hxxps://sharemods[.]com/i5awpejnary2/FS22_Sipma_Z279[.]zip[.]html

Resubmissions

29/06/2026, 14:20

260629-rnfgwsfv9s6

29/06/2026, 14:18

260629-rmda5sg18j4

29/06/2026, 14:15

260629-rklvhaft9s4

Analysis

user interaction
yes
max time kernel
151s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 14:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://sharemods.com/i5awpejnary2/FS22_Sipma_Z279.zip.html
Sample260629-rnfgwsfv9s

Score

6^/10

discovery persistence ransomware

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
496	drive.google.com
498	drive.google.com
576	drive.google.com
577	drive.google.com
494	drive.google.com
495	drive.google.com

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1912	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1991999443-3181470666-3272020885-1000\{A08D7345-D4BD-445F-869B-A2443ADA22B5}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1991999443-3181470666-3272020885-1000\{B5B0F587-EEBE-43DE-849E-F1DD632F3C1D}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1028	msedge.exe
1028	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 34 IoCs

pid	Process
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe

Suspicious use of FindShellTrayWindow 45 IoCs

pid	Process
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe

Suspicious use of SendNotifyMessage 20 IoCs

pid	Process
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3040 wrote to memory of 1556	3040	msedge.exe	87
PID 3040 wrote to memory of 1912	3040	msedge.exe	89
PID 3040 wrote to memory of 420	3040	msedge.exe	91
PID 3040 wrote to memory of 6084	3040	msedge.exe	90
PID 3040 wrote to memory of 420	3040	msedge.exe	91
PID 3040 wrote to memory of 6084	3040	msedge.exe	90
PID 3040 wrote to memory of 6084	3040	msedge.exe	90
PID 3040 wrote to memory of 4632	3040	msedge.exe	92
PID 3040 wrote to memory of 4632	3040	msedge.exe	92
PID 3040 wrote to memory of 4632	3040	msedge.exe	92
PID 3040 wrote to memory of 5420	3040	msedge.exe	93
PID 3040 wrote to memory of 5420	3040	msedge.exe	93
PID 3040 wrote to memory of 5420	3040	msedge.exe	93
PID 3040 wrote to memory of 5448	3040	msedge.exe	94
PID 3040 wrote to memory of 3016	3040	msedge.exe	95
PID 3040 wrote to memory of 5448	3040	msedge.exe	94
PID 3040 wrote to memory of 5448	3040	msedge.exe	94
PID 3040 wrote to memory of 3016	3040	msedge.exe	95
PID 3040 wrote to memory of 3016	3040	msedge.exe	95
PID 3040 wrote to memory of 4732	3040	msedge.exe	97
PID 3040 wrote to memory of 2552	3040	msedge.exe	98
PID 3040 wrote to memory of 4732	3040	msedge.exe	97
PID 3040 wrote to memory of 2552	3040	msedge.exe	98
PID 3040 wrote to memory of 6044	3040	msedge.exe	100
PID 3040 wrote to memory of 1572	3040	msedge.exe	103
PID 3040 wrote to memory of 1572	3040	msedge.exe	103
PID 3040 wrote to memory of 1572	3040	msedge.exe	103
PID 3040 wrote to memory of 1372	3040	msedge.exe	104
PID 3040 wrote to memory of 1372	3040	msedge.exe	104
PID 3040 wrote to memory of 1372	3040	msedge.exe	104
PID 3040 wrote to memory of 3224	3040	msedge.exe	105
PID 3040 wrote to memory of 3224	3040	msedge.exe	105
PID 3040 wrote to memory of 3224	3040	msedge.exe	105
PID 3040 wrote to memory of 5184	3040	msedge.exe	106
PID 3040 wrote to memory of 5184	3040	msedge.exe	106
PID 3040 wrote to memory of 5184	3040	msedge.exe	106
PID 3040 wrote to memory of 2168	3040	msedge.exe	107
PID 3040 wrote to memory of 2168	3040	msedge.exe	107
PID 3040 wrote to memory of 2168	3040	msedge.exe	107
PID 3040 wrote to memory of 2704	3040	msedge.exe	108
PID 3040 wrote to memory of 292	3040	msedge.exe	109
PID 3040 wrote to memory of 2704	3040	msedge.exe	108
PID 3040 wrote to memory of 2704	3040	msedge.exe	108
PID 3040 wrote to memory of 248	3040	msedge.exe	110
PID 3040 wrote to memory of 292	3040	msedge.exe	109
PID 3040 wrote to memory of 292	3040	msedge.exe	109
PID 3040 wrote to memory of 248	3040	msedge.exe	110
PID 3040 wrote to memory of 248	3040	msedge.exe	110
PID 3040 wrote to memory of 4868	3040	msedge.exe	111
PID 3040 wrote to memory of 256	3040	msedge.exe	112
PID 3040 wrote to memory of 4868	3040	msedge.exe	111
PID 3040 wrote to memory of 4868	3040	msedge.exe	111
PID 3040 wrote to memory of 256	3040	msedge.exe	112
PID 3040 wrote to memory of 256	3040	msedge.exe	112
PID 3040 wrote to memory of 5540	3040	msedge.exe	113
PID 3040 wrote to memory of 5540	3040	msedge.exe	113
PID 3040 wrote to memory of 5540	3040	msedge.exe	113
PID 3040 wrote to memory of 3484	3040	msedge.exe	114
PID 3040 wrote to memory of 3484	3040	msedge.exe	114
PID 3040 wrote to memory of 3484	3040	msedge.exe	114
PID 3040 wrote to memory of 1160	3040	msedge.exe	115
PID 3040 wrote to memory of 1160	3040	msedge.exe	115
PID 3040 wrote to memory of 1160	3040	msedge.exe	115
PID 3040 wrote to memory of 1004	3040	msedge.exe	116

