c4c0b8e1593bc5481521cecfce00b953e3ee6d7323b98e7ddf2e8c90a78ce545

Analysis

max time kernel
899s
max time network
900s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 12:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
VelocityLite.exe
Size 232KB
Sample260727-pkdssaah57
SHA256 c4c0b8e1593bc5481521cecfce00b953e3ee6d7323b98e7ddf2e8c90a78ce545
MD5 e4df8ee6e755c3da3088701eb1c05b76
SHA1 c52dbc1190b84555e27649b9b54746b958e5f3cb
SHA512 623ae06db60f42e33c6e94b4d74a20d6e456a1edb94e2b8bc58424532f27bc5baa516465cad455bddc0351e21614d4965919a123b7cb0891b8527021928a09d5
SSDEEP 3072:IlDJk88wN1QI7sxrYL1peQ3lOY9SkHNwG7NzaAT56Q7BQz:UAIwxrI14Q3kYBTM5QNQ
TLSH
T185341903B65890BAE1A2D638CD928981E7727C594F71A6CF37507B7E0F766D09E39302
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence ransomware

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
100	2516	msedge.exe

Loads dropped DLL 1 IoCs

pid	Process
3700	msedge.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3700_843048509\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3700_843048509\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3700_372573194\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3700_843048509\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3700_1396964535\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3700_843048509\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3700_843048509\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3700_843048509\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3700_843048509\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3700_843048509\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3700_843048509\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3700_843048509\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3700_843048509\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3700_843048509\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3700_372573194\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3700_1396964535\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3700_1902406300\edge_autofill_global_block_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3700_843048509\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3700_843048509\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3700_843048509\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3700_843048509\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3700_843048509\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3700_843048509\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3700_1478546759\classification.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3700_1051918110\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3700_843048509\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3700_843048509\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3700_843048509\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3700_843048509\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3700_843048509\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3700_1396964535\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3700_402119438\deny_etld1_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3700_2091853389\arbitration_metadata.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3700_843048509\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3700_843048509\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3700_843048509\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3700_882513243\domain_actions.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3700_843048509\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3700_843048509\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3700_882513243\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3700_1051918110\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3700_843048509\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3700_843048509\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3700_843048509\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3700_843048509\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3700_1902406300\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3700_843048509\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3700_843048509\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3700_1478546759\extraction.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3700_2091853389\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3700_843048509\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3700_843048509\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3700_843048509\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3700_1478546759\travel-facilitated-booking-bing.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3700_843048509\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3700_843048509\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3700_180370612\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3700_1902406300\v1FieldTypes.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3700_1051918110\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3700_843048509\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3700_843048509\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3700_1191121914\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3700_1478546759\automation.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3700_1478546759\travel-facilitated-booking-kayak.js	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2516	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134296287431606240"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3611646547-550105268-947503007-1000\{EA967CB8-3238-4678-BED5-FE8614AF6A68}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
920	msedge.exe
920	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe

