hxxps://google[.]com

Analysis

user interaction
yes
max time kernel
1798s
max time network
1797s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/07/2026, 04:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://google.com
Sample260705-e8xkpac16q

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 4 IoCs

flow	pid	Process
191	560	msedge.exe
238	560	msedge.exe
238	560	msedge.exe
238	560	msedge.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
237	raw.githubusercontent.com
238	raw.githubusercontent.com
236	raw.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Holzer-safety.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DoorMario.peaceful.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LogonFuck.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Monoxidex86.harmless.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
560	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134276998457363420"	msedge.exe

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{7712D523-D537-4272-85C5-EB878D53B948}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{8748BC0C-E52F-4703-97CA-9EA163E2353C}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
624	msedge.exe
624	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 35 IoCs

pid	Process
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5232	LogonFuck.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe

Suspicious use of SendNotifyMessage 48 IoCs

pid	Process
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3036 wrote to memory of 4232	3036	msedge.exe	86
PID 3036 wrote to memory of 560	3036	msedge.exe	87
PID 3036 wrote to memory of 540	3036	msedge.exe	88
PID 3036 wrote to memory of 540	3036	msedge.exe	88
PID 3036 wrote to memory of 540	3036	msedge.exe	88
PID 3036 wrote to memory of 768	3036	msedge.exe	90
PID 3036 wrote to memory of 768	3036	msedge.exe	90
PID 3036 wrote to memory of 2288	3036	msedge.exe	91
PID 3036 wrote to memory of 1460	3036	msedge.exe	92
PID 3036 wrote to memory of 2288	3036	msedge.exe	91
PID 3036 wrote to memory of 2288	3036	msedge.exe	91
PID 3036 wrote to memory of 1460	3036	msedge.exe	92
PID 3036 wrote to memory of 1460	3036	msedge.exe	92
PID 3036 wrote to memory of 3716	3036	msedge.exe	93
PID 3036 wrote to memory of 3716	3036	msedge.exe	93
PID 3036 wrote to memory of 3716	3036	msedge.exe	93
PID 3036 wrote to memory of 4708	3036	msedge.exe	94
PID 3036 wrote to memory of 4708	3036	msedge.exe	94
PID 3036 wrote to memory of 4708	3036	msedge.exe	94
PID 3036 wrote to memory of 3820	3036	msedge.exe	98
PID 3036 wrote to memory of 3820	3036	msedge.exe	98
PID 3036 wrote to memory of 3820	3036	msedge.exe	98
PID 3036 wrote to memory of 4472	3036	msedge.exe	99
PID 3036 wrote to memory of 4376	3036	msedge.exe	100
PID 3036 wrote to memory of 4472	3036	msedge.exe	99
PID 3036 wrote to memory of 4376	3036	msedge.exe	100
PID 3036 wrote to memory of 1652	3036	msedge.exe	104
PID 3036 wrote to memory of 5844	3036	msedge.exe	116
PID 3036 wrote to memory of 5844	3036	msedge.exe	116
PID 3036 wrote to memory of 5844	3036	msedge.exe	116
PID 3036 wrote to memory of 5860	3036	msedge.exe	117
PID 3036 wrote to memory of 5860	3036	msedge.exe	117
PID 3036 wrote to memory of 5860	3036	msedge.exe	117
PID 3036 wrote to memory of 5972	3036	msedge.exe	118
PID 3036 wrote to memory of 5972	3036	msedge.exe	118
PID 3036 wrote to memory of 5972	3036	msedge.exe	118
PID 3036 wrote to memory of 208	3036	msedge.exe	119
PID 3036 wrote to memory of 208	3036	msedge.exe	119
PID 3036 wrote to memory of 4892	3036	msedge.exe	120
PID 3036 wrote to memory of 4892	3036	msedge.exe	120
PID 3036 wrote to memory of 4892	3036	msedge.exe	120
PID 3036 wrote to memory of 3864	3036	msedge.exe	121
PID 3036 wrote to memory of 5368	3036	msedge.exe	122
PID 3036 wrote to memory of 5368	3036	msedge.exe	122
PID 3036 wrote to memory of 5368	3036	msedge.exe	122
PID 3036 wrote to memory of 5328	3036	msedge.exe	123
PID 3036 wrote to memory of 5328	3036	msedge.exe	123
PID 3036 wrote to memory of 5328	3036	msedge.exe	123
PID 3036 wrote to memory of 5420	3036	msedge.exe	125
PID 3036 wrote to memory of 5376	3036	msedge.exe	124
PID 3036 wrote to memory of 5376	3036	msedge.exe	124
PID 3036 wrote to memory of 3700	3036	msedge.exe	127
PID 3036 wrote to memory of 3144	3036	msedge.exe	128
PID 3036 wrote to memory of 4036	3036	msedge.exe	129
PID 3036 wrote to memory of 5556	3036	msedge.exe	130
PID 3036 wrote to memory of 5556	3036	msedge.exe	130
PID 3036 wrote to memory of 5556	3036	msedge.exe	130
PID 3036 wrote to memory of 6124	3036	msedge.exe	132
PID 3036 wrote to memory of 6124	3036	msedge.exe	132
PID 3036 wrote to memory of 6124	3036	msedge.exe	132
PID 3036 wrote to memory of 3320	3036	msedge.exe	134
PID 3036 wrote to memory of 3320	3036	msedge.exe	134
PID 3036 wrote to memory of 3320	3036	msedge.exe	134
PID 3036 wrote to memory of 1468	3036	msedge.exe	135