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://sharemods.com/i5awpejnary2/FS22_Sipma_Z279.zip.html
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2a4,0x7ffb0ba7c188,0x7ffb0ba7c194,0x7ffb0ba7c1a0
  2⤵
  PID:1556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1692,i,1603249432027985991,11114976420885607444,524288 --field-trial-handle=2260,i,2093844515617513667,1347723870574122024,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1560,i,12258760011465879463,7784997164242799849,262144 --field-trial-handle=2260,i,2093844515617513667,1347723870574122024,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:2
  2⤵
  PID:6084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2464,i,2806571355790774915,1316807960755690798,524288 --field-trial-handle=2260,i,2093844515617513667,1347723870574122024,262144 --variations-seed-version --mojo-platform-channel-handle=3044 /prefetch:13
  2⤵
  PID:420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3568,i,7382708540787897612,13388453930625011319,2097152 --field-trial-handle=2260,i,2093844515617513667,1347723870574122024,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
  2⤵
  PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3592,i,12587096838370480112,1854528805160547429,2097152 --field-trial-handle=2260,i,2093844515617513667,1347723870574122024,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:1
  2⤵
  PID:5420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4204,i,4291165920065658514,18283462687759613793,2097152 --field-trial-handle=2260,i,2093844515617513667,1347723870574122024,262144 --variations-seed-version --mojo-platform-channel-handle=4776 /prefetch:1
  2⤵
  PID:5448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4216,i,14860893482525226071,38667837568626543,2097152 --field-trial-handle=2260,i,2093844515617513667,1347723870574122024,262144 --variations-seed-version --mojo-platform-channel-handle=4780 /prefetch:9
  2⤵
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5520,i,16123728380614243711,8300090600836533611,524288 --field-trial-handle=2260,i,2093844515617513667,1347723870574122024,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:14
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5528,i,12621817172143996541,12750693583734397316,524288 --field-trial-handle=2260,i,2093844515617513667,1347723870574122024,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:14
  2⤵
  PID:2552
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6272,i,6713367907785332818,8700390580016945103,524288 --field-trial-handle=2260,i,2093844515617513667,1347723870574122024,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:14
  2⤵
  PID:1004
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6272,i,6713367907785332818,8700390580016945103,524288 --field-trial-handle=2260,i,2093844515617513667,1347723870574122024,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:14
  2⤵
  PID:6044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6656,i,5676511552046688842,15855368235737305424,2097152 --field-trial-handle=2260,i,2093844515617513667,1347723870574122024,262144 --variations-seed-version --mojo-platform-channel-handle=6676 /prefetch:1
  2⤵
  PID:1572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6780,i,5356364661810169759,9894109058424538927,2097152 --field-trial-handle=2260,i,2093844515617513667,1347723870574122024,262144 --variations-seed-version --mojo-platform-channel-handle=6804 /prefetch:1
  2⤵
  PID:1372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6968,i,11832251315984338728,14433438842111570783,2097152 --field-trial-handle=2260,i,2093844515617513667,1347723870574122024,262144 --variations-seed-version --mojo-platform-channel-handle=6984 /prefetch:1
  2⤵
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6648,i,14821840010418413285,16860674224093110387,2097152 --field-trial-handle=2260,i,2093844515617513667,1347723870574122024,262144 --variations-seed-version --mojo-platform-channel-handle=7144 /prefetch:1
  2⤵
  PID:5184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=7328,i,6682459221749667743,655740761314581777,2097152 --field-trial-handle=2260,i,2093844515617513667,1347723870574122024,262144 --variations-seed-version --mojo-platform-channel-handle=7356 /prefetch:1
  2⤵
  PID:2168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=7172,i,8384217878303706147,1457956071713551718,2097152 --field-trial-handle=2260,i,2093844515617513667,1347723870574122024,262144 --variations-seed-version --mojo-platform-channel-handle=7632 /prefetch:1
  2⤵
  PID:2704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=7576,i,12844011523135979942,14563157610833641348,2097152 --field-trial-handle=2260,i,2093844515617513667,1347723870574122024,262144 --variations-seed-version --mojo-platform-channel-handle=7652 /prefetch:1
  2⤵
  PID:292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=7588,i,2332451885207833034,1027529581961725905,2097152 --field-trial-handle=2260,i,2093844515617513667,1347723870574122024,262144 --variations-seed-version --mojo-platform-channel-handle=7664 /prefetch:1
  2⤵
  PID:248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=7492,i,8392063570238658413,9282883272989936372,2097152 --field-trial-handle=2260,i,2093844515617513667,1347723870574122024,262144 --variations-seed-version --mojo-platform-channel-handle=7636 /prefetch:1
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=7196,i,15151460108024647407,15899680362991126454,2097152 --field-trial-handle=2260,i,2093844515617513667,1347723870574122024,262144 --variations-seed-version --mojo-platform-channel-handle=7640 /prefetch:1
  2⤵
  PID:256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7292,i,1918525430682023000,18283670634244857079,2097152 --field-trial-handle=2260,i,2093844515617513667,1347723870574122024,262144 --variations-seed-version --mojo-platform-channel-handle=8064 /prefetch:1
  2⤵
  PID:5540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=8276,i,7107659246099128844,3137492973002243997,2097152 --field-trial-handle=2260,i,2093844515617513667,1347723870574122024,262144 --variations-seed-version --mojo-platform-channel-handle=8272 /prefetch:1
  2⤵
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=8416,i,14882984203117428359,1938751042911406161,2097152 --field-trial-handle=2260,i,2093844515617513667,1347723870574122024,262144 --variations-seed-version --mojo-platform-channel-handle=8308 /prefetch:1
  2⤵
  PID:1160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=8276,i,584200031893369347,5647816412204250110,2097152 --field-trial-handle=2260,i,2093844515617513667,1347723870574122024,262144 --variations-seed-version --mojo-platform-channel-handle=8456 /prefetch:1