Suspicious use of FindShellTrayWindow 11 IoCs

pid	Process
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 3700	2176	VelocityLite.exe	89
PID 3700 wrote to memory of 4352	3700	msedge.exe	90
PID 3700 wrote to memory of 2776	3700	msedge.exe	91
PID 3700 wrote to memory of 2516	3700	msedge.exe	93
PID 3700 wrote to memory of 2776	3700	msedge.exe	91
PID 3700 wrote to memory of 2776	3700	msedge.exe	91
PID 3700 wrote to memory of 2000	3700	msedge.exe	94
PID 3700 wrote to memory of 2000	3700	msedge.exe	94
PID 3700 wrote to memory of 3440	3700	msedge.exe	95
PID 3700 wrote to memory of 3376	3700	msedge.exe	96
PID 3700 wrote to memory of 3440	3700	msedge.exe	95
PID 3700 wrote to memory of 3440	3700	msedge.exe	95
PID 3700 wrote to memory of 3376	3700	msedge.exe	96
PID 3700 wrote to memory of 3376	3700	msedge.exe	96
PID 3700 wrote to memory of 5152	3700	msedge.exe	97
PID 3700 wrote to memory of 5152	3700	msedge.exe	97
PID 3700 wrote to memory of 5152	3700	msedge.exe	97
PID 3700 wrote to memory of 1936	3700	msedge.exe	98
PID 3700 wrote to memory of 1936	3700	msedge.exe	98
PID 3700 wrote to memory of 1936	3700	msedge.exe	98
PID 3700 wrote to memory of 4700	3700	msedge.exe	100
PID 3700 wrote to memory of 4700	3700	msedge.exe	100
PID 3700 wrote to memory of 1316	3700	msedge.exe	101
PID 3700 wrote to memory of 1316	3700	msedge.exe	101
PID 3700 wrote to memory of 1316	3700	msedge.exe	101
PID 3700 wrote to memory of 3140	3700	msedge.exe	102
PID 3700 wrote to memory of 3140	3700	msedge.exe	102
PID 3700 wrote to memory of 1592	3700	msedge.exe	103
PID 3700 wrote to memory of 1592	3700	msedge.exe	103
PID 3700 wrote to memory of 1212	3700	msedge.exe	105
PID 3700 wrote to memory of 2760	3700	msedge.exe	106
PID 3700 wrote to memory of 2760	3700	msedge.exe	106
PID 3700 wrote to memory of 5316	3700	msedge.exe	107
PID 3700 wrote to memory of 5316	3700	msedge.exe	107
PID 3700 wrote to memory of 5608	3700	msedge.exe	110
PID 3700 wrote to memory of 5608	3700	msedge.exe	110
PID 3700 wrote to memory of 2104	3700	msedge.exe	111
PID 3700 wrote to memory of 2104	3700	msedge.exe	111
PID 3700 wrote to memory of 4976	3700	msedge.exe	113
PID 3700 wrote to memory of 4180	3700	msedge.exe	114
PID 3700 wrote to memory of 4976	3700	msedge.exe	113
PID 3700 wrote to memory of 4976	3700	msedge.exe	113
PID 3700 wrote to memory of 4180	3700	msedge.exe	114
PID 3700 wrote to memory of 4544	3700	msedge.exe	115
PID 3700 wrote to memory of 4860	3700	msedge.exe	116
PID 3700 wrote to memory of 5612	3700	msedge.exe	117
PID 3700 wrote to memory of 4608	3700	msedge.exe	118
PID 3700 wrote to memory of 2960	3700	msedge.exe	119
PID 3700 wrote to memory of 2960	3700	msedge.exe	119
PID 3700 wrote to memory of 3852	3700	msedge.exe	123
PID 3700 wrote to memory of 3852	3700	msedge.exe	123
PID 3700 wrote to memory of 920	3700	msedge.exe	124
PID 3700 wrote to memory of 2504	3700	msedge.exe	125
PID 3700 wrote to memory of 2504	3700	msedge.exe	125
PID 3700 wrote to memory of 4312	3700	msedge.exe	126
PID 3700 wrote to memory of 4312	3700	msedge.exe	126
PID 3700 wrote to memory of 5684	3700	msedge.exe	127
PID 3700 wrote to memory of 5684	3700	msedge.exe	127
PID 3700 wrote to memory of 3796	3700	msedge.exe	128
PID 3700 wrote to memory of 3796	3700	msedge.exe	128
PID 3700 wrote to memory of 5104	3700	msedge.exe	129
PID 3700 wrote to memory of 5104	3700	msedge.exe	129
PID 3700 wrote to memory of 4296	3700	msedge.exe	130
PID 3700 wrote to memory of 4296	3700	msedge.exe	130

