831bff95f6eb27d3da6b0def8b5dc994a0bfb3b284be73e4e9bf47882e8f1190

Analysis

max time kernel
899s
max time network
888s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
25/06/2026, 13:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Xeno-v1.3.55/Xeno.exe
Size 164KB
Sample260625-ql86ract2t
SHA256 831bff95f6eb27d3da6b0def8b5dc994a0bfb3b284be73e4e9bf47882e8f1190
MD5 895ceb92504645c29d2ea566980f07e9
SHA1 3bca6884a2f3c5da512547aa2c08513c4633c20b
SHA512 aa8a1c4b3f9efdb809cb0769897d170b96980ea2e7c5314438d3655aa0a594c17048d12f08f19b5911fa0c9b6812a4da72ddb565a2667f528514d684e7f9d9a3
SSDEEP 3072:U20jWfVKLer5haSpfO9D/y7jXEkemZA4nsSyU34HW:JIVSpfO9jkS44U2W
TLSH
T117F33B07A6A850BEE1B3D679C9924941FB723C594B71A6CF03507AB60F777D0AE39302
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence ransomware

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
66	3852	msedge.exe

Loads dropped DLL 1 IoCs

pid	Process
4244	msedge.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_699085859\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_1985195966\Sigma\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_1511154300\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_308219142\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_308219142\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_1897018245\deny_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_1985195966\Mu\Advertising	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_1985195966\Sigma\Fingerprinting	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_1098933340\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_308219142\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_1642770317\travel-facilitated-booking-kayak.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_676622778\crl-set	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_1985195966\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_1985195966\Mu\Cryptomining	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_440504926\arbitration_metadata.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_470763981\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_699085859\v1FieldTypes.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_1985195966\Sigma\Analytics	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_664213552\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_197303336\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_664213552\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_1985195966\Mu\Staging	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_1985195966\Sigma\Advertising	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_1985195966\Sigma\Content	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_665338324\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_1098933340\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_699085859\autofill_bypass_cache_forms.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_1985195966\Sigma\Social	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_1511154300\ct_config.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_1642770317\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_699085859\edge_autofill_global_block_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_1985195966\Mu\Entities	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_1985195966\Mu\Fingerprinting	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_1511154300\crs.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_1985195966\Mu\Content	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_1642770317\automation.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_1642770317\classification.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_1897018245\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_1871082711\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_1985195966\Mu\Analytics	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_844512665\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_197303336\domain_actions.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_1871082711\safety_tips.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_1985195966\Mu\Social	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_1985195966\Sigma\Staging	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_70309817\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_1511154300\kp_pinslist.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_1967632949\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_1098933340\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_1985195966\Mu\CompatExceptions	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_1985195966\Mu\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_70309817\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_1098933340\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_470763981\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_470763981\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_1897018245\deny_full_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_440504926\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_1871082711\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_1985195966\Sigma\Other	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_1967632949\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_1642770317\extraction.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_1642770317\travel-facilitated-booking-bing.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_699085859\regex_patterns.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3852	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134268673867318401"	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1741132852-2793423776-1557670484-1000\{7C88B501-632B-430A-8E02-06E61232A2E6}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2556	msedge.exe
2556	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe

Suspicious use of FindShellTrayWindow 12 IoCs

pid	Process
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3720 wrote to memory of 4244	3720	Xeno.exe	83
PID 4244 wrote to memory of 3220	4244	msedge.exe	84
PID 4244 wrote to memory of 3852	4244	msedge.exe	85
PID 4244 wrote to memory of 4104	4244	msedge.exe	86
PID 4244 wrote to memory of 4104	4244	msedge.exe	86
PID 4244 wrote to memory of 4104	4244	msedge.exe	86
PID 4244 wrote to memory of 2260	4244	msedge.exe	87
PID 4244 wrote to memory of 2260	4244	msedge.exe	87
PID 4244 wrote to memory of 2124	4244	msedge.exe	88
PID 4244 wrote to memory of 2124	4244	msedge.exe	88
PID 4244 wrote to memory of 2124	4244	msedge.exe	88
PID 4244 wrote to memory of 4416	4244	msedge.exe	89
PID 4244 wrote to memory of 4416	4244	msedge.exe	89
PID 4244 wrote to memory of 4416	4244	msedge.exe	89
PID 4244 wrote to memory of 4960	4244	msedge.exe	91
PID 4244 wrote to memory of 2256	4244	msedge.exe	92
PID 4244 wrote to memory of 4960	4244	msedge.exe	91
PID 4244 wrote to memory of 4960	4244	msedge.exe	91
PID 4244 wrote to memory of 2256	4244	msedge.exe	92
PID 4244 wrote to memory of 2256	4244	msedge.exe	92
PID 4244 wrote to memory of 228	4244	msedge.exe	94
PID 4244 wrote to memory of 228	4244	msedge.exe	94
PID 4244 wrote to memory of 2184	4244	msedge.exe	96
PID 4244 wrote to memory of 2184	4244	msedge.exe	96
PID 4244 wrote to memory of 1240	4244	msedge.exe	99
PID 4244 wrote to memory of 1240	4244	msedge.exe	99
PID 4244 wrote to memory of 1240	4244	msedge.exe	99
PID 4244 wrote to memory of 968	4244	msedge.exe	100
PID 4244 wrote to memory of 968	4244	msedge.exe	100
PID 4244 wrote to memory of 3840	4244	msedge.exe	101
PID 4244 wrote to memory of 3840	4244	msedge.exe	101
PID 4244 wrote to memory of 1244	4244	msedge.exe	103
PID 4244 wrote to memory of 3820	4244	msedge.exe	104
PID 4244 wrote to memory of 3820	4244	msedge.exe	104
PID 4244 wrote to memory of 3188	4244	msedge.exe	105
PID 4244 wrote to memory of 3188	4244	msedge.exe	105
PID 4244 wrote to memory of 5052	4244	msedge.exe	106
PID 4244 wrote to memory of 1644	4244	msedge.exe	107
PID 4244 wrote to memory of 5052	4244	msedge.exe	106
PID 4244 wrote to memory of 1644	4244	msedge.exe	107
PID 4244 wrote to memory of 1644	4244	msedge.exe	107
PID 4244 wrote to memory of 3088	4244	msedge.exe	108
PID 4244 wrote to memory of 4140	4244	msedge.exe	109
PID 4244 wrote to memory of 3088	4244	msedge.exe	108
PID 4244 wrote to memory of 4140	4244	msedge.exe	109
PID 4244 wrote to memory of 4992	4244	msedge.exe	110
PID 4244 wrote to memory of 4992	4244	msedge.exe	110
PID 4244 wrote to memory of 224	4244	msedge.exe	111
PID 4244 wrote to memory of 3404	4244	msedge.exe	118
PID 4244 wrote to memory of 728	4244	msedge.exe	119
PID 4244 wrote to memory of 5104	4244	msedge.exe	120
PID 4244 wrote to memory of 4308	4244	msedge.exe	122
PID 4244 wrote to memory of 4308	4244	msedge.exe	122
PID 4244 wrote to memory of 3404	4244	msedge.exe	125
PID 4244 wrote to memory of 3404	4244	msedge.exe	125
PID 4244 wrote to memory of 4900	4244	msedge.exe	126
PID 4244 wrote to memory of 4900	4244	msedge.exe	126
PID 4244 wrote to memory of 5008	4244	msedge.exe	127
PID 4244 wrote to memory of 5008	4244	msedge.exe	127
PID 4244 wrote to memory of 2556	4244	msedge.exe	128
PID 4244 wrote to memory of 3824	4244	msedge.exe	129
PID 4244 wrote to memory of 3824	4244	msedge.exe	129
PID 4244 wrote to memory of 3728	4244	msedge.exe	130
PID 4244 wrote to memory of 3728	4244	msedge.exe	130