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://google.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x20c,0x7ff8c6a6c188,0x7ff8c6a6c194,0x7ff8c6a6c1a0
  2⤵
  PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1928,i,6686845500741858271,10878523865877596574,524288 --field-trial-handle=2308,i,10116048757208247102,2740299472618020653,262144 --variations-seed-version --mojo-platform-channel-handle=2416 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,10770152883806807005,12536810970708197562,262144 --field-trial-handle=2308,i,10116048757208247102,2740299472618020653,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:2
  2⤵
  PID:540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2288,i,12604152693912442282,10129855243219141724,524288 --field-trial-handle=2308,i,10116048757208247102,2740299472618020653,262144 --variations-seed-version --mojo-platform-channel-handle=2840 /prefetch:8
  2⤵
  PID:768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3472,i,10816378461748165832,949265105132452128,2097152 --field-trial-handle=2308,i,10116048757208247102,2740299472618020653,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3492,i,3305990556812894366,10081173833385074201,2097152 --field-trial-handle=2308,i,10116048757208247102,2740299472618020653,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4192,i,11443689600510592935,4300676317989573017,2097152 --field-trial-handle=2308,i,10116048757208247102,2740299472618020653,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:1
  2⤵
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4260,i,13323828549084466918,16820217602984473440,2097152 --field-trial-handle=2308,i,10116048757208247102,2740299472618020653,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:2
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5064,i,2937482482276128124,8691461859157634112,2097152 --field-trial-handle=2308,i,10116048757208247102,2740299472618020653,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:1
  2⤵
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5344,i,13023830302964001249,17353656981801737721,524288 --field-trial-handle=2308,i,10116048757208247102,2740299472618020653,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:8
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5348,i,16281273525929244889,5685935604051083960,524288 --field-trial-handle=2308,i,10116048757208247102,2740299472618020653,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:8
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,10613161326345484026,10118439334946843126,524288 --field-trial-handle=2308,i,10116048757208247102,2740299472618020653,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:8
  2⤵
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,10613161326345484026,10118439334946843126,524288 --field-trial-handle=2308,i,10116048757208247102,2740299472618020653,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:8
  2⤵
  PID:1652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=4260,i,664773207476072067,9042811872869321169,2097152 --field-trial-handle=2308,i,10116048757208247102,2740299472618020653,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:1
  2⤵
  PID:5844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4952,i,14114537811043905857,11691405586529768776,2097152 --field-trial-handle=2308,i,10116048757208247102,2740299472618020653,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:1
  2⤵
  PID:5860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6292,i,4619719929559075329,1568567467434422177,2097152 --field-trial-handle=2308,i,10116048757208247102,2740299472618020653,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:1
  2⤵
  PID:5972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4960,i,2234700257544174904,16167392694040122393,524288 --field-trial-handle=2308,i,10116048757208247102,2740299472618020653,262144 --variations-seed-version --mojo-platform-channel-handle=6572 /prefetch:8
  2⤵
  PID:208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=4944,i,4800887914400873377,5915251159462737124,2097152 --field-trial-handle=2308,i,10116048757208247102,2740299472618020653,262144 --variations-seed-version --mojo-platform-channel-handle=6624 /prefetch:1
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5096,i,2937941824451422039,16650883381699706878,524288 --field-trial-handle=2308,i,10116048757208247102,2740299472618020653,262144 --variations-seed-version --mojo-platform-channel-handle=6540 /prefetch:8
  2⤵
  PID:3864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6516,i,10955685539911933176,9455720592951820318,2097152 --field-trial-handle=2308,i,10116048757208247102,2740299472618020653,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:1
  2⤵
  PID:5368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6920,i,14462552260413626955,12092785378656010611,2097152 --field-trial-handle=2308,i,10116048757208247102,2740299472618020653,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:1
  2⤵
  PID:5328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6932,i,6843832112449473519,8953007996444997085,524288 --field-trial-handle=2308,i,10116048757208247102,2740299472618020653,262144 --variations-seed-version --mojo-platform-channel-handle=6956 /prefetch:8
  2⤵
  PID:5376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6900,i,6148794863397495399,2553210412678986008,524288 --field-trial-handle=2308,i,10116048757208247102,2740299472618020653,262144 --variations-seed-version --mojo-platform-channel-handle=6980 /prefetch:8
  2⤵
  - Modifies registry class
  PID:5420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7272,i,17330786776419018076,1373990168310403222,524288 --field-trial-handle=2308,i,10116048757208247102,2740299472618020653,262144 --variations-seed-version --mojo-platform-channel-handle=7340 /prefetch:8
  2⤵
  PID:3700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7276,i,1328329381875513590,776334002632957889,524288 --field-trial-handle=2308,i,10116048757208247102,2740299472618020653,262144 --variations-seed-version --mojo-platform-channel-handle=7344 /prefetch:8
  2⤵
  PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7280,i,15306017972111970306,13139225833200257820,524288 --field-trial-handle=2308,i,10116048757208247102,2740299472618020653,262144 --variations-seed-version --mojo-platform-channel-handle=7328 /prefetch:8
  2⤵
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7376,i,8488211552334190354,12386491524730667951,2097152 --field-trial-handle=2308,i,10116048757208247102,2740299472618020653,262144 --variations-seed-version --mojo-platform-channel-handle=7384 /prefetch:1
  2⤵
  PID:5556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=5448,i,7995828677367046865,17695684804534560855,2097152 --field-trial-handle=2308,i,10116048757208247102,2740299472618020653,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:1
  2⤵
  PID:6124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=6628,i,1736174499908705117,17359610718372217094,2097152 --field-trial-handle=2308,i,10116048757208247102,2740299472618020653,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:1
  2⤵
  PID:3320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=2156,i,15777685238801293175,7141050754378674132,2097152 --field-trial-handle=2308,i,10116048757208247102,2740299472618020653,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:1
  2⤵
  PID:1468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6572,i,6145155824582335772,8659933610512398787,524288 --field-trial-handle=2308,i,10116048757208247102,2740299472618020653,262144 --variations-seed-version --mojo-platform-channel-handle=4956 /prefetch:8
  2⤵
  PID:3796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7396,i,12376063316563254311,3156380095450455025,524288 --field-trial-handle=2308,i,10116048757208247102,2740299472618020653,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:8
  2⤵
  PID:5892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4916,i,14305035149104449743,12957557669319007170,524288 --field-trial-handle=2308,i,10116048757208247102,2740299472618020653,262144 --variations-seed-version --mojo-platform-channel-handle=5104 /prefetch:8
  2⤵
  PID:5672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=5832,i,2266060419514644511,13513042538071674829,2097152 --field-trial-handle=2308,i,10116048757208247102,2740299472618020653,262144 --variations-seed-version --mojo-platform-channel-handle=7340 /prefetch:1
  2⤵
  PID:5564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7512,i,8694637827305838941,10180484455116974474,524288 --field-trial-handle=2308,i,10116048757208247102,2740299472618020653,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:8
  2⤵
  PID:5576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,4012467261328596890,9005929732883553935,524288 --field-trial-handle=2308,i,10116048757208247102,2740299472618020653,262144 --variations-seed-version --mojo-platform-channel-handle=7536 /prefetch:8
  2⤵
  PID:5916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=6360,i,4166034125967661656,17185441560867022637,2097152 --field-trial-handle=2308,i,10116048757208247102,2740299472618020653,262144 --variations-seed-version --mojo-platform-channel-handle=7504 /prefetch:1
  2⤵
  PID:3316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7656,i,5256003838639183869,8189153561272556550,524288 --field-trial-handle=2308,i,10116048757208247102,2740299472618020653,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:8
  2⤵
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5380,i,16496168126614397514,10074446654063674854,524288 --field-trial-handle=2308,i,10116048757208247102,2740299472618020653,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:8
  2⤵
  PID:2952
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7352,i,15479112159633960232,16775689054411089358,524288 --field-trial-handle=2308,i,10116048757208247102,2740299472618020653,262144 --variations-seed-version --mojo-platform-channel-handle=7652 /prefetch:8
  2⤵
  PID:5848
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7352,i,15479112159633960232,16775689054411089358,524288 --field-trial-handle=2308,i,10116048757208247102,2740299472618020653,262144 --variations-seed-version --mojo-platform-channel-handle=7652 /prefetch:8
  2⤵
  PID:2472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=4272,i,8784420226869927609,10493768095427136055,2097152 --field-trial-handle=2308,i,10116048757208247102,2740299472618020653,262144 --variations-seed-version --mojo-platform-channel-handle=6768 /prefetch:1
  2⤵
  PID:5640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=5588,i,10955234499085210511,4154012613751058060,2097152 --field-trial-handle=2308,i,10116048757208247102,2740299472618020653,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:1
  2⤵
  PID:1204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=7340,i,5247679927646491390,6957606308328599339,2097152 --field-trial-handle=2308,i,10116048757208247102,2740299472618020653,262144 --variations-seed-version --mojo-platform-channel-handle=7484 /prefetch:1
  2⤵
  PID:5360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=7636,i,10413098188500116796,13945719949283894913,2097152 --field-trial-handle=2308,i,10116048757208247102,2740299472618020653,262144 --variations-seed-version --mojo-platform-channel-handle=7488 /prefetch:1
  2⤵
  PID:5588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7784,i,5981316642144120276,17483570558084466727,262144 --field-trial-handle=2308,i,10116048757208247102,2740299472618020653,262144 --variations-seed-version --mojo-platform-channel-handle=7808 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=7808,i,13257393721791760648,5816624722297599302,2097152 --field-trial-handle=2308,i,10116048757208247102,2740299472618020653,262144 --variations-seed-version --mojo-platform-channel-handle=7200 /prefetch:1
  2⤵
  PID:1436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=7756,i,7040737240914761968,7838287217374143770,2097152 --field-trial-handle=2308,i,10116048757208247102,2740299472618020653,262144 --variations-seed-version --mojo-platform-channel-handle=7788 /prefetch:1
  2⤵
  PID:3852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=3600,i,15003282197488503581,2099339920764519427,2097152 --field-trial-handle=2308,i,10116048757208247102,2740299472618020653,262144 --variations-seed-version --mojo-platform-channel-handle=2644 /prefetch:1
  2⤵
  PID:2952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=6192,i,12127148425794542392,5823142994467554890,2097152 --field-trial-handle=2308,i,10116048757208247102,2740299472618020653,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:1
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=5568,i,1754120210088910730,13948124152589118858,2097152 --field-trial-handle=2308,i,10116048757208247102,2740299472618020653,262144 --variations-seed-version --mojo-platform-channel-handle=6628 /prefetch:1
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=6440,i,2874641906454975894,12673652974892873275,2097152 --field-trial-handle=2308,i,10116048757208247102,2740299472618020653,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:1
  2⤵
  PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=7936,i,8754084935680263748,15710898246010942909,2097152 --field-trial-handle=2308,i,10116048757208247102,2740299472618020653,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:1
  2⤵
  PID:904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8312,i,5535267369397409993,8043995049933789602,524288 --field-trial-handle=2308,i,10116048757208247102,2740299472618020653,262144 --variations-seed-version --mojo-platform-channel-handle=8268 /prefetch:8
  2⤵
  PID:3128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8340,i,16670996513404760506,12771273162211277954,524288 --field-trial-handle=2308,i,10116048757208247102,2740299472618020653,262144 --variations-seed-version --mojo-platform-channel-handle=8276 /prefetch:8
  2⤵
  PID:1580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8624,i,2601492102071617169,9056496063611404388,524288 --field-trial-handle=2308,i,10116048757208247102,2740299472618020653,262144 --variations-seed-version --mojo-platform-channel-handle=8628 /prefetch:8
  2⤵
  PID:5600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --metrics-shmem-handle=8608,i,14407546562416146026,6204746775536148837,2097152 --field-trial-handle=2308,i,10116048757208247102,2740299472618020653,262144 --variations-seed-version --mojo-platform-channel-handle=8596 /prefetch:1
  2⤵
  PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --always-read-main-dll --metrics-shmem-handle=9244,i,10200667778984577307,15759871502262226674,2097152 --field-trial-handle=2308,i,10116048757208247102,2740299472618020653,262144 --variations-seed-version --mojo-platform-channel-handle=9472 /prefetch:1
  2⤵
  PID:5216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --always-read-main-dll --metrics-shmem-handle=9220,i,5672345443014405139,17197722578556476271,2097152 --field-trial-handle=2308,i,10116048757208247102,2740299472618020653,262144 --variations-seed-version --mojo-platform-channel-handle=9224 /prefetch:1
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --always-read-main-dll --metrics-shmem-handle=9752,i,9292188666707140044,15012590184258446841,2097152 --field-trial-handle=2308,i,10116048757208247102,2740299472618020653,262144 --variations-seed-version --mojo-platform-channel-handle=9744 /prefetch:1
  2⤵
  PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --always-read-main-dll --metrics-shmem-handle=10084,i,11532972039211515320,16647549972338217758,2097152 --field-trial-handle=2308,i,10116048757208247102,2740299472618020653,262144 --variations-seed-version --mojo-platform-channel-handle=10108 /prefetch:1
  2⤵
  PID:5976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --always-read-main-dll --metrics-shmem-handle=10104,i,10064951695195800278,16936704362655296310,2097152 --field-trial-handle=2308,i,10116048757208247102,2740299472618020653,262144 --variations-seed-version --mojo-platform-channel-handle=10172 /prefetch:1
  2⤵
  PID:5156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2728,i,2957780608554418762,2005334018841921058,524288 --field-trial-handle=2308,i,10116048757208247102,2740299472618020653,262144 --variations-seed-version --mojo-platform-channel-handle=1348 /prefetch:8
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8484,i,9173659984611759660,11688151960087024033,524288 --field-trial-handle=2308,i,10116048757208247102,2740299472618020653,262144 --variations-seed-version --mojo-platform-channel-handle=8276 /prefetch:8
  2⤵
  PID:5904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1528,i,15027563260895976066,6991998589659546202,524288 --field-trial-handle=2308,i,10116048757208247102,2740299472618020653,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:8
  2⤵
  PID:6052