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\VelocityLite.exe
"C:\Users\Admin\AppData\Local\Temp\VelocityLite.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?framework=Microsoft.NETCore.App&framework_version=10.0.0&arch=x64&rid=win-x64&os=win10&gui=true
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2c8,0x358,0x7ffec880c188,0x7ffec880c194,0x7ffec880c1a0
    3⤵
    PID:4352
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1700,i,15914078435595362283,15370084237739577899,262144 --field-trial-handle=2380,i,8107619769112638333,9528721432807567881,262144 --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:2
    3⤵
    PID:2776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1920,i,18248691129996056005,12341388918242515918,524288 --field-trial-handle=2380,i,8107619769112638333,9528721432807567881,262144 --variations-seed-version --mojo-platform-channel-handle=2428 /prefetch:11
    3⤵
    - Downloads MZ/PE file
    - System Time Discovery
    PID:2516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2440,i,11088920785474077999,2397364729477775081,524288 --field-trial-handle=2380,i,8107619769112638333,9528721432807567881,262144 --variations-seed-version --mojo-platform-channel-handle=3196 /prefetch:13
    3⤵
    PID:2000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3480,i,15016851375903511703,10428908755640831268,2097152 --field-trial-handle=2380,i,8107619769112638333,9528721432807567881,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
    3⤵
    PID:3440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3488,i,5605663388410108877,5441211826123193316,2097152 --field-trial-handle=2380,i,8107619769112638333,9528721432807567881,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
    3⤵
    PID:3376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4188,i,13051318486311283670,309570748594666652,2097152 --field-trial-handle=2380,i,8107619769112638333,9528721432807567881,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:1
    3⤵
    PID:5152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4172,i,9889392626129085925,3197964856637845344,2097152 --field-trial-handle=2380,i,8107619769112638333,9528721432807567881,262144 --variations-seed-version --mojo-platform-channel-handle=4876 /prefetch:9
    3⤵
    PID:1936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5328,i,13714563301976281127,18067845461961846591,524288 --field-trial-handle=2380,i,8107619769112638333,9528721432807567881,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:14
    3⤵
    PID:4700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3776,i,8129156104943144455,11463693027341803470,2097152 --field-trial-handle=2380,i,8107619769112638333,9528721432807567881,262144 --variations-seed-version --mojo-platform-channel-handle=3764 /prefetch:1
    3⤵
    PID:1316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5316,i,17440112425090445208,7272854703293510834,524288 --field-trial-handle=2380,i,8107619769112638333,9528721432807567881,262144 --variations-seed-version --mojo-platform-channel-handle=3760 /prefetch:14
    3⤵
    PID:3140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5464,i,11543399052665770240,8338036430457768792,524288 --field-trial-handle=2380,i,8107619769112638333,9528721432807567881,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:14
    3⤵
    PID:1592
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6192,i,2689484411273435041,15496920983667530155,524288 --field-trial-handle=2380,i,8107619769112638333,9528721432807567881,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:14
    3⤵
    PID:4520
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6192,i,2689484411273435041,15496920983667530155,524288 --field-trial-handle=2380,i,8107619769112638333,9528721432807567881,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:14
    3⤵
    PID:1212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6456,i,38047147846618794,4771610440798569866,524288 --field-trial-handle=2380,i,8107619769112638333,9528721432807567881,262144 --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:14
    3⤵
    PID:2760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6608,i,17267324383116859732,9001064923736202410,524288 --field-trial-handle=2380,i,8107619769112638333,9528721432807567881,262144 --variations-seed-version --mojo-platform-channel-handle=6616 /prefetch:14
    3⤵
    PID:5316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6888,i,17153742888592306892,15914217767663395210,524288 --field-trial-handle=2380,i,8107619769112638333,9528721432807567881,262144 --variations-seed-version --mojo-platform-channel-handle=6872 /prefetch:14
    3⤵
    PID:5608
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6912,i,3695102917873909375,10564852592842410213,524288 --field-trial-handle=2380,i,8107619769112638333,9528721432807567881,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:14
    3⤵
    PID:2104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=3836,i,5179390857384638308,11673542278089697055,2097152 --field-trial-handle=2380,i,8107619769112638333,9528721432807567881,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:1
    3⤵
    PID:4976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3844,i,8450065498015068314,452275820001396549,524288 --field-trial-handle=2380,i,8107619769112638333,9528721432807567881,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:14
    3⤵
    PID:4180
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7128,i,14289382216575939375,14858666149064389049,524288 --field-trial-handle=2380,i,8107619769112638333,9528721432807567881,262144 --variations-seed-version --mojo-platform-channel-handle=7144 /prefetch:14
    3⤵
    PID:4544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7124,i,5144280941483430126,8665396017469085995,524288 --field-trial-handle=2380,i,8107619769112638333,9528721432807567881,262144 --variations-seed-version --mojo-platform-channel-handle=6596 /prefetch:14
    3⤵