  2⤵
  PID:1004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=8676,i,17211388139329178554,14882546639580129893,2097152 --field-trial-handle=2260,i,2093844515617513667,1347723870574122024,262144 --variations-seed-version --mojo-platform-channel-handle=8696 /prefetch:1
  2⤵
  PID:5888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=8904,i,2182211293928232964,7299022500116635273,2097152 --field-trial-handle=2260,i,2093844515617513667,1347723870574122024,262144 --variations-seed-version --mojo-platform-channel-handle=8872 /prefetch:1
  2⤵
  PID:2696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=9064,i,7648746780582427322,12126861372524490094,2097152 --field-trial-handle=2260,i,2093844515617513667,1347723870574122024,262144 --variations-seed-version --mojo-platform-channel-handle=9016 /prefetch:1
  2⤵
  PID:956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=4800,i,10703183131105969692,13977209408831071235,2097152 --field-trial-handle=2260,i,2093844515617513667,1347723870574122024,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:1
  2⤵
  PID:2628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8944,i,8948786786483786932,8607282051974257689,524288 --field-trial-handle=2260,i,2093844515617513667,1347723870574122024,262144 --variations-seed-version --mojo-platform-channel-handle=8888 /prefetch:14
  2⤵
  PID:584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=8952,i,6294389919804383363,8041888405910312189,2097152 --field-trial-handle=2260,i,2093844515617513667,1347723870574122024,262144 --variations-seed-version --mojo-platform-channel-handle=8432 /prefetch:1
  2⤵
  PID:2832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7772,i,8450081690748150463,809060923615193147,524288 --field-trial-handle=2260,i,2093844515617513667,1347723870574122024,262144 --variations-seed-version --mojo-platform-channel-handle=8936 /prefetch:14
  2⤵
  PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=8136,i,14652028461292462239,16964374001146255021,2097152 --field-trial-handle=2260,i,2093844515617513667,1347723870574122024,262144 --variations-seed-version --mojo-platform-channel-handle=8128 /prefetch:1
  2⤵
  PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6652,i,5469131285209933170,15857534071941192966,524288 --field-trial-handle=2260,i,2093844515617513667,1347723870574122024,262144 --variations-seed-version --mojo-platform-channel-handle=1596 /prefetch:14
  2⤵
  PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7564,i,15852329981067271175,6918517200279292312,524288 --field-trial-handle=2260,i,2093844515617513667,1347723870574122024,262144 --variations-seed-version --mojo-platform-channel-handle=9160 /prefetch:14
  2⤵
  PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5212,i,1793639260451498332,11486935027584959132,524288 --field-trial-handle=2260,i,2093844515617513667,1347723870574122024,262144 --variations-seed-version --mojo-platform-channel-handle=6856 /prefetch:14
  2⤵
  PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9148,i,7193636604883860169,1471601935070671578,524288 --field-trial-handle=2260,i,2093844515617513667,1347723870574122024,262144 --variations-seed-version --mojo-platform-channel-handle=9164 /prefetch:14
  2⤵
  PID:2516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=4052,i,4868528614825505582,15211690953239678300,2097152 --field-trial-handle=2260,i,2093844515617513667,1347723870574122024,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:1
  2⤵
  PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=3648,i,14865080746688129280,6807583439338912909,2097152 --field-trial-handle=2260,i,2093844515617513667,1347723870574122024,262144 --variations-seed-version --mojo-platform-channel-handle=4040 /prefetch:1
  2⤵
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=3808,i,908512360316565650,15718525561288185415,2097152 --field-trial-handle=2260,i,2093844515617513667,1347723870574122024,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:1
  2⤵
  PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=5664,i,8396957114999146355,1815157033036424304,2097152 --field-trial-handle=2260,i,2093844515617513667,1347723870574122024,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:1
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=4824,i,4834149581974105587,16102734502537391375,2097152 --field-trial-handle=2260,i,2093844515617513667,1347723870574122024,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:1
  2⤵
  PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=6712,i,8838699128888818194,11609583169562199739,2097152 --field-trial-handle=2260,i,2093844515617513667,1347723870574122024,262144 --variations-seed-version --mojo-platform-channel-handle=8020 /prefetch:1
  2⤵
  PID:688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=4852,i,11164076639789409985,14878392811711896902,2097152 --field-trial-handle=2260,i,2093844515617513667,1347723870574122024,262144 --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:1
  2⤵
  PID:5208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7012,i,6399023796251866624,6884068213088635541,524288 --field-trial-handle=2260,i,2093844515617513667,1347723870574122024,262144 --variations-seed-version --mojo-platform-channel-handle=7040 /prefetch:14
  2⤵
  - Modifies registry class
  PID:2860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6372,i,12555099938422243874,13121934607501250224,524288 --field-trial-handle=2260,i,2093844515617513667,1347723870574122024,262144 --variations-seed-version --mojo-platform-channel-handle=7088 /prefetch:12
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,17926710363509515084,17015410753225312608,524288 --field-trial-handle=2260,i,2093844515617513667,1347723870574122024,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:14
  2⤵
  PID:2080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7972,i,5173646172509322270,12831300866920238190,262144 --field-trial-handle=2260,i,2093844515617513667,1347723870574122024,262144 --variations-seed-version --mojo-platform-channel-handle=2088 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=7980,i,13881780776240429587,17010780684332385066,2097152 --field-trial-handle=2260,i,2093844515617513667,1347723870574122024,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:1
  2⤵
  PID:3432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=2304,i,6073092559321254804,9526633601700409042,2097152 --field-trial-handle=2260,i,2093844515617513667,1347723870574122024,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:1
  2⤵
  PID:2640

