hxxp://bonzify[.]exe

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/05/2026, 15:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://bonzify.exe
Sample260522-sr53dshy8x

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
140	5108	msedge.exe

Executes dropped EXE 9 IoCs

pid	Process
5304	bonzi-buddy_softradar-com.EXE
5460	bonzi-buddy_softradar-com.EXE
368	bonzi-buddy_softradar-com.EXE
3416	bonzi-buddy_softradar-com.EXE
1152	bonzi-buddy_softradar-com.EXE
3728	bonzi-buddy_softradar-com.EXE
5312	bonzi-buddy_softradar-com.EXE
5840	bonzi-buddy_softradar-com.EXE
4708	bonzi-buddy_softradar-com.EXE

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4256_458651348\protocols.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4256_1689468155\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4256_1689468155\nav_config.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4256_1542997399\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4256_1542997399\office_endpoints_list.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4256_1542997399\smart_switch_list.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4256_47958612\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4256_458651348\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5108	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134239369624059320"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{6EA3D66E-AF6E-485E-AA36-CD1F939F1D7B}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	bonzi-buddy_softradar-com.EXE
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	bonzi-buddy_softradar-com.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
956	msedge.exe
956	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 32 IoCs

pid	Process
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe

Suspicious use of SendNotifyMessage 46 IoCs

pid	Process
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4256 wrote to memory of 4420	4256	msedge.exe	87
PID 4256 wrote to memory of 5108	4256	msedge.exe	88
PID 4256 wrote to memory of 560	4256	msedge.exe	89
PID 4256 wrote to memory of 560	4256	msedge.exe	89
PID 4256 wrote to memory of 560	4256	msedge.exe	89
PID 4256 wrote to memory of 4808	4256	msedge.exe	90
PID 4256 wrote to memory of 4808	4256	msedge.exe	90
PID 4256 wrote to memory of 2296	4256	msedge.exe	92
PID 4256 wrote to memory of 4492	4256	msedge.exe	93
PID 4256 wrote to memory of 2296	4256	msedge.exe	92
PID 4256 wrote to memory of 2296	4256	msedge.exe	92
PID 4256 wrote to memory of 4492	4256	msedge.exe	93
PID 4256 wrote to memory of 4492	4256	msedge.exe	93
PID 4256 wrote to memory of 3136	4256	msedge.exe	94
PID 4256 wrote to memory of 2260	4256	msedge.exe	95
PID 4256 wrote to memory of 3136	4256	msedge.exe	94
PID 4256 wrote to memory of 3136	4256	msedge.exe	94
PID 4256 wrote to memory of 2260	4256	msedge.exe	95
PID 4256 wrote to memory of 2260	4256	msedge.exe	95
PID 4256 wrote to memory of 1804	4256	msedge.exe	96
PID 4256 wrote to memory of 1804	4256	msedge.exe	96
PID 4256 wrote to memory of 1804	4256	msedge.exe	96
PID 4256 wrote to memory of 4036	4256	msedge.exe	99
PID 4256 wrote to memory of 4036	4256	msedge.exe	99
PID 4256 wrote to memory of 1920	4256	msedge.exe	113
PID 4256 wrote to memory of 1920	4256	msedge.exe	113
PID 4256 wrote to memory of 1176	4256	msedge.exe	102
PID 4256 wrote to memory of 1176	4256	msedge.exe	102
PID 4256 wrote to memory of 1176	4256	msedge.exe	102
PID 4256 wrote to memory of 1636	4256	msedge.exe	103
PID 4256 wrote to memory of 5048	4256	msedge.exe	104
PID 4256 wrote to memory of 1636	4256	msedge.exe	103
PID 4256 wrote to memory of 5048	4256	msedge.exe	104
PID 4256 wrote to memory of 3452	4256	msedge.exe	107
PID 4256 wrote to memory of 5028	4256	msedge.exe	108
PID 4256 wrote to memory of 5028	4256	msedge.exe	108
PID 4256 wrote to memory of 1744	4256	msedge.exe	109
PID 4256 wrote to memory of 1744	4256	msedge.exe	109
PID 4256 wrote to memory of 1712	4256	msedge.exe	112
PID 4256 wrote to memory of 1920	4256	msedge.exe	113
PID 4256 wrote to memory of 1712	4256	msedge.exe	112
PID 4256 wrote to memory of 1920	4256	msedge.exe	113
PID 4256 wrote to memory of 2464	4256	msedge.exe	114
PID 4256 wrote to memory of 2464	4256	msedge.exe	114
PID 4256 wrote to memory of 4860	4256	msedge.exe	120
PID 4256 wrote to memory of 4860	4256	msedge.exe	120
PID 4256 wrote to memory of 4384	4256	msedge.exe	121
PID 4256 wrote to memory of 4384	4256	msedge.exe	121
PID 4256 wrote to memory of 4384	4256	msedge.exe	121
PID 4256 wrote to memory of 3984	4256	msedge.exe	122
PID 4256 wrote to memory of 3984	4256	msedge.exe	122
PID 4256 wrote to memory of 3984	4256	msedge.exe	122
PID 4256 wrote to memory of 1176	4256	msedge.exe	124
PID 4256 wrote to memory of 1176	4256	msedge.exe	124
PID 4256 wrote to memory of 1176	4256	msedge.exe	124
PID 4256 wrote to memory of 5544	4256	msedge.exe	130
PID 4256 wrote to memory of 5544	4256	msedge.exe	130
PID 4256 wrote to memory of 5544	4256	msedge.exe	130
PID 4256 wrote to memory of 5624	4256	msedge.exe	131
PID 4256 wrote to memory of 5624	4256	msedge.exe	131
PID 4256 wrote to memory of 5624	4256	msedge.exe	131
PID 4256 wrote to memory of 5888	4256	msedge.exe	132
PID 4256 wrote to memory of 5888	4256	msedge.exe	132
PID 4256 wrote to memory of 5888	4256	msedge.exe	132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://bonzify.exe
1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x258,0x7ffdbabec188,0x7ffdbabec194,0x7ffdbabec1a0
  2⤵
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1920,i,10309328548496183091,1206349410195896084,524288 --field-trial-handle=2280,i,11192125633018917683,9249515889798621361,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,16349219099503679416,15729603611954317714,262144 --field-trial-handle=2280,i,11192125633018917683,9249515889798621361,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:2
  2⤵
  PID:560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2332,i,10899843435518279556,15414599409713696534,524288 --field-trial-handle=2280,i,11192125633018917683,9249515889798621361,262144 --variations-seed-version --mojo-platform-channel-handle=2588 /prefetch:8
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,15373210593617602381,475130690442241889,2097152 --field-trial-handle=2280,i,11192125633018917683,9249515889798621361,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3472,i,15525916483329915356,11117557489497326104,2097152 --field-trial-handle=2280,i,11192125633018917683,9249515889798621361,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4236,i,13482289533327016861,10235524938176824058,2097152 --field-trial-handle=2280,i,11192125633018917683,9249515889798621361,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:1
  2⤵
  PID:3136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4268,i,13523496017607978976,17034439897136644454,2097152 --field-trial-handle=2280,i,11192125633018917683,9249515889798621361,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:2
  2⤵
  PID:2260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4984,i,8646586262621489060,3889274434680285479,2097152 --field-trial-handle=2280,i,11192125633018917683,9249515889798621361,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:1
  2⤵
  PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5400,i,17634651667239511427,16800853571254230339,524288 --field-trial-handle=2280,i,11192125633018917683,9249515889798621361,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:8
  2⤵
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5444,i,17330360089628173271,2610545125192050576,524288 --field-trial-handle=2280,i,11192125633018917683,9249515889798621361,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:8
  2⤵