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55\Xeno.exe
"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55\Xeno.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?framework=Microsoft.NETCore.App&framework_version=9.0.0&arch=x64&rid=win-x64&os=win10&gui=true
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2e8,0x31c,0x7ffe7a2dc188,0x7ffe7a2dc194,0x7ffe7a2dc1a0
    3⤵
    PID:3220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1900,i,1619400541240456622,2549145727654287821,524288 --field-trial-handle=2320,i,3484412899336361890,9362092525709226783,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:3
    3⤵
    - Downloads MZ/PE file
    - System Time Discovery
    PID:3852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1772,i,12713020156955269618,12340886534800450016,262144 --field-trial-handle=2320,i,3484412899336361890,9362092525709226783,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:2
    3⤵
    PID:4104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2636,i,8064962122727375158,9087950151182840056,524288 --field-trial-handle=2320,i,3484412899336361890,9362092525709226783,262144 --variations-seed-version --mojo-platform-channel-handle=2624 /prefetch:8
    3⤵
    PID:2260
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,16086815431332584759,6181693826542612546,2097152 --field-trial-handle=2320,i,3484412899336361890,9362092525709226783,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
    3⤵
    PID:2124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,760065494368900153,13900640383564607896,2097152 --field-trial-handle=2320,i,3484412899336361890,9362092525709226783,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
    3⤵
    PID:4416
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4188,i,4236392420966094691,6764149587338589309,2097152 --field-trial-handle=2320,i,3484412899336361890,9362092525709226783,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:1
    3⤵
    PID:4960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4228,i,277911963567953454,7693873029025523183,2097152 --field-trial-handle=2320,i,3484412899336361890,9362092525709226783,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:2
    3⤵
    PID:2256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,16872757071456929856,11843643454699556516,524288 --field-trial-handle=2320,i,3484412899336361890,9362092525709226783,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:8
    3⤵
    PID:228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5280,i,17993881656818659893,15123715699516272769,524288 --field-trial-handle=2320,i,3484412899336361890,9362092525709226783,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:8
    3⤵
    PID:2184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5276,i,1496659316354172196,15690575663906204348,2097152 --field-trial-handle=2320,i,3484412899336361890,9362092525709226783,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:1
    3⤵
    PID:1240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3564,i,16500635525710917507,3769925334467474351,524288 --field-trial-handle=2320,i,3484412899336361890,9362092525709226783,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:8
    3⤵
    PID:968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3660,i,4795453586920690007,8917833500891554685,524288 --field-trial-handle=2320,i,3484412899336361890,9362092525709226783,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:8
    3⤵
    PID:3840
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5836,i,18205876690037762936,12359240101449761576,524288 --field-trial-handle=2320,i,3484412899336361890,9362092525709226783,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:8
    3⤵
    PID:3560
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5836,i,18205876690037762936,12359240101449761576,524288 --field-trial-handle=2320,i,3484412899336361890,9362092525709226783,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:8
    3⤵
    PID:1244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6132,i,14160597077955923231,14328087989939340718,524288 --field-trial-handle=2320,i,3484412899336361890,9362092525709226783,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:8
    3⤵
    PID:3820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6288,i,12042664179866305799,16346007635403650775,524288 --field-trial-handle=2320,i,3484412899336361890,9362092525709226783,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:8
    3⤵
    PID:3188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6624,i,1700118527852305787,1468801210397444037,524288 --field-trial-handle=2320,i,3484412899336361890,9362092525709226783,262144 --variations-seed-version --mojo-platform-channel-handle=6636 /prefetch:8
    3⤵
    PID:5052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6604,i,14275267510020734593,11429292224994380175,2097152 --field-trial-handle=2320,i,3484412899336361890,9362092525709226783,262144 --variations-seed-version --mojo-platform-channel-handle=6668 /prefetch:1
    3⤵
    PID:1644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6436,i,5565006284012764086,14050000693640747361,524288 --field-trial-handle=2320,i,3484412899336361890,9362092525709226783,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:8
    3⤵
    PID:3088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6440,i,10507406208243094547,16259164370812099358,524288 --field-trial-handle=2320,i,3484412899336361890,9362092525709226783,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:8
    3⤵
    PID:4140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6428,i,2972941602625009518,17700939695326142668,524288 --field-trial-handle=2320,i,3484412899336361890,9362092525709226783,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:8
    3⤵
    PID:4992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6216,i,953097210473481100,14198007757542315753,524288 --field-trial-handle=2320,i,3484412899336361890,9362092525709226783,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:8
    3⤵
    PID:224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7276,i,6028804852111568193,4114673376564568068,524288 --field-trial-handle=2320,i,3484412899336361890,9362092525709226783,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:8
    3⤵
    PID:3404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4236,i,9913062462395579766,13274089959642718096,524288 --field-trial-handle=2320,i,3484412899336361890,9362092525709226783,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:8
    3⤵
    PID:728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,14481690596671913616,11877960639739848711,524288 --field-trial-handle=2320,i,3484412899336361890,9362092525709226783,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:8