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4572

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2076

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2684

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:5436

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3a958178f477b8cf0f18d83e0835916167b3eaf95d859728b647bc0100a82efc
MD5 b2c496fb89251ff9b8ff1c46a5315932
SHA1 19626950ca3b280d084016871229a48eb3fa5ffc
SHA512 bbd974e4a08ca8f629f0b9a8892ba78ac7d4191c1640d1037e4fd018dadb4d8edd0a663e4a673a29497151c4defd9be09b6a4a4788adf24b182cbc36b18ccda7
TLSH
T1C5D08031774DFD08C18054757890D3517A104460245AC3186329E01DDDBC68513DF0DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 48b0127c48894e5c8e42b14bcc7f6b1f91ca5d97355f42d22391fb602568bb1d
MD5 df62623cabc43e309a7767f4081f29d9
SHA1 420f1a4b11b86944a73d3cbcd4aec4883dfdfd62
SHA512 02067a08d194a87842f985ff7d0bee13c7b7228146565bf19114ffaebc120cb3d2ba8b19c941bb0d2773043366f064246a55efd57127d4a0de5768f453b2730c
TLSH
T1FDD08035774DFD08C18054717890D3517A204460345AC3186329A01DDDBC68513DF0EF
MD5 SHA1 SHA512 TLSH