  PID:1920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4412,i,4680145243666642344,7217655212048089912,2097152 --field-trial-handle=2280,i,11192125633018917683,9249515889798621361,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:1176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3472,i,10368012068315939899,3463899624405379760,524288 --field-trial-handle=2280,i,11192125633018917683,9249515889798621361,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:8
  2⤵
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3412,i,8036543926122579858,896904777174501360,524288 --field-trial-handle=2280,i,11192125633018917683,9249515889798621361,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:8
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6260,i,11505331582367208329,549949963928104681,524288 --field-trial-handle=2280,i,11192125633018917683,9249515889798621361,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:8
  2⤵
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6260,i,11505331582367208329,549949963928104681,524288 --field-trial-handle=2280,i,11192125633018917683,9249515889798621361,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:8
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5232,i,5858082647188279888,12338627470482153273,524288 --field-trial-handle=2280,i,11192125633018917683,9249515889798621361,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5276,i,13259946352475574866,3280587098936266513,524288 --field-trial-handle=2280,i,11192125633018917683,9249515889798621361,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:8
  2⤵
  PID:1744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6664,i,2119061998470832552,2995044861603050732,524288 --field-trial-handle=2280,i,11192125633018917683,9249515889798621361,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:8
  2⤵
  PID:1712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6668,i,10063649351641684957,4742927396678672211,524288 --field-trial-handle=2280,i,11192125633018917683,9249515889798621361,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:8
  2⤵
  PID:1920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5504,i,14115353744054629214,5539141479101192816,524288 --field-trial-handle=2280,i,11192125633018917683,9249515889798621361,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:8
  2⤵
  PID:2464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5516,i,3312032839520185810,9366639015282197690,524288 --field-trial-handle=2280,i,11192125633018917683,9249515889798621361,262144 --variations-seed-version --mojo-platform-channel-handle=6808 /prefetch:8
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6664,i,3090282233608198136,9960087603125483184,2097152 --field-trial-handle=2280,i,11192125633018917683,9249515889798621361,262144 --variations-seed-version --mojo-platform-channel-handle=6648 /prefetch:1
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=6488,i,6733324254161331934,8007759461840685436,2097152 --field-trial-handle=2280,i,11192125633018917683,9249515889798621361,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:1
  2⤵
  PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=3516,i,4929644747060447474,7989230486835215611,2097152 --field-trial-handle=2280,i,11192125633018917683,9249515889798621361,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:1
  2⤵
  PID:1176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=4572,i,929508601891146124,13515785351267734175,2097152 --field-trial-handle=2280,i,11192125633018917683,9249515889798621361,262144 --variations-seed-version --mojo-platform-channel-handle=4576 /prefetch:1
  2⤵
  PID:5544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=6352,i,7113563996575595956,13256801957878974099,2097152 --field-trial-handle=2280,i,11192125633018917683,9249515889798621361,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:1
  2⤵
  PID:5624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=5496,i,5869297707345439482,11272290042226837134,2097152 --field-trial-handle=2280,i,11192125633018917683,9249515889798621361,262144 --variations-seed-version --mojo-platform-channel-handle=6440 /prefetch:1
  2⤵
  PID:5888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=6804,i,15196222381950050274,6292474210058207899,2097152 --field-trial-handle=2280,i,11192125633018917683,9249515889798621361,262144 --variations-seed-version --mojo-platform-channel-handle=6848 /prefetch:1
  2⤵
  PID:5948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=6992,i,12270287981546669585,6753144591493068847,2097152 --field-trial-handle=2280,i,11192125633018917683,9249515889798621361,262144 --variations-seed-version --mojo-platform-channel-handle=7000 /prefetch:1
  2⤵
  PID:5956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7360,i,15379576706731694273,17409768904410318957,524288 --field-trial-handle=2280,i,11192125633018917683,9249515889798621361,262144 --variations-seed-version --mojo-platform-channel-handle=7396 /prefetch:8
  2⤵
  PID:6136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=7548,i,10652724163762823882,6678972503009386839,2097152 --field-trial-handle=2280,i,11192125633018917683,9249515889798621361,262144 --variations-seed-version --mojo-platform-channel-handle=7552 /prefetch:1
  2⤵
  PID:1512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=7700,i,18360601826931461727,15320705159103318288,2097152 --field-trial-handle=2280,i,11192125633018917683,9249515889798621361,262144 --variations-seed-version --mojo-platform-channel-handle=7688 /prefetch:1
  2⤵
  PID:5424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7732,i,1315559192704643815,5678740568514908485,524288 --field-trial-handle=2280,i,11192125633018917683,9249515889798621361,262144 --variations-seed-version --mojo-platform-channel-handle=7844 /prefetch:8
  2⤵
  PID:5420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7736,i,11031305486747621125,17960292051431760105,524288 --field-trial-handle=2280,i,11192125633018917683,9249515889798621361,262144 --variations-seed-version --mojo-platform-channel-handle=7872 /prefetch:8
  2⤵
  PID:5412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7744,i,6207471880821732607,5139784588374139748,524288 --field-trial-handle=2280,i,11192125633018917683,9249515889798621361,262144 --variations-seed-version --mojo-platform-channel-handle=7920 /prefetch:8
  2⤵
  PID:5404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=7888,i,3609257393762912900,12832040837126947278,2097152 --field-trial-handle=2280,i,11192125633018917683,9249515889798621361,262144 --variations-seed-version --mojo-platform-channel-handle=7880 /prefetch:1
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7688,i,5893326428447011502,5033761824276406317,524288 --field-trial-handle=2280,i,11192125633018917683,9249515889798621361,262144 --variations-seed-version --mojo-platform-channel-handle=7796 /prefetch:8
  2⤵
  PID:5160
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7788,i,7577979084341661729,8718476817019828919,524288 --field-trial-handle=2280,i,11192125633018917683,9249515889798621361,262144 --variations-seed-version --mojo-platform-channel-handle=7756 /prefetch:8
  2⤵
  PID:5840
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7788,i,7577979084341661729,8718476817019828919,524288 --field-trial-handle=2280,i,11192125633018917683,9249515889798621361,262144 --variations-seed-version --mojo-platform-channel-handle=7756 /prefetch:8
  2⤵
  PID:5820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=7812,i,15913215645170483800,11695180397591660682,2097152 --field-trial-handle=2280,i,11192125633018917683,9249515889798621361,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:1
  2⤵
  PID:1720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=7352,i,2755457982379266184,18412790357402679846,2097152 --field-trial-handle=2280,i,11192125633018917683,9249515889798621361,262144 --variations-seed-version --mojo-platform-channel-handle=7900 /prefetch:1
