hxxps://www[.]google[.]com/?zx=1782667082116&safe=active

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
user interaction
yes
max time kernel
899s
max time network
882s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/06/2026, 20:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.google.com/?zx=1782667082116&safe=active
Sample260628-ythyjady7l

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3196	msedge.exe
4188	chrome.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134271507969229844"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{66C32EDB-BEA2-40DC-974A-2499516745FA}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{2B8EEBDF-B3D2-46E0-8013-1424BEACE619}	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
5488	msedge.exe
5488	msedge.exe
3244	chrome.exe
3244	chrome.exe
3244	chrome.exe
3244	chrome.exe
2444	chrome.exe
2444	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 47 IoCs

pid	Process
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
3244	chrome.exe
3244	chrome.exe
3244	chrome.exe
3244	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3244	chrome.exe
Token: SeCreatePagefilePrivilege	3244	chrome.exe
Token: SeShutdownPrivilege	3244	chrome.exe
Token: SeCreatePagefilePrivilege	3244	chrome.exe
Token: SeShutdownPrivilege	3244	chrome.exe
Token: SeCreatePagefilePrivilege	3244	chrome.exe
Token: SeShutdownPrivilege	3244	chrome.exe
Token: SeCreatePagefilePrivilege	3244	chrome.exe
Token: SeShutdownPrivilege	3244	chrome.exe
Token: SeCreatePagefilePrivilege	3244	chrome.exe
Token: SeShutdownPrivilege	3244	chrome.exe
Token: SeCreatePagefilePrivilege	3244	chrome.exe
Token: SeShutdownPrivilege	3244	chrome.exe
Token: SeCreatePagefilePrivilege	3244	chrome.exe
Token: SeShutdownPrivilege	3244	chrome.exe
Token: SeCreatePagefilePrivilege	3244	chrome.exe
Token: SeShutdownPrivilege	3244	chrome.exe
Token: SeCreatePagefilePrivilege	3244	chrome.exe
Token: SeShutdownPrivilege	3244	chrome.exe
Token: SeCreatePagefilePrivilege	3244	chrome.exe
Token: SeShutdownPrivilege	3244	chrome.exe
Token: SeCreatePagefilePrivilege	3244	chrome.exe
Token: SeShutdownPrivilege	3244	chrome.exe
Token: SeCreatePagefilePrivilege	3244	chrome.exe
Token: SeShutdownPrivilege	3244	chrome.exe
Token: SeCreatePagefilePrivilege	3244	chrome.exe
Token: SeShutdownPrivilege	3244	chrome.exe
Token: SeCreatePagefilePrivilege	3244	chrome.exe
Token: SeShutdownPrivilege	3244	chrome.exe
Token: SeCreatePagefilePrivilege	3244	chrome.exe
Token: SeShutdownPrivilege	3244	chrome.exe
Token: SeCreatePagefilePrivilege	3244	chrome.exe
Token: SeShutdownPrivilege	3244	chrome.exe
Token: SeCreatePagefilePrivilege	3244	chrome.exe
Token: SeShutdownPrivilege	3244	chrome.exe
Token: SeCreatePagefilePrivilege	3244	chrome.exe
Token: SeShutdownPrivilege	3244	chrome.exe
Token: SeCreatePagefilePrivilege	3244	chrome.exe
Token: SeShutdownPrivilege	3244	chrome.exe
Token: SeCreatePagefilePrivilege	3244	chrome.exe
Token: SeShutdownPrivilege	3244	chrome.exe
Token: SeCreatePagefilePrivilege	3244	chrome.exe
Token: SeShutdownPrivilege	3244	chrome.exe
Token: SeCreatePagefilePrivilege	3244	chrome.exe
Token: SeShutdownPrivilege	3244	chrome.exe
Token: SeCreatePagefilePrivilege	3244	chrome.exe
Token: SeShutdownPrivilege	3244	chrome.exe
Token: SeCreatePagefilePrivilege	3244	chrome.exe
Token: SeShutdownPrivilege	3244	chrome.exe
Token: SeCreatePagefilePrivilege	3244	chrome.exe
Token: SeShutdownPrivilege	3244	chrome.exe
Token: SeCreatePagefilePrivilege	3244	chrome.exe
Token: SeShutdownPrivilege	3244	chrome.exe
Token: SeCreatePagefilePrivilege	3244	chrome.exe
Token: SeShutdownPrivilege	3244	chrome.exe
Token: SeCreatePagefilePrivilege	3244	chrome.exe
Token: SeShutdownPrivilege	3244	chrome.exe
Token: SeCreatePagefilePrivilege	3244	chrome.exe
Token: SeShutdownPrivilege	3244	chrome.exe
Token: SeCreatePagefilePrivilege	3244	chrome.exe
Token: SeShutdownPrivilege	3244	chrome.exe
Token: SeCreatePagefilePrivilege	3244	chrome.exe
Token: SeShutdownPrivilege	3244	chrome.exe
Token: SeCreatePagefilePrivilege	3244	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
3244	chrome.exe
3244	chrome.exe
3244	chrome.exe
3244	chrome.exe
3244	chrome.exe
3244	chrome.exe
3244	chrome.exe
3244	chrome.exe
3244	chrome.exe
3244	chrome.exe
3244	chrome.exe
3244	chrome.exe
3244	chrome.exe
3244	chrome.exe
3244	chrome.exe
3244	chrome.exe
3244	chrome.exe
3244	chrome.exe
3244	chrome.exe
3244	chrome.exe
3244	chrome.exe
3244	chrome.exe
3244	chrome.exe
3244	chrome.exe
3244	chrome.exe
3244	chrome.exe
3244	chrome.exe
3244	chrome.exe
3244	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
3244	chrome.exe
3244	chrome.exe
3244	chrome.exe
3244	chrome.exe
3244	chrome.exe
3244	chrome.exe
3244	chrome.exe
3244	chrome.exe
3244	chrome.exe
3244	chrome.exe
3244	chrome.exe
3244	chrome.exe
3244	chrome.exe
3244	chrome.exe
3244	chrome.exe
3244	chrome.exe
3244	chrome.exe
3244	chrome.exe
3244	chrome.exe
3244	chrome.exe
3244	chrome.exe
3244	chrome.exe
3244	chrome.exe
3244	chrome.exe
3244	chrome.exe
3244	chrome.exe
3244	chrome.exe
3244	chrome.exe
3244	chrome.exe
3244	chrome.exe
3244	chrome.exe
3244	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4132 wrote to memory of 4828	4132	msedge.exe	86
PID 4132 wrote to memory of 3196	4132	msedge.exe	87
PID 4132 wrote to memory of 2368	4132	msedge.exe	88
PID 4132 wrote to memory of 2368	4132	msedge.exe	88
PID 4132 wrote to memory of 2368	4132	msedge.exe	88
PID 4132 wrote to memory of 3608	4132	msedge.exe	89
PID 4132 wrote to memory of 3608	4132	msedge.exe	89
PID 4132 wrote to memory of 2572	4132	msedge.exe	90
PID 4132 wrote to memory of 2572	4132	msedge.exe	90
PID 4132 wrote to memory of 2572	4132	msedge.exe	90
PID 4132 wrote to memory of 2336	4132	msedge.exe	91
PID 4132 wrote to memory of 2336	4132	msedge.exe	91
PID 4132 wrote to memory of 2336	4132	msedge.exe	91
PID 4132 wrote to memory of 608	4132	msedge.exe	93
PID 4132 wrote to memory of 608	4132	msedge.exe	93
PID 4132 wrote to memory of 608	4132	msedge.exe	93
PID 4132 wrote to memory of 4400	4132	msedge.exe	94
PID 4132 wrote to memory of 4400	4132	msedge.exe	94
PID 4132 wrote to memory of 4400	4132	msedge.exe	94
PID 4132 wrote to memory of 3444	4132	msedge.exe	97
PID 4132 wrote to memory of 3444	4132	msedge.exe	97
PID 4132 wrote to memory of 3444	4132	msedge.exe	97
PID 4132 wrote to memory of 436	4132	msedge.exe	99
PID 4132 wrote to memory of 4784	4132	msedge.exe	100
PID 4132 wrote to memory of 436	4132	msedge.exe	99
PID 4132 wrote to memory of 4784	4132	msedge.exe	100
PID 4132 wrote to memory of 2820	4132	msedge.exe	102
PID 4132 wrote to memory of 3748	4132	msedge.exe	114
PID 4132 wrote to memory of 2668	4132	msedge.exe	115
PID 4132 wrote to memory of 1712	4132	msedge.exe	116
PID 4132 wrote to memory of 4084	4132	msedge.exe	120
PID 4132 wrote to memory of 4084	4132	msedge.exe	120
PID 4132 wrote to memory of 4084	4132	msedge.exe	120
PID 4132 wrote to memory of 1384	4132	msedge.exe	121
PID 4132 wrote to memory of 1384	4132	msedge.exe	121
PID 4132 wrote to memory of 1384	4132	msedge.exe	121
PID 4132 wrote to memory of 4216	4132	msedge.exe	123
PID 4132 wrote to memory of 2076	4132	msedge.exe	122
PID 4132 wrote to memory of 2076	4132	msedge.exe	122
PID 4132 wrote to memory of 2148	4132	msedge.exe	124
PID 4132 wrote to memory of 2148	4132	msedge.exe	124
PID 4132 wrote to memory of 2148	4132	msedge.exe	124
PID 4132 wrote to memory of 1112	4132	msedge.exe	125
PID 4132 wrote to memory of 1112	4132	msedge.exe	125
PID 4132 wrote to memory of 1112	4132	msedge.exe	125