    3⤵
    PID:5104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1068,i,9536841217846942778,13232544165775200807,524288 --field-trial-handle=2320,i,3484412899336361890,9362092525709226783,262144 --variations-seed-version --mojo-platform-channel-handle=6636 /prefetch:8
    3⤵
    PID:4308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5936,i,16833958590125047648,4075638638290298126,524288 --field-trial-handle=2320,i,3484412899336361890,9362092525709226783,262144 --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:8
    3⤵
    PID:3404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6928,i,14283870751368221057,16997252567602427246,524288 --field-trial-handle=2320,i,3484412899336361890,9362092525709226783,262144 --variations-seed-version --mojo-platform-channel-handle=6672 /prefetch:8
    3⤵
    PID:4900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3676,i,17084859232825654786,1830978186887819290,524288 --field-trial-handle=2320,i,3484412899336361890,9362092525709226783,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:8
    3⤵
    PID:5008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2784,i,2533651823170174071,4016286308450489519,262144 --field-trial-handle=2320,i,3484412899336361890,9362092525709226783,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5516,i,11936739879723559662,17074875249284636281,524288 --field-trial-handle=2320,i,3484412899336361890,9362092525709226783,262144 --variations-seed-version --mojo-platform-channel-handle=5612 /prefetch:8
    3⤵
    PID:3824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3704,i,13829071241195742396,9431903135445268037,524288 --field-trial-handle=2320,i,3484412899336361890,9362092525709226783,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:8
    3⤵
    PID:3728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5616,i,3523470638221033632,1279364769381877351,524288 --field-trial-handle=2320,i,3484412899336361890,9362092525709226783,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:8
    3⤵
    PID:3548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5724,i,7849325583791775306,6377426042013764145,524288 --field-trial-handle=2320,i,3484412899336361890,9362092525709226783,262144 --variations-seed-version --mojo-platform-channel-handle=3400 /prefetch:8
    3⤵
    PID:4752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4260,i,1973211200787247577,13111079709331103095,524288 --field-trial-handle=2320,i,3484412899336361890,9362092525709226783,262144 --variations-seed-version --mojo-platform-channel-handle=3768 /prefetch:8
    3⤵
    PID:3876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,3267050140450869773,2347446304902473636,524288 --field-trial-handle=2320,i,3484412899336361890,9362092525709226783,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:8
    3⤵
    PID:3612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3664,i,16992081374721745323,12381707872913434477,524288 --field-trial-handle=2320,i,3484412899336361890,9362092525709226783,262144 --variations-seed-version --mojo-platform-channel-handle=4532 /prefetch:8
    3⤵
    PID:4484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7320,i,6119714531318171902,16622556859664371380,524288 --field-trial-handle=2320,i,3484412899336361890,9362092525709226783,262144 --variations-seed-version --mojo-platform-channel-handle=7336 /prefetch:8
    3⤵
    PID:4780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7328,i,3599253757332190656,6602195597425345664,524288 --field-trial-handle=2320,i,3484412899336361890,9362092525709226783,262144 --variations-seed-version --mojo-platform-channel-handle=7376 /prefetch:8
    3⤵
    PID:3436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7416,i,13956407754915417141,6533394019129047895,524288 --field-trial-handle=2320,i,3484412899336361890,9362092525709226783,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:8
    3⤵
    PID:824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7188,i,1080391629436098146,12903579205307649037,524288 --field-trial-handle=2320,i,3484412899336361890,9362092525709226783,262144 --variations-seed-version --mojo-platform-channel-handle=7512 /prefetch:8
    3⤵
    PID:1064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4216,i,7974350015231547962,9880889759453456550,524288 --field-trial-handle=2320,i,3484412899336361890,9362092525709226783,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:8
    3⤵
    PID:3360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7332,i,16031954388835367141,4317762507184114679,524288 --field-trial-handle=2320,i,3484412899336361890,9362092525709226783,262144 --variations-seed-version --mojo-platform-channel-handle=7316 /prefetch:8
    3⤵
    PID:556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5060,i,6777895266879732383,8284502039054934375,524288 --field-trial-handle=2320,i,3484412899336361890,9362092525709226783,262144 --variations-seed-version --mojo-platform-channel-handle=7316 /prefetch:8
    3⤵
    PID:1788
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4268,i,12421956540864689981,52587717564067107,524288 --field-trial-handle=2320,i,3484412899336361890,9362092525709226783,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:8
    3⤵
    PID:2144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4268,i,16404293512542206859,8822839148618048021,524288 --field-trial-handle=2320,i,3484412899336361890,9362092525709226783,262144 --variations-seed-version --mojo-platform-channel-handle=7236 /prefetch:8
    3⤵
    PID:3768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7096,i,13760652156953658158,14575315621669718134,524288 --field-trial-handle=2320,i,3484412899336361890,9362092525709226783,262144 --variations-seed-version --mojo-platform-channel-handle=7500 /prefetch:8
    3⤵
    PID:1008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5996,i,748383518995759357,15549913158259411374,524288 --field-trial-handle=2320,i,3484412899336361890,9362092525709226783,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:8
    3⤵
    PID:3932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7368,i,12573380289945739742,11860868414318854200,524288 --field-trial-handle=2320,i,3484412899336361890,9362092525709226783,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:8
    3⤵
    PID:3208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4204,i,3902829968700591577,2508846974074751714,524288 --field-trial-handle=2320,i,3484412899336361890,9362092525709226783,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:8
    3⤵
    PID:1152

