEE011B7D5684BC8E7C84F0E10A6099F74B965
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 24b43ab10ee6fcad647889160fad2cd9bbb9b834aa63b70e1d347f0d2437495f
MD5 02a48e592d7de1dca3899b1657afc506
SHA1 c4566fe7f9ff98f5f0c851d029adfd911d845976
SHA512 68bcb88ecceedc1b32cf3a77f4678068c1aada683b8e74c7c448c6e6410e4f7efc13363980e475697e8b5997d0d4c95df59ef1f02cb3ca3251893f2f905436f3
SSDEEP 768:DFiE6esE8lDldUGz3UCg6l7FQu5zu+cqGOdZovGqsW7iIKu8fqGotE184r:6eB85d73nlRn2zqZWGeiAhGiE1L
TLSH
T1AF039E35E894CDA36CDA8F89E34A3697AEE011A3D98C4BC4E5C58D0E10C709E374FD69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 e06189882d24b4ef84bce7dd86be5c3b4c69814ff67193cda70cc36b9bb450da
MD5 e6f0a584efe6c6f3a81ef7a460dba134
SHA1 11256b0e160f62eaa7e1ddb68dccdc431817c537
SHA512 b3636ba83db26e7632d0ff650aa221665ef5a1e35b88de18d9cc29a5f3ef7b35a0afaea819f0bd74ab171618ffae952c062e8b1577c9ccdbd4dbf1aa405fb0c5
SSDEEP 768:jF90raxyp4sQe6WGfvT3/CgufDlNUQu5zu+cqGOdhJE1SovGqsW7iIKu8fqGodE:4b0e8fL36fDlGn2zqbE1SWGeiAhGd
TLSH
T15B13AF75A8A4CE676CE98FC6E74B3657AEE410A399CC4BC4E5C05E0F048718D2B4FC5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keys.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2026.3.23.1\keys.json
Size 8KB
SHA256 ae6e69a145f84c0a261b4e82888779fbf137f193881d687588e1af71609ae947
MD5 d3ebc1cb4b692c6e2d29a4625420fe73
SHA1 4ce74c1e9af6fd34d6379ec0fec6afb24082a7c1
SHA512 e34b855615e6a3bf770f27d85aa29ca57a324c08bd8f8d9c0130e2a142c0e4a5f17bffd0861b725acc8a2316f73b7fe50406b0af26264a5c2d8f37599b260860
SSDEEP 192:uNtGbR+mFGfvPNyR9Pm4lOvMwkoR9PuGMXcy:ORmqwKjA
TLSH
T18402A57F14A41181CE7FC1698F0B78B78FA038065BCA3A83539BFA49494296D173B5B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ghbmnnjooekpmoecnnnilnnbdlolhkhi_1.3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ghbmnnjooekpmoecnnnilnnbdlolhkhi_1.3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4896_1042178933\manifest.json
Size 177B
SHA256 096e772e0f2e8c15e6dec9087ee0a1fb8b0c56b25061626aedc9e7e705adfc2e
MD5 2714a51ed8c2a891ad73b7488ab655b9
SHA1 9a8cc479aec8de1b4eb678e5d68b23b16a39dc99
SHA512 4811522c06ad6946626a9f4d12eb62a1d623825d18a1cd0ad7b628f4c059f37d299b5857abffd959e4ea53239412490539f5705b4aa6c6951d13c68e6d5b72ad
TLSH
T1E6C012EFDC509DB215EB4323156D43C4E733CF4B1546490935FB66082A25981C193500
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4896_1398448756\LICENSE
Size 1KB
SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
MD5 ee002cb9e51bb8dfa89640a406a1090a
SHA1 49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2
SHA512 d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c
TLSH
T17D31535723840B9306DA2B4566AEBDC4B0DDC02D7F27AE05186EF394537B52ED8B3443
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4896_1398448756\manifest.json
Size 79B
SHA256 7ea98f2308a9c51d17a1ac71b64afbe2a41ff0a083a166a0e4cc428bf44f0715
MD5 817fea104100763cd1bf4f15a51bfe94
SHA1 589717cf98cf7e2d55fc0d6025a4b8e215ed13d6
SHA512 da7b959d93113c5a6be360f90d9c721989c5e7acad7fa592081b582c4c3a0c4a9066a71473fd8492ce7fe7b0fbfd6870d939428a67fbd508fcf6b2c6dc1a41ea
TLSH
T15EA0122058019233108407600360478243551C022015244809461041258813A12A3128
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4896_473066436\manifest.json
Size 113B
SHA256 98821f71a1973ac61b45967ce0c121eb598ac6e95abaa23c912d2f33e4237d8c
MD5 7ef3c71464d0fef472bc1d81fd363c62
SHA1 230e8ec0f849bf34d444c55ef548ba0c9c94d39b
SHA512 f74b96ec3b9569e360a02bfdd4fe237efad8ee2a5deaf46db891bcadd39dba22fd6d59a4e9aafe5511152625ce9f468519dadd53fc0c9b6c8826dc58cbe6cd7c
TLSH
T1C8B09262DC80D872693A93AC0E2246C4F228234B2558AA493630048C0A3A3F082A2321
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4896_55590674\manifest.json
Size 85B
SHA256 2d905d7b28b1afd313753d14f6a916a2e56ec4c1316bfa43046b09214ceb6090
MD5 8ce95626b39ebc2401eee0b34c24fc7c
SHA1 f97a2fefe756f7a03e388e1333573b884730c2b0
SHA512 f04e4f695977918adf6e0603386b6f9c75a4a2202b0fe7215b642f3db491a1db398039cc28633b8e2541749403581622d28c1400f3f8fc66a3daab200e27266d
TLSH
T106A0121018015DE318880320213143D2D3A51C05247437001106108019B8636027A22E
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.fingerprint

