705d7004b8e684c4688086f79ecc821f8a03719190b5863ed16fc0f4175d7d4a

Analysis

user interaction
yes
max time kernel
162s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/05/2026, 12:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.html
Size 326KB
Sample260522-pnffsaaz9q
SHA256 705d7004b8e684c4688086f79ecc821f8a03719190b5863ed16fc0f4175d7d4a
MD5 cdc5edbf5c0a8e4db813ffecb8682acb
SHA1 743237e72eb4cf711fbbec88d7c949a6e95bae47
SHA512 7a01a094bd7b6a2ce505992a99af4e453241ba62ca4a5c75be4d0bbd853f0e0322b529fc9b75e3f31dceb31b8a6514ab98489a8d75dd4c1fed6026613c47007b
SSDEEP 3072:5YsgAkHnjzxQ6KSAiTOHL88aW+LN7jxRLlzglKxf2n17:dgAkHnjzxQBSAzr88CN7DBxf2n17
TLSH
T1B9643C25E5D2607F682B8033F27F3318B73FA483A101C965BA1CC5E5AFD19862177B99
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
624	raw.githubusercontent.com
625	raw.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5044	4816	WerFault.exe	170

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nyx.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
648	msedge.exe
1204	msedge.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134239265223462579"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{BED2FBE9-4AD2-43B2-A7AF-281CA03C00B1}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{DBCEF6AF-538F-448E-864D-DCF6B354DDFF}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1092	msedge.exe
1092	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 22 IoCs

pid	Process
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4816	Nyx.exe

Suspicious use of FindShellTrayWindow 50 IoCs

pid	Process
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe
2124	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2124 wrote to memory of 1148	2124	msedge.exe	88
PID 2124 wrote to memory of 648	2124	msedge.exe	89
PID 2124 wrote to memory of 4428	2124	msedge.exe	90
PID 2124 wrote to memory of 4428	2124	msedge.exe	90
PID 2124 wrote to memory of 4428	2124	msedge.exe	90
PID 2124 wrote to memory of 3584	2124	msedge.exe	91
PID 2124 wrote to memory of 3584	2124	msedge.exe	91
PID 2124 wrote to memory of 1600	2124	msedge.exe	93
PID 2124 wrote to memory of 1600	2124	msedge.exe	93
PID 2124 wrote to memory of 1600	2124	msedge.exe	93
PID 2124 wrote to memory of 4820	2124	msedge.exe	94
PID 2124 wrote to memory of 4820	2124	msedge.exe	94
PID 2124 wrote to memory of 4820	2124	msedge.exe	94
PID 2124 wrote to memory of 4768	2124	msedge.exe	95
PID 2124 wrote to memory of 4768	2124	msedge.exe	95
PID 2124 wrote to memory of 4768	2124	msedge.exe	95
PID 2124 wrote to memory of 1128	2124	msedge.exe	96
PID 2124 wrote to memory of 1128	2124	msedge.exe	96
PID 2124 wrote to memory of 1128	2124	msedge.exe	96
PID 2124 wrote to memory of 4796	2124	msedge.exe	99
PID 2124 wrote to memory of 4796	2124	msedge.exe	99
PID 2124 wrote to memory of 3388	2124	msedge.exe	100
PID 2124 wrote to memory of 3388	2124	msedge.exe	100
PID 2124 wrote to memory of 4852	2124	msedge.exe	102
PID 2124 wrote to memory of 3468	2124	msedge.exe	103
PID 2124 wrote to memory of 4852	2124	msedge.exe	102
PID 2124 wrote to memory of 3468	2124	msedge.exe	103
PID 2124 wrote to memory of 4452	2124	msedge.exe	105
PID 2124 wrote to memory of 4408	2124	msedge.exe	106
PID 2124 wrote to memory of 4408	2124	msedge.exe	106
PID 2124 wrote to memory of 1916	2124	msedge.exe	107
PID 2124 wrote to memory of 1916	2124	msedge.exe	107
PID 2124 wrote to memory of 820	2124	msedge.exe	111
PID 2124 wrote to memory of 820	2124	msedge.exe	111
PID 2124 wrote to memory of 4324	2124	msedge.exe	112
PID 2124 wrote to memory of 4324	2124	msedge.exe	112
PID 2124 wrote to memory of 3116	2124	msedge.exe	113
PID 2124 wrote to memory of 3116	2124	msedge.exe	113
PID 2124 wrote to memory of 3280	2124	msedge.exe	118
PID 2124 wrote to memory of 3280	2124	msedge.exe	118
PID 2124 wrote to memory of 3280	2124	msedge.exe	118
PID 2124 wrote to memory of 4752	2124	msedge.exe	119
PID 2124 wrote to memory of 4752	2124	msedge.exe	119
PID 2124 wrote to memory of 4752	2124	msedge.exe	119
PID 2124 wrote to memory of 516	2124	msedge.exe	123
PID 2124 wrote to memory of 3684	2124	msedge.exe	124
PID 2124 wrote to memory of 5064	2124	msedge.exe	125
PID 2124 wrote to memory of 4232	2124	msedge.exe	134
PID 2124 wrote to memory of 4232	2124	msedge.exe	134
PID 2124 wrote to memory of 4896	2124	msedge.exe	137
PID 2124 wrote to memory of 4896	2124	msedge.exe	137
PID 2124 wrote to memory of 4896	2124	msedge.exe	137
PID 2124 wrote to memory of 2920	2124	msedge.exe	138
PID 2124 wrote to memory of 2920	2124	msedge.exe	138
PID 2124 wrote to memory of 2920	2124	msedge.exe	138
PID 2124 wrote to memory of 1588	2124	msedge.exe	139
PID 2124 wrote to memory of 1588	2124	msedge.exe	139
PID 2124 wrote to memory of 1588	2124	msedge.exe	139
PID 2124 wrote to memory of 464	2124	msedge.exe	140
PID 2124 wrote to memory of 464	2124	msedge.exe	140
PID 2124 wrote to memory of 464	2124	msedge.exe	140
PID 2124 wrote to memory of 3988	2124	msedge.exe	141
PID 2124 wrote to memory of 3988	2124	msedge.exe	141
PID 2124 wrote to memory of 3988	2124	msedge.exe	141