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:388

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 994380ffd288a5f1a9acc9eb76a487a55b12cc1daec839d811240f6cbdc4da3a
MD5 f5ed4946834be586ac6410ed88740a7c
SHA1 6108ce368e8b3bb8012956bb25606c3b16835c7b
SHA512 76bf60b37c50422ab125edd3da70629e685408a106655a9b7e5cb6aa7b6a9000c76d8ac2f5dc85e58e893b61bef9b539b9488ac894f1fc1338a58944dc9f4711
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P77:fwUQC5VwBIiElEd2K57P77
TLSH
T1E5B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7073226b4cd1cfc4cf618f45a53939bc635bacfa557eafd1683ee91614cda0d8
MD5 5ff1793d8c9849e8aa6f4b07eaa08bef
SHA1 f5fe82f06b14c36eb220d075b1991d8ce3ddd649
SHA512 12cef1a00cae76ef3fc336350f290b288914eff9dcc7d486d3ac1f47bd4fde52db613b450bb58f380ab912b64ce3ec0b76fcdbb59da73ad728aa42c2e562ab9f
TLSH
T177D012A27A0DB440F6055331E25383012666256028535702B261D41CD6644DC13D71C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9a3d10b16d8afe0c105f8b187f8f3616b1a6a5acead1299db43d8132ffbdd701
MD5 b1909b2a7b7440e7b9a3adf7750f7e70
SHA1 b05948679b364b6e193b3dfce38acfcbbce327a5
SHA512 6e1a661cdc2dcd861ab31eb46bd839bfe8a465393ade11a2c8d9ad612b4cc1265fdb4cf2a0d373288d8cd20cc1cb7f3e8bf565e575e5204858390018dabaae28
TLSH
T16FD012A27A0DB840F6055331E25283012666256028539702B261D41CC6644DC13D71C7
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 8f58a21a46357911c6eb789a66536ae5a422fcc1e7f406ee1fe26d5582e3e590
MD5 36bbf8cdc32a8191e2861f4fd2441253
SHA1 772dde61bf154796fa5eca21d7637fb7336d0ee7
SHA512 93018dfb4985972bbb8d24d60b5f33b17c525dd3a129dda983dc77d8e984a584757f9dd192ee514acc059c286c10e5f5335b3d0dddb53f4e9fe47f43f8d13d34
TLSH
T1CCE026E448CBC32E9648FE474AACA30C8380374E93C86D8E1710C884B001B40A2C6590
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 addf4268aecafc70ea0c17b11de437a41d4c4def9fe454c67314d8f1e691f07c
MD5 cfb3abe88b60ac5f71b9f200c08525b4
SHA1 0db072a826079031d4119da1e02b6bdefbd45705
SHA512 9b0fb3999b79d320ef91e6a01646375617b5d1730e2a982f3370d95b07d406175aa3864a05e845af029563abc06c6cd18dd1d6252ff6c9f8a68b500801ee2847
TLSH
T18AE026D445CAC32EA240A5A741BCB34CD3903B2F97C9ED8E1B00C4857202240A2C35D0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 357B
SHA256 207dd0ff50a2c78dfb8547b27ebf8e154f7195172116fff0456c5008f18aa1b2
MD5 d58b6c7a049fcb4b5d6b0863c7cbce5e
SHA1 cc23efe9ec42e9a6ac8e25f6a89dd1f09b268f49
SHA512 727d22b36ffafa1a2466bb02950b90b5cfa52b12ea637b093fd0014148c4b77b0e089c97f1dc343f9b605b658591bd5f5f5220e6a241e8c16172eeebafe95b33
TLSH
T115E048A4829AD2AD5502B947825CF315C6517A0D975FBEFD37C4E08C1411B006597594
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 275B
SHA256 a2b4ad9e12dd53d916d061f1e573f75ee685250ad64da89688bf620e0907a4d2
MD5 092ae23cc850ab069379bff4339b7680
SHA1 5d915635066eaf62124c80d87c54f1aa7acd8bee
SHA512 9c3dd7af23f84bec884da2cb7ffcadd061b6ec3877b7f29ba156596146350a2da25a707f2a3202079f9e419411800aa5ad31a0ca26ad7e54d81e3f098b2d5068
TLSH
T1EBD02BE9BEDC9D8EC3D119FE4732B4400F5562E2881BAB030561FCC03291BF01F2A120
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 71dd1aabd61e5bf189db753d301e733dd316709d446a1ccd43f3abb69a0856df
MD5 ad7a754c3a746b3b70333aa6bcbe8128
SHA1 be8aab620ec3f06341ee981d45160ced7ca2b4f9
SHA512 3821bd292497ff0b6ee02cba7c0ff1226e9ba0d89d3ca8aab47ecfb648bf5850db89d6744862a7d728c213f094a8dbcf7c1df9d4484f77e48ac928f3348137b7
TLSH
T19171C37C415249C4D768F7B2CCD4B260FA720DACBED37D2229CA94F2291F3A68C17418
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5891ea.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5891ea.TMP
Size 3KB
SHA256 3630a289e404e62ec81872b7a4aae184843729968ca638e6fc0456070c7e8fac
MD5 1198dd80643ea1b46c988718333e3418
SHA1 3ad8f1be0c95f00b03a1dfbff88105844a64fe3c
SHA512 219819ecd08d28c98b1b3c04fe644d662f2a9cb90eb6c0b9374e3603109925e1b6d9656f61ffd640b4949b810fac0b642f0380ebdae5eda41bb940c426aba24b
TLSH
T11E61D57D012285D0E368E3B2CCD0B260B5724DBCBDE37D6179C894F2221F7668C57418
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 011fb5ef026a96e0a2dc60f6e400aaa9662d655863d9e3a43fa8476ead935831
MD5 416acb6da78ddbf37edc8415937ba8af
SHA1 c741d9d0218121e91dd869e7b262bb47885cacaa
SHA512 ee7fea7bfe6d3f796a6a3e523c1830d4bf985276eef1ddfb2193bb3db2dfa0398bb3983051b832676af554fd68f8a173333e89b3f3eed35333be725128311eaa
TLSH
T1C351AFF787F4856E8A0195F0A618AE1FDF2D0655831C3C56C9E4AE27D3E3871E10165F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 463f627222d6e0fa709cfb1016df2d24f532f411d29abf856e5b6a55ae6cd508
MD5 c06f6c4cf670c2e7795578864546da21
SHA1 710553ca0648eaeaee27437d9a340a25dc86195c
SHA512 96b36881579624129f90f778748c0ded43d244202fdff27d9754f41539c66f584d8c27ede8970378f8026df0c531c961b6a3c242e4b24edeb8b6e4f3e1268a66