    PID:4860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7140,i,5233470068811797626,10155624493860826955,524288 --field-trial-handle=2380,i,8107619769112638333,9528721432807567881,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:14
    3⤵
    PID:5612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5500,i,9471552926997823441,10085153491182372030,524288 --field-trial-handle=2380,i,8107619769112638333,9528721432807567881,262144 --variations-seed-version --mojo-platform-channel-handle=6768 /prefetch:14
    3⤵
    PID:4608
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3872,i,2983589081712603110,9787254071515477582,524288 --field-trial-handle=2380,i,8107619769112638333,9528721432807567881,262144 --variations-seed-version --mojo-platform-channel-handle=7120 /prefetch:14
    3⤵
    PID:2960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6204,i,9267997170311040992,5238526138412636396,524288 --field-trial-handle=2380,i,8107619769112638333,9528721432807567881,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:14
    3⤵
    PID:3852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6648,i,134832261590185580,17127589959256130672,262144 --field-trial-handle=2380,i,8107619769112638333,9528721432807567881,262144 --variations-seed-version --mojo-platform-channel-handle=920 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5228,i,260230996385543690,563598339320654584,524288 --field-trial-handle=2380,i,8107619769112638333,9528721432807567881,262144 --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:14
    3⤵
    PID:2504
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6052,i,2397409775026585009,8377354773683121648,524288 --field-trial-handle=2380,i,8107619769112638333,9528721432807567881,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:14
    3⤵
    PID:4312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5792,i,12044010241027029229,13069178304148994093,524288 --field-trial-handle=2380,i,8107619769112638333,9528721432807567881,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:14
    3⤵
    PID:5684
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6388,i,177955338728779847,2967846126338159810,524288 --field-trial-handle=2380,i,8107619769112638333,9528721432807567881,262144 --variations-seed-version --mojo-platform-channel-handle=6752 /prefetch:14
    3⤵
    PID:3796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5564,i,15212566360049320305,7269855591042182344,524288 --field-trial-handle=2380,i,8107619769112638333,9528721432807567881,262144 --variations-seed-version --mojo-platform-channel-handle=6636 /prefetch:14
    3⤵
    PID:5104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2296,i,13290550132593958916,2151287133049811937,524288 --field-trial-handle=2380,i,8107619769112638333,9528721432807567881,262144 --variations-seed-version --mojo-platform-channel-handle=2868 /prefetch:14
    3⤵
    PID:4296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4832,i,13403943666076741478,504357199487735068,524288 --field-trial-handle=2380,i,8107619769112638333,9528721432807567881,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:14
    3⤵
    PID:3092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7128,i,16021123584026583296,4885101096291751724,524288 --field-trial-handle=2380,i,8107619769112638333,9528721432807567881,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:14
    3⤵
    PID:3228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7292,i,15265042474589153990,11892687972421263685,524288 --field-trial-handle=2380,i,8107619769112638333,9528721432807567881,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:14
    3⤵
    PID:2720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5960,i,10526938869488130398,1438616844866975971,524288 --field-trial-handle=2380,i,8107619769112638333,9528721432807567881,262144 --variations-seed-version --mojo-platform-channel-handle=7240 /prefetch:14
    3⤵
    PID:924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2860,i,9251611788363702229,1663865518683751684,524288 --field-trial-handle=2380,i,8107619769112638333,9528721432807567881,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:14
    3⤵
    PID:1608
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5504,i,1604432213066473013,6975658721981079413,524288 --field-trial-handle=2380,i,8107619769112638333,9528721432807567881,262144 --variations-seed-version --mojo-platform-channel-handle=6732 /prefetch:14
    3⤵
    PID:4012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2860,i,10008160390107442596,2250626811615654553,524288 --field-trial-handle=2380,i,8107619769112638333,9528721432807567881,262144 --variations-seed-version --mojo-platform-channel-handle=3096 /prefetch:14
    3⤵
    PID:2540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7268,i,3824685289704745294,3658303153406108409,524288 --field-trial-handle=2380,i,8107619769112638333,9528721432807567881,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:14
    3⤵
    PID:2416
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,15741798046856451143,12090010863742922807,524288 --field-trial-handle=2380,i,8107619769112638333,9528721432807567881,262144 --variations-seed-version --mojo-platform-channel-handle=7288 /prefetch:14
    3⤵
    PID:4004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5504,i,5315221185593319666,13152471787537578022,524288 --field-trial-handle=2380,i,8107619769112638333,9528721432807567881,262144 --variations-seed-version --mojo-platform-channel-handle=6724 /prefetch:14
    3⤵
    PID:3488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1200,i,11116305841872460116,1954937701823181782,524288 --field-trial-handle=2380,i,8107619769112638333,9528721432807567881,262144 --variations-seed-version --mojo-platform-channel-handle=7312 /prefetch:14
    3⤵
    PID:3908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2224,i,5998426449915460134,6920199303978017685,524288 --field-trial-handle=2380,i,8107619769112638333,9528721432807567881,262144 --variations-seed-version --mojo-platform-channel-handle=1200 /prefetch:14
    3⤵
    PID:3216