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\file.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b0,0x7fffe223c188,0x7fffe223c194,0x7fffe223c1a0
  2⤵
  PID:1148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1864,i,13050666802867629719,7610025412121121943,524288 --field-trial-handle=2104,i,14696587848583906582,16086554536555888168,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:3
  2⤵
  - System Time Discovery
  PID:648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1660,i,12371961209760138793,9397540152386433881,262144 --field-trial-handle=2104,i,14696587848583906582,16086554536555888168,262144 --variations-seed-version --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2108,i,4138270322838658,1824373048765608338,524288 --field-trial-handle=2104,i,14696587848583906582,16086554536555888168,262144 --variations-seed-version --mojo-platform-channel-handle=2716 /prefetch:8
  2⤵
  PID:3584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,11841873702893253982,3325788401252677011,2097152 --field-trial-handle=2104,i,14696587848583906582,16086554536555888168,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:1600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,5205453050099056329,1629386538748395827,2097152 --field-trial-handle=2104,i,14696587848583906582,16086554536555888168,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4208,i,6373626904924667376,3900051261097821083,2097152 --field-trial-handle=2104,i,14696587848583906582,16086554536555888168,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:1
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4284,i,12206895795291341446,1400695463282396898,2097152 --field-trial-handle=2104,i,14696587848583906582,16086554536555888168,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:2
  2⤵
  PID:1128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5028,i,14985089266950193367,3446686873243033693,524288 --field-trial-handle=2104,i,14696587848583906582,16086554536555888168,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:8
  2⤵
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5220,i,10846158623353836017,8918859681877435414,524288 --field-trial-handle=2104,i,14696587848583906582,16086554536555888168,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:8
  2⤵
  PID:3388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2576,i,17131872303628174595,5433341534249332224,524288 --field-trial-handle=2104,i,14696587848583906582,16086554536555888168,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:8
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5240,i,5781558749191978491,14909531839265718876,524288 --field-trial-handle=2104,i,14696587848583906582,16086554536555888168,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:8
  2⤵
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5920,i,13439920428852902220,16767400530925842985,524288 --field-trial-handle=2104,i,14696587848583906582,16086554536555888168,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:8
  2⤵
  PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5920,i,13439920428852902220,16767400530925842985,524288 --field-trial-handle=2104,i,14696587848583906582,16086554536555888168,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:8
  2⤵
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,5952530441642477660,4687874602810858890,524288 --field-trial-handle=2104,i,14696587848583906582,16086554536555888168,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:8
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6228,i,17107134656860029781,9461133681821259711,524288 --field-trial-handle=2104,i,14696587848583906582,16086554536555888168,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:8
  2⤵
  PID:1916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6236,i,7702338115391774449,17102443751468578627,524288 --field-trial-handle=2104,i,14696587848583906582,16086554536555888168,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:8
  2⤵
  PID:820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6256,i,9249753716674869427,9127105551790669946,524288 --field-trial-handle=2104,i,14696587848583906582,16086554536555888168,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:8
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6540,i,14074354972554793411,14013526826840833385,524288 --field-trial-handle=2104,i,14696587848583906582,16086554536555888168,262144 --variations-seed-version --mojo-platform-channel-handle=6524 /prefetch:8
  2⤵
  PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=4832,i,13560034409312028015,7448863856050883192,2097152 --field-trial-handle=2104,i,14696587848583906582,16086554536555888168,262144 --variations-seed-version --mojo-platform-channel-handle=6628 /prefetch:1
  2⤵
  PID:3280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=120,i,11782014163940932795,12363715761567774866,2097152 --field-trial-handle=2104,i,14696587848583906582,16086554536555888168,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:1
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=560,i,3945867573081539081,454502618490263327,524288 --field-trial-handle=2104,i,14696587848583906582,16086554536555888168,262144 --variations-seed-version --mojo-platform-channel-handle=6564 /prefetch:8
  2⤵
  PID:516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6420,i,14340323074416479428,5397935002658401336,524288 --field-trial-handle=2104,i,14696587848583906582,16086554536555888168,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:8
  2⤵
  PID:3684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,5189933309670951265,6028390470109522290,524288 --field-trial-handle=2104,i,14696587848583906582,16086554536555888168,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:8
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5512,i,3860133608975679858,230822109206092328,524288 --field-trial-handle=2104,i,14696587848583906582,16086554536555888168,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:8
  2⤵
  PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=4348,i,10081424974125744015,5682709810489332428,2097152 --field-trial-handle=2104,i,14696587848583906582,16086554536555888168,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:1
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=5332,i,8144865113111251432,12723211211158894600,2097152 --field-trial-handle=2104,i,14696587848583906582,16086554536555888168,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:1
  2⤵
  PID:2920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=3700,i,17586309419233540394,17845229463725424288,2097152 --field-trial-handle=2104,i,14696587848583906582,16086554536555888168,262144 --variations-seed-version --mojo-platform-channel-handle=3752 /prefetch:1
  2⤵
  PID:1588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=6756,i,9248860790548328984,6720845810343057221,2097152 --field-trial-handle=2104,i,14696587848583906582,16086554536555888168,262144 --variations-seed-version --mojo-platform-channel-handle=6760 /prefetch:1
  2⤵
  PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=6724,i,5979874203120424144,13231124942100527058,2097152 --field-trial-handle=2104,i,14696587848583906582,16086554536555888168,262144 --variations-seed-version --mojo-platform-channel-handle=7144 /prefetch:1
  2⤵
  PID:3988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=3744,i,2615541601297365347,1331322579426172953,2097152 --field-trial-handle=2104,i,14696587848583906582,16086554536555888168,262144 --variations-seed-version --mojo-platform-channel-handle=7012 /prefetch:1
  2⤵
  PID:3632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=7104,i,11300641180095444077,1515229430059725495,2097152 --field-trial-handle=2104,i,14696587848583906582,16086554536555888168,262144 --variations-seed-version --mojo-platform-channel-handle=7088 /prefetch:1
  2⤵
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=6200,i,2675663938712110754,11514150078048881157,2097152 --field-trial-handle=2104,i,14696587848583906582,16086554536555888168,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:1
  2⤵
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3712,i,7015049578117748115,17696949725801801860,524288 --field-trial-handle=2104,i,14696587848583906582,16086554536555888168,262144 --variations-seed-version --mojo-platform-channel-handle=6844 /prefetch:8
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=6792,i,7751798571068782884,10333200588928737080,2097152 --field-trial-handle=2104,i,14696587848583906582,16086554536555888168,262144 --variations-seed-version --mojo-platform-channel-handle=6772 /prefetch:1
  2⤵
  PID:1580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7064,i,9155839356095267436,9220744279985584131,262144 --field-trial-handle=2104,i,14696587848583906582,16086554536555888168,262144 --variations-seed-version --mojo-platform-channel-handle=7172 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=6736,i,12249800350453345938,13931278581603057126,2097152 --field-trial-handle=2104,i,14696587848583906582,16086554536555888168,262144 --variations-seed-version --mojo-platform-channel-handle=3752 /prefetch:1
  2⤵
  PID:1764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=7080,i,474946470277629640,7001915407181413035,2097152 --field-trial-handle=2104,i,14696587848583906582,16086554536555888168,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:1
  2⤵
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6908,i,6194311345570879583,8795387594836741867,524288 --field-trial-handle=2104,i,14696587848583906582,16086554536555888168,262144 --variations-seed-version --mojo-platform-channel-handle=6868 /prefetch:8
  2⤵
  PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=760,i,1140293926123619005,17521547891241140756,2097152 --field-trial-handle=2104,i,14696587848583906582,16086554536555888168,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:1
  2⤵
  PID:2024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=6612,i,3440002984573489797,6637295905421062692,2097152 --field-trial-handle=2104,i,14696587848583906582,16086554536555888168,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:1
  2⤵
  PID:2648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=7472,i,159244756174919553,7159570737249058541,2097152 --field-trial-handle=2104,i,14696587848583906582,16086554536555888168,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:1
  2⤵
  PID:1032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=7672,i,8633310761221839372,2363255172688485260,2097152 --field-trial-handle=2104,i,14696587848583906582,16086554536555888168,262144 --variations-seed-version --mojo-platform-channel-handle=7644 /prefetch:1
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  PID:3768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7fffe223c188,0x7fffe223c194,0x7fffe223c1a0
    3⤵
    PID:4836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1976,i,3578205944773324390,9801552984735057018,524288 --field-trial-handle=2208,i,1143642214115217784,16119694353382206121,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:3
    3⤵
    - System Time Discovery
    PID:1204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1856,i,9011318581367039586,6217684896760379551,262144 --field-trial-handle=2208,i,1143642214115217784,16119694353382206121,262144 --variations-seed-version --mojo-platform-channel-handle=2204 /prefetch:2
    3⤵
    PID:1984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2540,i,12974984377311289119,5668495705571055502,524288 --field-trial-handle=2208,i,1143642214115217784,16119694353382206121,262144 --variations-seed-version --mojo-platform-channel-handle=2556 /prefetch:8
    3⤵
    PID:800
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4504,i,15855727110165829916,7766451345921353316,524288 --field-trial-handle=2208,i,1143642214115217784,16119694353382206121,262144 --variations-seed-version --mojo-platform-channel-handle=4520 /prefetch:8
    3⤵
    PID:3640
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4504,i,15855727110165829916,7766451345921353316,524288 --field-trial-handle=2208,i,1143642214115217784,16119694353382206121,262144 --variations-seed-version --mojo-platform-channel-handle=4520 /prefetch:8
    3⤵
    PID:3944