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3048

C:\Users\Admin\Desktop\Holzer-safety.exe
"C:\Users\Admin\Desktop\Holzer-safety.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:5876

C:\Users\Admin\Desktop\DoorMario.peaceful.exe
"C:\Users\Admin\Desktop\DoorMario.peaceful.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:6132

C:\Users\Admin\Desktop\LogonFuck.exe
"C:\Users\Admin\Desktop\LogonFuck.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://kaspersky.com/
  2⤵
  PID:4372
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://kaspersky.com/
    3⤵
    PID:3852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.norton.com/
  2⤵
  PID:2224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://www.norton.com/
    3⤵
    PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.avg.com/
  2⤵
  PID:5760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://www.avg.com/
    3⤵
    PID:996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.malwarebytes.com/
  2⤵
  PID:5868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://www.malwarebytes.com/
    3⤵
    PID:6068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.avira.com/
  2⤵
  PID:5560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://www.avira.com/
    3⤵
    PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.mcafee.com/
  2⤵
  PID:5320
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://www.mcafee.com/
    3⤵
    PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.bitdefender.com/
  2⤵
  PID:2988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://www.bitdefender.com/
    3⤵
    PID:4896

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x504 0x150
1⤵
PID:5800

C:\Users\Admin\Desktop\Monoxidex86.harmless.exe
"C:\Users\Admin\Desktop\Monoxidex86.harmless.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1072

C:\Users\Admin\Desktop\Monoxidex86.harmless.exe
"C:\Users\Admin\Desktop\Monoxidex86.harmless.exe"
1⤵
PID:5156

C:\Users\Admin\Desktop\Monoxidex86.harmless.exe
"C:\Users\Admin\Desktop\Monoxidex86.harmless.exe"
1⤵
PID:6064

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 083d78ea5ea69126b24164f2e05fc467ce21fdcdf2ec67f8e94c4366a1284886
MD5 da79f81681859af2b76762aa37a5f73e
SHA1 53d69c959eb46848bc7ed7b5c480df864295389e
SHA512 f647681c342e36fa2f41fb9d54d089303f98b802703a42609226ef5755aafc91ef00af41a82f980c0f2819709322c59ef6cd1c18725ef5133691894902fc44c1
TLSH
T1FCD09B7077CDAC11D5450471D45547535D96CA4C24D7DB076011801D68557D9B35E067
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 965e5ede1dd95e7182bc6ed8b645e4796c53616af10fe7a02b411984e0f5fca1
MD5 252c38f22d645a5fc39fa9f1fdd92b34
SHA1 70c6079cc3ffdcb0efb6f56834b64311e1e951bc
SHA512 e23e1b164567d933593229d39744ddacb3330f715193f293c7aee9a5a95fc433809933ab830a7a1c5cdf37824965c32650c227083092c2a6488a2ab768744ad1
TLSH
T110D09B7077CDAC11D9450471D45547535D96CA4C24D7DB076011801D58567D9B35E067
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 f83a45cb966b54984e819e32e01cf6dc665e3191cf6041c0ceb30e82877be150
MD5 38c258df99830b28b54d1917f8e17791
SHA1 c029a4de2ff88bb44c4b2d1786c650c069316069
SHA512 12c7fb4becebb0c65392c48941f0a4c088f7bc78e1fbaace14f53e1ba09460e01302945311d73deb639cc2962ae30c99e5999f7ee33b5137a1334fe724fba680
TLSH
T147E020B44FC4C27D910074C78358830CC2D1371F96C47E55572088D87142064E7D1DE0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 352B
SHA256 344bff71496d124b246650df4ab892e23ff90b953bf907bc3e28e204c5481f25
MD5 12471229c3ffb68805369e3b0dc5c2e9
SHA1 2e699edab20e3f08cac9860b7d186e3927495694
SHA512 c7425f3d0e127fcd316d264d477af40acfcf9b41b05a59d4c2d3f3550ba5758630987e25b6f59b21a584b819284114a335d221aed3ab25ef8b82ad0ce185cd23
TLSH
T17EE0D8BC7B90C1640370B6C78248C356E596723BDB4CCA5E3B56609C354009AE7E7EE1
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 158B
SHA256 f803625f7089762ff6faeb3ece82729aca5f5a8ea6348ac385095f4ef1109a96
MD5 886d3a2f30ae328537f8a8495b7ac587
SHA1 7c18a459a31db22bab627b1df46f4732da5c15d8
SHA512 8d54299c0b059afd776373426c1e9e04dc2a04db5ba8722970b08f1abe9288e7b9230a4254217fff0985090db156a1f16de461ec7037774cdff0e4deaa405a0a
TLSH
T1D5C080D8BDCC845DC281187E5716F400075176119417A6170551FCC03241EE01F29120
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00008d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008d
Size 107KB
SHA256 6506d5dcc5034afe6899e0413930dc5954e177536ddd8878dc0d464d97171451
MD5 afcf5a0ee925e6e908221648c28c7923
SHA1 a5f393e9c9cb6af429ead5eb26ac3af6a8fc738e
SHA512 241256565ebc64f3e85741a31791e655f89e7785c40bafe19b410637605a5b2b3fd119ef3307d606db6fd670aa6410acaf94b2fa0c0cdeb3a00566f849d0f270
SSDEEP 3072:QxLG3w6Si23k+/CRbRxOsw5776KAX/ucVBwL:aC1vG/CNe76KAXlV2L
TLSH
T193B3123A2C696872B705B12631B38C07FF172676125869F74FA168B2C6C44E5B7AC6A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000097

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000097
Size 21KB
SHA256 13753756eab1db0b2faee0c9e28a8c714420894e44f84e5aaa3add52038e1558
MD5 4325f31b2686a18064a87fc67d92419e
SHA1 03806612e3ae66081550a53b15898c828f8a8123
SHA512 e649db13657d5f890ab079b2cab1bf2401cb6453695ae3406959942fec4d1ccb1d1a182f5a74d9b04593dfd2760842d71925b45ca6e31f82d610f503ba4a420a
SSDEEP 384:MOj2yWOv/5p+u0oISA+49i8yVS7y186STDMrnWjw8E6UXsWo5U6yYgKA83VaI:MSWOv/5pn0/Soo8yVS7yuzDMrT8ptWo/
TLSH
T1EEA2F1A33B4250F2C2E970911955B22A7B07DD16DCEB7A4BE3CA3D7A0E47101B46717B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000ae

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ae
Size 131KB
SHA256 1ab7375550516d7445c47fd9b551ed864f227401a14ff3f1ff0d70caca3bd997
MD5 bd65d387482def1fe00b50406f731763
SHA1 d06a2ba2e29228f443f97d1dd3a8da5dd7df5903
SHA512 351ecd109c4d49bc822e8ade73a9516c4a531ebcda63546c155e677dcff19708068dc588b2fcf30cad086238e8b206fc5f349d37dda02d3c3a8d9b570d92e4d9
SSDEEP 3072:yC1uNIhRRMavV44UAh1fwNoDiAG7BNS0O6WBHMz/:UehRRtv24UAh8oDvMg0ORBH2/
TLSH
T16BD37C00B0C1C4B2D5B5193118B5FAA64E3DFE740B249EFF77D81A6A4EB41C129B396B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000b0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b0
Size 72KB
SHA256 baa324b098a79b670bb87ddb209072614969707bf8b419dc7bc1aae6cf42b832
MD5 2b28cd5a40630e0deee5063c97f39e50
SHA1 455dd8a6f3908253f80d3081c94c8fb380ebcebc
SHA512 a4f9f5299b11b8eef9d8ef215c959d5a91f6ad660fbef4375044520247481b80197bb4af866a67428e48fb5ec292daa4daecf27a459a0ef0397b4f7db40ae14e
SSDEEP 1536:No3tmjQr2/LGdpP7nri8NVlrPyQe++Gwr8kpQDWEsGmWEUF:6ZiDIJFP5e+3wr/zEsbWEUF
TLSH
T1337302AD1F0FEB189C7FBF8926CA07F41066C04F569A98A15D6CE78688084593B3917F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000107