PID 4132 wrote to memory of 4240	4132	msedge.exe	126
PID 4132 wrote to memory of 4240	4132	msedge.exe	126
PID 4132 wrote to memory of 4240	4132	msedge.exe	126
PID 4132 wrote to memory of 4008	4132	msedge.exe	127
PID 4132 wrote to memory of 4008	4132	msedge.exe	127
PID 4132 wrote to memory of 4008	4132	msedge.exe	127
PID 4132 wrote to memory of 2572	4132	msedge.exe	128
PID 4132 wrote to memory of 2572	4132	msedge.exe	128
PID 4132 wrote to memory of 2572	4132	msedge.exe	128
PID 4132 wrote to memory of 4768	4132	msedge.exe	129
PID 4132 wrote to memory of 4768	4132	msedge.exe	129
PID 4132 wrote to memory of 2252	4132	msedge.exe	130
PID 4132 wrote to memory of 2252	4132	msedge.exe	130
PID 4132 wrote to memory of 2252	4132	msedge.exe	130
PID 4132 wrote to memory of 1724	4132	msedge.exe	131
PID 4132 wrote to memory of 1724	4132	msedge.exe	131
PID 4132 wrote to memory of 1724	4132	msedge.exe	131
PID 4132 wrote to memory of 4796	4132	msedge.exe	132
PID 4132 wrote to memory of 4796	4132	msedge.exe	132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.google.com/?zx=1782667082116&safe=active
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffdbabec188,0x7ffdbabec194,0x7ffdbabec1a0
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1848,i,15596682900936462223,7229934708273552212,524288 --field-trial-handle=1880,i,6697976779791557010,10112788360689168348,262144 --variations-seed-version --mojo-platform-channel-handle=2144 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,14327267465929094029,12184988499721900113,262144 --field-trial-handle=1880,i,6697976779791557010,10112788360689168348,262144 --variations-seed-version --mojo-platform-channel-handle=1860 /prefetch:2
  2⤵
  PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2600,i,4898150311637794011,10596443141184012429,524288 --field-trial-handle=1880,i,6697976779791557010,10112788360689168348,262144 --variations-seed-version --mojo-platform-channel-handle=2580 /prefetch:8
  2⤵
  PID:3608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,17089471618945816462,25609273855300855,2097152 --field-trial-handle=1880,i,6697976779791557010,10112788360689168348,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:2572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,5174906214694382474,4164923335951982729,2097152 --field-trial-handle=1880,i,6697976779791557010,10112788360689168348,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4188,i,2385525455512721451,14146188642631580530,2097152 --field-trial-handle=1880,i,6697976779791557010,10112788360689168348,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:1
  2⤵
  PID:608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4228,i,14706453079131316828,13632200347068969801,2097152 --field-trial-handle=1880,i,6697976779791557010,10112788360689168348,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:2
  2⤵
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5100,i,7829978250238791802,7500124397069832149,2097152 --field-trial-handle=1880,i,6697976779791557010,10112788360689168348,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:3444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3524,i,1081628597359488699,6815163415157923042,524288 --field-trial-handle=1880,i,6697976779791557010,10112788360689168348,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:8
  2⤵
  PID:436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3576,i,3277947794988561132,4272744263404094290,524288 --field-trial-handle=1880,i,6697976779791557010,10112788360689168348,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:8
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,13635598526812834025,4529083082701030567,524288 --field-trial-handle=1880,i,6697976779791557010,10112788360689168348,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  PID:2092
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,13635598526812834025,4529083082701030567,524288 --field-trial-handle=1880,i,6697976779791557010,10112788360689168348,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  PID:2820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4432,i,13186118623573625073,7782932954460152687,524288 --field-trial-handle=1880,i,6697976779791557010,10112788360689168348,262144 --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:8
  2⤵
  PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=560,i,10903123120898859972,6403550165749190130,524288 --field-trial-handle=1880,i,6697976779791557010,10112788360689168348,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:8
  2⤵
  PID:2668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4444,i,1749871823560286670,11534201213282119988,524288 --field-trial-handle=1880,i,6697976779791557010,10112788360689168348,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:8
  2⤵
  PID:1712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5300,i,15914822411984107307,337229482338281321,2097152 --field-trial-handle=1880,i,6697976779791557010,10112788360689168348,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:1
  2⤵
  PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5348,i,14975399815953288190,8588579914102953149,2097152 --field-trial-handle=1880,i,6697976779791557010,10112788360689168348,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:1
  2⤵
  PID:1384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3684,i,4082019840550029581,1780447367017604459,524288 --field-trial-handle=1880,i,6697976779791557010,10112788360689168348,262144 --variations-seed-version --mojo-platform-channel-handle=4416 /prefetch:8
  2⤵
  PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3740,i,15485562395735154273,4736080891709880208,524288 --field-trial-handle=1880,i,6697976779791557010,10112788360689168348,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:8
  2⤵
  - Modifies registry class
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=5384,i,2713998923139863540,14096046739182846131,2097152 --field-trial-handle=1880,i,6697976779791557010,10112788360689168348,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:1
  2⤵
  PID:2148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=5464,i,6605952639226741363,10803667555575570348,2097152 --field-trial-handle=1880,i,6697976779791557010,10112788360689168348,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:1
  2⤵
  PID:1112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6460,i,16939064296677796655,6237506927121374200,2097152 --field-trial-handle=1880,i,6697976779791557010,10112788360689168348,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:1
  2⤵
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=1208,i,5164155996284136239,18122474970344533090,2097152 --field-trial-handle=1880,i,6697976779791557010,10112788360689168348,262144 --variations-seed-version --mojo-platform-channel-handle=6576 /prefetch:1
  2⤵
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6752,i,12053280871507010896,9951849407362219602,2097152 --field-trial-handle=1880,i,6697976779791557010,10112788360689168348,262144 --variations-seed-version --mojo-platform-channel-handle=6756 /prefetch:1
  2⤵
  PID:2572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6956,i,15778794087413626802,14312227508130598100,524288 --field-trial-handle=1880,i,6697976779791557010,10112788360689168348,262144 --variations-seed-version --mojo-platform-channel-handle=6904 /prefetch:8
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=3604,i,146018830605298800,14882447301904940456,2097152 --field-trial-handle=1880,i,6697976779791557010,10112788360689168348,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:1