TLSH
T165519DF783F4856E9A1195F0AA18AE1FCE2D0655831C3C5689E4AE2793E3861E10165B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 4383dbc08a9ebedc1dd44512a5142dbed65054f18334d932f4086857da7da9b1
MD5 00c7729f7cea7b67f9ae0b605b2aab1d
SHA1 0edef25d80baa3ce54a572a1a781094ced262864
SHA512 13c1de00fbd54c492d471022dedd81ee65c03a912c0c3bd26f7b4da884da293e32fe261bd158589164bc81536de6a179cdf7312045fae5ee7f3414fea239b33f
TLSH
T1E451CFF783F4856EDA1195F0EA18AE2FCF2C0514935C3C6A89E4AE27D3E3471E141A5B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 c151814bb5de87dae2c26939acc659e218657dc70181e229cbef99106e8bc977
MD5 c2fa7b53eb43769052a47a0f9fbabf8f
SHA1 d50ae26bd7a2f679b2e6d691389ab75f3b20f5e1
SHA512 881bcf18cef7a209a33ee385553323dbfb1733b7180c300e10a71bf35322c7a29e53e454d4f8a3c8a2f71ea5770920097c1248805d3d318ad027f4deb2d8d9b9
SSDEEP 192:sxZIRayM/jK1Ml8MzH/fKsABxXf6WIdpwAHW6+WNrTv/Abcrt5MIg4J:sxZIELH/fKsABgXJHbH/Sc
TLSH
T142520A16AA349977CCCBD609FA557F53D6F54562A2940E44AAFCCA0C00E6BEC2207C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 29KB
SHA256 20e95bcfb697facb628ae5c9de58543407d87f587f78c03ee1f0857d4eb02c2a
MD5 560ee127c8f6b7e5c13df2429e82f47b
SHA1 1d24d05ae5f29c8627bf212e4546b5af3854efb8
SHA512 6e0017807518b5722f9bda66906b0bd5b52f5a92c14d831f16422a28cd7e4231101fc1ba7a0c28820413ffb3f084b57afabc6e92fb0d0887ae9729eaec5271ad
SSDEEP 384:sxZIpq2H/fKsVL66s8qMpRiYnazAW8pZS15posJWeT+TgXjHbH/g0:sQw2H/fvL4Mnc7WeT+TgTHbfR
TLSH
T167D21A05A934C877DEC35D18B57C7E339AEC40526285CEDA1AECCA0C01AD6FDAB47867
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 a74d60599a6cf7fca7faa73df900d4f1d4516adc91208d666fa69b4ffe037fe8
MD5 df687da6e14a155c9a9e51d03ee11805
SHA1 1c29fe5c85604ba18cddb57132e42f4e5754419c
SHA512 343d642b6d10ea1385b93e6ee81293300b2b8ff1ba246c419e607e3a51f7897512ed79024e4bda27a86c6f9a48c01a1596b44882b28a6537a6f1e14dbe2f8938
SSDEEP 192:sxZIRayM/jK1Ml8UQCzH/fKsVBxXf6WIdp6AHW6+WNrTv/Abc6+bMIg5+J:sxZIEq2H/fKsVBgXjHbH/G0
TLSH
T1F062F916AA345977CCDBD609FA557F53D6F54462A2940E84AAFCCA0C00F6FED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 05c6a2318dae62ba2afed267d46dfd1e561308e1f4dd8bc7389fa21fbf5dae12
MD5 e3fff102f83f237fb2cfc958597791f4
SHA1 49358c1c0e31f9b5395bf0b89c68c0b110777ce8
SHA512 2ac0e331dcd5ca15c38bb7da8aed7843393c94a5ec9a68c8db85ad9199e499c825789c76c13bb3e2faec7b67c6a74d68560ff9323c0ecc4776eef45928b5042d
SSDEEP 768:HQ03iOL7pLuL7qCWvqG1m8F1+UoAYDCx9Tuqh0VfUC9xbog/OV0Xn9Ll1/CBoroD:HQ03iOdE7qCWvqG1mu1ja5Xn9LfKBTIg
TLSH
T10CF2FB7B280CCB7E4F804E9CED2A7E9A6DE801CB56D8C99447FA844C02C66EF51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b6ba92c8-53f0-4431-b23c-88f47e76f432\index-dir\the-real-index
Size 2KB
SHA256 caa82dcb21d33037be60bfe9a644a6f2d7def35db886f332bb6d972fb6cee501
MD5 3b8d46f4b479ccffb90ecab61e50144b
SHA1 daec0977d17ff49ed7d2880665bd7794692adb83
SHA512 bb7d7491c541f1f078ba3b3baa3abb00afa334ee387a0b6fded9917148e08cb637c53ca4ce2daf33d151c3530ebde6b24c62bb6763f6a2b68d7f92ef475cb65d
TLSH
T14841B7494E508E2FF86400B305B2A4E8333458DD5750D6138CBC23387E13B6E2D5B6ED
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5cc115.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b6ba92c8-53f0-4431-b23c-88f47e76f432\index-dir\the-real-index~RFe5cc115.TMP
Size 2KB
SHA256 9d76a793c7d9355a095cb4c27b34ec135ba21a0c85f661187845a95612c5ba0a
MD5 38eae3c4e3938c6bbbb203d905410c4d
SHA1 0019ace79963ff76ce8ab8c9fdbea9488cdcc3ca
SHA512 e2457d957852866d157c3bf45aea32223956a004f961a14b3c687084d6802dd7ae0241f7dd89593c5909718b393f01a64a1ac0a978353eb7e1f7e42064b804c9
TLSH
T11641B8964E818A1EE89040770EA3F4B8733958408715BF57B8BC5336A8617FE2E4E0D9
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 931dbecc4879d59dbda4d42c6e9f39316567708103484355eb8646755050c430
MD5 08f3230ceb11815b328842b2b4623db1
SHA1 08fb388c56b8c2fb192565ce164b589ee98d3e36
SHA512 e63800b5cecaee80986db015c7e58cf3ea831c2ba386f447cb4ac248861f9ff40b25c329133402cbfdcbebdf75b790c2115e52efd06aaa122db906d1883b091e
TLSH
T16CE026B63CE73C60FDAFABE7383248A54519B8E4D64DBC4F513A51C320E63522452CA2
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 a5f0194f4435d261fc8bb823f3a36fd2a6e6e7e634a0a53e968cf53dc5489037
MD5 43ba0c9467c19854b69661178e3f7be0
SHA1 bb01616ed7ca53f5d5e9c4b545c0e7f3eefb4631
SHA512 7604da55af6cc53653c598af899a15475fe8cda1577ca89e1c6e59ca09e1091fb9a702d4ff542855758b2e2cfea68f23e53c094dbb98813da577e65745e336f4
SSDEEP 48:KI5IRKycErylvIdK0sww4IvKBOMfytTIpK0QEH:KI5uKycymveK0s/4IKBOWWTOK0QI
TLSH
T1DFC10317313E0206387D291C9B95863B8E8131A370596DEF7BB811A18D67E224DFDCED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