  2⤵
  PID:5240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=5896,i,15192544559759731469,5016125419885513302,2097152 --field-trial-handle=2280,i,11192125633018917683,9249515889798621361,262144 --variations-seed-version --mojo-platform-channel-handle=8228 /prefetch:1
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=8512,i,13746313270321120357,1420468382179491390,2097152 --field-trial-handle=2280,i,11192125633018917683,9249515889798621361,262144 --variations-seed-version --mojo-platform-channel-handle=8500 /prefetch:1
  2⤵
  PID:5380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8104,i,10407640036373021321,11504592138112162963,524288 --field-trial-handle=2280,i,11192125633018917683,9249515889798621361,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7740,i,13943112034786301639,13711077868010808002,524288 --field-trial-handle=2280,i,11192125633018917683,9249515889798621361,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:8
  2⤵
  PID:5496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=7544,i,10705419188025973983,6729320424854569071,2097152 --field-trial-handle=2280,i,11192125633018917683,9249515889798621361,262144 --variations-seed-version --mojo-platform-channel-handle=7420 /prefetch:1
  2⤵
  PID:1852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7020,i,10192319309175784559,11546810047527937265,524288 --field-trial-handle=2280,i,11192125633018917683,9249515889798621361,262144 --variations-seed-version --mojo-platform-channel-handle=7356 /prefetch:8
  2⤵
  PID:3480
- C:\Users\Admin\Downloads\bonzi-buddy_softradar-com.EXE
  "C:\Users\Admin\Downloads\bonzi-buddy_softradar-com.EXE"
  2⤵
  - Executes dropped EXE
  PID:5304
- C:\Users\Admin\Downloads\bonzi-buddy_softradar-com.EXE
  "C:\Users\Admin\Downloads\bonzi-buddy_softradar-com.EXE"
  2⤵
  - Executes dropped EXE
  PID:5460
- C:\Users\Admin\Downloads\bonzi-buddy_softradar-com.EXE
  "C:\Users\Admin\Downloads\bonzi-buddy_softradar-com.EXE"
  2⤵
  - Executes dropped EXE
  PID:368
- C:\Users\Admin\Downloads\bonzi-buddy_softradar-com.EXE
  "C:\Users\Admin\Downloads\bonzi-buddy_softradar-com.EXE"
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7360,i,6474659094809109098,16387969919878381280,524288 --field-trial-handle=2280,i,11192125633018917683,9249515889798621361,262144 --variations-seed-version --mojo-platform-channel-handle=7756 /prefetch:8
  2⤵
  PID:1256
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8488,i,12905979844598089027,14199782322030456130,524288 --field-trial-handle=2280,i,11192125633018917683,9249515889798621361,262144 --variations-seed-version --mojo-platform-channel-handle=8456 /prefetch:8
  2⤵
  PID:5348
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8488,i,12905979844598089027,14199782322030456130,524288 --field-trial-handle=2280,i,11192125633018917683,9249515889798621361,262144 --variations-seed-version --mojo-platform-channel-handle=8456 /prefetch:8
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=8600,i,3579108611803018669,9640762766856299988,2097152 --field-trial-handle=2280,i,11192125633018917683,9249515889798621361,262144 --variations-seed-version --mojo-platform-channel-handle=7972 /prefetch:1
  2⤵
  PID:5532
- C:\Users\Admin\Downloads\bonzi-buddy_softradar-com.EXE
  "C:\Users\Admin\Downloads\bonzi-buddy_softradar-com.EXE"
  2⤵
  - Executes dropped EXE
  PID:1152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --metrics-shmem-handle=6988,i,13770480494875212933,16293710632173186373,2097152 --field-trial-handle=2280,i,11192125633018917683,9249515889798621361,262144 --variations-seed-version --mojo-platform-channel-handle=7084 /prefetch:1
  2⤵
  PID:5884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --always-read-main-dll --metrics-shmem-handle=6524,i,10951095927737701284,5582229944615183565,2097152 --field-trial-handle=2280,i,11192125633018917683,9249515889798621361,262144 --variations-seed-version --mojo-platform-channel-handle=7896 /prefetch:1
  2⤵
  PID:5848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8564,i,5411794798601332274,14895725868315464822,524288 --field-trial-handle=2280,i,11192125633018917683,9249515889798621361,262144 --variations-seed-version --mojo-platform-channel-handle=7580 /prefetch:8
  2⤵
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5764,i,13116599513436132266,10507219143622484297,524288 --field-trial-handle=2280,i,11192125633018917683,9249515889798621361,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:8
  2⤵
  PID:6084
- C:\Users\Admin\Downloads\bonzi-buddy_softradar-com.EXE
  "C:\Users\Admin\Downloads\bonzi-buddy_softradar-com.EXE"
  2⤵
  - Executes dropped EXE
  PID:3728
- C:\Users\Admin\Downloads\bonzi-buddy_softradar-com.EXE
  "C:\Users\Admin\Downloads\bonzi-buddy_softradar-com.EXE"
  2⤵
  - Executes dropped EXE
  PID:5312
- C:\Users\Admin\Downloads\bonzi-buddy_softradar-com.EXE
  "C:\Users\Admin\Downloads\bonzi-buddy_softradar-com.EXE"
  2⤵
  - Executes dropped EXE
  PID:5840
- C:\Users\Admin\Downloads\bonzi-buddy_softradar-com.EXE
  "C:\Users\Admin\Downloads\bonzi-buddy_softradar-com.EXE"
  2⤵
  - Executes dropped EXE
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6056,i,2329790153248229081,8718117839868554079,524288 --field-trial-handle=2280,i,11192125633018917683,9249515889798621361,262144 --variations-seed-version --mojo-platform-channel-handle=8584 /prefetch:8
  2⤵
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7044,i,1116218251606177612,211997604041468867,262144 --field-trial-handle=2280,i,11192125633018917683,9249515889798621361,262144 --variations-seed-version --mojo-platform-channel-handle=7732 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --always-read-main-dll --metrics-shmem-handle=7816,i,17723212430219838500,11197650133806961020,2097152 --field-trial-handle=2280,i,11192125633018917683,9249515889798621361,262144 --variations-seed-version --mojo-platform-channel-handle=7036 /prefetch:1
  2⤵
  PID:5940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --always-read-main-dll --metrics-shmem-handle=7108,i,2509300258109289332,962533467243283373,2097152 --field-trial-handle=2280,i,11192125633018917683,9249515889798621361,262144 --variations-seed-version --mojo-platform-channel-handle=7684 /prefetch:1
  2⤵
  PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --always-read-main-dll --metrics-shmem-handle=5844,i,734017616726416012,7723158333564308891,2097152 --field-trial-handle=2280,i,11192125633018917683,9249515889798621361,262144 --variations-seed-version --mojo-platform-channel-handle=8600 /prefetch:1
  2⤵
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --always-read-main-dll --metrics-shmem-handle=6820,i,6386486965977299664,4461399035376343919,2097152 --field-trial-handle=2280,i,11192125633018917683,9249515889798621361,262144 --variations-seed-version --mojo-platform-channel-handle=7440 /prefetch:1
  2⤵
  PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --always-read-main-dll --metrics-shmem-handle=6956,i,16442292241569403022,11195554175602250790,2097152 --field-trial-handle=2280,i,11192125633018917683,9249515889798621361,262144 --variations-seed-version --mojo-platform-channel-handle=6972 /prefetch:1
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --always-read-main-dll --metrics-shmem-handle=7344,i,6123149413171503713,13878854470471830708,2097152 --field-trial-handle=2280,i,11192125633018917683,9249515889798621361,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:1
  2⤵
  PID:3868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5552,i,15590954963213962475,5747956101255606458,524288 --field-trial-handle=2280,i,11192125633018917683,9249515889798621361,262144 --variations-seed-version --mojo-platform-channel-handle=3992 /prefetch:8
  2⤵
  PID:5916