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2728

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1416

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2352

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4260

C:\Users\Admin\Downloads\Nyx.exe
"C:\Users\Admin\Downloads\Nyx.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4816
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4816 -s 2748
  2⤵
  - Program crash
  PID:5044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4816 -ip 4816
1⤵
PID:1948

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0443146f2baf5d100b235bce06be0050ce12f029b68aaa28accd6963e44b4d0c
MD5 0e17e39d2893ee1bb586adf6537b5d8a
SHA1 3b2425be69b3b0e38ebe771272df9437f62235a4
SHA512 09a34c2db05e8fbe69349e31d41cf9449b1fcd5ced6abcb1ab3e80112d56f7a9c904b8f39fbd630ad983d03e778c9c58b34691b9b12d76e9383e6470f6e6aafc
TLSH
T147D0A7243A7514C2D3D855357C4F8B552BCDD4A8120919550AC518151DD68A7808D5C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ddb84bd26463821c736a7d92c8c5c49ceebfe2b68b41d8542aea996f0166fdcd
MD5 d24cf90702d86fb547055cf915c8314c
SHA1 813def0d06a518494cc2827c8322a6dbc756d7b6
SHA512 27c30d3e2998b2b7993b8631a4c049e0f3e9a101a3a77dc1b3f148b8bedf004c5a94006e2330361cc2ff613b3b74232cc845d699e13fe14fffe8d0e9195b67ba
TLSH
T1BFD0A7243E7554C2D3D855357C4E8B553BCDD4E8120919550AC518151DD68A780CD5C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ab98da7535c8de464335204ae97fd672936e639269325c3a388b3039d8396b83
MD5 1656a3560c7aeae221756f3891b89fd3
SHA1 e48441fe2b843ba3bd0bb7799c07b22a27db8eb7
SHA512 c06d7152d11e33601716d4c5c33c7373ac4e0c16571e80ac4a8ffb9cabb52fae51d4fe8d808fc75be943287b55a320e90a186d71a5f06e9db006f6ab89266400
TLSH
T1CFD09B307B597042D3074031E8074790169E84B5249B86066554410D7D5A485E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ce8ae7a71e1779c6433940cc76fad3139d0e73ea422d4288bd0a5a6a59a98933
MD5 a2a27e5ee7cf2569b2b28798bc7ff397
SHA1 b922ce360a1247ebe9f71239c2f3f4d48c5facce
SHA512 7eac847951e0f8213f1e02bf2a13c769f91de82ad3263645720c8eac54bc9d33cb27c55576fc029eab899d635f00f677291a1b6ec657da39eb1a1233b8c452b1
TLSH
T141D023143F7668C1E378103979474F402FCC94F51209155907454C154CF64D784CAEC6
MD5 SHA1 SHA512 TLSH