domain_actions.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Domain Actions\3.0.0.18\domain_actions.dll
Size 83KB
SHA256 d35c8efcb710239f009633bcc5ae904ac6dafa985d451bedf791cf6909f014d4
MD5 956f610121cd5827fd5549097b79cd9f
SHA1 dbd23f99895a3a92fbe04c3c35d475a6f6998fd0
SHA512 3cc4712f64474497495d229ddd743c6bf25c30c3fbfca2525f46227d99a59a0f9e80e2119ffb40bc8a707b539f65f907e2e1565ea937e0387db47cf7269944e6
SSDEEP 1536:sNGnmI1FOxAdgxBf8paY3JQzQik428fKagFVbydki8yyafuzWk:sNG91FPgrfrPza428fIenya2Sk
TLSH
T16D83F180DF58411BF86F4835E0B269857A78E6B50FE092DF2376C9590E12FD1AF39705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe590824.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe590824.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 e5949eb423e6f94f0a302c53bca8ecbe84a7218e7563039d22e57d4c875992de
MD5 a490242526f39db35e67c9fdd48da6f0
SHA1 0c293779c30ad2d986d99d0b31155b57241cbb19
SHA512 272e699d9662a063ce5a90c2ae0428fbbc45de6faddbc0eac62b207814fe8fe20489a459f44732f719e34f6c85c0798efb64783f8537d2131ccec991eee5453f
SSDEEP 192:uukLsNrkj5QKP+rERQmiU1axEv4pROBqfnhuhObSJrBO7aqw4U8:nSsNrkj5TqCIqA3OB8huQuJrGTU8
TLSH
T1CD32F9356D789C7759A6A500F18737A39FA81077DE8A2F98D2E94F0C04D779C230B91B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 29KB
SHA256 76f4622a2d79f4214fb2a54ff38fc98451537b75de43211d0c0f680f3c706797
MD5 09e175ffabfc5f5fbf41574e0bdd9c87
SHA1 116a8cbfcbb0c421b497af7ca0c76bceadfb0b6f
SHA512 38fb7a8ded51489f73b28c24536356e174c8623a2dc8a6cb5e19bf90c59328dbafa2116698cb8d62937fd6886bdb8acd63f9460ac294600c75dd824c1860cb57
SSDEEP 384:nPiF1tNn/s3n9SHzsN18TUNTUlIlkwTqCIkA4Df4QOB8huQuJr7Tmn15wbAjEj:aF1j+9YUwgYkGQOBmuQuh7Tmn12bfj
TLSH
T126D2B5F598D78937E8AE4783A33E2E569EBCC063B5891984F7D44D4CCC866BFC206815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 cd03d8c2b8f3be4fa048f89203ea7593095be7078a08db50f837dd948795f7b2
MD5 520c625964b45ac3c337fcc3005ce490
SHA1 b06b0400c48e299ca78a62734e8cdd0b928fcf1d
SHA512 28758c68761f2809d3ec77b75524623f042121637aac1f6d739212223283e903beba8937bb407d74d6e75f2febf638f6f4b9043f92ac8b0094f426fe671441c7
SSDEEP 192:QONe6v+QQmiUy4Y5gmROBqfnhuhObSJr3Riaqw4U6:QONe6vPLOg8OB8huQuJrkTU6
TLSH
T17112E835A87CAC676DA6A514F08737A79EA81077DE866F84D1D85E0C00DBB9C270B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 889e81939dbe0634ab28d61ae8016aff7831daa2fe9fb5e77b939e107653b157
MD5 0c12830b09817c5350ed728a52364caa
SHA1 782c66937881e161ad7a3a3b285f2e682d3aa9ab
SHA512 cb0e0600e08c9c3dbf42f4302fe4f08ae1d7bc320b2dce97772803481099c68359b4d1d14305433ff65a5fa627fbdd76a315a953f59f18e87d7e126fdc8171c0
SSDEEP 384:natNn/s3n9SfsNrkwTqCIqA3OB8huQuJrGTmn15wbAjEj:aj+9ULq0OBmuQuhGTmn12bfj
TLSH
T1D9927C366C385D235CA6A544F14A33679FB81077DAC62F94D5E88F0D04D7BCC231B91A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0ef337e800d0d43f2390696df2cabe6ef875ef738b83f2dc420351c7ee96fd3c
MD5 56fa46856302d3029b371ba28baaf00a
SHA1 e402493626b520c7ccab3de351619ff70ef0f3b1
SHA512 0d5be1aabff5af33c2198452c018e3690da3245cdbf3a9b99b0cf126f8aad82a4e3857d6ac620dcd3cf9133cc2fa75fb895bf420c242b6d0096b2db56bb22da7
SSDEEP 192:eOND6v+XaQmiUyM5CmROBqfnholRyiwU6:eOND6vtTC8OB8hyVwU6
TLSH
T1CA02DA35BD7C7CB79EA1AE44F04737175FA81067DA962F84D6E85E0C00DBA5C2307926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 757c40068c8b44526fedddbae76f4ef49d46e6f99e9c5b6ac7daee04f31c52bc
MD5 d3c09492385327b4a73e8682955af55b
SHA1 240fab0985703fee85cf6f4073e03764bdb8aa5c
SHA512 09a4d78749d0d19904aa74f079fa2811f4b5de2b62305c89fc775606945a876578959e3f95cfb06258b2450dae9c4ed8a80ecdef86debcfb139ef6a47615ec6c