  2⤵
  PID:2252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=4992,i,16231681613627864096,12439966722558474217,2097152 --field-trial-handle=1880,i,6697976779791557010,10112788360689168348,262144 --variations-seed-version --mojo-platform-channel-handle=7300 /prefetch:1
  2⤵
  PID:1724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=6316,i,13689718689291317302,16467119274741585173,2097152 --field-trial-handle=1880,i,6697976779791557010,10112788360689168348,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:1
  2⤵
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=6416,i,7578293420586832305,12714430760558663737,2097152 --field-trial-handle=1880,i,6697976779791557010,10112788360689168348,262144 --variations-seed-version --mojo-platform-channel-handle=7116 /prefetch:1
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=7540,i,1541906569474298508,2907767219524587357,2097152 --field-trial-handle=1880,i,6697976779791557010,10112788360689168348,262144 --variations-seed-version --mojo-platform-channel-handle=7632 /prefetch:1
  2⤵
  PID:3156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=7504,i,3231024788262257592,7461321761216126671,2097152 --field-trial-handle=1880,i,6697976779791557010,10112788360689168348,262144 --variations-seed-version --mojo-platform-channel-handle=7816 /prefetch:1
  2⤵
  PID:5136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=8012,i,11436007932191750061,6807201526784776762,2097152 --field-trial-handle=1880,i,6697976779791557010,10112788360689168348,262144 --variations-seed-version --mojo-platform-channel-handle=7976 /prefetch:1
  2⤵
  PID:5204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=7964,i,15467836980275575342,7300067395826659880,2097152 --field-trial-handle=1880,i,6697976779791557010,10112788360689168348,262144 --variations-seed-version --mojo-platform-channel-handle=8136 /prefetch:1
  2⤵
  PID:5212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=8296,i,6478240049846163540,4161962629212610158,2097152 --field-trial-handle=1880,i,6697976779791557010,10112788360689168348,262144 --variations-seed-version --mojo-platform-channel-handle=8300 /prefetch:1
  2⤵
  PID:5400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=8460,i,1481275357674833145,344461684865573224,2097152 --field-trial-handle=1880,i,6697976779791557010,10112788360689168348,262144 --variations-seed-version --mojo-platform-channel-handle=8476 /prefetch:1
  2⤵
  PID:5408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=8608,i,1227402494880859497,14244568370610374298,2097152 --field-trial-handle=1880,i,6697976779791557010,10112788360689168348,262144 --variations-seed-version --mojo-platform-channel-handle=8612 /prefetch:1
  2⤵
  PID:5420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=8828,i,14866254811402294367,3716224283068377794,2097152 --field-trial-handle=1880,i,6697976779791557010,10112788360689168348,262144 --variations-seed-version --mojo-platform-channel-handle=8820 /prefetch:1
  2⤵
  PID:5520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=8948,i,7648645815328793928,1956059566703844017,2097152 --field-trial-handle=1880,i,6697976779791557010,10112788360689168348,262144 --variations-seed-version --mojo-platform-channel-handle=8848 /prefetch:1
  2⤵
  PID:5528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=9096,i,2008859109672176383,15458893527493222874,2097152 --field-trial-handle=1880,i,6697976779791557010,10112788360689168348,262144 --variations-seed-version --mojo-platform-channel-handle=8996 /prefetch:1
  2⤵
  PID:5632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=8660,i,10574435217088651966,18304708322158981219,2097152 --field-trial-handle=1880,i,6697976779791557010,10112788360689168348,262144 --variations-seed-version --mojo-platform-channel-handle=7468 /prefetch:1
  2⤵
  PID:5796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=9108,i,6664108954707975984,7964014451742647105,2097152 --field-trial-handle=1880,i,6697976779791557010,10112788360689168348,262144 --variations-seed-version --mojo-platform-channel-handle=8836 /prefetch:1
  2⤵
  PID:5900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=8828,i,2060301627480946824,3608257096141285521,2097152 --field-trial-handle=1880,i,6697976779791557010,10112788360689168348,262144 --variations-seed-version --mojo-platform-channel-handle=8724 /prefetch:1
  2⤵
  PID:5980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=9104,i,8041995739100753329,11726332999095476258,2097152 --field-trial-handle=1880,i,6697976779791557010,10112788360689168348,262144 --variations-seed-version --mojo-platform-channel-handle=9288 /prefetch:1
  2⤵
  PID:5144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=8832,i,9970378382503698024,8818296677772220974,2097152 --field-trial-handle=1880,i,6697976779791557010,10112788360689168348,262144 --variations-seed-version --mojo-platform-channel-handle=9740 /prefetch:1
  2⤵
  PID:5744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=8032,i,8238004518496641906,6554898027125264308,2097152 --field-trial-handle=1880,i,6697976779791557010,10112788360689168348,262144 --variations-seed-version --mojo-platform-channel-handle=8048 /prefetch:1
  2⤵
  PID:5784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=8548,i,1141338039098297427,13011388503506469223,2097152 --field-trial-handle=1880,i,6697976779791557010,10112788360689168348,262144 --variations-seed-version --mojo-platform-channel-handle=8000 /prefetch:1
  2⤵
  PID:5236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8560,i,14887897025135994902,3928920225568723549,524288 --field-trial-handle=1880,i,6697976779791557010,10112788360689168348,262144 --variations-seed-version --mojo-platform-channel-handle=8096 /prefetch:8
  2⤵
  PID:2936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=7720,i,13343624335032505720,4791936116204293755,2097152 --field-trial-handle=1880,i,6697976779791557010,10112788360689168348,262144 --variations-seed-version --mojo-platform-channel-handle=7644 /prefetch:1
  2⤵
  PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=8356,i,14982123280248094474,10973757301592646323,262144 --field-trial-handle=1880,i,6697976779791557010,10112788360689168348,262144 --variations-seed-version --mojo-platform-channel-handle=6912 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=5468,i,11725597299261502084,9658762741054434306,2097152 --field-trial-handle=1880,i,6697976779791557010,10112788360689168348,262144 --variations-seed-version --mojo-platform-channel-handle=8220 /prefetch:1
  2⤵
  PID:5928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --metrics-shmem-handle=5480,i,12144595436045558136,12867772950374836464,2097152 --field-trial-handle=1880,i,6697976779791557010,10112788360689168348,262144 --variations-seed-version --mojo-platform-channel-handle=8208 /prefetch:1
  2⤵
  PID:5292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --always-read-main-dll --metrics-shmem-handle=8312,i,13320352378027007880,15348703107770387615,2097152 --field-trial-handle=1880,i,6697976779791557010,10112788360689168348,262144 --variations-seed-version --mojo-platform-channel-handle=8408 /prefetch:1
  2⤵
  PID:5244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --metrics-shmem-handle=8400,i,17590044553181423992,15744456290972641882,2097152 --field-trial-handle=1880,i,6697976779791557010,10112788360689168348,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