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4160

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4880

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4256_1542997399\manifest.json
Size 160B
SHA256 2a7fe18a087d8e8be847d9569420b6e8907917ff6ca0fa42be15d4e3653c8747
MD5 a24a1941bbb8d90784f5ef76712002f5
SHA1 5c2b6323c7ed8913b5d0d65a4d21062c96df24eb
SHA512 fd7dfec3d46b2af0bddb5aaeae79467507e0c29bab814007a39ea61231e76123659f18a453ed3feb25f16652a0c63c33545e2a0d419fafea89f563fca6a07ce2
TLSH
T133C04C23ED18BABA12F587D40971DB43F7F0031B34E169463B39948C5F761B8925175A
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4256_1689468155\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4256_458651348\manifest.json
Size 135B
SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
MD5 fbebd68ecaa98928909421f66909c054
SHA1 99d787d90f7ed2e5ad924f9c5668eb988b5a6c07
SHA512 749a3b2be47fe28399dc763888654a3e8d397e06e8d3c3af3965bb45846a1336e6ab4ca82c82c3df846b34a2afafa2156f2690e9bf347ab175408dc0171c61cc
TLSH
T158C04C668D51DEAB00A747A56B295315E23B4B4B5044800A7AF5429C1A288964171944
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4256_47958612\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
Size 3KB
SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
MD5 1de85fec2dfcc28011a7c2aaab95eb5f
SHA1 80e8c954bfbe8f7ee5a2335c8d969ae033935dc3
SHA512 9c7dd37eb0c094b6aa05201e7c71a8f33b9db81284223bcfa595a44a6ac95d5a6820ab6f07b7aa8d26bf207454e94277bf35332e9c009ee63f083752b6b51750
TLSH
T1D1611DB79A3048090E3412B86B19B35DF63E029F1AD598EB76BE568F1F710F7245C54C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ab98da7535c8de464335204ae97fd672936e639269325c3a388b3039d8396b83
MD5 1656a3560c7aeae221756f3891b89fd3
SHA1 e48441fe2b843ba3bd0bb7799c07b22a27db8eb7
SHA512 c06d7152d11e33601716d4c5c33c7373ac4e0c16571e80ac4a8ffb9cabb52fae51d4fe8d808fc75be943287b55a320e90a186d71a5f06e9db006f6ab89266400
TLSH
T1CFD09B307B597042D3074031E8074790169E84B5249B86066554410D7D5A485E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ec6419a915c6f94199df67c6cf1d67bc666c22ef160c8377d6792913a6518679
MD5 a8d0099e5966b86c13c6997282a63770
SHA1 df541b93a0caebe364906ec90c768bb625495f4c
SHA512 a2093c42c3f547b910f560ee7a58cb187cef96045e8e335276c7bde87fdc5e9894b670421e94170d0878e86a2bea8125d914e11181882004f966732f9670a693
TLSH
T135D09B303B597442D7074031E8064790169E84B5249BC7076554410D7D5B4C5E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_0000a4

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a4
Size 21KB
SHA256 64dffe36b3f74b0eb4364261c78568b6fe79c9317469e82ed2a5529e79241f44
MD5 7d86312d3147d1cfce62975efadfc067
SHA1 fea5270287330285c68d357a7686e6e11779b5b1
SHA512 14416ce9a505d86e4d9c7143cda541a75a5c0ff15801819da7855db7633452b3f8a2df6d9cc7cf088c542cb06bdf2817c3e7f2aec6cd052a1480e0851a1d196d
SSDEEP 384:mhsinpfFSQcv7TmNJZ8Dbz0uiCMHZULI/iquwAAlylI+FvV00oCVTumX4SjXR+Tg:es8pf/cPmNX8Hz0rCMSs7gZkCtNX4Sjh
TLSH
T1FCA2DF6A74CA675A938352B62B7262FC315AB2FC7803E44A7B62B30317AF5403D5E854
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000ac

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ac
Size 50KB
SHA256 55a8112118cb49a6db43a5ed0b2bbbe90e2c903df34e9c971540ad51a6806688
MD5 68ad14a2a2ccb92c8c787c4c793f77ed
SHA1 adaca5f9aa4f19c1b8a561efe1b13c4bf6eadd71
SHA512 0449d2902b1dcc1d17cf2860204ebefc9966172d86343e87cd5fe5353888c86bbef2ce13d38b61994dee8ad3f388ac178092caf11ede00bb2ae692d6790510da
SSDEEP 1536:YtiUkcc0dLvoE5W3uVJ7RvwbwVnREctYtCdT:SiUkggZYlYtCdT
TLSH
T13E3302FF64D5A671F04BD66F271ABE7032481B093A9021D39CEDEE4C1B6BB9D7920504
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000b0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b0
Size 23KB
SHA256 5151367b8311232adbba11729303522bf46a99bad534fb9d8e49654ac175e119
MD5 99fa697c6667075f430f9b76c02d51b7
SHA1 ffbeadc35ed8dfd83d09d541dcd8661555395dd5
SHA512 50b3762cee30db460628acdaa9b7c60398e740f91e7427493e6a0a878df9f5e34a30fd0289a3e891f5b9ee450296ef4ced5d1bf68b30638fa61987c13815ae4d
SSDEEP 384:2n0TZ18RVcxjtciEaNHA082zfVQdopSkLypncXFzetSdvT/UwEh4T20D5mWETL6Q:c0N1uajt6aNHAJO+kLypcXFCtSFT/1EP
TLSH
T109B2E1E3EE5C56A85F1527C120AC9EEE5D080A1BE5E9994EF580C9F3CCD3E600719AC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000b9