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000107
Size 36KB
SHA256 2eaaec18f93acdb0ad0651296f582806f473319094aea7a9a245104c3752310c
MD5 3260dbe265838f40435b4474a5e5a622
SHA1 3634e1b7b3365d2ae7cd91d5192771ccb37f205e
SHA512 e3c2451944ea360afa4ccedb0c1ea9ce1ead3e094e8dee38ff64be15332e941067cefbcdf90ed6da16692accb2d6ac6e6f4206ff7d9ea9358b6eb261f1095620
SSDEEP 768:eA7O1k7kGq6g1pIfWYY02RUI2k1aj/nL9esQZQIzYLgmrg+6nBYRH:eA7O1kvVg/IHU4/pesQZQoYVOnBYRH
TLSH
T15C03F10288ABF4772B8DCB7C9E5F4D9222903937872395B6645F10BB64407D428E8FB5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000160

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000160
Size 26KB
SHA256 3e285c2591fbf1ba2e34d37bb76fd3405185cda8877712eb2803c479faea915c
MD5 e65bccab560e420bd1f6a064fff8a78f
SHA1 3969dc3aa6848c6aec2ae833bc66ec2bf6b933c2
SHA512 b4f7e2a68f59cc7fe36636bd7c0d7edcbd74950442099c77bc1fe90698576222f508d4cc856b47b0978a34dacb044afbdd4887ad882cb131fe5bf5eaf7d3dadd
SSDEEP 768:HboWYuBMnkofWDHK1AJktkd/i87OU93KGHlBn:Hb/YuB2vad/Hd935HXn
TLSH
T197C2E14155BCFDF0A74D32589E305CFDC3CA8560C3480A9AB1662A142E275BAB66CD7F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 8KB
SHA256 f933cf81358fd044d4bd28763fa130b4a28a427f870db47555e01b7289102ce5
MD5 26f517c046d8d15ad2f13e698053a33e
SHA1 f91f2bd8ff89ac84e1c34533d5b400813e5c34d9
SHA512 fe5b3c4628198f9292aca16dc39f0ebd57b86011d08791078ebe8f55858ac66402c9137de13b0b21d19840cbbb04df0ba381e18b1fa045c3841587029ebcb3d8
SSDEEP 96:CM9BGA+L3Bx7QJiTJGgXTkNJYvoxjB3LuvCgbxgE+dC/r5G3uT8ubL0rHnmOLhY:B9Bj+tGukHTxjPeOEr9h0rBY
TLSH
T1C1123E9EA7B3D7D2E36035FEC4EB4612BF3A94E845234D3746508CFC263A324924C55A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 14KB
SHA256 611f0ddf3a35987c865335819fb5802f583076d5b96763882003fd68049e1f1b
MD5 7eb1aadf5986236e616a311b7b0cfae6
SHA1 cfe86b7b6612fb05c7cd66dea9e517a6e5ebaf78
SHA512 6e2c6d188e9a71532762b6ce3dad1015dfed9483dcc13338eb08c7b8819e3fcf0a15162b731d70aec2b3e9fafb7a1cfbc53d18fdeedd66de17a75bcf7b8efe87
SSDEEP 192:j93ffFay9gANpM3HjmdMs+W4VPKdbb3tCz/BCuvH:VfFaUgAgzmdMLo9tCz/YuvH
TLSH
T1F46251895BE2D7D9DF6039FDCAD64E02BAB95CA4C1139F63469848FF243B3D8610C089
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5988ce.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5988ce.TMP
Size 3KB
SHA256 8390e0a2e86bbf68b7b6f84f02ff3ab13378d598ebc40da2e6651af866375d88
MD5 e60d8d3d62338cd88cc9eafb16984285
SHA1 48c54c201c03d37b607cfb8373f851a0d55bc911
SHA512 1d37404cfa7bfac544f5dcfd3795c9c59da9bfb7c85d47791cec558b78449633f67fdf34edaf6e6679a647df7448cf3dcd04aa4164018c8426f6261a96a151af
TLSH
T13361D52A02B34797F322323CD4E30A23F3338488197B8D77464405FE7A39B22972966C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\Origins\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000001.dbtmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_github.com_0.indexeddb.leveldb\000001.dbtmp
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_github.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_uk.norton.com_0.indexeddb.leveldb\LOG.old
Size 387B
SHA256 f92ed3102ca65f1fda5ef05592ae844c5216c00ff27340efc484d3c04b459ae5
MD5 89b5f4d7ec29197d4180da6d9b0df322
SHA1 2ec1621bc8d40bb1e1936ca79d7c222d7def4ab4
SHA512 b267fcdb2b32de29cf64b6511943ec40d87f6e52824275064194da4f13be9c3b5c82a266552f86c990548b8281bfc479d7c928ff7822ac9b66b621e02ab37fba
TLSH
T11DE02BB84ACEC15FA11920970175BF0BE2D3350AE78C7D815B05D464B9C1194F7D9DE0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_uk.norton.com_0.indexeddb.leveldb\LOG.old
Size 347B
SHA256 a8dd7a485c4c4546e2ffc3195e0af6be47e13fce27d5bdb91b907d4cda47b224
MD5 584b90bb3fbd8f2137e8d19cdd4c148c
SHA1 181bba88a0e54da4fe13cc21781cc780f94c4559
SHA512 91e24e3af1ba2c98b5814f4f5ad32889b2690ac938ed9e2318b0db4ce6667db3870396311a004670d0f163c6911b402a1c2b744d795431754f3ced94096813dd
TLSH
T165E0D87C85CAC25B725466D60635BB0FD6D7660AE7CCBE450F08C8247542488B5BD5E1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_uk.norton.com_0.indexeddb.leveldb\LOG.old
Size 387B
SHA256 f9879ca2fb545dcda85893112344329067c709c49d90e3a558ca344386521de2
MD5 b4ed144f8d6f222f97e73eb0c611e67c
SHA1 c2befca83746bf26f3f4fa86467ad28627286874
SHA512 8a1741e163bde2b8f563150a089fb9b8204a163ca32d1dfaf7b874e7c617421584f68141045633f4cc00756e8182e070715c6ee66c4d18fee161434eadda923e
TLSH
T17BE09B7859CFC25F611524974238BB0BE2E3751FE7887D411B08D464F5C2454F7E99E1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_uk.norton.com_0.indexeddb.leveldb\LOG.old
Size 387B
SHA256 82a43b8631b612c4062841b9edefe5d48eaf559711509259ee5f5eed53178203
MD5 f2ee614facc96514e0c98c873b8b218c
SHA1 81aa88cfedab4be74a65decf2c2b654057a7e3e6
SHA512 d54386417f76d9d4241ea7a829fa0277275a52f531b8334414ce531a2f0aa5f938f19147398e9bf833604b6d6f72f60a9af853b81302b4aa6ce44a2e07b3742a
TLSH
T12AE0EDB849CD826FA00530970175BB0FD3E2360AE78C6E812F858864A641094BBA9AE5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_uk.norton.com_0.indexeddb.leveldb\LOG.old
Size 387B
SHA256 9b7d1894a6be9a23b3883bb5301fce69128471fc6a87eade6f3ff1c9cc3d604d
MD5 3f9126f37a890279c70e12b1b34816d4
SHA1 cbb613b0c77a1c16959acf54e8fffddb58135166
SHA512 e30c83ac582d8a1d2131d57a6f430d33489e9e747d2ce76b500fcaee2985ad9aa90bd9bce41714b612cfaa7a6b8ff53827026cec84c1a742a4abff19a74fd287
TLSH
T117E06DB855CE825F711620D64274BB4B9AE2761FE68C6E811F0488B4E441494BBA96E0
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 11KB
SHA256 d6bf4b09ae94b33673e4f376ee5a955ed0a1369c454d93f2fd26f71efd00d8bd
MD5 c6841e777a261a0676fea449cf71f5eb
SHA1 2f9a536dde2d1c910b90635239908d07df464e4a
SHA512 a8b925dcfb7f275042b9b759d761d8648500a06f20029ea341ca06d4c458cd443573afc06e882b1157a4e8f2ccf4a4a873fe2069215fd1714e86ba03531a1810
SSDEEP 192:D0UDFSKCE31BJftgJ3temAGeJ77I4+6GaIpSDr41FKUiaPP0Id8I8IevMEuTaANf:D0UDFSKCS1BJfts3temAGeJ77I4+6GaQ
TLSH
T14B329DF7C3D8C12D891116F8AB15AF2FCE1A1614431C3C3A89D8BE4AD3E2871E21675E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 37KB
SHA256 aa9a00f45ca20291b81b0661c3a22f6b79bd5767c97af41934fb3cf2d22f97b3
MD5 e2039d3d35ddee215f1ae121a52f8eba
SHA1 d007e86d135663a636a232e96cf98760771032a4
SHA512 9bd326a9a4b46f490a11bc0cc752b2ac3bfc327c8a97cc05c33173a93a7df1583970bd48c96824e2c5a200b1f7dc35404eaf1887b073acb5a74a1599ae4f995a
SSDEEP 768:OAAAubF6L53zGyqi8iQS5Ox/iBww2o8XC1C:FubF6LNzOO2o8XCI
TLSH
T17B0389FB83B5866EDA1195F4AA14AF1FCF190524472C383AC9E47E17E3A2472E10275F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 41KB
SHA256 2ab4db7cebb1f503ee970d1172b5640a8e35e2a6057ae664b1ad92241f103bf2
MD5 bb15424d2c61e03c0b7e1012d1b0c9e3
SHA1 50b22f2617f967d2dcff148110340437f03ebc7e
SHA512 5912c462a084d5b5c03c19ed34dafb5a22952ee5393ac8f68759a2c20138b8d409b71375bf01ee25b0852308e6fd60eb0e030c68bcdf8b923087c1075fa18ecc
SSDEEP 768:OAAdwYiSL53zGyqi8iQSFO3OGX18J82+EPJqc:AwYiSLN7O+N82+EPJ1