Submit Download

964b0be0-e6de-4d2b-ab07-902b23dcbcff.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\964b0be0-e6de-4d2b-ab07-902b23dcbcff.tmp
Size 414B
SHA256 ba0ba151d705447fc223a70d1a6239ea0832d7cb9c840805f554fc8bee91015d
MD5 365a0af00d9684e3565e47812f5e9614
SHA1 ebd7fec8e4dd77c1517f41833b4760177d8cae7f
SHA512 c746dcf478632188f562e8dc0ed46490d0bdcb4459329b25883523a879a06ddc9f978c4e2795d9cd903da08800a59551eecdbc14d3779fdbc5fc7a09b4a0765d
TLSH
T135E02BE7C921DCAB1CF9072D51504746E74003672751450B3A3C820C8FB4537454A89C
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000095

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000095
Size 364KB
SHA256 8659c125bc8718eb28f8269dfb43a22a2b080ffa264928c0370e09a444ec142d
MD5 c6684b15c592145210534468e21335d9
SHA1 3ada6b014dc2227be173aabdebca3da225e51cb9
SHA512 2dd829c13df5113112632ccb6288105485ac73f48f08820cf32aef74edfb59287a243fd16c7f88fc208c94ac524117bf3dcc4b9cdd9bc85d6fbc38888e79a1b9
SSDEEP 6144:/xy3n4OXVRq7eQwYem1rSDGHmWjXe4wIg9zkxDHwwoGu4Dz25/tCB4V/FIGzZHmL:/xun4KV+eQwYp6GHmWju4hCCUwosi/7Q
TLSH
T1348423BE81B84C867A3E1AD57943E723C205BE26E1316BC73E4E010A23765E3457BDC6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 53a8dd51d196320f94b19674b869ebd6a0006ab24b35321610af9f380a00ef56
MD5 25eb1b5a023ae6a2e65941e0da68354e
SHA1 c6092d365bf1ad6a1ee4b55c0b5a2d6a4bcc155c
SHA512 cfa2d34268c6ff6748c390fba34214ccc1ab3909b618a6c02b75e5202a3314858be949d185505360f763773a4f582eef6f12c0396bb5f5893c50a3a11f307a40
TLSH
T18E6191380F8601A4FBA2037157D1C252B47D86E7FC93DE96E3B009F44BF57228A1974A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 e95841515b74b72fd260e4c160ce105b241244ca94a52057ababdff33bb43e63
MD5 86e749eeb81f194e79be10f41ddabacd
SHA1 b77e063d854366bd74ed05b59499c29f7133bb87
SHA512 21110a9a184dc773217b3f4d011db6eb95183a3ac44ce488bed66b656c0f20d00f40489c794b3304ac10fd8ab3d2338b9c7b3a7d2e67af5bb9d4b4254dd30a54
SSDEEP 96:foY5n2y4Lc/g0sLhmyS1pYEDqq15XJbYl49UZ1HpGohPf0x22BE:foYp20/yhmy+pYEDqq1RJ0lXTp3hPf0u
TLSH
T183B1CB381F45C5A0FBD3023156F6D76A747D82D6FCA3DE85D3A009F44BB2792890DA4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5892c5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5892c5.TMP
Size 3KB
SHA256 d05ef046b69bf5e0c7f661509e80ea694ccd382ad47fe7d76682d66504f001f8
MD5 39ada812b32ff14536f41ddbfb6c397c
SHA1 71f4ed50b733e26f4db9f813cb77244b7fff0885
SHA512 88fc82da73b234e4d70fe5b25c0274173fe6d201c35b7fcb2af3be058bd5fcc0897785d6a3ff0edd06987a79fe41b93ab068e03ea3b9b1d5c3db0ce3ff5ce92c
TLSH
T1B86180390F8601A4FB62037197D1C252B47D82E7FC93DE56E3B009F44BF57228A5974A
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.106.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

computed_hashes.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json
Size 429B
SHA256 b829b0df7e3f2391bfba70090eb4ce2ba6a978ccd665eebf1073849bdd4b8fb9
MD5 5d1d9020ccefd76ca661902e0c229087
SHA1 dcf2aa4a1c626ec7ffd9abd284d29b269d78fcb6
SHA512 5f6e72720e64a7ac19f191f0179992745d5136d41dcdc13c5c3c2e35a71eb227570bd47c7b376658ef670b75929abeebd8ef470d1e24b595a11d320ec1479e3c
TLSH
T10AE055170A1A50B79BB8DB90EE525CA2E8A0A6B1C50438D63E608234B68A11F738347D
MD5 SHA1 SHA512 TLSH