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b9
Size 18KB
SHA256 8703a76d7c48967feb7abffa75cc6c4f1b632a00dacf775c998b41efe1878176
MD5 fc394f83566e212db63ec44cdff9317a
SHA1 fc909d963fe63069959b6f927de9d1576057f897
SHA512 7881765551433c3d8530f598ea7b04a5b41490cb87c6f0fff3fa59f23bf7016ed78179101ee503c13165660264401bc400f493e4d9b5dc4f0d99e6eac87b7d14
SSDEEP 384:jFgkdE5oBEHM8y4rtvd2WEpArefsVqamlSLMK6la6FHjnNTww7TKH7t0g:j2kdE5Fs8y4tMWmO7VzchbNHKH7v
TLSH
T1AF82D1C5386A22AFB203ED78465BB6B014F5EDA3484CD94F1BBE36E98525690BE44C09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000ba

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ba
Size 51KB
SHA256 c35135cb4e8e6a4d1c9cc60ff9b0e8fb23d5568cc69272ee6df455afef52e2a1
MD5 529b5adccd0797228915db17b3ed99ca
SHA1 78b4c38dc561a81c96a05912a28f22b4a22e1866
SHA512 53ab629b320f633dc9bcbcbd71284c0b8c36767beae6fb6e4e83171d226de9c88347787e0cb93d263704faec7465189c3913c112f6afae39d4bb0e8cb12276b1
SSDEEP 1536:13HtckVrCyymEspIQVRwc1NBCdRnF8SVWCD:1ik/pIQ/13BMWCD
TLSH
T12E33018BB1D4E43BD8A5A5FDA39DAC2ACD8282C58ADCEE335300164D033FC73E695915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000bb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000bb
Size 51KB
SHA256 8e95246891091131d753fb3af619af7404a96b8f0f251a4f1178a0f5df99fdcc
MD5 1dc2969f93ccfdc026d8a2f7926d503c
SHA1 223dce52d5a4561c58ee8a1540bb26c3fa1fa73c
SHA512 571f95958fd6859da85d3b5109c52ff49fee20f4d3236a2342f3f39e8621b508a063103b0227ad51e22dc09e0d9a540c886cd6ec3c31a189798e4ed8588bedbd
SSDEEP 768:zh3HtckmdrGW9JfmZEQaENVN03x1gikZbBryGtho1CMWYufNrvvaPGSz2E5Ylw6:l3HtckqrG6fEHVkXO8Yo14fpSVz20CD
TLSH
T19133F2CCFB99D616E5753CB3259928018BD800AC03E9CCA95705AE8CA33FB378AC7355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000bc

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000bc
Size 91KB
SHA256 9591e031449880d287eb6289f7580e8328c0889056c396778b03b249b64ae2a7
MD5 806d7c3016f9e4d75a297898985033a6
SHA1 097e7553f5d585d458d5268e06ff8b2942ceaa60
SHA512 8113ff24a0c71c258fb37e899afa9125382809e4d4709936c4348b3bc9499fb87e10350a83096b61c24c22c0a7e07262045576c77ea1662f9bad3ed673d218e0
SSDEEP 1536:RrnFZoLXVN8E9l+sjK9dpBVtKdHKGNxiVcBjLYzki5a5Mjoy8pRfa+vX:1oLFLOsm9dRtSHKIxCcFYzt5a5Mjoy8N
TLSH
T1C693127EA1B246F3F809993F9C4FCFC258816E5E67BEC22119495E25E80B4837314927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000bd

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000bd
Size 91KB
SHA256 b746587b04bfd7e4d1011a6ac3d5e967a2d9df351d43137f6ece6a3a452d1dd0
MD5 2f4aad557670f226aa5df58d531e4e3c
SHA1 c274d2a4e9ef24f862b9d72a754e6acea0ae92ef
SHA512 321bc23df4e3b610df79c26c3c21d5c4694f89543049e33aa7858069a7fc81adc4e447c54e3105ee69c5e67328ec10307370f21b75a947759c9dd465f6915b3d
SSDEEP 1536:7S+Hm7+mXKdrjLJn8In7jt2jHZjWXCH9JfcOM0bCYzki5a5MjMcm62Cqvhvd:G+mXKdLl8Invk79WXm9p0WCYzt5a5MjQ
TLSH
T11393127D4CBA191EB78CC61B98357ACF446033D9FAA380F43AB6591E4D59F9F1B00426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000be

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000be
Size 29KB
SHA256 0ea3a6ac5a11f7b18f9d644b89d495c42d4b59b4af2e1197050f610e62c40c1c
MD5 7124e8d35ca88b8465bbd882cb258f9c
SHA1 76ee6350cb5ec51a9011829d83ce576ab469fc0d
SHA512 471041054a45d542bd6015d574f6b5afcf082fa20cdc00097f3706d0fbb087b9870138ddd01fc09454b21dd50e9297bb664f4cc577edfae02a879c80bcdf07f4
SSDEEP 768:PxX4Xg//L+jEUEfRWD46oVbmhF0JbW7JFpOCpXRxnVnVKD:Piw36A+D4AF2S7Jz3zVVU
TLSH
T160D2F1B95FF12465FDF4DE71E59981EA1F49B5128A98CD701A2FB2FA1023181A83B0F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000bf

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000bf
Size 31KB
SHA256 f0ef7ee8e55facd721d2f1e68ad4304b0418a3d36e141ae54876ecad4e6c5466
MD5 0598c1512e2c76f6158e3f35565bdc54
SHA1 2085e14c07894d708e2b1252f0660efe04a88448
SHA512 64aecb4bbf9d9e2a92bb0a5f42c5c44a6d1d23a9c5bcb1ff0ac4477eb2182005e5e71e43d8ce7be9f4b645f26f3ee17e7be4ee468e172c24947a4e4fcded07a6
SSDEEP 768:hhkiL35OPRqctallBchiZNl7bW7JIFeDeMCfzzDp:75OpqctaNchcNpS7JIqazDp
TLSH
T102E2E1F07AB09D6601E056F7A246C1E328E2D2C35A85B28CECF53141E4D91AE6F5E0F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000c0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c0
Size 41KB
SHA256 6b23e94dfa260fe97e76f3c1c043a5186edb3d0990e78e2e8a56b5583c202320
MD5 064cd8518b3757e0274912a1150013bf
SHA1 46c101f4a2c40433de86ff94f7777d879c5b530f
SHA512 42d13a8ac565c5504b4c6af1a65c66a1a4773e3f9ef461e04505f17665b833532e14831ceb49a0d5b3c6009149d7ad3017657cb9d80ae566d50ad39610e78e7c
SSDEEP 768:kY1YXBl/VYmgSpiiHRXlSATpSeX4lxn8r61vKyJUlrd6mcxRsFBgNceWtE:FYXBl/iNSpicXS72r61Hyrwmcxe3XE
TLSH
T1FC13F1C876FAF16CC60E1DBB278B97DAD737D895B4D14E34678A9F1CAA19C0188C00D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 7KB
SHA256 80d1b82f40570b02d2d705aac1a99aa7bafd7e2c6631399b287119939188fd78
MD5 741295597bca2da7e27af129eb34cf3c
SHA1 e8f8af38d13b0d76c00e89df90cc438d40338b11
SHA512 469faabd2a5544fd457cca8c6665f5385dca4b13f66d7c7bbdc4b346ec7bb082d4b579e4ed2f3c41b184a8f8ec4d125be89bcc1f05009ce4a9774a3d087de69a
SSDEEP 192:lNblkTlRclPl4lQlTlRleDlcleslYClRlJlhllluni3lblmlOlGlXlQnlElLlrlR:lzGidowpDWUeEYmDrz/1BSKy1QlMRxys
TLSH
T17FE1A73B20830BBDEB26613B44CE185E76F2C9E0F0135E8E3816953294A2B99CDC7759
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe59b905.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59b905.TMP
Size 3KB
SHA256 212b1d6d2296c91869c4aab26b55afb7dcc6bb8227af129fba7d4e31a3101114
MD5 4b943417a01e030dc98dc86269517d23
SHA1 a61adf55425e3421a41a7978f02cfe6fcd1ca9b4
SHA512 0879b721c78c44b32325b21ae592f99a8bd3f5a88f0964d387d784fc1475dd8620e8d0efe423031ad28b6f86958f60f15cbd06ff887f2ccc440f90287bd0cd81
TLSH
T1A5715F3820474FB9EB22A17388DE209D7B3082F5F4125ECE5CA4E67565E1329CEC6759
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