TLSH
T1221368F783F5862EDA1196F4AA14AF1FCF190524432C392AC9E4BE06E3E2471E11275F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 23KB
SHA256 4606c5d3ccac58df2336bf391a4295b40f628290683521e0db2555b82998815e
MD5 e8fa163f38e3c6337f70ddb2bf4b49f8
SHA1 365edc8162c0d2523d3d84615163ba6320c7d5a7
SHA512 39f47b6b18dd26b83df84690e3ccb77d10427d1ab47f97470c6e399e5be24d3680d522208185bc635776e7d9288709b22d25351024856deadb7bd4faf78fabac
SSDEEP 384:D0UDFSKCS1BJfts3temAGeJ7I3sVPPA+GWI4+UaIpSDr41FKUiaH0Id8I8Ie0EuE:xeChmOvZHVJXEi8iQScO3O9
TLSH
T188B27AF783E5862DD91256F4AB15AF1FCE1A0924432C392A89D4BF16D3F28B1E10275F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 318d71f7e1719089b0732f1319ceb92cb68ce4f364f9c01b6d590d261bef44a2
MD5 7b3c047bf5432d47290321f411b9483a
SHA1 6706866275d98219d63c0831c299c64d20cc3c3c
SHA512 c8f50fec771852ccc0e2c0d33895410c7c2ef9beb929f110b01874600a3a7bf8bf39d45b980a168f8a1095a867d3230d423748cd8d9d098e3a40b213ea49e7c0
SSDEEP 192:sxZ04RlyM/jK1Ml8MkA/fDswrl6IdpqaXHW6+WNrON/YwC4j3IgrJ:sxZ047MA/fDswZTpHb0/F9
TLSH
T1D052E8026A34997BCCDBD209FA55BF53D6F54572A2900E84A9FCCA1C05E7AED2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 5672bd9eb4bc4b42b76d3b528bba5181e1f9c579e72a61d8e2f03c31809dd9dd
MD5 7878949e5baf4db029aed09cca3d7b82
SHA1 c1e18ac3e3f5b1b1ef46051d973f583bceb99c3c
SHA512 b98cc4f1ee7cda5bdba03e7d89534a6948385e814a04c40c2d9cd797a452d8620d18b36d3bd37c49801bb711513a261c2b28740a2f3884b62dcc1f1724849a9c
SSDEEP 192:sxZ0oRlyM/jK1Ml8MQA/fDsmr9/nIdpv3qmQIHW6+WN4YgRn+Y2XYwW5G3Ig57J:sxZ0o7oA/fDsmpwhHbOMX9r
TLSH
T12C62FA426A3459B7CCDBD219FA55BB57D6F54422E2800E84E9FC8A1C02E7BED230781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 2ffa213c18acf422824e0eacf5edcf7302ebf98b972f007ba2362efdb241a8aa
MD5 e1bafb066f6defa5f0ef0e703460d260
SHA1 4ae441f53841f83c8df7f50c49f0bc41f513adbe
SHA512 08b335bab5261d8f3756bd4c84102ad21ffd23a67d3a3c74eef81eb858a94ce80652f23e23761b620cc99b694a459fbcae71d6693a79899506b6d06e9175a641
SSDEEP 192:sxZ0oRlyM/jK1Ml8M9A/fDsmr9/nIdpv3qmQIHW6+WN4YgRn+Y2XYwW5G3Ig57J:sxZ0o7lA/fDsmpwhHbOMX9r
TLSH
T1EF62FA426A3459B7CCDBD219FA45BB57D6F54422E6800E84E9FC8A1C02E7BED230781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 122e264c592406af106fb49973902cc38eb250478ebee054690bc723d7e02d7b
MD5 2c3cc2e64c64a8f7d08aaca440e7df73
SHA1 225a72e360a3b8c21eb25d1b629f6a6f45da5566
SHA512 0b6aa8a780669113019f82e282c607a00f84e5ecef9e5756b8da292358f546ef10c74765ab98a92d98697b32ceb957b888d7cc75da235e35441c0ca710f7c31c
SSDEEP 192:sxZ0oRlyM/jK1Ml8MkA/fDsmrl0Idp939HhHW6+WNNIY2XYwk6j3Ig5nJ:sxZ0o7MA/fDsmZtpHb4Xvz
TLSH
T1AA52E9426A3459B7CCCBC209BA45BB57D6F54422A2800E84A9FC9E0C06E7BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 a982e2b6e51397161218748747152d52cf4d583222073de112cdb9c3cc081260
MD5 3ea7e353418927c94fe4aa9e070a65e4
SHA1 8f7a89460251e9bfc7c31206aed7f2f0403a611c
SHA512 aa2962adfb74f756fea4c4c9376254f166b968984e465a7fb1b4bb3d92a4c93a513e20111c99c9caa56137dc6433d01d143c3ef2936876369f3cbd907c774dc4
SSDEEP 192:sxZ01RlyM/jK1Ml8UQLQA/fDsmr9/MIdpvRiEyjoCmQnVeUHW6+WN4YgRnW7P1qb:sxZ017qMA/fDsmp9tuHbOc2hM63/Vr
TLSH
T11C82E983A5344AB78DD7D219B911F757E2F51462E6804E84AAFCCE1C02E7BED620781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 2f1f7d2d809786a907688d86d07beeea653642eb8615a1d86e3e4da7dd7932d0
MD5 e5860aaf856719aa41c267c1e64d7e19
SHA1 b94dff9ab54c775a8a0eca68b319f53b95814baa
SHA512 7eb3ef2ab20ec578de76f6956688aa5ed2e37f1ded47a0c0f30d01939cfdefa126e20a00589ed3082b57231a47bdf1f5af804eeee9489ea1ea29efbcf5ed3299
SSDEEP 192:sxZ0oRlyM/jK1Ml8UQLQA/fDsmr9/OIdpvFEyqmQnbUHW6+WN4YgRnW7P+Y2dBxZ:sxZ0o7qMA/fDsmpHeYHbOcM6/qr
TLSH
T1F172E943653449B78CD7D219FA51BB57E6F54422E6904E84AAFCCE0C02E3BED620781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 a1844e78a02f5a26f6edd6eef69812f915edfc989b60bc95bde54d9ca96c9351
MD5 b1b8470508f67f2d4bbf30d549acfad2
SHA1 76aa31955df6b9e675aa7aae894b9a89025b1423
SHA512 a2009de7221a62f5c3d274396549511da381fe105e5dcf61144ceff8967a827d95af1eba8a2cde0172211aa4bf74a15f199fbb4041ee0d87627db7d02d1ab9d6
SSDEEP 192:sxZ0oRlyM/jK1Ml8M9A/fDsmr9+Idp93LHSHW6+WN4WIY2XYwC6j3Ig51J:sxZ0o71A/fDsmpvsHbgXxl
TLSH
T19462E942663459B7CCDBD209FA45BB57D6F54562E2800E84AAFCDE0C06E7BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 32KB
SHA256 87b77de53bb0c28d2825245e5d3fa39bde26f8e14a4e2044fa87578ad41eb1e6
MD5 fabf3b4040adbae8a3ce3a35a31fdbe1
SHA1 5facae681497f525780827400e56823f285cb25c
SHA512 ca4701b1bd0b8b71566ccbafebc023717bb9a2c8f6c15177ff910b44127e536f707961d52451cde1c4f0a41c133b355532bb43974c11d07fa29c20f124a4554a
SSDEEP 384:sxZ01OqMA/fDsmA66s8qMpRiYnazAW8pZS15posJWeT+bbtjHbOc2hWM63x/+y:sYxMA/fBA4Mnc7WeT+bJHb/t
TLSH
T1B1E20A429424C9B78BC39D19743CBE37D5EC1452A6C4CECA5AECCE1C029E6FDAB07856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 c68e2fc960014953270ccf2854ddb7a16da61a6b5557381a7898218b9c4c5895
MD5 b03f65954196a957a6355e7c4f005865
SHA1 c16c99e17b1abd738ab206fabc55c4cfc0eeaa1a
SHA512 9bfdaa6c124d8d52a52d4fe7cf7e755718ab0466e77fa5be595e9ecafd14a48d708223e4aeb1c182ee4ee2e11b84b1769f529dde6b507687a8505acae0e75e69
SSDEEP 768:fM4jeXmWvmKLE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhPLlrZ+dMrohacraiE:fM4jeXmWvmKLEu1jacPLZQdXLVE
TLSH
T1F2D20A3B280CCF7E4F844E5CED26AE976ED801CB6A584D5047FA894C03C76EB512B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\06cdf1d3-b695-4c71-9713-e0c03943cb59\index-dir\the-real-index
Size 1KB
SHA256 11961fda47ca0202157c19fa644718e69bbfd3b05d2fea57cf36ac68b6873592
MD5 5ada28d226229cd2537d6ef98f98767d
SHA1 50aeb0e7f80238dfdd943aa6dadd11a8df768e75
SHA512 a8def2cda46f2ef84bf52020a2d672325f012678c112d1422774e5e227f2662bbd5a5314f8806ff75abf4a0438b2922434b962110672d4b6f12da0a1f0f27d3d
TLSH
T1DD31204E8ED59D9FE86844B60573B9B8737089CC4721E32399BC62362E267491A4B1DC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5d26c4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\06cdf1d3-b695-4c71-9713-e0c03943cb59\index-dir\the-real-index~RFe5d26c4.TMP
Size 1KB
SHA256 d6f9a8758aafdb95101164dc8a7cbede4ac2cb8efbefb11b5a4ebcb3df96491d
MD5 e5f87e8e987cfa4bf587413bbcb299b3
SHA1 70c47b5d1f583b808d95e17723f7904b281120ab
SHA512 6e6c66ba5d4da3242026a869a604d4580e35bcb900e5b634d54e27cf3b24fc9585111992a0faa6c3d805089c72f2e914dbd3cb1a3061ebdbfafe6039ff595f6b
TLSH
T10031324E4A918D0BF8C4507B0A63B8F87375C8004321B393A57C62399D25B8E2E4F0D9
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 e38bf069cc378499c6449ac608f66777a4cdf1eea3d194cba781ee15237bd9ce
MD5 e887a4b79e93b4848e7f0492708ba413
SHA1 b6be90a9ea51803c3cc036ae129ff73b46488cd2
SHA512 0f5af68cba5aab568290ab0f027b90bc4602ead59642688594f84c047fb1000457f5b8b17c94c75d3d0d92155284ac15edaf9debcdae41f518b5eff7b6a98b60
TLSH
T1F9E068F62CD72E20AC7F47E228B205A44046B429C950AC8E2016A2E750A02282026C20
MD5 SHA1 SHA512 TLSH