Submit Download

f_0000d8

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000d8
Size 53KB
SHA256 351ba345250baf98ce325b4017ac9b96c9498f6644937ef558dc5993af676f2a
MD5 1e2d4737305eea41ee9198e3fd3f59c2
SHA1 abff05d701173ab7eae355be60ad30cf7f63536b
SHA512 469723131222dec7ea745b528fe62586da62d02505b6904a4b97157259dd37c26bf0d7012538ec6ab999c4a82d44f97ad7a1bc526cea9e8ee1cd30ff218fbce8
SSDEEP 768:aE9HsQuRLPPTiTRi06pYSINz9AdaTV7n5qAsVUdRwRuIDzjYTXqq2emOr8d/cNPk:aE9HsHPPR06bIhedCaAb+u2veJ8KNad
TLSH
T1354302A0446EF3CA3E6FFD7D9F225D5124E22A354838CAF6103721793F58B959CC1A88
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000e8

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000e8
Size 39KB
SHA256 ac85e23c550308bad09f3e636e6fd254d98d316b2b1d38df585683c023e1a344
MD5 3110e73c33777000cd778bead26546cd
SHA1 8d873cbb1fed3a8572feb5d209c562f3c3014fe5
SHA512 d2b94916ad76795fa0a8767f5ebfe9897988487ce678322ecfcddf925aa3ca3fb111bf42373584ea9522a2c10022575e789544424e9f0dcc951f7cba34505387
SSDEEP 768:E+R1LylL8xB/j5opXXBfKgNcZpyp8T4/nH3WrzHi3OhoDV9lG:EMEe3/j5opXIgeZu8T4er7dhopTG
TLSH
T11703022D5CD515E88E9B51B9A850A5361C2CC3E37ED585FA7E233E18ECCD8902303FA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000ed

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ed
Size 39KB
SHA256 20b535fa80c8189e3b87d1803038389960203a886d502bc2ef1857affc2f38d2
MD5 9a01b69183a9604ab3a439e388b30501
SHA1 8ed1d59003d0dbe6360481017b44665153665fbe
SHA512 0e6795255b6eea00b5403fd7e3b904d52776d49ac63a31c2778361262883697943aedcb29feee85694ba6f19eaa34dddb9a5bfe7118f4a25b4757e92c331feca
SSDEEP 768:Vce3jkow68wmT4IBX0tXdlSirS61gSjcz0GPwHbP+w2jec56O:VcI/iEEEtXdFJj+0GPwHbP+w5rO
TLSH
T13703023A5E3CCF1A84157A703950F6D9A8481E548E9D143B4F1AC7BF085DDE2209B6D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000f9

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000f9
Size 26KB
SHA256 9bebb48254a8f3a1f5d7d790ca2088acefb762833515dd4030f98d5d1e737e71
MD5 099fb5724692944ab7ddda069b457228
SHA1 e8029842060533793c4790ead4ea6fdea91f8bd3
SHA512 72ae24c69c4473d99d6e3f2a08a51e3599848bb657de43396fd478b680d363353662c3374004ac4c8180ffd017b7704a6792dc55498606a352ac6ba3304f20c6
SSDEEP 768:VImQX7j+EoweH4CtiVoym5H0MAQyXGFgAG8pgx:cX7j+FweHYPmGMAQyXCFgx
TLSH
T1A6C2E1A053BB3287B5AF2E296385F151EB7C5B210EE85D131F93D540F14256738F9A32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00011c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00011c
Size 53KB
SHA256 0d4ab6f8e9a3dc51f8db157a72d307f55f5759fc35fad7db2fc06a96b40d4233
MD5 b6ca636286309add828cfb82a25e80c3
SHA1 7b3aa024ce59bd79b4665554a4afa85ea7047d89
SHA512 1679659cc081eb9cee72c8180f5e4e4bc0f899c231d94fa7346d296d1d0d50a43db987f5819c72769455aedccdd81195949d09908b41c36213434e76e628e5b1
SSDEEP 1536:nnu8rdr9xq9JqMrW4cPrG6ySh/BvcGoQQ+6tR6UzAO8U6A:nnuS9xqnrki6vx36XlD8U6A
TLSH
T1C643024F1CECAA0EDD70CF6657047461B213AB4AFD4A6A5FD5882D23346703E9B1E84B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 c2e5a78e2d3c78f3fcc0806c183011b96ef7238ac7873dbd808c4b1b46603f5e
MD5 87244cd3dc0aad37c0ea6662bd9d7e54
SHA1 724de8ae606c5ca121e269ac1985900d4a80553a
SHA512 fdcb05199d81ab924b2542db7cfd6900169255d534fdde37bf064fb5ce378959d635e581ffcb38b51ff878748a98d71e3210ac827e22ebc42c9d1bba88618804
SSDEEP 192:JyeeJtxwyH43DigyNEShhhGF0wMRL5uxPlbxbgeGacTqFf4oE03vLyfhhjRxV7bu:JyeeJtxwyH43DigyNEShhh53RLMxPlbh
TLSH
T10DE1210768F79804EB924F7805D2D9103331F99C0A872F6AA891F436FC877E99E92175
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 3376c7996c32344057aac26c4faf0747210d13d4604c267549430036a11a43c7
MD5 9154fd2085a7441e9a5654611c6a310d
SHA1 ca27602fa0f9f4304be6ce6af7f83713322ff7d2
SHA512 0e7ed43ece9e9e5ff641049b4cd492b0d4594eecc319d0ee2a321b8290c889339b2b2fc9f7cff66fdbee2cc29fc898c7ba18991c00286b90a38435ee360dd207
SSDEEP 192:5yeeJtxwyo43DigyNEShhhGF0wMRL5uxPlbvbgeGacTq7f4oE03vLyfhhjRxV7bU:5yeeJtxwyo43DigyNEShhh53RLMxPlbn
TLSH
T151D1220778F79804EB924BB805C6D9503331F99C0A876F6AA892F436FC477E9DE92075
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5a2eb2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a2eb2.TMP
Size 3KB
SHA256 5fc15490fba8b77311406a1a522309948d75c41df25a37349dd0029e8c0f63d5
MD5 d4e2b09415c22f6bbdec4bf5a45be527
SHA1 e684fc7a27f34eaaa585f4509b8cb0bd44e06f4d
SHA512 10b05723f0a98015d0bd6aa4d47c602d61dc4e96c3bad50c5bb37d5a84002612ebcf4e805883b801c2571f96c5339c9a9a4a58bee0a54e7d480a8c65ccaf9d1e
TLSH
T1E861602638734911DB6948B9A2D330953374BE914C036EB9F694BA74CC8BFF4D2C61B1
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_drive.google.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 24KB
SHA256 5989205eba9ff1a0d0b660489a458c9d1a23526aca9c84b7d9bb67a3499ff153
MD5 431eb92a7429aea3cc194d2ec948f825
SHA1 0d057d8b340430a2c1728bdbdfb133f98e8fc4b4
SHA512 b3a0e7183abf6421fba37fa2a43e0c25487433867f004532dc9a25562cff44760898c6aa3688c42991d5cc1c81d43f4cb7e191b02a63b60b1433c9f952d7fc37
SSDEEP 384:DqtHkefoMna4QFJtHnJh0/kepsy/9J+K/shr/rg2bu5ZY1DBbXIkGVCBMPRYZM8a:/fF20N3xgka5B
TLSH
T161B2EBF783E9D62DD91296F5AB11AE1ACE1C1918435C3C26C9E4FF0B93E2032E21565F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 319db40883c1361a7fed347ffd4ec749a9d6ae79d44ecd9522d4b597a7eb1129
MD5 dfb51ec5b40fd9cf7c2b6ecc9435f0da
SHA1 5c4eae819d42c579b62d499babaacb688082a1ae
SHA512 7362bc6e6ce65fb5d8df08bdaa9fbd93f6af2fc3aa2dc1e4504ad36221c1d4181998a3fb91df3c1058a5c1acbb516dfc33d69f6857345fece3d4ab91af1d7b2f
TLSH
T124D0232317003479756C7EC64057ACCFC36600154553DED464F05458353685D560F144
MD5 SHA1 SHA512 TLSH