Submit Download

verified_contents.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\verified_contents.json
Size 1KB
SHA256 d23b2ba94ba22bbb681e6362ae5870acd8a3280fa9e7241b86a9e12982968947
MD5 738e757b92939b24cdbbd0efc2601315
SHA1 77058cbafa625aafbea867052136c11ad3332143
SHA512 dca3e12dd5a9f1802db6d11b009fce2b787e79b9f730094367c9f26d1d87af1ea072ff5b10888648fb1231dd83475cf45594bb0c9915b655ee363a3127a5ffc2
TLSH
T12B317466C8683D56267A63348E2D0602EB57C2BB0050640EB5AC558D4F7115FE242FAF
MD5 SHA1 SHA512 TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 36KB
SHA256 c5ff7804147955b3d5eee960dcbeb497571598b4ec25618e68a3269f997e5dfe
MD5 3b81aa31a9565a9229a994f60812455c
SHA1 77b3b3dc7234641ea3c17f1f481edfbceb5ef506
SHA512 7a398ad3f9183a04b0d0ec0e0f054ad37cd7f9f58b43820deb0b3171500ef0954d4dacacb27a2d846d4ae7d593dfdce0c7909000a75ad2f9d711dbdcbb4a94e8
SSDEEP 192:IIBK6FcZad501bmL5kjjC688W+8fSYy7uSKrkVBsQQ:6v6GMiESOSYkVB1Q
TLSH
T126F28DCB59B0F239CA722C36781931B8DE77D7491FBAEE16E90700228CBC46951E391D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 224KB
SHA256 509cbc0047977fdc06c5b1c98ad217162c2ef67d53cac969ab64f372dde8239d
MD5 22ef914a482206570e2561c50d22b777
SHA1 d90f4cc0df7fdcc7371f35e2615403f26efd1ab3
SHA512 ac1c35c880ed99a803d38132dc1cc6093cf1d4d815d242fa2e9b3ffe2161d1fb1a6ece52434f19f1551dc0a480d6674dbc415b100afcc9a2a5649cddb1d01d00
SSDEEP 384:hCSOVKN2/83uICtTBBevQSHzS5S77DXspU3i:hCBVKeptTBBevQW25U3
TLSH
T106243C4F4B606335CC7D547638E661F36D7DF12B8723AE95E81200A0CEE9A1660EF86D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