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4460

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5304

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:5804

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ee3af991fa1719733ca1e3ac746d5b605f4205e269bf244bd9ae780ceadb9bd8
MD5 a044f6413820c4c3fbd300ee9b379ebc
SHA1 94fc91536a25274f06d3a6e89322dec7fde7912e
SHA512 ced4374c54d7b4ea2b76afe4ca5d8841dfb55d8cb5db96de4ed49e64bd3850a817db5301787c268756641c94c0bf85eb4ee188f04fc891fa2e45ad48284985a5
TLSH
T13AD02BA433044D0CCE40203215B8A210720484209C49031A8D41B01C8C6FD4387171FB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 22c1d58ffa7df77a7e0440ce3b2c474b1e03f30b60355bbf5dd6392fefb641fd
MD5 b9f45a900b1f64efbf90731f41c6ad44
SHA1 0c28e85e464e328fbbc07373b05113d39f83bdcc
SHA512 132313545c55ea809da0e811d6d5d324ecf5b6cfaefadb3fa4a29df5e6266dfeca7cffa4daf21754b4b37771504d3692189b5660a468784b5eaf80bf92f59ae0
TLSH
T11ED02BA033044C0CCE40203215B9A210720484204849031A8E41F02C8C6FD4387161F7
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 b48243dd381a231c3af641447f292d9973b74b3d3f5d4fc4393503927f85e8ee
MD5 127fc26e61a92171a0b01ed012cfefe4
SHA1 7de8bf3e4f34735e8fd73cbe2f17571b3d0dcaa0
SHA512 056ff558c0c076bcda08eee5d38a2e351e48c91d3b11329d3b17677756299adcd2bbd8982bc684b402004cc9816ca1589fb7e8a92d5f42947892a4aeeae5aa46
TLSH
T10CE026C644C8D22EEB006457417C534CC681360FEBC87A8E273888857383054A3A37D2
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 b377f0e1e1cb5c55cdca532d4079496ecef03870de1214d65bf7542f6a811d40
MD5 917457c85cd504cf662201a9abdc0890
SHA1 47f4d17d5e98a6a90ddb92bf28c256544bf90b0f
SHA512 f411da4a72d416d04961b70cf08d539f128c620a89f87c5d4e2d74aa99fffb9614985ef048d92822a6bfda084b7eeedeb6333bc419f05a34398446dc97113278
TLSH
T110E026A706C9C32EA6426957837C530C8282371BE2C8AF1E1728C4C47283044E3A26E2
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 f42d012f127f0884785da8c29db72655b2195cb7fb083185d74577a70cc50701
MD5 0ef2ba486ae7c370bbbb0e9003db33d0
SHA1 812f3b810ce2e500a5758a1ca4eeb256656d21b1
SHA512 c03eeccc41e91c52dc9747a2327f5f7fe8c9267a80b7b7aad23192b0f99eeee912630567707e0845b96158f5fab3b8924380f723810ea1584ebb6e7386a1f1e2
TLSH
T193E07DC705DAC2AEA700744741AC630CC691360AD2C86FCF7708BD847BC3860B3E7690
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 99c3d2015374718fcdbbcac409104791bda9a3d7031fbf1999302547b65318cd
MD5 0f9945df99e1933dbe5d3bd02ea2ced2
SHA1 586453cb65d6a39d9a673ef465ac54a0c7e4cff5
SHA512 acd869215c1935adb009af2c627215eb99623eb1019587cb6f14f2268db717314187f9958d8aab3091c602b0aaed0887483e3ccd04af7bcfef7ef47e48f757b7
TLSH
T1B761A21547AECA90DB23C9B21CF91C7932F6A1D9110B5F3E0AA5AF32AD46F4860C00D3
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59f0fd.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59f0fd.TMP
Size 2KB
SHA256 7a0ec76609188877ddfc7713693c029fa8e58e3c9051a82c78abe4dda3809d48
MD5 f4c56247b634a3d6df89b07e339fd05d
SHA1 1714165ac3d0ec2a6c8bebcd41ab9d234a96f0d5
SHA512 e4530366ff23bdbe1121aee9eb21dea34ada1d76c57d841d7758f79a3dce294e3bfa7102ba0faf5647ffd064b4b3eb731925b663298465b4212f504e9b1c927b
TLSH
T11E516F11476ECAD0E727C5B25CF91C7932F6A0E9000B5E3E06A26F768E42F0820D10E3
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 93ee1b7d19a4b355d3a5faaa6a235cee0ded54349de0742b4aeb9c259b4964ff
MD5 648c14d74cd5c700cd366b434b247a66
SHA1 c518b4ac2b3714effa5eaa47de3dd998f40b3f08
SHA512 0aade1a907438687f0e0cbe8311c62e1c342cb944b7874955caf4700794afcd989484e829fa792879028041419725a829a87fd3574c48ba7ce4999bdf95eaff5
TLSH
T1D7719BF787B4856EDA1196F0DA18EE2FDF2C0515431C7C6989E0AE27D3E3072E14266B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 40a1e04c97f3df9aa41a73e9e28da454e0ec4ee91a8bc58fce4fb3d84935e1d8
MD5 c25af670957206d40983dd94701b826d
SHA1 7cbeff5ddbaafd92dc8dde4ad0e3695920376609
SHA512 056b125024de3e38a4116e6909bdf277b28d93fa4a4db959ff36045c1a0258e6fb2eccc083ea609ee2890a2c7037d602d337662973086ebce598cf5067eab1ce
TLSH
T16571BEF787E4856ED90196F09A18AE2FCE2D0615431C3C5A89D4EE27D3E3472E14265F
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