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4896_625903301\manifest.fingerprint
Size 66B
SHA256 c236a2ac7741d48e1c56980652331cb3f1f12baf937baf0b280600fbafb143e3
MD5 c28ffa45708f10e3a35143ed2708782f
SHA1 84a03f2615333c9311dbf79d6f58f56b5c009163
SHA512 beac0eacff45a152eb2a50f4d72db2933b8f8ba97e6f0a9f6811abe866fef5c7c83068151915dbdffaccaee5d0cd335d182671f44dbab6da2222266ff8a28ff0
TLSH
T169A022F3F000F02030022F8A80203C00C8A23BA80C8020808000BEE0200322A3A0C820
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4896_625903301\manifest.json
Size 135B
SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
MD5 fbebd68ecaa98928909421f66909c054
SHA1 99d787d90f7ed2e5ad924f9c5668eb988b5a6c07
SHA512 749a3b2be47fe28399dc763888654a3e8d397e06e8d3c3af3965bb45846a1336e6ab4ca82c82c3df846b34a2afafa2156f2690e9bf347ab175408dc0171c61cc
TLSH
T158C04C668D51DEAB00A747A56B295315E23B4B4B5044800A7AF5429C1A288964171944
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3468-0-0x0000000000870000-0x00000000008CA000-memory.dmp

Download

memory/3468-3-0x0000000005660000-0x00000000056F2000-memory.dmp

Download

memory/3468-2-0x0000000005C10000-0x00000000061B6000-memory.dmp

Download

memory/3468-4-0x00000000058E0000-0x00000000058F0000-memory.dmp

Download

memory/3468-5-0x0000000005510000-0x000000000551A000-memory.dmp

Download

memory/3468-6-0x0000000005840000-0x0000000005896000-memory.dmp

Download

memory/3468-7-0x00000000058E0000-0x00000000058F0000-memory.dmp

Download

memory/3468-51-0x00000000058E0000-0x00000000058F0000-memory.dmp

Download

memory/3468-50-0x0000000001290000-0x000000000143C000-memory.dmp

Download

memory/3468-1-0x0000000005530000-0x00000000055CC000-memory.dmp

Download

memory/3468-56-0x00000000058E0000-0x00000000058F0000-memory.dmp

Download