Submit Download

ba23d8ecda68de77_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\ba23d8ecda68de77_0
Size 33KB
SHA256 e9d6cc67083a82fb11d740f3e0b042d5f099926de5ac47a5d362248d1fd130ed
MD5 16b94f85eb9070a87518c1fabb887ae1
SHA1 0d10743336d846f052dcf342889668ec8394b4b0
SHA512 3c053058a2981e599a786bb2442a638fb9955401e369203248714580ff5f993417e48ffddea535369f8c75a3efdc4d7f07a6f85d470e3d87bbb9b20fd64cd850
SSDEEP 768:DWn2QUynTt2+b9yd2mfX0NYidNAT4F2iDvuwobpiMCM:QwwNeiCjdP
TLSH
T1B3F209C36234F2366BD5A2A9F4A04721E6F730AD314444EC35AC2DC737C5EC86299E7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ba23d8ecda68de77_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\ba23d8ecda68de77_1
Size 56KB
SHA256 abca507393031d155a30654e318bf75690090f21d387aa33a335588c4869f4e5
MD5 4945422ff006c8e8160ffb83c21995ab
SHA1 f0fc6528c8a435f16421af9f9185e32e0edb964f
SHA512 874eca2e0645bb0b49a0653fa07ec8ce7bac19b26e156fc544afde8ad41feb07cf2da227347b5688048523589c2fa11c43a504cd5d3c22c6d516b0e9e82f0ea4
SSDEEP 768:He1KCaGJFQV+ttW2begbKLROd59F5eLGaF64tLmntNY9HX1NtsaNfMDDKWh4fZCt:HexJDre4KVwLmdNCTYZL19MXKWh4ct
TLSH
T1EE4307525322962BCE1293FF4152862BB37982053F83D31538DD57282F763F7998E91B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 bbb0496b324a903fa0fb5c19a64d08e3b6801fd03d9dc1119c823db8e667c820
MD5 75eeecabc3a3630b2f7567e329f63006
SHA1 3d1212e3c873675a16d7046c7e8ec47e6a55b51d
SHA512 3ac7934e3d09b16b7116a06253c7d779648a890e724c9dcb5fb1c98ff431d61248f3439e2bb4f186e956dde70f16a3ea5f7347aa7a58f052e6e613a394eb04f1
TLSH
T101A00212116E6055C11502B492452F84E738C81071C2576344F651F4AC51941491F055
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5ac6fb.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5ac6fb.TMP
Size 48B
SHA256 b03cc2cf173355a3a6d51db31b25eb9f8d56545df0894cb5128099229072885a
MD5 13e87706a630d8f8468f3be24d49cf0f
SHA1 54ac774728799619c02b1da2f5e2bce2773109a1
SHA512 fbe048ee8cb3b5fda2d7c87f9c5ec93e8a50b75374f94b036699102a89c267ad970ea68daeb4c44a3e5ab4712898c9e018f13e5a4119c326d4945dd62facb0b7
MD5 SHA1 SHA512