  2⤵
  PID:2752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --always-read-main-dll --metrics-shmem-handle=9884,i,14720610544051484335,17771160844700412930,2097152 --field-trial-handle=1880,i,6697976779791557010,10112788360689168348,262144 --variations-seed-version --mojo-platform-channel-handle=7620 /prefetch:1
  2⤵
  PID:5560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --always-read-main-dll --metrics-shmem-handle=7776,i,13081055937928016045,10030487573568506513,2097152 --field-trial-handle=1880,i,6697976779791557010,10112788360689168348,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:1
  2⤵
  PID:5180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --always-read-main-dll --metrics-shmem-handle=7328,i,938012210232484110,14715315397020455324,2097152 --field-trial-handle=1880,i,6697976779791557010,10112788360689168348,262144 --variations-seed-version --mojo-platform-channel-handle=3956 /prefetch:1
  2⤵
  PID:3572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --always-read-main-dll --metrics-shmem-handle=6492,i,5530428868482827975,6450802122846717879,2097152 --field-trial-handle=1880,i,6697976779791557010,10112788360689168348,262144 --variations-seed-version --mojo-platform-channel-handle=8856 /prefetch:1
  2⤵
  PID:5676

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2868

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffdc6e3c728,0x7ffdc6e3c734,0x7ffdc6e3c740
  2⤵
  PID:3348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2164,i,9150682944011101440,3390925481799001618,524288 --field-trial-handle=2080,i,569522408622241517,14998710854873188972,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2244 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1764,i,4492273891689874564,10702081628373301848,262144 --field-trial-handle=2080,i,569522408622241517,14998710854873188972,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2076 /prefetch:2
  2⤵
  PID:1064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2440,i,116822699026761801,14003427836908988428,524288 --field-trial-handle=2080,i,569522408622241517,14998710854873188972,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2620 /prefetch:8
  2⤵
  PID:3996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3268,i,2205021767968570395,2734684597821595944,2097152 --field-trial-handle=2080,i,569522408622241517,14998710854873188972,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:3464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3288,i,11790588752525502685,1907796445977372271,2097152 --field-trial-handle=2080,i,569522408622241517,14998710854873188972,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3564 /prefetch:1
  2⤵
  PID:5856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4468,i,10655250270780696087,9776651536566344136,2097152 --field-trial-handle=2080,i,569522408622241517,14998710854873188972,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4452 /prefetch:2
  2⤵
  PID:2136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4764,i,12195893989419897695,8522433741639081073,2097152 --field-trial-handle=2080,i,569522408622241517,14998710854873188972,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4768 /prefetch:1
  2⤵
  PID:3152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4948,i,16101623303436140088,5218769539035606603,524288 --field-trial-handle=2080,i,569522408622241517,14998710854873188972,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4960 /prefetch:8
  2⤵
  PID:3936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5080,i,16676832530217104832,11407264100094898178,524288 --field-trial-handle=2080,i,569522408622241517,14998710854873188972,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5088 /prefetch:8
  2⤵
  PID:2348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5512,i,9006781113839110463,17440690655388752802,524288 --field-trial-handle=2080,i,569522408622241517,14998710854873188972,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5488 /prefetch:8
  2⤵
  PID:4368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5544,i,9502861484950667170,10326661029251571384,524288 --field-trial-handle=2080,i,569522408622241517,14998710854873188972,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5936 /prefetch:8
  2⤵
  PID:5904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3064,i,5982101802316684593,2244202529865986262,524288 --field-trial-handle=2080,i,569522408622241517,14998710854873188972,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5788 /prefetch:8
  2⤵
  PID:1008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5692,i,15957566073067699662,4345473447704855089,524288 --field-trial-handle=2080,i,569522408622241517,14998710854873188972,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5556 /prefetch:8
  2⤵
  PID:5668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5732,i,12363229250651653943,15806514078144312617,262144 --field-trial-handle=2080,i,569522408622241517,14998710854873188972,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4488 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=1348,i,12017327982943058053,17982867024203254730,524288 --field-trial-handle=2080,i,569522408622241517,14998710854873188972,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5740 /prefetch:8
  2⤵
  PID:220

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5296

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1140

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 bce22c310e7244732edf0ee4baf33b2d469578641f261f48d3671e437e4cf2f7
MD5 a76e2fc1831a84c25b6e7ae3f266c43e
SHA1 da588b06872d7de31919cae4f18eaa0e55ca4e76
SHA512 76fb311ab3320538f64711ce35977d62797f239731cdc9ea26c95efa73fede997c1596d07f0c0257e0fa655d75e8d0a4d6b062a2be512ed50cd8f145e73723b2
TLSH
T1E2E02BAAC821FC2B4CFD476E60501B46EA20535727A1C45F363C87088FB1677019595C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 3641e80db8b235f148824eb6bc55df64211caa0b241688dfccca9bd646214820
MD5 318fafb6244f31ebbcc76e580c16fce4
SHA1 ded31c8e92cbe1c6683cac30805e5265b4d7a982
SHA512 8e70801fe0049bbe2f748dbd7e96a083167f78db1aa8bdf83e3d488510d4393622aa94010d4936c0436600877d7c7369c6397d7d99d6079d2cc8328141146b25
TLSH
T1ED519BF7D3E8867DC90156F4AB216E2FCE290A14532C3C6688D4AF0F43E2972D34028E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 2e544b63fed6b1535211ec62b968cd7e20c12b81a56be15d2a4f107f1b24c896
MD5 38c2f1a4ea3ba47abad848fb95125635
SHA1 5b262fd7e8c9ba022fcdd48227ebf5e894e592e1
SHA512 6268f2aa2f8e10c3a422ff8af08edb5c6f596cf613d3a52a2146b81a73cdd7a10373029cd7289451404877092b9d08bbf22c420f8c7a1e63e7f7a71ac45ba923
TLSH
T14C51ADF793E4867DC91096F4EB11AE2FDE790A14132C3C6288D4AE1B43E2972D34178E
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 91750b9d1c86150269654901e609a0233562ef0ca7c97fd1604b11d5a1c635ae
MD5 b09697b23b0f00eff3a97874ed441069
SHA1 6e08acba33db6a98f21cbcc325acf8f852628a69
SHA512 3862b4baac6002dc3b7c85b844003a3b4472ed85df8a2573576eb3c87fc2c09a18dadf631ea3a8a03a8ee105c6a241ad0bf11e768801ed2813e20ce2a5588c36
TLSH
T1AFF024A7A66D746B10AE14BA2E44BC09A8F9A439128069F4CE6A42BCE0A15F31F06443
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 158a43b7b9599a6e316e5ada6faece6bf604132595a83ed961d46543b4c789f3
MD5 b80c6fac8cb6004891c6939429f56d7f
SHA1 efd1bb4b178834083c7da1a7ae9b9e231f278ca5
SHA512 e9e25e07e41c69744376a953eb65d15b7c9dbd69a7ee9cc20283a8e70dff4c597175c6f1ea8106defa79fe83017d9ba0134f87a2e66e3d525728959bf42dc662
SSDEEP 192:MRkc3rsA8hxCv7ApAPRp2l9qHsb+WNnM70yAikw/czVyIsnAUgtaJ:MRkcQOkUXmkwo0Lim8