ac82dc15-0e09-4be8-a06d-d3b4a12daa34.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\ac82dc15-0e09-4be8-a06d-d3b4a12daa34.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 796e7ef8a9eb8df06ad6dc100edca809da74d0782593ee6f6d3cc8bd0b77d120
MD5 7b7308fc82f56071729902681e9c7ac2
SHA1 826e9feb5467e1ab93fc3959a73992f7e7a670a2
SHA512 d7fec4ae281786371e601d2567825bb5ef89c32c13386b91d408fa36209de72c4d6fd93e94c91e5dfb708141a8d6d2fdae053f3f447e2b7e283b669344d92191
SSDEEP 192:sxR67RJCC/flsqVz2IZv9SGzoD8p9H/g6+WNZY8/AAcGFxnk+GnzIgViaN5J:sxR67mC/flsqVC2v9S6x/5R/LeBnj
TLSH
T1FE42B91AAD38593B9CCBD21DBA55BF53E6FD5032A1D41E48A7FC8A0C14EB6DD520380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 370aed9d0e627cdff90e6c3f286d786c4e249a6174b613aa13f5a7579053667d
MD5 824e699279e8c1c7cf6089cc1d4e3343
SHA1 0fc777ea8496e72dc834912a00e02a817747c59e
SHA512 8e56577c9bed1d8170d90ef7b5d19f1ed6e7e47772d9e9c89d521476f618e9509e6e1ebc863f385b990a5e57ad0629093e44b960818b7bd40c38237afb1267ab
SSDEEP 192:sxR60RJTC/flsxVzBIZv9SGzoD8p9H/g6+WNZY8/AAcGzNk+GnzIgDhiaN5J:sxR60XC/flsxV92v9S6x/5R/LEBvj
TLSH
T11642C81AAD34593B9CCBE20DBA55BF53E6F95032A1941E48A7FC8B0C15EB6DD620340B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 32354ed9c5785d5b0e4cdf0e3a880d3a31d172d62263d2a385eb219ca3f1cfa9
MD5 6b51a6353a67e38febfad051cdb74428
SHA1 4c9930176d42d1a29a023699c1cd761a0c04cb7d
SHA512 27201211bd63c3025aed9392635f21d699f71f9ad51e85722a6510be5c0b787ace662bc43888af31678cfb9fe3deb2d8cab12d2d188681aad74f1cfabb52a02f
SSDEEP 192:sxR60RJCC/flsxVz2IZv9SGzoD8p9H/g6+WNZY8/AAcGFxnk+GnzIgDDiaN5J:sxR60mC/flsxVC2v9S6x/5R/LeBpj
TLSH
T12A42A81AAD38593B9CCBD21DBA55BF53E6FD5032A1941E48A7FC8B0C14EB6DD520380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 26KB
SHA256 953f9d491eb4022b36c8451a132135982a8a710a4f6cf44ee7e41edb3d2e0a1d
MD5 f5635ed31a311a1dc4655b46641a1798
SHA1 e6bdc939577dd7c5d543ce5c493dcf93f1e64daa
SHA512 3fbdd58b02ec3a796844905bc2594e981d3dc1f335ebb69dab21ed6664a7b1a5b0a39a45ff4e40fddcd792029d6141ed0fb09ced13000604fcdb3ce47c053478
SSDEEP 384:sxR60XC/flsxVm66s8qMpRiYnazAW8pZS15posJWeT+f2v9S6r/5R/LEBvj:svXC/fCVm4Mnc7WeT+f29r/5lLEB