35f14d0c-d147-4f01-8751-9a1dac536041.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\35f14d0c-d147-4f01-8751-9a1dac536041.tmp
Size 211B
SHA256 a4f528687ce7fee603e39bbbbf263c3122ba09e63173bfd2eead52a611d34113
MD5 3aa540b5929d1e4bf4cfab5d4d5b2f44
SHA1 51c276858c39e659ead417383aa5847e285877c7
SHA512 ed74b2bcc054cb0052882bd9787e646f58b27908d329bfb6140d8890b8e25cc9262ee236d56991b1c12943a31eaece4146b4df4fc243ef66384547cb3ac05245
TLSH
T1FFD022F32315B1F9E56C2E9154AAACAFC33A20281D82DDDD68F098DC053146D0917344
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 17KB
SHA256 fbc1052803d0c0de9dbf4255a772d3b447d674a2ddfcfddfad2ff61c52cf3be3
MD5 e2e041e6441655cb4984e0e2af7d7c1b
SHA1 70045c09acd4e0717d0b9a867322732673b1cf08
SHA512 d40909c67f8828cd13d64dbc4b2e934adb120e120d643e6e81c0622fa0327469e1d7cd82b256028c3f992889e9bc9586e401c4fe11c86f9c0637ee7e5ab8a624
SSDEEP 384:DjNq+6fZ0XMVXJTyDeeJS7cKeBHfJc9J//s4WPljeBakGYx4gfsvVNOiXTTpp++Z:GJK48dzenO9bFd
TLSH
T13C82EDF3C3E5972E991116F066646E1BCE0C09188B183C77C8ECBF8B93E6471E61661E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries~RFe58f9bd.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe58f9bd.TMP
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 fe22cc545081fdd17ec3be2ec38c580b88224f8b5ec0ac41cf9eab3e43dd30cc
MD5 c59521aaf2f3dafe13412a5e2946fe19
SHA1 e1df92f36b769634a861cdd1e7d9599766b3d58e
SHA512 d6683a083861ed3f46532a179199f95126ad0b7ec86d9786f992db048d172ed2905d829469432688cabf4e033e7a14b56486ad520944f98233b4f4ebc97a6b29
SSDEEP 192:sxZgR9yM/jK1Ml8M0cB4a/fss2Cnr+xXjgdpTeQGHW6+WNiWq/Yz6wnIg4ItJZR:sxZgFsm4a/fss2k6asHbq/i9n
TLSH
T19A72C7526A24C977CDCAD609BA75BF53D7F50463DA504D5CAAFCC90C00AA6FD220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 f071ed5fb7b416916fbb2b5c2c4d8d91b941cae449150b2c344e1feb2cc4ec86
MD5 14fcabbea42546525e9326792f7e1b73
SHA1 565a06e5753c3fe932879f9a6332d6d6b9f52433
SHA512 2e72503a3faf263cbc60662f56883b97cb428b265efdb57f88766ecd3bf4ab2daa9d33fe89967f6ab426aef509954b63a989232e9d3bb6b0abcbe3ed665e588b
SSDEEP 192:sxZgR9yM/jK1Ml8M0cB4a/fssdCnr+xXjgdpTeQGHW6+WNiWq/Yz6wnIg54ItJZR:sxZgXsm4a/fssdk6asHbq/ijn
TLSH
T11472C7526A24C977CDCAD609BA75BF53D7F50463DA504D5CAAFCCA0C00AA6FD220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 196e370440c9f559e3d4da5c5fdef47a98707a54b33c61ba61c2a0a4494de6a3
MD5 ad7d8b5f25c9f2d0ec7e044d7459df63
SHA1 accbcff3636a77ca79f950e5af5aafe125d17d99
SHA512 554ad7a9524bb97e532660a32bb58ac131444ad3cd8bedef54582c70b6ed0c38487971bc4c206089a667099e5c1c881e67b50dda56904fb3cbb853a0b2dece7d
SSDEEP 384:sxZgXqFmha/fssdk91yHbQd4XrC/yQrAsVFhn:sY6Fmha/f+9AHbGOW/7pn
TLSH
T1FD92D9D3A5348A778DCAD525F561BF6AD7E50473DA904E88AAFCC90C00DBAFC6102C5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 a298cf9e9643d1fcd294a52faacf3b1383f507eb8e9dbb7259e2c837a1b90e11
MD5 74624ea50af60926ea33167d53beb6e2
SHA1 e37ad02a1961f3158a9484b5e93c9f32f1f0dc95
SHA512 00accf66d288ae9782097e67512f69248057548000e4bd288fa0994aea9e8fed58163f6c60d35825ac7a16b25fe977e68123f809c9322b0fb0df8b23f147018d
SSDEEP 192:sxZgR9yM/jK1Ml8M0cBha/fssdCnr5xX6gdpTVQzfHW6+WNiGC4XrIJthNrkIz6S:sxZgXsmha/fssdk9f6Hb64XrdyVHhn
TLSH
T13482D993662089778DCAD519B5A1BF5BD7F50473DA504E98AAFCC90C00EB6FD6102C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 bb91823e107150d334c9f9646f215b4e6368ea4ef88aa8ec6c8aeee60eec8923
MD5 f25e0d3f826490f2899e1114cac7189b
SHA1 51cc43f5ba6f5cca0f89a52804ae88f78c85eb91
SHA512 45782e1803e5b099ce09f003847953d17837938d529ea78c97e9a52df5c8e9e82448df612974c330a3d3310acf9c27f477c0543387aef29f9af6972571af3a82
SSDEEP 384:sxZgyqFmha/fssdk91yHbQd4Xr1D/yQrAsVFhn:sYdFmha/f+9AHbGO5/7pn
TLSH
T15192D9D3A5344A778DCAD525F561BF6AD7E50473DA804E88AAFCC90C00DBAFD6102C6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 78beba17e5a03922a067d87931f6088f3a9368b8914eb7cb11cf748b02f0e3ed
MD5 dd0afc6c7a40891b6ecf6e1d69746a9e
SHA1 e3c7caf0656ac184cbe5d8acd29d742665f060a4
SHA512 a4028a61bf873c3f899d03bdedc6e74cdec03bae3b0ee5ae07b2598a13f09f2bb6fb240b18d450677e179c53a19135e9e319ac3a454ee3838a817395ef3c3c93
SSDEEP 768:InW7keO7pLuLX80Wvqida8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhlb5LlWYSj7ro0:InW7keOEX80Wvqidau1jaMlb5LA3jIn0
TLSH
T152F20B7B780CCB7E4F804E9CEC2A7E9A6DE8018B96D8C95447FA844C03C66EB15175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 4dc892d1bdb986b7779063d156dfdce77317f8186e310c1c8dd2d6eec6ad70a6
MD5 3f050509586c0c62315069b766fe4737
SHA1 a4fa28248f41fb4ba37f20f001d1c6c53b5cf9b5
SHA512 46793f63c90cfaf35706b789277fad6152b66764165e25d55cd2e58100f5a1e61cc2bac76bc9f98d834c32ccb9384c5a50ac0d456864b30238fb6bb5a5374be1
SSDEEP 48:KfSVOyIQA2aQL9IZy2KYTfJIdKiQoPyVvI5KYIM0sIrKh7:KIbCKcfJiKiQamvGKYIvsoKh7
TLSH
T1C2912496733B0601387D2848975A9A374E4331A3741DA4AF7BB801721E67F211EFDADD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe597bed.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe597bed.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