TLSH
T15A11F0D25D6D19C2C5BE0FAFE0877AFD40D8D216F194707A1888ED54427991E114147F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 612B
SHA256 98d9b184e4c7220b5aaf7ae412b0c1b3f32e3dc4933afcf852538b8082017b9e
MD5 c20138f2b92ee0645ce99eebc563daa6
SHA1 8e20392ea25dec3d3cef957c8ebbe1a0c589ea3b
SHA512 151098a27cb44d715d48210b12b95a9d1341beb7ca1de3096edc0434ba70c3d274e446604c7692d7a4d92af7b41872166747a30fd452fd0279407a6993fc02c0
TLSH
T15DF00CD28C3E21C2C5EA0F7ED04B2AF884D46507F0887439088DEAD4C17A80F118247E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 9107e613905835c00077a499d2faa20bb70b974e6309d1f2f33ae52933318f07
MD5 2012d4de563c653f56f62ccbf46db598
SHA1 fb24881003593f1ceb79019e52ce5ee9e94c889c
SHA512 c03d6584395c1c97c75af7dc6df57df358d3957035521bb6833c538679683aebe0410bb12586472b84dc98111e703984dd37868464fa9c66fdafb423e763b555
TLSH
T10CF00E829C3E25C086E90F7FE44725F840C46517B0883879088DE9D8813A40F11414BE
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 7ae3abeff1a7ac2b396b3e38dc9d2900c37a4fa3623cd6a74cdc34b502978149
MD5 d7023fa4d2528dc28cb0aaefeff697bf
SHA1 a9d914b66ca62916a33ca38b55ff971687cec7f8
SHA512 a12e587ee1c0f13ff6b3da22343b7611d6985799073cd0898decd626042b0e3a69747a3419b461a74ae1dee8d439eef7f39e61fafbf6bc2d3be40d501161b36b
TLSH
T13221FEE26D6E1AC2D1BE0EBFE0873AEC54D8D21AF1D4347A1888ED94923D91E154187F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 852B
SHA256 142a7cc7a4933a976aae32a9d04e1758464486092207243f09edbbad51f1d934
MD5 95fe84d83629d03e0bc6e035f44a5cae
SHA1 2af304ef821c70f2d00b47a3e3872c17d33e40e7
SHA512 266ac6fd03731d757bebdacd0d27aa0326e022f9791d7892445f595285b17def95b722da875c974360a7567be530324d0d91a3310008958cbca0f09f04676301
TLSH
T14E0112D25C3D26C2C5BE0FBFD08776E844C4911AF19474BA1C8CE994827980E208243E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 21075672ed04fcc0ad86c96036a015a0479bc539f9eb22ed2ee07d5f51ed51d5
MD5 a8b716843d7c8f9dba996daed984824f
SHA1 0c96d6d123c2416eb76b7da62e37d23071beadb7
SHA512 5d339045c75561891f8b131b85aa5713a39f0c762a24cffd19d9577849262e259f66a06264e6b97d4d7a2b39170891003f4bfd55c6f8d31f9da107ab6548e117
TLSH
T1DE21F0E15C3D2AC1D1BE0EBFF0873AEC90D89216F5D4347A2898ED94823D91E158187F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 2b7c607fd6a639934c6f7311f36aa760dd4a600f84b9f8e2d066832856488091
MD5 a36353281ee63c90e6d74b67255fe9ed
SHA1 f8aa66a70fe63c5f2aae1964243c68b3617d9c57
SHA512 9950368809a0ccd2b7cadae6c5ad4af6b981a19210a81b38ebe99aa0a683ffdc822d6bec67c6e4cf1ddbf1d47b71b7aeae4380c6552f5d5b6298fb649949ae69
TLSH
T1D3312FE25C2D1AC1D0BE0EEFE48B29EC84E8D216F19434392898ED94567D91E258087F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 d4f5f34a25513ebb2dbddf60319142763fcee96a7e387c538e1a60e9faefc72d
MD5 67224293206a594e6a8de4215a2a12e1
SHA1 9769d03ac519a93bb95d80edf413fec20a9638a5
SHA512 6701b6b07a8362d368e2e44b0baad8accabd38f99e499fc4f26bf595df04a42e45b37ae452a92aa2dda013b2043fa334d45d5a408d8fbf6ec0f37e77d437c214
TLSH
T10A3141E15C3C1AD1C4BE0EBFA08B39FC84E8D226F5A470792C48EDA8563991E254083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 732B
SHA256 a5548ca519cf47ecb420c8f1299a8a50517fa463459a704ef2ff17c4db35117a
MD5 b2c40634bbfa57be0d4fad8adfbd6ccb
SHA1 6f8b9ba2f40d9aa42d217ed2bc6dbcdedd1763ad
SHA512 3cfbef4e4a4a7d8fa1530c69ea34fbc3b84627888361a9d201b21e6ead15f5d4e51fea8bc95edd07415b6d2d06a3c19beb1bcea3195e05a6d8af4939b95f77b5
TLSH
T1220110D29C7E26C2C5AA0FBFD08B26EC44C4A516F098747A1CCCF9D4823980E148243E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 972B