TLSH
T191C20909A924C8379EC39D1C693D7E33EAEC505262C5DEDA56ECCA0C01AE1FDAB07457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 9397f187dfae892ee175ea50543a023be70f02dc9caaaa910214ceb3ce2dcffb
MD5 33daa9e2a4fae2be01e7508e0e2f8aaf
SHA1 d8a397baa4c0a2d0f1d6b935441feef58f1586cc
SHA512 4bc44d2f04fe3814602e90ac0b25836d24dd1f190bfa4c0b567052e957d1f34b4a2bc2f438e7bdf0f50d9b079579a2d5887a619d401fcb79cac192525fa5db8a
SSDEEP 768:UQYibZ7pLuLfONWgv7fxJ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVx15pNK2roG:UQYibvEfONWgv7fxJu1jay15fKNG
TLSH
T1E7D2DA7B740CCB7E4F804A9DAD197E9F6DA802CB9698CD8047FE941C02C6BEB51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\16b4a958-4f13-4dc6-970e-cb1279d99ceb\index-dir\the-real-index
Size 360B
SHA256 017b6f7cb1d8734d9ee3691ac9dc8bf0e77fccebf6a967dfaa149e9d607af6fe
MD5 0d99cbc0b4edde4efd16be18fd875dcf
SHA1 c1e4854c941e51f21bc56fac8988049ca4240922
SHA512 ea721fe70edfd20a705620847bd9d8dc7e74c0a613575dfb324a656d4f516e9f9ec77114e2393cb24c68deacfa3b02b27dd237bcf60e9ff91ddcabdd65d9a5df
TLSH
T184E0EB8B8CA2080BCA337CB60633A02F333B02FD3900AE5650FC041D9602A3C4381609
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5e630d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\16b4a958-4f13-4dc6-970e-cb1279d99ceb\index-dir\the-real-index~RFe5e630d.TMP
Size 360B
SHA256 09ca1dccd2a56f5f95b712b924fb5a61ca4dc066de10967fed71f8265037ed5f
MD5 1cb5e601d39fb66276c4fc963e7a92ea
SHA1 63cb4ab8fdfe29097ec0b93794bc2d7b5b952983
SHA512 ce7798f045a03261e86a42c51a0a92189eacda314604b9b952c416d4cf932ac16f85f37330bb1feb9aeb0136572125554b8733aeab60157e864624c36c71ae1d
TLSH
T147E02BDF40D15D53C92659751503911A333B08252915DA1A60DE585ED5217AC8585A0A
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 6a44c7388f07247ec78727a79248890268c1fd7068926d4a23166b9cda5db600
MD5 86245f20da8d05d7ea034640a407152b
SHA1 ecbe0d0cf6d9eb032c9ced6df9983cd85a886741
SHA512 42260f3ad4ef05df1d8d690ce2e16c0dac8ff914c0b3e542c79c60d89c7d0bb3035d8ee09ada0ac06744e19c88633cfcbd70e82dc53dc756354ba164d5ad5775
TLSH
T11EE068B22EBB1820F87F93C624B184A449407855C641EC0F1097538760B131A7499CB2
MD5 SHA1 SHA512 TLSH