office_endpoints_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2.0.0.0\office_endpoints_list.json
Size 3KB
SHA256 8480f3d58faa017896ba8239f3395e3551325d7a6466497a9a69bf182647b25e
MD5 94406cdd51b55c0f006cfea05745effb
SHA1 a15dc50ca0fd54d6f54fbc6e0788f6dcfc876cc9
SHA512 d4e621f57454fea7049cffc9cc3adfb0d8016360912e6a580f6fe16677e7dd7aa2ee0671cb3c5092a9435708a817f497c3b2cc7aba237d32dbdaae82f10591c3
TLSH
T1F681BE27C5B58E2796F060119750E654F53D43AFA600C6AFB5FC825C2F373ECE88A4A8
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 5e8874e158e07be9f59cf2f905084864d2ab3a2bef491c9e2fc6c36352493bea
MD5 163dbf5cac243f88d516a0111dc760bc
SHA1 9e9bf19617026817443bd8de81ae8a3e873d9d63
SHA512 37736b39411d444bdeb5d28a0adfa978ecf633f0a098c7f4902392196c66411475f6b74ba062355581881429a8b3f9682454b5f4e6cbbfea6cafd61528a60ff3
SSDEEP 192:MON364BAQmiUyE1wW5GBPKmx+FdG+Po5Z4aDYZ6U6:MON36eAXiWldWF+6U6
TLSH
T14B02E735AC796C7B9EB2AE45F48637175FD8113BE6C12B44EAE85B1C01A735C230382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 2575030aa053d44d5a640aaeb6c332469014b4e5c03fe8c748ff93d7fd9010b2
MD5 80e5d75b3d08ff922ee909b9b7492e84
SHA1 f29272790703fc187e3ae82583637f97af5f8f14
SHA512 03f2ba97e9ec5299a3edb7fd437aa8172a3577c724abcbedccc1d120f2c90e7b7e6365497ef0fba6fabd6a14af0d55f4b9c75cd6c6d58072c1e0824e6353af1c
SSDEEP 384:nKiF4tNnNnb9M0sNF8TUNTUlIl3sbhnOYZxfxSdWGim7HR56kfkDO0Qd1:BF4jZb92wguwoSoGiuHR5h0I1
TLSH
T143E2B5F198E78976E9AE4783A37D2D469EBCC16375841990FBD81D0CCC822BFD306805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 e90bf9a06e247dcdee16567396352134bda7881675af67cf4e98f5f4efc002da
MD5 7fc2918ecdb9fc69d26ff4582e38b842
SHA1 42e139649bbcc6a01c30cd8bebe92265fa16d05a
SHA512 efecbf8588d2e3713fe31cee2228c9d959e313f5dca2822a61071d2d344e317b28fd07a96560bf0e7d64076238bd5889e56fee3169a3a9e5db1125f9f4a6f62a
SSDEEP 384:nEtNnNnb9ssNu7sbhypYOdWGimyR56kfkDO0Qd1:EjZb+OmToGiTR5h0I1
TLSH
T16E928D715C796DB79EA66A42F08636476FB8107BD9C42E90FBED570D00D73AC230291B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 177d4237bf48c77199d013bf26b95b5b9f6fe042b3a233f47de1194e47fcab20
MD5 d96a3c63e4330b7e78645ace20bf980b
SHA1 110efb6cd265819c9528349d393db20ead131f76
SHA512 ec3dafbf2a361775bc3e8e555114fda8e69852471907b016bdb82cd6bcf0375c9a74a1cba5ee3babaf3736baaf4ef1c24fe36c1c03367381ec74fcf674ba0bec
SSDEEP 384:nKiFKtNnNnb9MysN+8TUNTUlIl3sbhTfYZDfwSdWGimHR56kfkDO0Qd1:BFKjZbbPwguB5SoGi2R5h0I1
TLSH
T132D2C4F188E79936E9AE5783A37D2D469EBCC167B5841990FBD85D0CCC822BFD306805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 10ebd6f994da88b97afbbc9928040b1100f7ecf9ded14ed42ef4e089ffeee63f
MD5 88895a683cfbe491ba5550536dac0ce6
SHA1 3c97548c6eb1095cae36323ece57f243c50bbcd1
SHA512 0dcf06cddb3b6f1b7bb99d27f77196c9100ae6b132cdb6aa9b83c1cc772d7e7ab2ddc16ca0ea40cb68f54bb0a3352fcf1877663ccd27c88ce0d601e0febc51aa
SSDEEP 192:uu3LsNugQNBbhmoQmiU1e3T4aGBPKmx+FdG+Po5Z7pEimMLdNGr/G56kXPc1DNfC:nbsNugsbhhicOdWGimyR56kfkDO0Q3
TLSH
T1F4725D7168786C779E766A46F4863A039FB4107B9AC52E54FBE9570C04CB3EC2306D1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 698cd32514e1833fd60c36221a6d959b0025b265222c6e7d35b8c1c4f12d645e
MD5 6adc98db250afc312317ade0672a874e
SHA1 8c27e57d1cb45fa4af606d3beee6d34d6389a1d3
SHA512 6c1cca3982d6350b37b83ae59d3a2256556486a4e1da92be002020fbce458e5f8cca0102ab98bcb57f08b23c29ed4a960bc78d23bf3b7b18bf9fae7cc717f641
SSDEEP 384:nEtNnNnb9+sNu7sbh+Tt2OdWGimyR56kfkDO0Qd1:EjZbEOYt9oGiTR5h0I1
TLSH
T1EA928D715C796DB79EA66A42F08636076FB8117BD9C42E90FBED570D00D73AC230291B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 195eeb2abaad38ff3793075ffca9be956a257d931bc9a3934378117390dcdcdd
MD5 76453000b918bad4a45732dfa9aa61e5
SHA1 6e878cd020156d8a75c3c16efb77f8178ac9b66c
SHA512 b2c7dd93d511f873e2f5e1995d912474097d6e7da749cec45c3126dc1dc0188413cd9b5d43f64186ff9a77ed211efd82aa98dbd22f23df63b5e4b34906fb6ef9
SSDEEP 192:MONf64BjQmiUyGwM5GBPKmx+FdG+Po5Z7pEimMlWwGr/GU6:MONf6eVwMldWGimWRU6
TLSH
T11A12F73568787C6B5FA26E42F48736175FA8213BEAC52F44EAE85B1C01D739C230381B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 525cddf25eee8d3d77e8a153b0ad4c204cbac952a3752e7bcd4669413c6ea382
MD5 61c8deb293623f493a1333f1dff9795f
SHA1 12b54c50759fe23006220ed33ce38eb4f55dec87
SHA512 b5e3d0d97b7c2b75017f24e0f7f183f1426f5131a48829022581089d0f464ea279c9cf7bf299bf19e3443728960c715bf25a99150404486329b4329bb0962d3f
SSDEEP 384:njtNnNnb9+sNuysbh+1cOdWGimyR56kfkDO0Qd1:jjZbEdWXoGiTR5h0I1
TLSH
T194928D715C796DB79EA66A42F08636076FB8117BD9C02E90FBED570D00D73AC230291B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 ff4e6e98a9bb0a29ea6a800744ffb78f92113fba765f5c8ff9e325f43ff23bbb
MD5 493d1e2d2937cb666bdf8e14eaca6579
SHA1 d0656253fb09e968d2d8f9ee51ba6784b588bbd5
SHA512 0545b7b8272bba4fea490d2c659268314340e889dbc27f30ee4dba15c8891148182a2323eab88f5e6eef104daf2c5600dc4bb430002069dba999d7a8e383347d
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 76b225afb21459ff69214369bb42518c20cd76bdf5e0a16ee37ee15b57f41047
MD5 4c4ff280b23ba88d831f0b9120c8153c
SHA1 2ca4eb32298773142b1b0d141df5eb575966bf01
SHA512 f4567e40727f5e091b5bc3295e011905e83305c0513cea48b9095455f0239d779c5d70d614baba2eb2daa75e8a8cfdc949c485d61f8b90b20f852d948a944ada
TLSH
T1AEE00147E70452BFC02C4B3485E71B312FA7C07406E206061F2542693CB23803FB1EC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5923bb.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5923bb.TMP
Size 392B
SHA256 4f6d76c18fcff915b32da1f7e69f22749b38781488ed114f635b6a692c1da80a
MD5 61b782d89cde53364b1df6b04b428a53
SHA1 b1c36a1f327685b01157a5532b362f1a86cd3c77
SHA512 a3d066ab3ed30331e45576ef22dfb67d543f8926e0c356ce0ab37d6c4977b1a092d4a0482ccf33b6f5887614098921e65fd1623977636d1f4a7c812e3578c4ca
MD5 SHA1 SHA512