Submit Download

a7c90316-41bb-4922-b5dd-4462d72526e2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\a7c90316-41bb-4922-b5dd-4462d72526e2.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 99a21b12f72447ee589080fef3b752184232f7885820d893fc2284802de52c6f
MD5 e7399409fd125b67ad9b03252befba2c
SHA1 0dc368e9125ac5b64ebc8fb98684918aa37ac85d
SHA512 cd6e260bcfdf9d1dee205ec8b24d752285d218f2027d2905c38ed17d70dbe8fe7fc47f036e1961afdf2576e24ddf452c918036e305766866bd4f9de04ae6925a
SSDEEP 192:sxR8ROyM/jK1Ml8wor/fCs8oonzoA8prn/g6+WNfZu/Y4xAe0lGfIgDAJ:sxR84Or/fCs8oHz/5w/2e0qQ
TLSH
T19862D916A62469778CDBD209F955BF93D6F95533A2901E04AEFC8A0C01E76ED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 8225f638b20d2965daedaec9ad9635670bfe137054078ba7fe0f28174f3cac45
MD5 55a4351fa75c964b6726c986fc7a460e
SHA1 65035a00347a42d6d81ae26a5a9f19ef27c2616f
SHA512 b5bd9db74976afc6b7c6eb00af4aa7de37a5a4315a8256d9ad0beb346beab1a90ab2544053a1b402f1de6e2aec443174be53f8b5206cedfe1073aaab2f3dba81
SSDEEP 192:sxRXROyM/jK1Ml8wFr/fCsioonzoA8pr6/g6+WNfZu/Y4xAe0lGfIgIJ:sxRX4br/fCsioH2/5w/2e0qs
TLSH
T10A62D91665246D7BCCDBD209F955BF53D6F95533A2901E04AEFC8A0C01E7AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 21KB
SHA256 43142457dca35f46f87bc58bed0f6a19a7bae4440fba6d496db12678c83c5d62
MD5 386d9078f6c4169875c6022afcd1bf63
SHA1 79bbe36ff7ccb2a8ee5df20db0f30d843d9e8373
SHA512 648ea2bff965db177f81d25243fbb37677633090c99505f8cbbcfc1d805cc775a6f5525743ca278c7992014f961eb04486504894a9d1223d7685a8f48dea6881
SSDEEP 384:sxR84qsm4r/fCs8oYfILY537N7/Ye0qC3:sQfsm4r/f6oYiY5BYe0n3
TLSH
T1F0A2E85355308977CCEBC159F921BFA6D6F91463DAD04E4CAAFCCA0C05EB6ED2202827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 f47dcd8bcfd2c348d973142c460aa5ea31be3bbe50c5513bffb79e5930656bc6
MD5 004b67353a292d3135207a0514fa2af3
SHA1 cb973c33eb6d4c845f9eca0c2e08ed317450350b
SHA512 50c4044c4ed7d04f71a333e46b612fdf4e612b6c4c39ebe7b5f4f936928f3c30beedf0206b4b2e81ab36fdb707296a2ed20750334ae5b590d62cea303ec620b1
SSDEEP 192:sxR8ROyM/jK1Ml8w5cB4r/fCs8oo+3tVbsyVoA8pJzS2+n/g6+WNfekV6mZuHe2b:sxR84Hm4r/fCs8oxiH+/5gN7/be0qC3
TLSH
T1F792E9565520997BCCDBC109BD25BF93D7F91463DA905E4CAAFCCA0C01EB6ED221283B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 21KB
SHA256 28eab5575619ba064b7ee3c74b0afbeeea767bd1aebff0c107ce75995da87f63
MD5 3adf1ef34e20c79dac1df495c5bc86fd
SHA1 a333c766908f89b831a55cf9a7eb72ad31e41972
SHA512 65c360ca423166a6c7d7f5f4b657f6018ea312323bdc07b33180eba910de055db00b723f27b2b2760cb26bb2b598afa1726f1b3c82730221d405ae6f5e0a8800
SSDEEP 384:sxR54qsm4r/fCs8oYfIKpY537N7/Ye0qY3:s9fsm4r/f6oYFY5BYe0b3
TLSH
T1D0A2E85355209977CDEBC159F921BF96D6F91023DAD04E4CAEFCCA1C01EBAED2202827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\41c50a8a-f01a-43ce-93ab-c6b0e6de1c3b\index-dir\the-real-index
Size 72B
SHA256 46dde4591556d3acd3e3ae0bd94c984bef4245b5672dd04f562deacd9fa6f422
MD5 b1101f0595f864e0dabc2cd9187a45a2
SHA1 c750871755d444da31cf43769c584122b04a7718
SHA512 8d6a0f2aaa01122679db56984c7d67399d528c9dde7c67a331bafbed968add6438cf064679c6363cc0505a99925572c92952cb65dbe799f9d9892ec666b23c35
TLSH
T1DEA0022405553642C00947F295C7127163656C9545D36B3B44A0586DC8E23988519054
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\7df276b7-40aa-49c1-bf1b-dc9bc3a7abee\index-dir\the-real-index
Size 360B
SHA256 9a59fd2402dd00b4b28bbd7257fa395e76c74581738de8e1eddf8b7cc511568b
MD5 f08a26d436b3464491fef62f761643b5
SHA1 c6948bf9ea7a344565291bf7a05f886d54a485d3
SHA512 6f0b4c990de479501a5750d06a2d7667d6290e2718c2d6570e6b93675f2f2e72c543fee252773b7e3eee6af154e7b3204ea47a24d7049afda59540dc346c1493
TLSH
T1CFE0959BFDD00853DF4144B10EB12C0C333715FF64401B9370BD107E693316D5424549
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\7df276b7-40aa-49c1-bf1b-dc9bc3a7abee\index-dir\the-real-index
Size 3KB
SHA256 013f97c1a96a15ba95f4e5e8f4d06cc5f13733e39ef3a307c6e531df78ba662f
MD5 dea0d7d8b8fb0735ba9306a350a9944f
SHA1 3523e8e6c11451774b409ff3ef3210fcabce08cc
SHA512 82f530bce86498a9ddbfa0e1e010388dfeeca3379fabf1fd0a4a2364171013d6cf63e6f76e1e7ccf9d7bd15a3eda5a596d9b92df4c467784665e7b54121d348b
TLSH
T14B51955D8C8B5B17DD7856B318B5088D277675EC1B884E0768BC653838872392C79E58
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe598ed8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\7df276b7-40aa-49c1-bf1b-dc9bc3a7abee\index-dir\the-real-index~RFe598ed8.TMP
Size 360B
SHA256 4a7c393a5a8de0b2cf51ba7fc40d44f5adbe27612839c7c756019ddf26d981b8