TLSH
T16742B82AFE10693BACDBD62AF9117753E7F5103521D42E84E6FC8A2C29E75CC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 d10945b11fea9fd794a94560054c6e31f1f44fc3c60ed38940939be592ffe2df
MD5 ee8d8c8cfa6f076e0c9d693287841634
SHA1 10c1256a526497a7149b54e8aab036197eb2cb7c
SHA512 a16c6f44e466a3e96b94b2436716ff2e82ab8e8b8725029f2e54ea6e205e664a6abd7c043fc2dbc50f296e57f362ae7269fb30e39e8fc1f0a37ae307fb2ed40b
SSDEEP 192:MRkctrsA8hxgv7ApAPRp2l9qHsb+WNnM70UAikw/c2VyIsnAUgraJ:MRkcS8kUXmkwo0liNe
TLSH
T16F42B72AFE10693BACDBD62AF9117753E7F5102521D42E84E6FCCA2C29E75CC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 26071a9ab04ff4b77b08a13cc0ee2f0c65f0b8143d829a3d9ddf958cd56f5e69
MD5 b5d166f5033f2bb98ef5c4711c909961
SHA1 9ccc08d2f248fe4707e0f964eefa392bb15af204
SHA512 8de33fb3ada63bd08478ed40d3ca82301603463037b599df108ed2ba51c66d261bdca3d0c2c79920577c325238b061b20e7d1cb387128ea650ea682da5c3c14e
SSDEEP 192:MRkc3rsA8hxgv7ApAPRp2l9qHsb+WNnM70UAikw/c2VyIsnAUgraJ:MRkcQ8kUXmkwo0liNe
TLSH
T15242B72AFE10693BACDBD62AF9117753E7F5102521D42E84E6FCCA2C29E75CC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 13805701603dbbca9403b94e006c712edafb4f98a8e0ae4ce0ad1b025b835f93
MD5 28aca1b912d001e337a9e715a111a353
SHA1 177a8b35a6fa74a15deedffd79dc9066169fc496
SHA512 0e554b40f873ea651a22f9b91cf52ad45cc99b35e2db0e34845d695aa13aaf61497b6646f39f5b0ba26fc4a43100e92a0aff8ad949d0289fb397cfe00b0cede5
SSDEEP 384:V7jxY7KxkXqKf/pUZNCgVLH2HfgsluX7pLuLcSjvKXODx4+ErU31PHG0pdpS8gfp:V3xY7KxkXqKf/pUZNCgVLH2HfgskX7pf
TLSH
T1A4720967AC0C9E374F94D6CCDC277B4FADB5015B61E9886483FA981903D5BCA110A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 ee8d24b9f0c1759ddd600ebdb64285c1141d1c182b08a0038f5193161a7599b2
MD5 6069e1232b929c0135330f996f1d7ee2
SHA1 6f89cfc5924d5a156a523e585aa5a78f05160df7
SHA512 3c2db44095935de2aabde3d6ebb0d73bbaa7ef6e97a4073faf0c582355f4dd696701972cfed8cafe7af11ce9a84a00c8073221d4eb2d2b20a052129e45fd6c81
TLSH
T183B01202C0017111C04242F0174214D8731C6F10DF1A170143E4BD62D82966181190D0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5b5f05.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5b5f05.TMP
Size 96B
SHA256 af9c42fcffc7f490ba60b1e946e4fb1e2edfaf8c7aee825893deadf870f7080a
MD5 18f06e9fa66bb3b6bf800497f6b62efc
SHA1 8fd7aafa873e0f5df349cccfdd27c130aadadde7
SHA512 f422636ef7cf8c118c432c308ab81074639266f2edd0fb84b09f29e50505f3062ac2d788a9f094dca326820319926839c795821f80f539e9438cf886d9e2c7a4
TLSH
T1C6B02208C2023302C00203F02CC088CC3020EFE0CF030202C2E00AABEC20330002A0A0
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 22daa69da42c4f96795c5fc385e48e522fc8ba773d68bae683e63e5dd60409c8
MD5 16c5951013ca44b97bd8f22400b790e3
SHA1 f492d2fdc4348eddc4a8c60319761309a775e3ea
SHA512 2a70266a28ca7e49fc0ff569a001151d47d2ac8cdf7c19be6c1a94ba092fd9530fbe82bac15be5a0577f64d136e3d5414c6be4f8884025b02390d44527a27e7c
SSDEEP 6144:uSttY13Xb5zuXltKY1sK6hem7Rkm1tYpBeh2BAoq:JttaLI/KVK6h59oBGcAoq
TLSH
T1A53412236F25A93759FCA6DE700B6E2F1DB16D63DC21D6B58089AF0036E87CE1601D78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 b8f5f3475cdf55d310579bed6f65982a7701b243febdf9195b27ce03e8c22736
MD5 c62738ddbb4ef637e93fa16476338245
SHA1 e7da9ec41051f91960635b1a9a5f78032a8fca26
SHA512 afe61800df376ba02efa7365b19af11fac49a7c214445c20b4f4c975859d5020f6a1aafc389c5f3eb5f89eaf7b088e4ccc681e0960672fe53364a3fe0c263154
SSDEEP 6144:IsSttY13Xb5zuXltKY1sK6hem7Rkm1tYpBeh2BAoq:uttaLI/KVK6h59oBGcAoq
TLSH
T1693412336E11AD3749FCAB9D700B6A2F1DF16E63DC20D9A5C489AF0036ED68D5A01CB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 14054e44f4185a24ccdd511fbadb6f9760972ac686aca42a8af466757444ff37
MD5 8af90c2fcfff08a152678dcfc9ca488d
SHA1 41a6094f8910fb6892169c1fea2b7fdd4a133952
SHA512 739a6c9264c221963c137c735eb94f3fcd70c6696bdb4efc7e4193054f09128d13b36e9ad2b426db1b694168a5fb0bb018ebec418bb8c172dcb3392b8325e751
SSDEEP 6144:HSttY13Xb5zuXltKY1sK6hem7Rkm1tYpBeh2BAoq:yttaLI/KVK6h59oBGcAoq
TLSH
T1313412236F25A93759FCA6DE700B6E2F1DB16D63DC21D6A58089AF0036E87CE1601D78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 3d6d61ebdcf5d28327105d7be603f75dee50f58686a9c1b7614102752c4992b6
MD5 a8e4f911eb35bf4e05dd332ff736c4bb
SHA1 c789df3bb541ca02e8adbb061ba0fc360cfa76af
SHA512 29d55220dd2875fda025db5a40ed50d0c33515b025e33936dffd9489bb8a1959c37838a404aef507b3f665c34cf35f864aaa166f99537415580c6f6a09b20490
SSDEEP 6144:YsSttY13Xb5zuXltKY1sK6hem7Rkm1tYpBeh2BAoq:ettaLI/KVK6h59oBGcAoq
TLSH
T15C3412336E11AD3749FCAB9D700B6A2F1DF16E67DC20D9A5C489AF0036ED68D5A01CB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 ac646cb2f0e1d5e0cfa8c74d94901a7bb64143f2c083f3dc4f46eb217495a4cf
MD5 55c6199136666f329a91349bd8310b83
SHA1 1fcc8a04626862d17f5c538a9cdea1c6a786b47a
SHA512 866c1c153645eccf8288b063a25be09d51252406ab633998a2c0797e02a6dce98c9b8824f73c88c65f12c20e3feaaea69bb855e19bd2823753595d68c2b4a6b9
SSDEEP 3072:AkGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:sm7Rkm1tYpBeh2BAog
TLSH
T17CC3023B5E75EC3B5CB5A74EB08E0B1E2EF149A6C920DE9288D85A0437F97CD0A44934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a760cba1958be152fb737121d04109cfcda34c4781289cfef5379dc35d6c9182
MD5 bc7b65a61cf6bcd4901c0fc156c41b87
SHA1 10d62a2fafc8b2b83e82d2309f945a309fb547dd
SHA512 0b793394309d9044d759a6d7da3d5236b568b7c0566034571ca204a5945f5692f85129eb4dfb4179c9f002af577d8cf4c9b6f17549e3fea47cd43cba8dbf9695
TLSH
T135D0A72433763442E7291071F8134740739E8471359EC202D154810E5E7F4D697CB2C1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ab98da7535c8de464335204ae97fd672936e639269325c3a388b3039d8396b83
MD5 1656a3560c7aeae221756f3891b89fd3
SHA1 e48441fe2b843ba3bd0bb7799c07b22a27db8eb7
SHA512 c06d7152d11e33601716d4c5c33c7373ac4e0c16571e80ac4a8ffb9cabb52fae51d4fe8d808fc75be943287b55a320e90a186d71a5f06e9db006f6ab89266400
TLSH
T1CFD09B307B597042D3074031E8074790169E84B5249B86066554410D7D5A485E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ec6419a915c6f94199df67c6cf1d67bc666c22ef160c8377d6792913a6518679
MD5 a8d0099e5966b86c13c6997282a63770
SHA1 df541b93a0caebe364906ec90c768bb625495f4c
SHA512 a2093c42c3f547b910f560ee7a58cb187cef96045e8e335276c7bde87fdc5e9894b670421e94170d0878e86a2bea8125d914e11181882004f966732f9670a693
TLSH
T135D09B303B597442D7074031E8064790169E84B5249BC7076554410D7D5B4C5E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_0000e1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000e1
Size 21KB
SHA256 abe68a2d6d6e808ce07fb5c2dd0d3b0b33fa562c00e7d034d98a727933d37868
MD5 b2f34e72fa18b6333aeabff2d5ec2b89
SHA1 e5f0510ec55de37eced78d80313ad6c5092e89d0
SHA512 952b8fbefd14c5ebbc64233dbb2387894eae1a994d4769e701e6b7cab2b78217aa8709770be46bfa68267236f4ec53cc419a1fcacaee18de220245dca2add93d
SSDEEP 384:IFXKehyxzB3h60aoRdZNQtJw2tWKjWxyoQO9/CcRb0D3a8nnkqkole7DRmSg:qnUzBx60aoR9QtPjsI2eD3a2nLNwRm7
TLSH
T177A2E181F5B2618130C7FE9C9DCABF09C059CF36E91574BA286B6B71F99114058C3F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00011c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00011c
Size 32KB
SHA256 eff9dfe4ebe815c15fa6087a8b712ccacea7a59dddcb55a5c819293252d73c32
MD5 cba69340542e691fa9e4b30334a07507
SHA1 4af443e83868d3a18fc9ad853e58eaf39bb065f7
SHA512 4f8d78c0ae8e04e27dfbcef602d3d46cdefd8f01085cc549edd35805d775065c4f78b75da617adf5f8f699a9edf7fa69db7c267917e5f9cb967e59563f905227
SSDEEP 768:wOsAPzChBrMSp8DxHnpmf3ILP1KpbjtXPgYVkutZ:lsArKDqtO8KZtXPgYXtZ
TLSH
T17AE202DF0C15679A01C371AE6A7C6024EBB3E07B3035CA1B1E764CD250B6660E5DB8BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00011d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00011d
Size 96KB