769cda70-b520-43e5-89c6-82ed5457625e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\769cda70-b520-43e5-89c6-82ed5457625e.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 0a9a289914728c7c670ced1cfc7a13b0a0c84c9566c64a9e4ac416508f1c1c4d
MD5 cf39df917882cb49b131ce65893a592f
SHA1 b4754d26a35a145a665e21ba54fa814eeb0d306c
SHA512 88269793771b8de6a1e10f9826de90e45454d328fb50fcd5fd17cfa231e7600b3f69919f593c7766b0f7f86674fec35bc30277769be8ef7353be7bb9ac73ab55
SSDEEP 192:Dv1uAyJ3yCceer9WaXZIQDGZRhQAZkKhZK2k2Nr8J4ERl:Dv1uAyJ3yCceer9WaXZIQDGZRhQAZkKG
TLSH
T162E18ABAC2E8477E891252F0AB256D2ACD1D155B432C3C96C9F4EF4F63E24B1D10169F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 29KB
SHA256 b6653de3874b969bdaaa7426f81a2897936600910078623fdd60c22faaa563e7
MD5 45ba3cf9414297c183bc7b56ba7e575e
SHA1 02ca2662788173b76a6fe246b16e6b6900e2f027
SHA512 adbeafd6a12c817774b44c3d5c3b5281d2e3e9327f2bb298671e455055cbaebc1b96a97a8f8a4b96426e6a3c33d315e9a3abb3d35fbf95a3773e51433e50092b
SSDEEP 384:Dv1uAyJ3yCcet00458yECYLW4X6ZltDRJpaohpiMqeIebroir9WaXZIQiZRhQAZp:uwsUinMxOa2sbwVjA0IDdMU6
TLSH
T1FAD2DCF783E5C66EC81257F4A6106E1BCE1D0619832C3C1688E5EF8BE3E2472D15A65F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 d983b6864714e15836a8f7456f66b7c126a13c4240dd4549719af1ad23fd2cad
MD5 e213d51465b491cf34384756fb8ac43d
SHA1 976cf6dd2da069ff43fd333279eb49f84779ef82
SHA512 2cf3be98a0082c5666b8ef3e86252278f417992666ec4450a93d054bd89dae1517f5481dcc261ee36af247deae0b51c1319b39bedc2e2e4f69823d36239fe623
SSDEEP 192:sxZFRu5yM/jK1Ml8Mkb/fcsTsAxK8OIdpdjHW6+WNG/5z8YmIg4J:sxZFY7Mb/fcsIAoQ9HbGsc
TLSH
T11B52E946AA38597BCCDBD209F951BF53D6F9157392940D44AAFCCA0C04E6AEC2207C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 aa408a78fe9695b5353be4e0bd00b55f62b4fbd98de63e7ccbd6dcaa600702d3
MD5 59cb2542635696244e79db677c1e68b6
SHA1 2298f78e2678443e04ff0d2aa7247eaadd4939eb
SHA512 c5936c98ed8f2b72a93cc1006b4f2243d555c63a47bd77b38ca8eda50cb18910a06a2b5a1b44688732a1fc94eacbabba2eda06ffdbdab3e7863813df8ec441bf
SSDEEP 384:sxZFYVqrb/fcsDWveUotlHbg/rVzP1BNkMWVZi:s93rb/fTYeUeHbehzP1ZW2
TLSH
T142929693A538497B4DDAE12AF451F72BD7E5047796D04E85AAFCCA0C00DBEEDA102C4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 8df2e3cb6444fbddf5b1c0e747be62ebb5a9650582ca74135cd9d96c6089f878
MD5 77547c1b8146e7b8c22ab759da1df554
SHA1 8771bb6b19a414255fae9fdfe2504be0e8cef5bc
SHA512 a71f03953992c48912e1d0dc92c75844b7e0687b20f9d98a27b7ccf3f1b3437ec7afa4df6c13be67f9c3d3fd20163fb27e5e58d78550cabedc3ae8134f6b15b4
SSDEEP 192:sxZFRu5yM/jK1Ml8UQ+db/fcsisUxKUOIdpHxKAymHW6+WNE06+FK//NjPKJaPtk:sxZFYVqmb/fcs/UoYlHbG/lrMVfeQ
TLSH
T18D72B793A538497B8CDBD21AF541FB67D6F5047796940E84AAFCCA0C00DBEED6202C5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 8578c9c0de67b81e20ad1aef5acbd2f406f3b149fa356000ea547085e8c8e557
MD5 93676ee65d01e249c9b5f958e3ec3d98
SHA1 e010641e41dff3e38a8eb04893e3652c8479de84
SHA512 81e9ff2c198fbb6a465312e6011e14a687c23b457716db62ff2114b55e15b2cb4c9f1fd8cd2e8d712dba270244c00ed440ad65696c27bcb673cd425c8fe803f3
SSDEEP 192:sxZFRu5yM/jK1Ml8Mfnb/fcsisUxKFOIdpHxK6ymHW6+WNE06u/3PvJtH7kVI9yU:sxZFYV3nb/fcs/UoV3HbLfQVnQ
TLSH
T10972B797A638497B8CDAD21AF541BB67D6F5047392940D84AAFCCA0C00DAEED6207C5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 90f2dd36bdbda04545178091e026ef1cc5f8f82f949cae72445472ef82091c9e
MD5 513dc81da2e3019da200f61ee84f4009
SHA1 0fee08cc23c2d011879baa8f83d51e840e3ce6b5
SHA512 d856aad541812f731dfc9f336e391ead2742a2b28bf26d32b21b29eb5a29957f744dcb6cc5d3f396ab292cea871ac447a626f2e06a7f2eb5aa7868210508536f
SSDEEP 192:sxZFRu5yM/jK1Ml8Mkb/fcsisUxKKOIdpHjHW6+WNG/3Pl+jzWYmIg5SJ:sxZFYVMb/fcs/UoeDHbGfxQ
TLSH
T17562D746AA38597B8CDBD219F941BF53D6F5147392940E44AAFCCB0C00E6AED6207C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 abf95771d0f273d4644e35d13f7902cad70fff21d89df67bbad03bd4e82036d5
MD5 4c344ba365e79ae92420340a7ad4ce91
SHA1 a529fb9afe62c825f9823f94c18fe09ef129489c
SHA512 eda0c44e055699c7c08dab1839b4758d5f0f51fcf62e50d7ffd798e4060939714e1e69b6fc334b04b03fe9d3bfeef30e4f1104bbf72b26ef3bc21380271683b3
SSDEEP 768:qxW7k2T7pLuLX80Wvqina8F1+UoAYDCx9Tuqh0VfUC9xbog/OV9tKa5LlWYSjxrF:qxW7k2FEX80Wvqinau1ja8tKa5LA3jKq
TLSH
T134F20B3B780CCB7E4F804E9CEC2A7E9A6DE8018B56D8C95447FA844C03C66EB15175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 0367068cfc967f5d1488995ae8c587dda68518618939562f09040ff39149dff2
MD5 ba8449ee8aaa7622357b09e625078762
SHA1 92bf779425742defc45d084f27a2e8bebaa6babd
SHA512 3ae293f7a02f7238fae39dcb2a45002feb6bfa752ceab1409f71c7e91e22e2c4c8cf054a85368196d71c3dc08d263c986bf2b76d20e3b0116ec48af1ef32f267
SSDEEP 768:qxW7k2T7pLuLX80Wvqida8F1+UoAYDCx9Tuqh0VfUC9xbog/OV9tKa5LlWYSjxrs:qxW7k2FEX80Wvqidau1ja8tKa5LA3jKH
TLSH
T19FF20B3B780CCB7E4F804E9CEC2A7E9A6DE8018B66D8C95447FA844C03C66EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 ffaaaddd535d6a48cbe78006e43170ec0a03e0161fe25978841605e1da825dd1
MD5 621efe29543bffbc0239324c992201e1
SHA1 ac6a2df6676ddf3d70b9a2cc7f7b6f1a205e068f
SHA512 98006d2b2cbece9c50f672b057e3da847ec742dd5a660f335b90331e2a5000f2e6f1c6ce83986ad48ec754ab41230025d835f504ca0246c03de197799159018a
TLSH
T18BE026D48AE8C17D61362087432EE308C2E4B40BD3C83D462F00CA807283904B197680
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 184B
SHA256 9da6546d7666cb190cd6cd5d58b5b2ca4d0d00cd6d0775886fac5948217f2f97
MD5 a06a62d32ad804e333f481dc8f8248c4
SHA1 3f6ad0fcd118937b4d641eac1b679a525e247cd4
SHA512 a990c9953dd8527d75dca4bf657eb7b1e22499c0d7806842f674a80015d55948616d3a5f2c4ab56db49c81fb8ad6ed5b35f4e97e3960c1a1553cc05273e44552
TLSH
T1E1C08C81BB08D353E4FE1A31669307D1A630E01346008A33884E7B210D0A2B47F00CAA
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 aa258b7303e806e2eef326ad767d9a2b7592fb5e779de427f2ca12963f996ceb
MD5 3f6c955b437a5c0ae8b021fb64ba3641
SHA1 ad21587ce13b69b9b1312240efb42059ec54f43e
SHA512 62aa01ef26cbec9dc3f44b5ddd63ea11b315a0fce979a36f68759b873f6a9821e01d4c35b2bc6121dd700aad61599f5c12603a3b8677b90e5210984aaffa9656
TLSH
T13BE0D86457DAC27A615630CB8379F308C5E2B507D6C83A553B09D4C173479807247680