MD5 b7656c65846e327137b8bad93b2ab48c
SHA1 8eb001a31ab4bf15c73aad8f10280b297c87d0c7
SHA512 4050034c8d96c68f5bc0dc3e67d62592a70ea1711aa271557e0ed076467b7b886886a9a0fce5b871f81b92222077d173c9588d5b681cbfd9a03af0fcf7fefe16
TLSH
T1E8E02EC6AAC15BA2EF4085F60A12290C377369363500AA0320FEA0BE857321C262929A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\af0a9330-3609-4380-9782-84de8b602dee\index-dir\the-real-index
Size 72B
SHA256 a1e89348e9cb5841646fa555c80195caf1981a77bf08ea6deca926af70bbf7e7
MD5 5e0a0893927525a0cb0a2e75e448b9ad
SHA1 9c5f908fa9c7b993211b343cc603139bfeece078
SHA512 112c2b9219e82a597befbee5d2052854182f62411924ed4e4e1c78b8a5ba2d9336417d41172a635207ce3059b10bbf4b42549e27e9c42fa8402ad5e51207570a
TLSH
T176A0029402D51103C01252B1ADD6456526254954A201531541914346E86256A698B01D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\af0a9330-3609-4380-9782-84de8b602dee\index-dir\the-real-index
Size 72B
SHA256 4f748ee5075e024b6e80aa34e8c41641844e20f92872f07338c1ef25f6a1d134
MD5 20db4495ea64d6bd31c84cee28fe6101
SHA1 6dafcc6e63ca31c9a207ac62e781b4d0b03c3d86
SHA512 223418e016b0b344b62fd541ef69bb0afaff3a5dc162e70db3ac9acba6080304c180795ba31932481c2430a140f65938600648898b64e81b06b674be611d9580
TLSH
T1E7A0025017D18245F81221B11956D64A738189145100174E61F11544CC905C4668500C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\dd03cdd6-de0b-49e3-ada5-e0d480f749c2\index-dir\the-real-index
Size 72B
SHA256 55804d9857d79f0dec2e03a3082bde5c5495707b16b2f64f75b54fee76d12c75
MD5 ed863181fe17bb415d678fd9dbc7182a
SHA1 3bf7ffb5f60253b08e711309f971c478ac9f3298
SHA512 073bf0f86e56c1894370e2ba3df4e64370a0802381f8512c1867a9b69b63167d5fc18e17ca933144849742bfc919d203e2dd58df0c5767eaf3b48421d768271c
TLSH
T181A0023405424097C2101379509B09546B305C1C5A4A2F3267B0E97C9C502944966150
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a1bd6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\dd03cdd6-de0b-49e3-ada5-e0d480f749c2\index-dir\the-real-index~RFe5a1bd6.TMP
Size 48B
SHA256 8563fbe0c5e4de4540fba9bd0f5ce66de8c915f62ee34162aad68a08f0f74ae5
MD5 a5489bda4704d0771477aea5192c62ab
SHA1 7063a706efe6464662795af53f9d519f2e7861cc
SHA512 84c34e4693208034bfec29699eb8845bd3c11e2953bf0375c54e4189df1d69c5b68b5bc3c701ba6ff8d47833b06f8657092c2995c20fa748db6cbb54ed978f6b
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 481B
SHA256 b1ca82f51b5fdd23a4de33b7ac90b4efbec5d095aae131db2b0f3a227558641a
MD5 7a3000f20c968b32d39191164219ebbe
SHA1 e9605e950752c88c76689b33cdb1a4126221d5d1
SHA512 a0957e0d40fa0a534e188d6166c193dbe939937035d5038c3afd52ce559b0170045e8721cea0d2dd090cf99e778384728812abf5c4795ce54687e63ed33469a4
TLSH
T14BF027773FF72814FDBEE3E22076446009647C588624BC0E101BBA8690B2364245EC63
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 476B
SHA256 2bad0d4046076a357b82353a1fcd350501d986d2f3a03210cd75a9f9602cedf9
MD5 28d8fb4d3ec959e3ca77a0cfb4c2cc27
SHA1 9caed568df79ea5ae322c4118def2c500f4042b9
SHA512 ddc0c14aa13cbf4a9e9d8200608f87cc10c1ad8dfeb44ef09651a738b4e398bc7df47b1a8418209f3960c0df813021745bcfaa8c12359c3403c60e2377c7adf4
TLSH
T14FF0277B3FFB2854FDBEE3E620764460096478588234BC4E101AA68650B2764245AC63
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 7368a6d595d3a83ab6fcb73240772d892b1d213658fd10fc2ec9ac6968161d0e
MD5 0e4b4cc591aa8c157cb4fba15590c7ed
SHA1 57e4e0d88dd2721c9ec74cf4bd97ee316fc94d18
SHA512 8167e0061267f51e6ae2d8d3090ef965790f506606772448d6af8bbe6eee63668362e31ef91ca06c712fa23369e780e8e711fec49f9bbf65a4672d1f2e22b072
TLSH
T1D2A00292819E1952E4480370B14101E82334C91006052223E6A44167AA5A1625A17026
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59e536.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59e536.TMP
Size 48B
SHA256 b89206fc48742d6d9cbfe46b24f7e3d19858ce33ec16544c146f4ccb36377851
MD5 72851e70b80334d2dca2f065f1c99678
SHA1 34b7cc1b959f6d398a9a97372ae9035f172d12e6
SHA512 ef0736c9bd22192586059991c71a87f5db51de67dc2b302798b8bd587af45b2a04952ff53914091b9e0ea32829235e2789a84e44cf4a0b3e56b36408752e08ec
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 a5df82b5288b5c779c6a398a8e495c5de88120157cfae70657016e3fe15b7216
MD5 cdac91ac9a891a101ebd5616e1a65698
SHA1 b92a4f64e45c4de82a0a452bd5549ae6016a49f1
SHA512 c9da74e1957323128d15295cf7814253da87c7be29e2527a89a77342822617a3fc803cf7927db7878e085a796abcf013008a44bafa73d7a5ae6f26ea8a832d03
TLSH
T139A0022065605063E10217B3B0998A4133646D640911120677E44847D8743564295614
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