SHA256 11de5a5aa3d08f69e1db14ac9c5347b7d09b8ec8fa89a4dd48a53ac13bfc3af2
MD5 601873d8a87f7b6dc6d2be569d361b63
SHA1 90ddce036c5ac461fc0e2ad6d2549625f35fcad8
SHA512 8d0aa2ed004fd07ff6c8cf0b2f96bf2addadcc481e811d3070d206a2862ebd154f857021dc0186eff184667914b6e23239b3886e18521bbe109e9c70df09ea1e
SSDEEP 3072:TY9ViJr6dK5Zi9YhM9Dic9o4EKgg3Wn41QA2kCISlb5:EeV6dmIx9lSg3c4FCIgl
TLSH
T18DA3020ABF4FE1AE46B742548AB607CE7A906241D0369997871107CEB1F78FE5C183D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00011e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00011e
Size 401KB
SHA256 38033735ff4ff2ba4762f13ed6c52ff85aeceacadb2612dbf998c5bf79ce6cbc
MD5 037c3af77fa83e73e12729e3ca855f99
SHA1 d4fe4062376213d010bd4baa93331ad18b1cbde6
SHA512 0bfc554b7b318e97a1b9d733e2c436056d4d1b3c01298e2c8cb5124aa7eeda3944bb1a4c71ef3f5578584f71bb6dc61478f56437369e11392799841089ec0a0e
SSDEEP 6144:034q4Tbu7QaXFNQgG3HdOMvUnLToAKm84XBwHwX8qFFVATEvOjHs0BkQ:034qSbu7QaXzZd44LTm4RTX8qynwmkQ
TLSH
T1A294238B514BF27DA3CA4C16F643DF60F041395E8A42E9B7DCB7C84259D0AA90F1CAE1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 6994ada81d2617fefd8d329c5c57a16f8848329df82963596746a3565a7e9414
MD5 c421e1d36301c1f8de57f8cd8ec70683
SHA1 2fca31412f81b164db6f5a88f540c3cb7f967341
SHA512 d895c013665286ed0e86e1e7833d410f576a829089328a047e5564713c886270654486e0a3f8bdae1447a5c44fce4b1395522cd9683343f2ba88b21ff873a52e
TLSH
T1EC81713832874F7AEB62A2B388CE109E773086F4F5521ECD5CA4D67465D1329CDC678A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 13KB
SHA256 b09ca3fd79a6d48bc9a9f616cd68263e743e63549c9f607bb1a42db547727736
MD5 f98b289b7e6dc158b3502e72cb63ce2d
SHA1 9520a736ea758cd9641f89af360725adb69b6a4e
SHA512 de0b755f479fb2e6e172681b77765c8a864c05cdbf1927c201535b4893ce5545e5e8fcb8e48d69c82618141e90088a0564dce3d1299feb64e290b32dc5be8ffc
SSDEEP 384:vTwCVaopPEVGeVeE4842ZjOLqCPImpmnA99BmFgMFr5dsWddTyjWv+nZ+A7diB3g:vTwCVppPEVGeVeE4P2ZjOLq8ImpmnA9H
TLSH
T17C523E34218A5F62DF15FDFD54C91CC9F33094E4FAAB1F8AB61190382083398ABD9B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe590352.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe590352.TMP
Size 3KB
SHA256 69719faa9c94adeb4cf35d8bd2e080cda996e598925e734b90b37116915c7e8a
MD5 41c7789bc796365a4de27da394933d59
SHA1 6b41b6be39ae9e65701c79418931ddbb9aba15dc
SHA512 66633895b1ec89474a154fd202844ba11b6426566e8e22144dec8a06d2932e6ce338736cb3b87542ef67478f68e7ce294b4a32bb50d31af8f2fea6783c309de5
TLSH
T124715F3820474FB9EB22A17388DE209D7B3082F5F4125ECD5CA4E67565E1329CEC6759
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\Origins\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.aliexpress.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 47KB
SHA256 d5481818dd5f27700d8e2b89e57bd852ac435b97ef9503e20eb7101403bccb83
MD5 f20fda47dabf2833b62cc261017cb25a
SHA1 514289a7e48d48d0fa20707fef7ac5b19e1b8027
SHA512 a2c10fc9fe8551b1dcd338b969886abf0807ca17c850df44b311f7b2d1ab1a87167346399c49fd3001db8404934e7ecb8f7c91a4bbf84126515db9e477fda6e4
SSDEEP 768:WZ8NwCG/TYT2T7HUHQbvbHPD9Ob9PGJzY:bGbYTEeQXk4Js
TLSH
T14423DFFBC3E4862EC91255F0AB146E1BCE1D0915572C3D2B89D8FE4B97E24B2E24560F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 11KB
SHA256 c8681ccf36bf0a163f8ddc2e2c1acaf8d46c6b18bae0578a4a9b920e6a8d6369
MD5 a85a0bd4e918c5fdf2c2b278f9ebd4c3
SHA1 c859177675fe532b50e87cb5790d6d15e42e053f
SHA512 c6bd3bed3fa5ef4e72e41982a6dd61be28f182fc74206fe510f39261c53d3c318b04acb14c34c7b6da0b3c65311067605f8d9542424351a4a529c4ff33885eae
SSDEEP 192:DUkSdgQzaaJsLmKJWeIJDW1kj6PPTvAIZfIOJaP0gDrA1suXgILPJ4GKNPfvDfPL:DUkSdgQzaaJsLmiWeIJDW1kGPPTvAIFw
TLSH
T17D329DF7C7E8862E891156F4AB156F1FCE1D0A18432C3D2BC5D8AF4AD3E2831D21665E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 75d22c20763a7fc67cdd73bc2231268bd09eebb668b49c8270926695ceba937a
MD5 7d32cf388016bbea4b6f9030f986e56b
SHA1 48ceb79c49130339b558721cfe5132827f87e18e
SHA512 f30831c15ba4c81153d9b27605f686e3c0154b1786d88c7544ff319a6f26af490ea2a16137586c7b67b0e684efc20f12cb4f5a853b3a99e2fef57f4206c891a7
SSDEEP 192:sxZUReyM/jK1Ml8Mkr/fBsPcK2IdpqJoHW6+WNrnc/YzTKpQIgrJ:sxZU0Mr/fBsPc+zHbI/o9
TLSH
T1C1520A126A349977CCDBD209FA45BB53E6F55572D2900D84AAFCCA0C05E7BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 825f9b6a1237ff283c9cf1502e4ba583b8e9a8f0c6c951799ee61479f3928845
MD5 bde78338cb95c580c8d29ce276692daf
SHA1 87cf50f00b6186cd2478369d4cfcaecc9da528e5
SHA512 cf82bd2d0a628251fbfdbd8ef9d0bb0871ea9755e74ed6e650a0a133259c3134f680665904fdebe90b85e202bdba359bf3d60172e67ca054e82017adcc31313b
SSDEEP 192:sxZrReyM/jK1Ml8Mkr/fBshfA2IdpoR1CnHW6+WNeMgG+m9ZYz45WQIg506J:sxZrEMr/fBshfkbHbFFZZe2
TLSH
T1F3620853AA345977CCDBD219B945BB53E6F95163D2900E44AAFCCA0C01E7BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 a6349a289f779f38f3dc7dcbf895ff0a1eb8b0729bbb66c7460d6e3e7db54ebe
MD5 555e62e4406f7ca6aef5fe5a6259b40e
SHA1 f961b324f29bc37c0f08b7ddaf329042d8fa574d
SHA512 cffa50119f589c0a59be6d937e3bf3fad8eb86b32c50dd088910d441b18f63577eb2f97984be877dc31900998c8c8238336b0cb8fcf5f5ce23e88c1f24dac39e
SSDEEP 192:sxZuReyM/jK1Ml8Mkr/fBshfW2IdpoRugHW6+WNeFm9ZYz25WQIg5LJ:sxZuEMr/fBshfKuHbNZj/
TLSH
T114620913AA345977CCDBD219B945BB53E6F85472D2900E44AAFCCA0C05E7BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 25b929e137f5b5ec225923e79dfd7e2c269e9e92ae9e7f300a5aa15891673ef0
MD5 e35ec58ade2f39aa7f63bb08c0b49d08
SHA1 f000803f810ffb0194f4953ac64165e0458e64be
SHA512 ccef6a2dec22d52c9da0ef81b8a60d85035d9ac791475c46a56b66ee298a137b8ed2cc3976fc7270bbac61950c25fe3623186ace1b5c3c1a98245204123d7d97
SSDEEP 192:sxZLvReyM/jK1Ml8Mkr/fBshfc1dpcBGlSMvB7CBSnHW6+WNOA9BwMgGme9+m9ZK:sxZLvEMr/fBshfe0GOgHbd/hFZnQH
TLSH
T15E72F953A5345AB7CCDBD219B941FB57D6F95062D6900E84AEFC8A0C01E7BED320381B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 a06ff68846aaf5e13c0776ef9d110555753791bbb58e557e56c3c4c2e6eb529d
MD5 be91e38cae262ab4b9054f4ad43e70ad
SHA1 f0dcce757b8d570a94bb79e4df80fced4fc66d12
SHA512 33839d623ff97b0907ec225bb6e94038c3a57c28690bda9e39600bca5c5fe8fd93ab1f23580aab29ac81cbbd09a003d0a69e705d6cdc58c0f3da828743ca807e
SSDEEP 384:sxZqnrEuOr/fBshfYT8Q0G/gHbd/hwFZZQH:sMrCr/fUfAQHb+KH
TLSH
T1E892E853A534097BCDEBD269F901B757E6F85163D6904E84AAFC8A0C04E7BED2203C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 22KB
SHA256 eb6343d217383434c8cfbd66cb8ace68f938060317b6dd51423a88963dc2f9c0
MD5 24988fb78857fa440c3b3718399fa85b
SHA1 8dfd65c9fe76e41e90099b9e842c49d07a65896e
SHA512 1abcd1b2e5fac0c90eeb86afee5c1b620849f2a73c8407efd0904280a62bde1d3e5919b6f4e498e0c3c80d3039288dd4fadf22c16caab139d0504857dd13e7f4
SSDEEP 384:sxZqn4Eqom1r/fBshfNT8+0GFgHb4/hw9FZyQs+ThmRG:sM4Tom1r/fUfNmHbp/sIQG
TLSH
T122A2FA5365344977C8EBD269F921BF56D6F85462DE904E48AAFCCA0C04EBBFD2202C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 ab397d6c6c472240df71c0d0ebd1ab55e8eaf1303ea1a462c429e3a56a3759b4
MD5 0ed93f69078524a347927ad112238270
SHA1 9aa5cdcdf859cd1c613c9596d485419a53ffb6c8
SHA512 ce6a9760f1523efe48edb50c21fe463b622e038e8193c766591802d526b9bdefad828d8a7353f9fdd378a60e7ba3e9ab023d4e0d0c56e0e0ba34f0f143ef0537
SSDEEP 192:sxZUReyM/jK1Ml8Mkr/fBshfP2IdpqDgHW6+WNrm9ZYzJepQIg5LJ:sxZUEMr/fBshf/FHbEZA/
TLSH
T17D52F912AA345977CCDBD209BA45BF53D6F55562D2500E44AAFCCA0C05E7BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 6794a83885233994e2f6e6277f35597b2e6c7f8522c93f37da3806bf58aa012e
MD5 58341ee418639115eb3f71e02f7437bf
SHA1 969e12e3496bc8ef72f1eeadb7b4b05b8769181a
SHA512 0dd9b2969b0bfb42e1cdb17d3674a16e9c126e3e21c666fe0a0d5c9b085cf7e7daf1c0375d595859da0434e1e46a0ae3bfcf2ae0e35343aac888a6522ef4f373