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 471a02d0a28b4638a5a0b305c716a0ea302afc833c0f014762e892cfcb4757f4
MD5 397ed01a465964f4cb0c651e4a79e56e
SHA1 25e6bcf34b44d72f7c8c30d7d133210ceb74b0a8
SHA512 b367296e486ba57dc912ebb7147cb3332ea2dda74a3efa4c3325c2649f1e5444e4b8e886b541e97fe72c51a26c697bb22450a2221cfd4002bc0210c23f9dbcf1
TLSH
T112E086B486E9C239640960C78779E71CD6F4B84BD7CC3A8E570884C1B647548B6BBA84
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 e8a6e447fd5730d312b28ae83b8bdf100ed4378f25fb4f79bfe20949f7a44c1a
MD5 d02028b0647c14e1f49453cda4b0980c
SHA1 447055c4725bdf457dd00936408b46f8d05fcfe6
SHA512 ed3087fb73063bff3277dbf552cd17ab16204cb78e30b19171b8f876778b41ee912079c8f7208e713a9407d081a9f333f304aab959785f00413fa5b4043d3b35
SSDEEP 192:s2t/kh4fjRTnMv2zLJ2W1yZBOfX8L6xWqkIsPITOSuhWMfKqzkk:s2F6Jj
TLSH
T1F7D1410AB0364601387D3899B2A789365F4675A3751CB4EF7FB900A60E67E210DFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 340B
SHA256 cccbd695291c3813b3302d97d374a4005dfbc4a7fe9f90c96f066fce06c1064d
MD5 5e835170419f1b1cb0baa587b76952ab
SHA1 1448e6dba58c7bb4125ee45527f611d8e8733c25
SHA512 301cfc7fd9bdfe6ad9cf6eee0299f3b912b4ede6387286f92a260d43013c7e0bab4bc770c1e48f2aba95367b079a34781651ed0fd7342c45ef4447d46b7d35ff
TLSH
T1BDE0205464CCC15F641528D74278E34CC2E13803EBC43E859F01CC84768314176CF241
MD5 SHA1 SHA512 TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe592ea7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe592ea7.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 6ee472e9230ad4229ba4647575f625417d8e8c56a2411e8559c4241757d5a3e6
MD5 41c2b9c1fb2a3da20c6b6c60b6d8b6e2
SHA1 56fb0c863f2c70e2daaa64ad0ec6ebe0e93b09f4
SHA512 8adc57655884faab3d36a75fa37aee0274ffeddebe7ef0ead2f4a4c3047c81bf9243e64c2f997a2bda8f7c2fae4240c9f783a981b6f7f3c30154897bd7d168bf
SSDEEP 768:YF1jZbsPwgvemXPMCVlcjWuh6E/2lPJUH2o:cIgA8/2jUH2o
TLSH
T138B24B32AC65997BEEB79B81F5077252AFB011B7D8C42E84EAD85E0C00976DC130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 c54ada68f04ff74343078cfdf4350681e9137088b994c709adb00c3f0b9dcd7e
MD5 f69fd300ccd6f9b843ca06b965be3cce
SHA1 2b18328823791741fff51bc34a8ee319da18dc5e
SHA512 6360d6f8f1b48b3a067dc17547ee85754be64826da060eade81437720b766b35853bb7ef549c6353d33ac19606e1c473851db96d85337711d86126660ef390e9
SSDEEP 192:uu1ksNqDQzJewBbGtQmiU1XG04aGBPKlt+FdG8PohrGFC1SJrldN7/gAcU8:nisNqDQembUoL7dEh+CEJrJE/U8
TLSH
T196320B356C386C7B9AB3AA42F58737139FE4107B96C42E54EAE85B0C049B79C2317827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 721c86f978c3f728ee43ce316c30f52d903c8fcccec80975c902b3bef0a7f0ce
MD5 6281098c9e98e22f792352ddc1de6c00
SHA1 75a86fb54e16bfd3195454a9fc487c56a28d56f0
SHA512 d82461278d6551508b8457aa7066536766d831f43e89b5cb8cd9f9bff947f7c5e0dc4c58110c4e81eea9c13824c7816932c6890c3c80f512eae4435b12ef44b9
SSDEEP 192:MON/64BAQmiUyR1IW5GBPKlt+FdG8PohIaDLqU6:MON/6eA2GWAdEhxeU6
TLSH
T1F902FA356C796C7B9EB2AE45F48737175FE8113BE6856B44EAE85B0C00A775C2303827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 1c61c887572f1ea20c8cf5a1d146b2d28963bad4904e96170df8c81224d0a12d
MD5 674c6c1d623afcbd40cf63bdf26b2a4d
SHA1 88ce2d438e8b34f034fddfd90c0b5b7e2d1f5b05
SHA512 033b6031a234d3ce88157b11d3d94c8fbf1ffec69f5cdfb60a232e317adc50f6666e79c74fcf02771c574cf996baca4bdc6c7495c49c28285f585db6176c9c56
SSDEEP 192:uu1ksNqDQzJewBbGMQmiU1Xe04aGBPKlt+FdG8PohrGFC1SJrOdN7/gAcU8:nisNqDQembXcL7dEh+CEJrME/U8
TLSH
T1A0320B346C396C7B9AB3AA42F5873A139FE4107B96C42E54EAE85B0C059B79C2317817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 2197480d3ae20f4ae5576600abf1aecdcf2cc3f5d1c224a0d65e77b192b2d8fa
MD5 95b5eb70de37e6d5e67289e6f5eba287
SHA1 fb7a6f9b972a3ab0ee016527dbf4851ea2b822da
SHA512 1ede69ff8ea6177860dd7050f85df21ca0584db83fd93c5a9311188a333085343c1563c62ada759807304da519386514d8508b218fb6c78287df54e4fc88a018
SSDEEP 192:MONz64BWQmiUyaIJ5GBPKlt+FdG8PohrGFC1SJrlWw7/gAcU6:MONz6ey8JAdEh+CEJrpE/U6
TLSH
T1A712F83468796C6B9EB2AD52F48736135FE8113BEAC56F44FAE45B0C019B79C2307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 31KB
SHA256 527fe70c212a7438465ee0692ca0e10e15e2b4db25f61570ed28614b45627f1b
MD5 a81e0182ed0e7bd37e21094698e9613d
SHA1 d3219a8417e5e06045693fc8f6465c22bff762a2
SHA512 31e56ea9a86dc58d5ffff117692e128752ec5629c0228f0196b9a80dba54871c0e463d1748f9838b0b7e967e9e92623ea9ad327d7301ba93d882c0344ff17cb9
SSDEEP 768:YFIjZbPDwgOemlFMCVlcjWuh126PSp45k4MkS2lPJUH2o:NDDOPtg5NS2jUH2o
TLSH
T17EE23A72D8959DFB9966D6C5A507F2026EB00273C9885A8CE6FCBA3C305F6FC1307865
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 31KB
SHA256 5085f0cd0cef75e7f62c954955c2e022f68e8f97cd1acb3f193bfef4e918864e
MD5 be5d79935e3832fdafbb2c14e84b4779
SHA1 760d4c781517596acae42bbbffaa150e61509de8
SHA512 de8811994d470e19d7efb779ca2c64cc0ac75269ed25f8020a1b6cbda344ad560a6743363e8d966f546b2a0338cbec2177ad86fb05756c8860e529fe6a1082cf
SSDEEP 768:YFIjZbPDwgOemsFMCVlcjWuh126PSp45k4MkS2lPJUH2o:NDDJPtg5NS2jUH2o
TLSH
T147E23A72D8959DFB9966D6C5A507F2026EB00273C9885A8CE6FCBA3C305F6FC1307865
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 f688a5b7a297d6250a1396f82d52a5ed17bc4d588871c902e75c61167ebccc33
MD5 7245b9ec83a790b118be664d9c492f0f
SHA1 bd5216ad34dfeac8307480d4d3976ca03ea94d20
SHA512 96fd69f7df828c9d7c5c8b7ed833722ef68d518a103e2774a9bc879473561511c7102e640b1cf05e3d7f75c535875bd5ea51d67522ab75a589b33b4a70f5df1e
SSDEEP 384:natNnNnb9ZsNq6QembUoL7dEh+CEJrJE/hg2GlP7VUH2o:ajZbv/emXPWuhJE/2lPJUH2o
TLSH
T1A2927C3569396CB79AB3A942F00736136FB451BBD5C42E85EEDC9B0D00DB79C2307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 1ac4d659963ac933e2981ed829997bdaa41613da588fe564523d1cc949ae3a35
MD5 e36e8c4891bd2feead2acf16de53938f
SHA1 ef07b84b6244717224747fcf43a69455ff89998c
SHA512 76666f40235a77f1a56685bea7429407431724c2f10fb1056b73581686a875af79611263d4cf722b447f930cdcd507d74270f7a4769b8a2090e7e5526618f3ad
SSDEEP 3:MsEllllkEthXllkl2zExllYltl:/M/xT02zlX
TLSH
T125440404FFC00545C54010304033D37C1374F41405157743345344137CC55400C00500
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