b89d4f40-8a6b-4599-adc1-8c26693c30c1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b89d4f40-8a6b-4599-adc1-8c26693c30c1.tmp
Size 27KB
SHA256 e6de67973772c18f3342242823961ac98f5abe296aa0921044312eda222de7b7
MD5 b088ab00235033347d3a4784109f261f
SHA1 d69ca98b320e857c651a9e22f0e6cf129d135c9e
SHA512 442617bc728b669a1c72d1f6e4563cec14e81487ea465c44d456b9c70599ea121cf9f4a0a830170bc7b955cf66ef1107496d19db6c1629ec5e1b2df916e26c35
SSDEEP 768:Tqi0E3WgNxfcz8F1+UoAYDCx9Tuqh0VfUC9xbog/OVtXNGxroKTaQ3:Tqi0E3WgNxfczu1ja49GKz8
TLSH
T12EC2FC2B640CC77E4F804E9DEC2AAF976DD801CB97988D544BEA890C03C77EB511A5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

df3ae1e9-d4f4-4a7e-90c0-c7f1cd509e2e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\df3ae1e9-d4f4-4a7e-90c0-c7f1cd509e2e.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 0e1a171556afa5734a474b8ca0fc5b53841becafba5178700bcf9201765e591d
MD5 b76319e1d5ed68567a56d423ec285d55
SHA1 e8a9e6ee3742b7fdd27d0d3e3e1fa09c3f43bb53
SHA512 182a77e5023cfba3d3b01ebec7438fdbed11efb3e2596600622a36b745a9ffde5eb7492e236f5fd9d49969e37e7dc476930ec687b7ce16b0ec71bb6afd8da6d5
SSDEEP 768:Kj+9w3hfEaFthi+OBGhB+AW+152MvSCaihzn12bfJiZ:p9w3ygDDpx2paByJiZ
TLSH
T136F2AE32985A9D738CE286C4B70A3356AEB1566386C51E54CDEC9F0E02DB38D135BD3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 a1f67be376dd45ad30e5d0330d3d69d3d201f194ab6169ebddd51f288be7d043
MD5 088c33741eac1739f5f7ec7d7c100380
SHA1 51d272c7e6b5c4c58d4e51f827e5a88b848d575a
SHA512 b4f1dbece0821d9e05ccda06fd294624ac379ce26758352aff53c3f85d0a444b4da5c9f2e185afeaad18763d9e11c1ce1e3c1ada472e37c21d38043ed2014340
SSDEEP 768:XF1j+9w3GwgtOEZhthi+OBGh0+AW+152MvSCaihzn12bfJiZ:e9w3k3D+px2paByJiZ
TLSH
T136136CF288C78936CC9E4787673E2E029EBDC153B5811950BBD8590DCD872BFD24AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 a4b921effb6a7c3be0a100ba24ac288d193159d3844255742a52a6d75454db81
MD5 b820e3eaf3ab9280c96e4738b56d4e3a
SHA1 6678c3ec4325337b613333075ad3d121dc9528ec
SHA512 92e990767ace14ea35020f2a437bebd51ce75afafbca1cfcbeb1b35b058a3d5c428ed71a8f3405016652cedcb0618b03b1824f21ddedf9fecde21d40eaa920f2
SSDEEP 768:Arv+4UNbd23iPthi+Ok+AW+152MvSCa2vM+8rir9:Absbs3C3px2pSMDriR
TLSH
T1DE03BF32D8A9A9738CB686C4B74B36137FB0569389C50B94CDD92B0D069B6DD230BD37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 05bbc20e7921f9e3be7865c4fd62823e4cc06457be673d0f5eef32817afafdd1
MD5 93264feb5b51a1f9d067fe7770d1dce8
SHA1 165011162122e9d0773fd25d1ab202a23e04f6c6
SHA512 b5a4fd987cf2b3a65c736f036f1bd275c639a0e8cf55d82b1541be8b18a3a9ff8fb6480eae6be0de1dbae8f275092ec959d3a4f4d965d6346164d3f28831e150
TLSH
T128E00113D34695EEC06E277800C727753AB69835179307494A300A7A7C323805F20A80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 c375af0d44d483ae3ab062576288590783b931358e71c176feadc2b560b3f032
MD5 1a5353cf4e12243b3d5c8c69ab406f88
SHA1 8930ae5beb2d0ddddbdcbc34021028b37b8a3edd
SHA512 96b2f8479e966a0ed9093f481ebc79f4f593f16f5d85f7b45a095abe993d463ee008e62da2538f719f10465478dcdd6f28378449d4ff407d0b825bff81d1c02a
TLSH
T1CFE00153D34695EEC07E237804D727753AB7983517A3478A4E310A7ABC32380AF30A90
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 29bc10af77e7c3a18282a1e1d25cd4f64b0134c5c9c4e04138ebeade976c91ca
MD5 42aa8d680e3e2a9b031434a831b7e9b3
SHA1 fb83e2ca376b4ab3d39b3edab79392eacd4ed640
SHA512 39f3238ba7d4953a2db0f2d3191f02f22fc4f280f232c3038a44828c5fc7c4463165cf5637f86fc605099c8d3f8bbe6ef98b9dc98d4359d543b378d2b1c79641
TLSH
T18FE00112934684EEC069277800C727652AB598211693074A4630067A6C323805E20A80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 3ade770c465fb057ed894338aecf8a6b32f4259bf4b645bc98c15470313e4a9b
MD5 097a63c3139df18447651aee46ec82b5
SHA1 35b7df61e6046aa4651eee65bddf9024dc62fb37
SHA512 dd1adf7863b7738f5aa301db97a0438f54e762a3197a3b4f70e721fb20d75ef7442e9be3960f90b349d0c91c6b211cdc5093ae11ea18802f4b191fa4be776b94
TLSH
T1D1E00817D30555EEC46D237404C7267529B7943516A387965E21067A7C222819F20690
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 23fa525dd0a25992ad9acaec675711d75e214376cc01f69e026c8f038502cd4e
MD5 70ec29c3c9ac6f3179b7fa3290147b97
SHA1 6c5430b9c8e788e741cac849eeee96c89e112b3b
SHA512 a96c50c76c008a348e4fbdb629651a147231b740786a50bf927f3849d34ad37c7c310e84bb0fc2d9a351bcacbe7c3f7548aaaaada88a90950afb7809b6060398
TLSH
T175E00212930244FCC06D23780087376426F1D82115D3074A452001797C211804E30F40
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 80a1ba4a4aa8ed1d6a8dcc7ca6dbc5084a7c237d9be3e5d3d54a81dac2f748e8
MD5 b5d8ef0721c89bcecf68d128870483ab
SHA1 27ed8f6eb725d99a8d36004181f7186ca7bbf6d9
SHA512 651ef23d0af1a54434fb8cc88a25e99bfcedb277f7b068ccf0952678dcebb466431272db15ef750ab638a1c9964bc817f733c17bd8f5559f5ec9dee03b8b0776
TLSH
T1A9E00253D34655EDC47D237404D7277529B7943517A347864E3105797C32340AF30A90
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe59bbf3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe59bbf3.TMP
Size 392B
SHA256 263ee600cef271a244a9cd828e636230a62d8cdaeca8a1a9b47cec5443b9a710
MD5 6c485df1beb11e5258e42cb31160ea1b
SHA1 434ff5d009b2e24fa9ed73c83f98caabcee43eb6
SHA512 68ad9c8fd3d5abb49a0eeaa78be93a4e8c9760638d73ef03d47c06d23856f17dc11eb475ecc422d370ba6c953bdb921c93f95d2dde6fa38f588c44ed49362f2b
MD5 SHA1 SHA512

Submit Download

48c4ec67-b50a-4bfe-86ff-7a05ce01d4ff.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\48c4ec67-b50a-4bfe-86ff-7a05ce01d4ff.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

FS22_Sipma_Z279.zip.crdownload

Path C:\Users\Admin\Downloads\FS22_Sipma_Z279.zip.crdownload
Size 21.6MB
SHA256 d42a256768ed768a56acc4e1aca97aeab27aea591e71480e54a9bc78d3081cce
MD5 71f2ef8fb7266e6729f50e83898567b1
SHA1 9c6475b19964876a9675d82a4a923d3eece7873d
SHA512 283ec13819dfb4984cf236dac949cb8b4e0f9ffd91a0df2a2a2089dea5bd16202ff905722424afc3fe270c51e26eb594587c44d19994fa128564a9a5b90d12cd
SSDEEP 393216:mqY9BzyPZxZSMgZkRHotJaZHnUp/G/LCw7fmIFrSOLw86CDctTGjGjRMTIKV:qniZS9QoDaZHnf/LJfmErS+DcRGjGtMN
TLSH
T1233733B2B168E444D558C2F2E2EBABCB4759ED12AEC5D919D50DE4302CE2E7140E3FB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download