SSDEEP 768:s/W7kf0Wvqida8F1+UoAYDCx9Tuqh0VfUC9xbog/OVX5LlWYSjTroIZisYP:s/W7kf0Wvqidau1jaa5LA3jg7P
TLSH
T1B1D20B3B680CCB7E4F841E5CEC266F966ED801CB66988D5487FA884C03CB6EA51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4520dadc-db5b-4f2e-9026-0b551f142464\index-dir\the-real-index
Size 504B
SHA256 f135520c1822d19fd6d6c0b74bbf493e5c21ddfa0e75f909d3ad55f9b4d81ce3
MD5 3c3aa2a43a9cde0823732e796bf59017
SHA1 3e2c9513441f75dcb1f289243db6c8270334afe5
SHA512 8d501a6e857c685d7f993f5304e50036899ce8ddc887c7535d0b41fe034e6100779352f39c8e680a8fcdf9263a3a809982d344b3ef1d5def0ba2609df4165f03
TLSH
T171F068584F91552ADBA449F324F714A273B2CDEC7232C85B483C6C6E3C7A388616B1C8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4520dadc-db5b-4f2e-9026-0b551f142464\index-dir\the-real-index
Size 3KB
SHA256 32d7bc60ce5681a431010e16b3fac1bd9f534da92d399e2cba7e25342ea27594
MD5 fbddc3d69183e2bdc1e1aa4af453e9d4
SHA1 fcd5f45f76e79603bcf11e500f61b794a157cef9
SHA512 4c46d107811e752d3c710e11075666f6ea6cae4e4d6cdb8f65c56915ce7db192d7a88a2558bc59706adb65db7e3f373bf781e3a18386e55e451c54f2874e8598
TLSH
T1E651C78DCC895B87DD6C51B358BB14C8337678DC4A888A0B6EEC64386CD337E1C26689
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a4e12.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4520dadc-db5b-4f2e-9026-0b551f142464\index-dir\the-real-index~RFe5a4e12.TMP
Size 504B
SHA256 acf0bac71b8a1427670c8cb3c0df9f7e306e1cacd214d1d0137f34026990ee9c
MD5 71ef031161a1a20b79b4895c315854b6
SHA1 660017ae99ea1481f3c330b4ea2ecefd808de58c
SHA512 600b21be47e7371ce2bedf7ac369bf6af03be333070658495e95fa5697dff7b9d58a2fd2962b720b343346e0026bb88652bf2968ff96f193088772e2e9aad0b3
TLSH
T14FF0C08987920413EA200AB715E504A7B671CD207171E8832039A92E2C757C8A5530CD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\dc577b94-5e5d-41ae-97a8-afa364edec75\index-dir\the-real-index
Size 72B
SHA256 e52c9bab9b68bcbf3e6634475e725fe9e65cc4003ef9220e0e18995490355a07
MD5 7972e699a77f5a7cfb9af15b485a1287
SHA1 e6408949fd5760a115f1f0b4de4f82395d2968b3
SHA512 d0957be59b4b5552868f5c5cb95b71fb342deab8c4c047362a601e8e74ff79f8fc60512110d972e0a65d91ac92a293dbbd54f11c24b7b419045e389b1e4da0ad
TLSH
T16CA00413CFC30007D11311F15D5307411F01CDF075105307D4D1004CCC7044C4D4104C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\dc577b94-5e5d-41ae-97a8-afa364edec75\index-dir\the-real-index
Size 72B
SHA256 0fe90b26c039fa04bce67ba3258d0cad6a76384bc9205ccd977c3c9ba258e834
MD5 c9cd578ebe2a525bfae5dbd9d220db9d
SHA1 435dcc3223f34b129771f55c3ec964b1d95c9e73
SHA512 a9fa1ec7e06e2d2902f43c78a69594fb5d16825882e28812a5b56dd8df39079a18110c50f091e0287cd9c066b0ec1a3349f2731cdb60984f60f7f11121715fd4
TLSH
T155A0021D4A80CA41C103E2FA3996024A22534D55030257155190105ACD70B49475500D
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 1d9068254f3d6661a2b4795bb27efbd3dbea6c90be88258397e5387b414eeb89
MD5 75f9cf09ffa2802dab5d35a4ed35c8cf
SHA1 5e8ea2c220e4940f6a2b1962b32969f4a9cb64e9
SHA512 eee1f1f9158668d9fe7673d0f8222fe7ddf179aa0a682ee7f74c1b87196834442967aea5d6623b5748ede265d9d97471afeb6048350c36e406ed548e17ddc0ac
TLSH
T158E0D8BB2DFB1D24AD6F97D538B1A5A18185395C9504FC4E3167A29770F2751280AC21
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 87615629dcd2fe94d6229a1600d850f6d988c3070b23cd80f39893ae37988646
MD5 9da19ad880305a001515494840067000
SHA1 bd172e691df97899f2ca1141dcd1747c87952827
SHA512 b6e9b09a00bb4cadb3e2b4dfb69abc61921e653195ad7b57d247c34ebae17637e7b8ac42f39b8f7e13c9004c18532b299d35e4dc12b6e69cc867b985be78db0c
TLSH
T147A002A1C6770981E31146B8B45202847221CC10D65B331353B80054AC6A150C913518
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5aa818.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5aa818.TMP
Size 48B
SHA256 04d8fe10f60d50fec8eb1aec1834376def88fe5be13dd4404a6fc239c976d309
MD5 30308db34871d7837a087fc19127050f
SHA1 798d9a8e1fe2c2e3114a0ff5b277ba780df53e51
SHA512 712c0e4328a55c74e5d7258c0f51035f7d3561b98ec38f332142ff01ada8c58b08fbde4b8d8124d133b0c4e4b109b0c6f255fed0eca02a64999631fe05ebd026
MD5 SHA1 SHA512

Submit Download

aa0c8f5764a4c2d9_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\aa0c8f5764a4c2d9_0
Size 194KB
SHA256 ff604687ebdfe8466fc7bf6209e259b95f801f17ced24c5e284d897cc5bb04e8
MD5 c612f2d76fed5cdcdf0c13cb8c3a4960
SHA1 dd123d03e09620d77df3bea25a1feb7ce82d28df
SHA512 7de5229fa8787df4193ef376d8726385bd0804734d856ced5216de8a0941c157b0d10e03b7a65cbfe20b09c6ef71073a12598b8a6688c816de1bec644d0c3f66
SSDEEP 3072:NegF1cJu9zByRIZa8vj0QbJI1lXrZ1lThh:NegF1cc9zByRIZa8HlI93h
TLSH
T150146B316300F43BA9139E61A27F7F4E3C35A16BDD0686FCA1E4E870AEE6CB60515758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 120B
SHA256 d861eaf1114f68418e4b851dfe1670f400ae30fee2b5a24204971de36a61131a
MD5 ac8d981b5b4615b2b785a57e5bb6f3a8
SHA1 ca2548120399b58d539bd1ae658044d83415ec2b
SHA512 fbcdd7f707a396457ff949408cb98c5f8ac2bf72c5f09b3c06b322caa540dd18c518fce874d425c7e88fbe63c68d03d37e9dbee50a920ceaa59286a08c24dedc
TLSH
T13FB0128050A00C51CD080B7131D184C4FF341CD03394A60390F640756A074440318300
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 48b29e339cd4fd8a2b9fc3615e95ce5d778ed6409d99bea40dd133c4042e1099
MD5 6802f8ece04fedd1e62df9487abb0874
SHA1 6978ed8bbf5ab555e5dc6919c09cedf6a8d34cbc
SHA512 fc4916566c7e6701ebec1d06c073f16800e63915672d4d8c4e5f8eb847db1b3d32ced2d4932cf3fd7f6df4d80b8a700cc007258429e1a626e72c047da1dfdb6f
TLSH
T163A0025513D10875E90582F621DE5189AF286C522119DB0774FB0C4D9C9254C6149442
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 2d76b2797f5073b289b7bc5d64bd59af71b1c67d2a7f94d0f6dd09f8f7067dae
MD5 389837dbb30973aff819df30afd0f9ac
SHA1 a8539812a58234a4e78e4f643607295285b5e911
SHA512 897f1379d171e5eca844a5d17bb58ba7cd3324a8e015e17ee6c495bdfb3b261252ea1b2b8a60a6314505ae82326773146d1fc168f7cd57d792afc21c933ee740
TLSH
T116B0220C00A30CE2CA300BB022E008C8BF380CA0F30AE303E0F33008AC83E08820E20C
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 3c059c47a9575f1df35e2ebae9fb8a5f72d27e8133dd8e0df313816fd765e547
MD5 5d67d1c0da2e4f8384f9c02ab8589eda
SHA1 cc4427eb9ce5b3cb52be7ba4a7a79c35a8ca2c5a
SHA512 eec5423932bf233c8f72ce650d243d0b4b9150d7b7ede832bd5f71f98cad2d75b9eb405ccae1e3e8aca77efbabb7c4909d59d388988c5cc67800812815baf2ba
SSDEEP 96:KIbCKcfJiKiQamvGKYIwYNcoeKmMOabXkAMKsZkmMl:sSJFLYNcoeKmfab0AUZkmE
TLSH
T1599175A2773B1601387D2848A35D9A374E8332537459A46F3BB801B11E27F215EFDADD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 150B
SHA256 8f5c147c28d6dd5268cfd0c767e95313a92075bcb4dcb97d155a06459e3a2a6e
MD5 764aacfd26900bd27d76dd75b0beb577
SHA1 06f251c1d854143fcd05d39be350bc09503a829f
SHA512 53cb0d152b74d949dc301c89708c85750fcd12f94d8b2eceba5985a4fa7efa3d06ae4dc070c770f4ba260e363e146aafdf82c3b31016f2e5d5e6682ad2654f8a
TLSH
T148C04CF71510A68B5A35EDD91028752ED91B824D8CD4CCEC944454122474B375541A68
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe59a8b9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt~RFe59a8b9.TMP
Size 157B
SHA256 69f10553d296e04e21a8adf5900383ca3ec11c464c426dcb7c9bdcbc80553af5
MD5 dd37dadd64d72025a8489a48a9fe6a46
SHA1 99c3486d80049800f2f822b5266b293dd3fc7d57
SHA512 3bdd32dbad3ed0dc80cb00163d61c8ae616c048c14fa62164adb01fb0574d47efa8d3e56a3b5af6b7bada02d073a4cf1248ecaa6a2c56f4ac246ab697b0ceb4f
TLSH
T1A4C08CF70410528B0B32E8D91028711EC81B8D4E8CC4CCEC900570023074B335100A68
MD5 SHA1 SHA512 TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe597fd5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe597fd5.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 c24502f22f8fb86159426385aa54b84ddad9d88c525acd3edda2907aafe583ca
MD5 670d5c136fdc0f88d6944b456599d7f0