Submit Download

nav_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json
Size 2KB
SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
MD5 499d9e568b96e759959dc69635470211
SHA1 2462a315342e0c09fd6c5fbd7f1e7ff6914c17e6
SHA512 3a5922697b5356fd29ccf8dcc2e5e0e8c1fd955046a5bacf11b8ac5b7c147625d31ade6ff17be86e79c2c613104b2d2aebb11557399084d422e304f287d8b905
TLSH
T16B51DB73D5988C4B9BF4A29CE919A309F11107CF75D48C0B76BE010C1F7757AB5C6588
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 30e8b5d48a130d6bf81847b89c208c7a087525e9b7d9a0a97bcf21598332b63b
MD5 bf165c172af1f75083dd4c7e8915ad0e
SHA1 2eb27e18672fd0a1816ab00d00078a570eb62711
SHA512 a58ad7ee2e18750242b9c5d53224218bef54ecd50e067170da12510559c455979fb0523044d4c23d5d5a523562165e471f95d939376df623bfdea9228ca25256
TLSH
T181F09ED29D7E36C0D6E50F6ED44B64FC40D89506F05CB579484CEAD8913950B254287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

115afd6e-c946-4f85-a70b-9f4d5b629c38.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\115afd6e-c946-4f85-a70b-9f4d5b629c38.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 759bafd74b3a86529dd70b70242944523cec56ba3cf7234cc5fa53bb6fa6f335
MD5 5b5e746989f86d6a10e28676962018b8
SHA1 8b5b4a0efe553912b7f5fb2e335f48b32cc78cf7
SHA512 ed7e03ea1c6f6ed0eb459046832a77205dac88c594c74db17c1915622fbb9e7b1ad1c2ea2a1689a09f32490b7324556e130460ade4eddc7c9fbd7e91f87e7242
TLSH
T1FA41D99CBAFA1148B3B76E5A6FF6A46D487A7C372E06D55E10010D4F0A22B40C962777
MD5 SHA1 SHA512 TLSH

Submit Download

1280050a-3257-4cdd-bfe2-fa6122c4a9f2.tmp

Path C:\Users\Admin\AppData\Local\Temp\1280050a-3257-4cdd-bfe2-fa6122c4a9f2.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

71b822d0-a5f7-4ec2-8e00-e2c39d59a560.tmp

Path C:\Users\Admin\AppData\Local\Temp\71b822d0-a5f7-4ec2-8e00-e2c39d59a560.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

41e82435-66c7-40ab-9f91-cf4425523bae.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4256_1859581677\41e82435-66c7-40ab-9f91-cf4425523bae.tmp
Size 147KB
SHA256 d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
MD5 a9f7675ff091bb15c88909424bab4a39
SHA1 90f753d8d7e4397de0f49631fcd9222a7f59148c
SHA512 ff1f89fb04ae9c9a4c6cf6b1475f5a77f1c4f90829acda95cb39889b6b15c3b4f0b3b822a668f8ec8520b002cc90dd397cc26d314ac8fd5f3e2c9826bd458df5
SSDEEP 3072:Ph3iICVe1DvTtr/3tOpPu8LdKBTJyU4AshzWnD7UVDvuZE4tkGL:PgTVWvTZPghwln0AD7UV8Eeky
TLSH
T12BE3E01D29E2846EC82B24F4BA4A718FC71ECF07910BE40F25D984A55C7474E17E2EED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4256_432758291\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download