SHA256 590065152acec5cf42dffc28eb04749514feaa899eb2ae04edce7d38a148fbda
MD5 30ae49636160992413baf749cf492c9d
SHA1 93edd7244143177356c931699cb8a266bad04660
SHA512 b986d2486431c75ee9ea0acd7d891c2d40042dfe9185910eedc52db52d68de586df47518bb97647f325416a600eb0e7b794c9d5db9242f3417882791a266829e
TLSH
T11E1114D25C7E26C2D5BE0FBF90877AEC44C4D616F194347A1C88ED94417981E154147E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 ae32d9950928870c88235c4c17204b62b83ed38c436c2dd65ff80e018454fd14
MD5 1242319dd708adac46dfcb9d40c77068
SHA1 dff7fdf5059dcaa1f995142f3980df184021fc44
SHA512 5d2bd511e97055ebc6b00ef355284a011fa67ec5483ad8ca69504713c30386e967955c27411472de128ed8661c16bd2a8289de30d9be2b75dc6ae33bcf2e2395
TLSH
T14B311FE15C3D1AD1D4BE0EFFA08B29FC84E8D216F594343A2898ED98567991E254087F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 df444b5ed91161c5d2e84013e91e57a28fbbd1e4302590bddff64bc98663199a
MD5 cf37b72670448143ffb4009cf7ad060b
SHA1 e2e210f06fa8d4857fc11a37a890b02f672ed738
SHA512 5f6b4f3a776ba0f062d4fbbc5e594ca2af360bbdeaf0fcbb1d649d6f58cd39e668cad4551281c2374c3b44e3aa54648011bd878f27eb16660344550443d39f5c
TLSH
T18B3120E25C3D1AC1C4BE0EBFA08B39FC84E8D326F59474392898ED98563DA1E254047F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 3489c67589d11382f649439c79a0c832b6e49f2c9809d163291be01ca4ea7c46
MD5 e090b1e8aa5233a6b4e28e3f7303baea
SHA1 5c65bc9f725e2bd4a99b7b8606fd1161c942d482
SHA512 427144d1ee99a40e52b584c676072af484613952acbfe07de2731312ca11dfb1300a4add92f1978fafbb0c04bdf72db9851cc05435c049d23c126ce52921410a
TLSH
T1BC4142D15D3C2AD1C4BE0EBFB48739FC94D8D226F59434792844ED94563D50E258083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 2630367e8b5ed2b717cf0495605456b345138e71c95960d3b68357c8c5213d8e
MD5 6fd7771b6d3cd3ff58aa6dded1fc6696
SHA1 26484975b0092e7e9163e0eb3e67850356a325a7
SHA512 d41e027caf9ec9c6e70342af39464752b75bee28d823e13bc793e8fe8854a0e90fa3ce74854c9174fb93c02e908d9490748322c59048b3560e64d800638ac3df
TLSH
T1304141D19C3C2AD1D4BD0EBFB48B38FC94D8D226F19434792C58E954563D90D258083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 ce9106be8701db9601d3b96123eedb1a46020ef917a45af821f96e9c56086652
MD5 05f87210ba1d091a29bb0f6c68d9a01a
SHA1 f55a230a6a3cc6793de48a1f5c42fa170ce218ce
SHA512 bc6f92a12c2daeba508b32a2d0f73e466fc6385456fe055048bc6d06d71f211e169d6ea2bc5f805d7f4c8bcc2c269d170291082407c01821fc24463b93169b5a
TLSH
T1C7410799A6F91158B3B36F56ABF3A86D487F7D332E0AD45E00010D4F0A62B41D962B33
MD5 SHA1 SHA512 TLSH

Submit Download

7e8ad7c4-07ec-4a3f-9350-3f42bc6757b1.tmp

Path C:\Users\Admin\AppData\Local\Temp\7e8ad7c4-07ec-4a3f-9350-3f42bc6757b1.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

Staging

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_1985195966\Mu\Staging
Size 36B
SHA256 411a706def2e70f96a507208bf80bceb93e950c4c2d671cd1ddb4134ce54b2a9
MD5 0163de1b14421d4eee3757ff76fd81e4
SHA1 96c75c4fe1e3f33a367f45293bd1bd8bff1c06f4
SHA512 80114d59db8f3654dd6821589e5ad03daa923a35610a372756a8865b3e769621e32ef2aed92c2494de2b9fc06d9796b12f1e3bb75873ed794e8c9ae8a0d5e965
MD5 SHA1 SHA512

Submit Download

LICENSE

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_470763981\LICENSE
Size 1KB
SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
MD5 ee002cb9e51bb8dfa89640a406a1090a
SHA1 49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2
SHA512 d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c
TLSH
T17D31535723840B9306DA2B4566AEBDC4B0DDC02D7F27AE05186EF394537B52ED8B3443
MD5 SHA1 SHA512 TLSH

Submit Download