SHA1 2bb670721fa2f25d18432e154855d1d4f44c8832
SHA512 cb5d2792e121dd7b07ac8eac72ba6be488aa7ea5e4cf9fa2f94b9eeb376cd05daf1cc5cb3f05104327f2d9645c56749672f578ff4ac3a5e42f70e17288145f9a
SSDEEP 384:NtNn/s3n9SfsNzfaTOkbEHDuOdWGimcMLcG0FrMA16hbOsx:Nj+9Uh1CxoGi9MoG0fkN
TLSH
T1E9928D329C75AC2B5DA6A591F1073B035FF4C1779AC42F94E6ECAB0D02EB3A81317906
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 63930b783afe6933270b0acab7b46185e69d2d2aaf1ab26eae96eac41b5a9021
MD5 80fdfca57820ef7d10cd317f2fb7982d
SHA1 041562baaa9ed93fd9fce015dffe182c029d82a1
SHA512 27f1d650b0dbe215a471b293ec1b67e5ffc597df9838ce7216d64e09a0b2ee58633c55d036a32c5eca4fda587e2b0e524b467b571a5d01a23512d84f1fddebe3
SSDEEP 192:MON364BAQmiUyz13W5GBPKmx+FdG+Po5Z4aDbZ6U6:MON36eAApWldWF96U6
TLSH
T10802D739AC796C7B9EB2AE45F48637175FD8113BE6852B44EAE85B0C01D775C230382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 f1b2325c713d10dad93ff653034bd860829626d17f1469a13d2b3ca6b452c881
MD5 7aaca32ebd8c9e735fc6a10a7be1d3f9
SHA1 f3ecb46b82ba84103b02599d08a7953ed4395bd7
SHA512 58d6eb3dbb7d69330136825b6f21e38a0aeac58de001e69af0082f204be1e6e2f861bc7f2f9cfdb739854d1431a25374886c7cb567fabc4b93282910feaae6fc
SSDEEP 384:SPiF1tNn/s3n9S7zsNN8TUNTUlIlyaTOkbEHDP2OdWGimvMLcG0FrMA16hbOsx:SaF1j+9EUwgV1yL9oGicMoG0fkN
TLSH
T1D7C219F248D7983AD99E9743B33E2E025EBCD167B5806954B3D85A0CCDD62BFC306905
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 3e10afb25cde5f2cd5cd8e302b02c065002a006413dae135d3b23ecc2e94648d
MD5 75bcfa44c473ed37939586e2e9b4a674
SHA1 9f22f3510d5a296447acb6a2a0f5d7a8cafd9d76
SHA512 7d90f8ddded5d02d1cb5ba606f23ffe3177ec3ae27b947463bb76661f2999ab5a683b99c99fcaf95e666f36951c278143f0eccea2d8db0366f6780b578d3cc90
SSDEEP 192:fONm64BHQmiUys3W5GBPKmx+FdG+Po5Z7pEimMUWwtrq1U6:fONm6epVWldWGimJMU6
TLSH
T17012FB356C74AC6B5EA27551F48737035F98512BEB856B84E6EC6B0C02EF36C2317816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 18ebd299a3c7c99eee615d77adb48c417a76a0814fe68a07a5ab46e930971c43
MD5 c0ff3a7f4f202c3c2fb69f770d1a5b75
SHA1 195a0f7d6f2f8d9ae7c6e76bd7c7d089398ef2f1
SHA512 286f6dd59148076d49eab0dc1e5cd2c5ffce339350ae7d152d6d61dfb4329fbb8868089afc68656bc3904d07804d011551ff0cd71e2f24f2a3429f12f36c8c5b
SSDEEP 768:SaFoj+9cVwgn1WRoGiHAbS1Fn9D8oG0fkN:Ss9ck4n/8oG0C
TLSH
T1C6F23AE188D34CBAD59D9BC7A32DAD0129BCC137B4845958B3F4A62DED9B1BFC312811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 65fcb6deb46163647db1b12ef715e81b81fbc6a0c3a24ab162198ca807f27e2e
MD5 92671f00bce833029726910866d814ef
SHA1 ced176b00d8ad801225d58c2328470c6672d2e69
SHA512 a3189cceb6bca3212ca93b2a2aa5cc94318cccb639527a9ef161ff0fb1e04c7016489177d0a2db752fab6500b69087ec14fb0e716f575f89d5e5b30c9ad9ab8c
SSDEEP 384:wtNn/s3n9SfsNzyaTOkbEHDuOdWGimcMLcG0FrMA16hbOsx:wj+9UK1CxoGi9MoG0fkN
TLSH
T1F5928D329C75AC2B5DA6A591F1073B035FF4C1779AC42F94E6ECAB0D02EB3A81317916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 7bf1311c6fcf494cfe8b40ee73286979ac18d7530f2d9535cb724ca2f8e1f6cd
MD5 4afdb5c75d673e6c52169c62309d8de6
SHA1 d1a5df26b49afa9b6e9abe8650376f0559e65c39
SHA512 cf0a4e26d8c6a563343b39b1807d8f9d7d2a980399c004cd081845098b3b15f4690d11df0cd1cdf07d2bdcf7f365624e92d86396aada3310df665f17c167f9b4
TLSH
T10EE001239B0000EBC4795B3401D71B203FB3C530036303079E21257C5D327803F21AE0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 dfad24439d063ab7d2e8e8a68390fb7cc96e520d18f9e24344c5d04f42bd066f
MD5 a5ffd9d975d9ebf178fdf12ce4d88ac2
SHA1 ecfb6b94e0b07c265f3205e29b3040ea96fb169c
SHA512 18cdf355715d320beedc147cee662a7ea55bdce0746b4e2baeb453046548471853980a9fd78d7cd1f0033e7d40d343e5ee67b44f57e38152c98e906777bb6230
TLSH
T190E009239B0040ABC5695B3401D72B203BE3853103A642079E21296C6E327802E219A0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 8e11202596b529da62421934acfbb5e3aea873db268ec5fca17179ac577a4707
MD5 30ad9491571a4c11a9fdaed1485602aa
SHA1 95624c754c5ed004dfc49260c66030fb5fd5fe5d
SHA512 19bc44385886f04e890208d0b49ac02a8564196635310ca82e7b0a0d2ca9a3e821fa72f480d662a55fbb1375a33bc6ed7b565e4c129d40ccdf15591c51a0f972
TLSH
T101E00223970000EFC439573401C717303BB3C530035303079D21257C2D213402F219E0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 82fdf5f7206c331d9c33320ea4d2f2b6aca06c37ba9334e8aa1b0adb5fd5caa6
MD5 67a4ac23876455a60bdf7d9b59911f11
SHA1 29eabdb0fc7e86cb37d100cfa1f123d7cc618faa
SHA512 52e024e43912897c046864cdacd93ce907178eb513a28d47291fda8d380f150f18bb63b26435ed119eea95c0619e946882ca0a317dcb52251e6a484c55a61a68
TLSH
T1C9E00430D700001FC435573401C7133037F0C50003130307D411357C3D113401F115D0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 c727b72ee751a444834e18b34d89b9d663d0eb36062b28c767d4da95002125c6
MD5 4cd775d7108ae270d1a55913109ed5de
SHA1 99cb98d4143a84d67feb168350b0c3bd08195a93
SHA512 3cde1e5e6989b6e1050c234e8fd3690e42cc3692d28bb772dc209598de88efaaf5b605974161e8a4be6dc6db113f59b1243802761205150fdab8be5e33e9d9fb
TLSH
T12AE09213A70000FFC07C073401C327203FE3C430039242038E20142C2D317443F204D0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 3c85f4eb3e1e56056b995d33636ad7446811fab2ef4e903df97c4f8186c5559d
MD5 90cb4dcbee978411269023e6eda3b947
SHA1 1a680397a64060228e90385bb1518a51b9dc12ae
SHA512 0999b80a7b32f74eb651970f19225151f92efe969fafc90461e3f58c4a72ad9e30b88d69136835f62b771fc23e6e37da629397baa55678c50a6e5f31955db5a9
TLSH
T10AE04813A70400FBC07C073482C32B202FC3843002A142428E20140C2D327883E309D0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 336ec867097fa35d81ffdca82954b70fa7cd61c4c9f16acb1b1b7a378ef1b4f6
MD5 f3173edf60e0d531104a6d6866098bb4
SHA1 566cdbf8915b1c50e8a7df4f490240d241853862
SHA512 1f1a370219eef08418e5708f1720c0570a7f14059cae88ef9c5af36351aeda2cdd848c0a34c7f803ba56a81beda6b433c2c50ea048d13e391f2ba4316a0d2cc2
TLSH
T125E00923AB0040ABC56D5B3801D72B203FE3C57103A642079E21296CAE32B842E21AE0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 1a0df67a8ada619d9e90bca4fb115e9ec7c4d05fe3b5d4adf8456a3f96f46ec8
MD5 cba6e860a9470656318b787f7778b3bb
SHA1 e8bf826ee439c614a92d533e40b79513ec7790fa
SHA512 4bc20c227ab1ae388a0a2515c52b69d1ae012db73145ef6eda574f3300b982ccb0ea2410579138dfada6750bb9104a7a31524ad1d83e9aee69a9a02e25c34377
TLSH
T1FCE09213A70400FFC07C073481C327203FC3C43002A142038E20140C2D327843F309D0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe597a95.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe597a95.TMP
Size 392B
SHA256 17ec9744fbdefb6c945ded7c6691efc6da04163d607b5ced9c3304a495dcd03b
MD5 81ec5005b93185878eb938d059b10f7a
SHA1 86cdf08e6763680064d1d8b88b87a5e8805c618d
SHA512 3f8e6f3457082054e2e987049ece7e3200caceba5ece3eafcd5c6471ac3fec49f4f033d0ebd629b69aa5eccc11020a1a51debc4e1965bd7c1febbe160126da49
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 3f16807eec3a6a6f5d72dadcd9cde74dc326f081a427953952aa06735e163fee
MD5 f2f438960f30edc6a490ec91193d8563
SHA1 1fe09e6e383d88f6d56dd95eac8f4c88df9cb4a7
SHA512 dc5a65a9529223d61a979d587c1d4f860fe23b92c9a0567db178ce47da4da0d258fe1b8c3049da07e366ce6b276ed8c5329ce29310ed9e9266ea93f06fc10b1e
SSDEEP 3:MsEllllkEthXllkl2zEglt+Vl:/M/xT02zjQP
TLSH
T1CB440224AF805405C6005470942183501360D5A40D229B83346645125C855901C40040
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 ea7297a025657e9fad574bd8242d8016f9e4b15ed8c865d553767c3dbac98070
MD5 2bb35c09350ec0c20ad9652027299c8d
SHA1 6cb4c59ff24581d363d5c7918404ebae688592a9
SHA512 2537e4fce0759a2e986ee2d68a65d5df2c40f0613631ed998c1c01220a00391d7c519e324078f4ae74d1bce734977ac3011f6e06baf1eb5da766fdec8ca7506d
TLSH
T1B1412B9CAAF91104B3B7AF5AABF7A46D447ABC373E16D56D00110E4F4662B40C872B37
MD5 SHA1 SHA512 TLSH

Submit Download