4d2ae9cd-8433-4328-908b-52ce62890aeb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\4d2ae9cd-8433-4328-908b-52ce62890aeb.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 d740f49341b43974d4356271ca0f442544de297ea93acefe887053b34f4bd9e2
MD5 c57bb2366970c6089db800b1637274dd
SHA1 377bd73f3b69c6d3fed6b602be6e90b1c73839c4
SHA512 25bc44ced21c78812ed987c8100a931f44c90b696ff8d18ebea06c8de8f397678272f4a177e625636347321515089d6e77458c458f76ea65877bdc611322ba6d
TLSH
T15B412A58A7F9114CF3B76F5AABF7A86E887EB9772E06945D00010E4F4A22B40CD61737
MD5 SHA1 SHA512 TLSH

Submit Download

eb2d3748-b7b7-4b25-b070-29547f71b4c7.tmp

Path C:\Users\Admin\AppData\Local\Temp\eb2d3748-b7b7-4b25-b070-29547f71b4c7.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f06fa02e-5562-4e39-b93f-de43710b574c.tmp

Path C:\Users\Admin\AppData\Local\Temp\f06fa02e-5562-4e39-b93f-de43710b574c.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2124_223353338\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2124_223353338\CRX_INSTALL\manifest.json
Size 962B
SHA256 5694c91f7d165c6f25daf0825c18b373b0a81ea122c89da60438cd487455fd6a
MD5 e805e9e69fd6ecdca65136957b1fb3be
SHA1 2356f60884130c86a45d4b232a26062c7830e622
SHA512 049662ef470d2b9e030a06006894041ae6f787449e4ab1fbf4959adcb88c6bb87a957490212697815bb3627763c01b7b243cf4e3c4620173a95795884d998a75
TLSH
T1661121366E2FC4260AE00698DC51308AF92453ADD380850E35BCE42E5B744FA430631E
MD5 SHA1 SHA512 TLSH

Submit Download

5d0c287e-de0c-444f-b489-2fe771e90927.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2124_978248244\5d0c287e-de0c-444f-b489-2fe771e90927.tmp
Size 147KB
SHA256 d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
MD5 a9f7675ff091bb15c88909424bab4a39
SHA1 90f753d8d7e4397de0f49631fcd9222a7f59148c
SHA512 ff1f89fb04ae9c9a4c6cf6b1475f5a77f1c4f90829acda95cb39889b6b15c3b4f0b3b822a668f8ec8520b002cc90dd397cc26d314ac8fd5f3e2c9826bd458df5
SSDEEP 3072:Ph3iICVe1DvTtr/3tOpPu8LdKBTJyU4AshzWnD7UVDvuZE4tkGL:PgTVWvTZPghwln0AD7UV8Eeky
TLSH
T12BE3E01D29E2846EC82B24F4BA4A718FC71ECF07910BE40F25D984A55C7474E17E2EED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4816-1222-0x00000000007A0000-0x0000000000C74000-memory.dmp

Download

memory/4816-1223-0x0000000007D50000-0x00000000084B4000-memory.dmp

Download

memory/4816-1224-0x0000000008D50000-0x00000000092F4000-memory.dmp

Download

memory/4816-1225-0x000000000E030000-0x000000000E038000-memory.dmp

Download

memory/4816-1226-0x000000000E0F0000-0x000000000E128000-memory.dmp

Download

memory/4816-1227-0x000000000E0D0000-0x000000000E0DE000-memory.dmp

Download