Submit Download

d86f77e734edce25_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\d86f77e734edce25_0
Size 194KB
SHA256 dd359e9922ff60ea62fd1243ca9e96daf5d2f2c2d2c27d534f36c1e3faf88561
MD5 a9401c5bfdb9f9c0f95f11d6fa04066c
SHA1 dba1e6da3b71a7651707b50d6a0c80f10d9e2cff
SHA512 862d74eb670ba3d0f2af788adeb8b7570342073e616e6c11c4d3c00094796a6b51a343cf06b09f13e5fad4b19b06d8549a7c9ff0dc8456de3ac9139fcebf49c9
SSDEEP 3072:RegF1cJu9zByRIZa8vj0QbJI1lXrZ1lThh:RegF1cc9zByRIZa8HlI93h
TLSH
T1B8146B316300F43BA9139E61A27F7F4E3C35A16BDD0686FCA1E4E870AEE6CB60515758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 d9514268108f83b5879d46ca1e1bb64ff68823149270dfb10683aeb1f3fd7581
MD5 82619ea69446d0df1a809e79704ec25c
SHA1 f04f0d58c2df8ad0e0b5eb9c500f9ac80cc71b89
SHA512 8e5656c2fbf33fd50cdc6eba0b36ad0969bd944a974505ab5e26e65eb7597fbfb05a55fc1792df11af67ca1e46725881d8267771cc43cadbbcaec436fc2070a4
TLSH
T13FA0022125C1082DEE804B7318CE055522117D16750ECF0776FF4449DCA6649750D152
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 1f40ccb79b1cc1dec8173e47ed95b0fd02a4fb41995f4a07abecb704286f0b8d
MD5 a02a3977ff91b1fa439ae39b1eba18b2
SHA1 26cb1dae542827cad187d8b4f1489ee9c2971b9b
SHA512 a0fab1b3e8937d6ecf5a357e5fe8a9bee8d37dec4048acf9164fa3fcdd005ccf8fa0d4800e1488f8b291c888e307011c8dd3e0f0006e8895b8f7fd36f9480dd3
TLSH
T118B0112800830A0AEA000BB202C8008022332C033F0ACA03A8A30088CC8B380302A228
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 90d03a55ea1ae247c13456adaac4c1e0cc4dcfb7b4290e6c33a724af67cd18ff
MD5 e75d0b140688a537c5604e28765866e7
SHA1 36e10042ccbe254d651b78d549a85edad11cf08a
SHA512 b67db357f36de23a5aa4c578bb1d3231a1ec19654ea108c61b89fe14aadb736ed6066dd9cc2c330e9890ecf1dcb04ab7895e93dcf45e11f7bb1486fe44525c05
SSDEEP 96:KAzWK0YWeJOKa8a/oNJ/9dRWpGMgxRK4YgfRcHPuxdyHwBUAyeSIWz:QNR5/oNJ/9d8pGNxbYgf+HPuxdyHwBUH
TLSH
T113912356707B42913D3E290C936896168E8172A37524F93B3FAD01710E2BE269FFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 150B
SHA256 d18031bf26bccb8c10a81c9ae0036408a2df006e3440287c6917bdc631e115d1
MD5 f66eae2d9adcd5fa1d5929235f77229e
SHA1 ea4f464adb797c9597949651aa687317e3ee8607
SHA512 e349dd6496533f76cb00522dbe3975d14b41b8f32213b7cc3a0f30b374be3cae8b4a3de785dd859bd0327a6af112698ae6c1b5f107e1eb1ddb0390d81de0cd2f
TLSH
T191C08CF71D10894F1B30EAD81028322CD54B824D4CC4CCE8E405010B20B4D2B10018BC
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe593714.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt~RFe593714.TMP
Size 157B
SHA256 77388773a296fb998ab401fcd7d132bff9f482a5a93dbbd674b9cd3c239290bc
MD5 d4c60ec2ee06a459fc61fa4f92576e58
SHA1 2a0566d3b2a2ace61001fcd893b478b8388ea28b
SHA512 d3ee2b0585e2fc1a0b94e7633362eb88ae35bdb422b635774bf249a4c0ae846ab76aba706d98e68836df40ec563b0d507f11219daf904cd79bf6ff735124bef0
TLSH
T19FC08CF31D20498B1B30A5D61038322CD55B8D494CC4CCE8E406310B20B4D2B40008B8
MD5 SHA1 SHA512 TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe597546.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe597546.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 3ee57fa02f44bd8d47526b392ad60f2871d4aabff5b155af4282761d74f534d6
MD5 c027a7ced95e276b656a3f315b43a3ae
SHA1 3ff1f1e5d5aabbabbcad01276e2bee6b370c20d6
SHA512 745d4f26ccdda971777170d484cd39884fdf8441a1ac97353fec945c8e50a76c507202d0f7f701d90721c455a0e7ffbe0cbae60039f0466e2d94c83cadcc88b1
SSDEEP 384:BtNn/s3n9SfsNN6UkyoztAf+2/d9Y45KFlOObjI9G6w796:Bj+9UFob8l29M96
TLSH
T1F8927D326C249D774D939652F047361B9FF8967B97C42FC4E6ECAB0C01DB6AC1316816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 0382745d17728e20df59696e3f3cf5bc35c2fc9a1298fd2a515fedc33652f5b8
MD5 80612b312aa6c2128ec76a9ecd84a558
SHA1 39398c4ac7d988be16a3ff506b058416850cb7d0
SHA512 0dcd4a3d85e303086bc40e630eb634cefbea71be1be45af72d73cc748e89b8c9c4423de2cfeebad63c6028552d32f2fa7b00a3ffdffd89c78bcd4099b15fd454
SSDEEP 384:riF1tNn/s3n9SyzsNF8TUNTUlIlbUkyozdAf+2/d9Y45OFlOObjI9G6w796:GF1j+9Zswg7obAl29M96
TLSH
T18FC218F258D78976C99E8B43B37E2D168EFCC167B6806A84B3985A0CCD861BFC305815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 2dcf4f4a620e7fad8f52f11d2943bb6a515b0a83a448768d1941a40796d47b9d
MD5 b03787360c7397d7455325a10df2d6b5
SHA1 e65b1ae406f3cf10091fb8bdf196da67fbda80d8
SHA512 77bcf6cd5da9c672f32d08698c6ab5d84f82e2d5cad6788ed3d70b337f2180cf2261009c08587ec4b001f611b30e5312fc2aa2195d56a7e6225756aa4617c23d
SSDEEP 384:riF2tNn/s3n9SylsNW8TUNTUlIl/Ukyo1dAf+2/d9Y45+FlOObjI9G6w796:GF2j+9T9wgRobwl29M96
TLSH
T138D219F258D78976C99E8B53B37E2D168EFCC167B5806A84B3D85A0CCD861BFC305815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 38270e45f86737554edd01d9075592d9d544de45d1ffe90f6e083cfd3f02466f
MD5 a51ace1d2ce5d357a76fae6f8ada660f
SHA1 f0429943106f5fe7c9876b0ca367cb99c00f17f3
SHA512 ec38966e70adc1acbf3ccf1fe67d2a214337d1951c97a6d944232c14590518c705ad353d9712d0f23b593033eb3b9166f19bf9a2d6fa79eb95ab229808bb42fd
SSDEEP 384:riFKtNn/s3n9SyWsNW8TUNTUlIl/UkyoYQsf+2/d9Y45RFlOObjI9G6w796:GFKj+9g9wgnsbrl29M96
TLSH
T12FC219F258D79976C99E8B43B37E2D168EFCC167B6806A84B3985B0CCD861BFC305815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7e2e1261565b938b5ad6ffdc039fb406f59becf726a836234c000beaf061a5f5
MD5 edd0eea092ff38180e54789e5e5c23f5
SHA1 08200ddcb0298b1e7bcac0309adf372e4b3f4b71
SHA512 c770b64f4ba89d388cba37e050ae618535745ccdef2676fd6a3ee33e6e8c7340ce9f7b66240cd8a68fdfcd58f2db10585c8076a02c4d986047ef67092352a78f
SSDEEP 192:EON+V6hZ0QmiUy0Cpc/+jV40+Fd9YDJ5wOZ3eU6:EONw6oepu+2/d9Yk2uU6
TLSH
T1E402C935AC686C778EE2AE45F48777235FE4112BAAD56F84DAEC1B1C00D769C2306836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 ebd8443ead41d91acf2b1dc0e257e3c7a823b989a08120f4baefe6a4a5d25a60
MD5 1a98ece75f68356edee48818e37d7b64
SHA1 98cf4bd791ee8831a4fd51af7620757cde686871
SHA512 e94f8f75f1138ae08c79137860d755c6715f30aa584a4ab2bc1b12ae9259feb06801f04d5e187d0566494ef416a63dafe2123fd71b2bd1ae765b8cdb3db4cd5b
SSDEEP 384:NtNn/s3n9SfsN7bUkyoztAf+2/d9Y45KFlOObjI9G6w796:Nj+9Ukob8l29M96
TLSH
T122928D326C249D774D939652F187361B9FF4967BA7C42FC4E6ECAB0C01DB6AC130681A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 b2454c3b6b2c40e08b03272f342647db7fc326296e1a8cb506ff7877950a92b3
MD5 84df52b477fa6c2d2b79478df6e1e7ee
SHA1 17a92bae075fccc27e5302a319211f6b3a0228cd
SHA512 906a85fb736922e30d21e2f6420f955642590792e74e2bc6fbabc1d047448fed699c92177859255e72c59a2e1afd6734151786879e28cd4b88bbe1fe5f909fd0
SSDEEP 384:riFrtNn/s3n9SyWsNW8TUNTUlIl/UkyoNfx2f+2/d9Y45KFlOObjI9G6w796:GFrj+9g9wgbxmb8l29M96
TLSH
T19AD219F258D78976C99E8B43B37E2D168EFCC167B6816A80B3D85A0CCD861BFC305815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 f847610beac5d86ca2b007ec9459acaa3303d9b8157f37e2b00482ee0b5f5fb8
MD5 3182756f2bb3efbdfe0416dfa87a560c
SHA1 2eafe4b526fc1d7a549e4841a5a765115e83b2f8
SHA512 0832a7432027395067d1c1fd2da471e15481e10300ef499812b164a2f24aabdc41876b6328dedd0b8e158dcff00de597615ab93bcb51b541a4becfd7d2c5105d
SSDEEP 384:NtNn/s3n9SfsNrbUkyoztAf+2/d9Y45KFlOObjI9G6w796:Nj+9Uoob8l29M96
TLSH
T17C928D326C249D774D939652F147361B9FF8967BA7C42FC4E6ECAB0C01DB6AC130681A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 3b70a904e1538e2a1bc6618b938e715f4926d86683e062ca955c12df0760b67c
MD5 1be46092eb7d7f93cac57a317cc73305
SHA1 85f1eea0f14dd06d8caa98b473cc77f505e9ec2d
SHA512 636f0b5616c8861268a26f295bf3a2c77e7fe6ce3feedd766fb5b608a976a102c9654e49ea978e68694ab498337fe4a777d47cc6089cc739530ab765742c00db
SSDEEP 192:PON46hZZQmiUymCgc/+jV40+Fd9YD804NQ5cOqurqhU6:PON46jWgu+2/d9Y45r9lU6
TLSH
T13C12FB31A8A8AC675DD3A641F08736135FE4923BEEC57FC5E6EC6B1C01DB6AC130A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 67661fad7f71efff749e846f058f6210803dcaf71fd901c5be9fc7f8d1668604
MD5 65d9088c7a5b346e399e551ea9694696
SHA1 bcb5a58c47cfc0c00717a88efaf2508e0eae4d26
SHA512 da4b284bbfac88ff19f0a0523dcaaa7aa8c9113a79785adcff95c5bf31d731def41791ea58181dda7c9231cf97f5da2939f4a7d62e9d9e6a4ef5256290a86f02
TLSH
T1BBE009629B4805ABD028533400D71B203FFAC46087B7131B5AA10678BCA3B003E20B86
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 1d9b625b3a4297d21492ab418a625c65e79df1065460e1c18f3aa7d1ec494262
MD5 3e4668faea3ce785f02e641898af95ae
SHA1 064e27f4d7485d291920f0a926d6ac9e22b7f7e0
SHA512 4f00785baf869cfdebe800b24a4d67e8826571439cecef4dc939574810eb19bbb80a8fa4dddb1bcff4b74363a4e4c4f1e42de2336d3192bfe0cd91e577d73943
TLSH
T197E00962970805ABD02C533400D71B203BF6C42087E7131B5AA10278BCA2B002E20A85
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 1933cd08df0d04885dd00a19a9265286ea7da5787a91b64e7e5f5bd8336421b5
MD5 4a99557e4431d9ec462cdddac8eb5976
SHA1 0f211f43226c9d9c3c7bc4751254b6a35149596e
SHA512 31a01fada74f6d5605ea780e4fe95c6a04c98c47801c16b749de90e17b2f2a37fe5c9da6cee26880116fa3caa7fc7c83c27c311fc37b8aa01b7784372b92b070
TLSH
T1F0E048138708013BD42D033806830B203FF6C42043F3231B02610178BCA37023E30F81
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 5f916adc15917d78fba2960515f91ae71f212022f8a833d2f265d96b99b1175c
MD5 61b1c647e7c9ff27d51ae8168f8a280d
SHA1 12a80e291f85c30dc5845898ae4a84e2c2dc310d
SHA512 bd1502230b86aae7222046d9e845ec41ed844c5749b4ce0e118a887bda5d26486823a4e15270007129f94a69b48299d21d3f0a01f0f4045c484fd4b75ec5f2ea
TLSH
T1BFE004629B4805BAD46D573400971B203BFAC46097F7232A5AA10678BCA3B002E30F86
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 05b698e885487587acbcf53065b66913c741024de75ca24900a41e2e933dd582
MD5 224f254cf43a9ac51f575aa465242640
SHA1 5734d6bd1fafc247daf2419f461f03333da0e9d2
SHA512 43c73b59618dfb37e6458798fd42bb7952dbf31473be3355484e3ec6ada85249fcd392f2ef42122f6180537fcc4cb8a2944229ebb4838fd4ac4ea66f96ce5707
TLSH
T1E4E048128B08017BC42D033401C307203FF6C02043F3231B0A6001347C637022E30F81
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 47da4455571c39673400bb868512bc7aebcb36bef6f8718c25868cb546f1295d
MD5 197b8b10f97cc2fc4361d206fd81993c
SHA1 8e0fca475c971ffa769a7ccb5e836d056a44bd63
SHA512 cd00a1ef1305219ce355614d8ae7aa714ef03020ce9d62a2e91d50574fe8977e283c1001e5271544194c4b8c4e9c08897f0c266782c7faab6a6ec7e150db69d0
TLSH
T135E001138348417BD82C47380A830B203FF6C42043F3231B066105B8ACA77003E30F81
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 b202d4309ae56c53450ead6672fef880c085045e59b0c2cca008b3639125f519
MD5 4598718e33987188ab516dc13a2f02ee
SHA1 30df265e95fb8abdc4fb85a5537b47b34a6cabaa
SHA512 25d158ad4cbba2ea1142f065cef9c1ec0f2d280f52ba8c3e76dfc6b7ca167b596e6dd3bdc9c0ba916d0542e7736f192c6b180d596ef196f1fb6fec153a335b79
TLSH
T1AAE00123938841BBD42C4B384A830B203FF6D82043F3231B5AA005B8BCAB7003D30F80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 bfe63c4e37bc27808e6ae96302320ef8d753dd17a1f271144289944793c45f30
MD5 26912b92e6f7373f7c968159e6e88dab
SHA1 5fb7b429fa70b60658bbab156834353e0b2eee85
SHA512 6fcb425f6befd361ef5f53e1a141f2eb38613c003dcbfaf95416a8bc6c843a098cae1d4dee8ccb09d8cedf786753593e9afa16a9a998aeeab765213e3899b7ae
TLSH
T15DE0EC23938441BBD42C4B384A870B103FF6982053F3232A5AA005B8BCAB7403D30E80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 a88c7034a7faa8d24bb04c4b53a4875993c7c8ec5b68cae63ecfd8ecea994e1e
MD5 1358facd863703b1aa12d93a543fc422
SHA1 40e1a1c1c0918ca156ab4419a37e51eab3ae7eef
SHA512 5e10af333f3af32dd7afc8371e7a1a4a0d4ed2f7ae17fdcdbf49c056babffccaacc9b86cce330014f43d70721c009327297d59c1f5d7c18396ccf3b588043368
TLSH
T17EE0EC23939841BBD42C4B384AC31B143FF6A82017F7232A4AA009B8BCAB7443D30F80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 375005f45db570db2dfcba7030363ea49f3f826e614b3b6feb493892313bf5ba
MD5 dc88753a539e5dd0a610bcc05753a076
SHA1 76d8cd1d5646c5580c5009756b36c4902ca232ea
SHA512 2699b079b16b15864672cbbebcfde91bdf0a4d5ce58d4ea17d9f868364fea37ffc2daf18a322c894571cd46b28c9d8547e463e77825f82bf04a2e5bd038c442a
TLSH
T1DFE00162D708059BD028133000D31B203BF6C42083A7131B5AA10278BC22B003D10684
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 b859b525325e22ed0a6700cab90c60a3538123f4db47cdb3ed805e93a8641015
MD5 a5fccde153a59842bce5b1d14d2c09a2
SHA1 05595d397bf63e0637441eeff889eaa4b297c69c
SHA512 92e0be24f0b7f0fc88808894d8f24ca9d6cdc92225ecbdcd091edab6cde56efeee7987fa7f67d23fff19eeca28747946771b522c506e5451cd8ad14be86a9707
TLSH
T102E0043157040157D014133000D3171037F7C41043D7031F55D001747C117001D10544
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 4e55b5d82c526b29d697156c82b96c62e411a1e87c79913d97073daad98fb690
MD5 702168280c8f224740ad73070746ecbc
SHA1 eee64a452b841b75c80b8d810e9254a41ae899ab
SHA512 06bee38a6a80a7e44dab72bcf7bb905743466caab2d828f2774e979033346a0ba790abf20736887beac96e7e28e9a15a6ca1aef6dc1c8d2a4e32da4fc5337a9e
TLSH
T176E002225708019BD028133000D31B203BF7C42083B7031B59A001786C227002E10684
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5912e2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5912e2.TMP
Size 392B
SHA256 16e637617b713f7f1c370954575228d4f8f141a797d74cc279783d05edfbf826
MD5 cd11c324f3b1513520f96fc0c5372a46
SHA1 9819cea7619f7c420cd7cc4c2e2a33d46402d973
SHA512 456748093c47692817c861f1629e4561966b2a483f327e1379fa3aa7ba9fe55f55e7702cdf27255dd97fecc264e3411b4322ae3a75edb869705aa598834bf4b9
MD5 SHA1 SHA512

Submit Download

207642ca-1a66-4de6-b0ae-99390af54381.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\207642ca-1a66-4de6-b0ae-99390af54381.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 a17f2747b5cc2303458bab1c5c5bfd6c9fa886e7402b14f5b5ffb2dffe64050d
MD5 9e950e0a86642fbd003254a25b910c12
SHA1 62c06523b4ae9025f4e863861bf90de12025962e
SHA512 81186408fcff9d23a9af43e5c04dc5c32d816c2418367ccbef1980d0698e623c11e9bc681c1f8cbbd2270dc67e70895b61b2c06df65fe66ef7efba56aa9e2358
TLSH
T1E0410958AAEE1148B7B76F56ABF6A96D447ABC372F46C45D10010E4E0A22B40C972B37
MD5 SHA1 SHA512 TLSH

Submit Download

Holzer-safety.exe

Path C:\Users\Admin\Downloads\Holzer-safety.exe
Size 133KB
SHA256 933ff2091575b19eb0a48a7ae9785644aac73a4cd28c5fdd8b36017ab75bb00d
MD5 fbd61725e4140530e3e883d09329944c
SHA1 02d8a39994248e69a37dd5d6bcf98481544f8860
SHA512 2a1f0fd8ef0258c0c00a18082fdf45ec3916f15dbb09ec39b5d3b72144368bb02894a4f04ffb14475eb0c77ac3b7709ede062d87b888b2f83ca0e2aecf2b1090
SSDEEP 3072:yjAQNTa0ln/cg6/6joeCOyuIyDFnTTTTTHvvvvv9A7l:yBNrlU32Bhyl
TLSH
T171D36D50F4D1D873E23349302C74EAA58E5CBDA49F108DBB32D4772E0A791D25A36DAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LogonFuck.exe.crdownload

Path C:\Users\Admin\Downloads\LogonFuck.exe.crdownload
Size 9.4MB
SHA256 b4076d4d86fdcaf2d9dcb178898e4b1db04901272eea3371d3c7b2fe8e20f0b3
MD5 eade23cc6c78510b30897fecc7e0bbe0
SHA1 892216cfb07a2aec035c2e4f6bd53a6cb8abe065
SHA512 b2c58e5f845af7fc50ab2e554eebaa45c577ec9416411636c03cdd1d5764803bf3f84e4767ab9c8d9982304cc9f3fd7e352fd0f6b155b77c56fdb1ec568be726
SSDEEP 196608:+gxp6Kt8RxG2lMKeCA0AtnpV90HwvV1llI+5Y4bXyUNbARdbvSyT4/Lb4N5O8YsW:IRxG2l2CArzLvV15YCCaARZvv4/LbYOP
TLSH
T1A3A6D0C6E3B37D10A965CA33CEBD45F8F610F088BA490B2E2139DF9461B31F4964A795
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5232-1255-0x0000000005370000-0x0000000005402000-memory.dmp

Download

memory/5232-1245-0x0000000000030000-0x000000000099E000-memory.dmp

Download

memory/5232-1256-0x0000000005530000-0x000000000553A000-memory.dmp

Download

memory/5232-1254-0x0000000005840000-0x0000000005DE4000-memory.dmp

Download