Submit Download

domain_actions.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Domain Actions\3.0.0.18\domain_actions.dll
Size 83KB
SHA256 d35c8efcb710239f009633bcc5ae904ac6dafa985d451bedf791cf6909f014d4
MD5 956f610121cd5827fd5549097b79cd9f
SHA1 dbd23f99895a3a92fbe04c3c35d475a6f6998fd0
SHA512 3cc4712f64474497495d229ddd743c6bf25c30c3fbfca2525f46227d99a59a0f9e80e2119ffb40bc8a707b539f65f907e2e1565ea937e0387db47cf7269944e6
SSDEEP 1536:sNGnmI1FOxAdgxBf8paY3JQzQik428fKagFVbydki8yyafuzWk:sNG91FPgrfrPza428fIenya2Sk
TLSH
T16D83F180DF58411BF86F4835E0B269857A78E6B50FE092DF2376C9590E12FD1AF39705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a52c5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a52c5.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 c3fcdd628d0f1b5b1d3646a647e3b5015837c4eee2782e10bd506fbde4a97671
MD5 9fe6d16ab82de3078c792aa4d5821297
SHA1 1d0a5bb5d46f281477e92a966ab0c812bdf407b5
SHA512 1aec4ea7ef3263b618e1ae2e7e47e780c41f4413b793fd828a259f316611aa3b1597a404fc1b8c60270e439126ea35b552a655ad109c21313f14deb1a7730ddb
SSDEEP 768:u1t3VelYysyP07Hucys6BRvi82oP4/z6himo6xb9M26:u1t3OJ3imOz6Imoeb+26
TLSH
T1ADF2BF35E8158D73DCEBC249B5463B926FE4223395CC6E94E5EADF0D1687A6D030B823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 85daffb67f988a00e05725a6e7cb221faf2c99a1817b66ebdaaf27dcb8c00657
MD5 d1b6f30ddf895f1ef0e4d65cc1fcb182
SHA1 9fa4d8219e5248df374d399afb0286cccbb9bb58
SHA512 1658930ae9d2a3568403b715358e9650b38937d5e940a6009df991649bbcd55cade9c20d848e0b9dfbf08242add57c0c87d9329a2fa5ad5064d6f4cd6db9f231
SSDEEP 768:yMFFQ3Twg9LWQyPm7Hucys6BRvi82oP4/z6himo6xb9M26:yIQ3+L3imOz6Imoeb+26
TLSH
T1CA1339F598D78936E89E8787637D2E529EFCD123B5885880B7D55E0CCD825BFC30A811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 4df83154dbcc319320cfa67713898f5478b81dfd1b44abd6062e81e24bce145c
MD5 0b3af0c8295e6d3605ff85076a1ce96a
SHA1 f7484915f6ed97cdf56f1314a829651b03341bd4
SHA512 9847cd05d56a7100c800f6a641641d246e8d2ebdbd347c970677535b4fc53cb9b87065ef0440816f79d9e41562ba416fbd9137d7af19a8631bbb2308d10dda16
SSDEEP 768:61t34elYysyP07Hucys6BRvi82oP4/z6himo6xb9M26:61t3VJ3imOz6Imoeb+26
TLSH
T18DF2B035E8158D73DCEBC249B5463B926FE4223395CC6E94E5EADF0D1687A6D030B823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 7b366e2d5a0aa89abdaf1d1c40fbc303dbd07fda1e0de855a702f982e3a23561
MD5 4e54e68866bc2cef10a94c649d01b6f9
SHA1 1437d39c73db78be34d6ab97061849eb5c5d1a96
SHA512 b0483326ee8db282d3b044717b259ccaab4bfac3b9f6dd62e2f9812221eeac6506c8eac48c8c7eb7a488d62db35b3092ee1b743475f121ff0ea1fed293c627fc
SSDEEP 768:xGrv+4UNbdS3G49lYysyC7Hucys6BRvi82oP4/z6himo+W2bwn+h:xGbsbw3Go33imOz6Imo50w+
TLSH
T16003BF36F4148D73ECEB828874467A933FF4522355C91AC0E6DE5B0E529BA6E530BC63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 333b08c0508c9115b929fc05e446364929d3a56409ff4e8ef7ef5ef9c5609b3b
MD5 49ba6cadcec0a05f9e0ab68e870499d2
SHA1 a80ba67a05f9a1016fec03122777ad3f0eeef418
SHA512 2dedef7a05e67ad10c16f39f864a4bf5e95cda3f88673b8bb16dee8063a3a6c786ef734f70608ebce9768549c3e6ad52cbf70397a0b276874364153d2ff12004
SSDEEP 768:uAt37elYysyP07Hucys6BRvi82oP4/z6himo6xb9M26:uAt3053imOz6Imoeb+26
TLSH
T1AFF2A035E8158D72DCEBC249B5463B926FE4223395CC6E94E5EADB0D1687A6D030B823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 9107e613905835c00077a499d2faa20bb70b974e6309d1f2f33ae52933318f07
MD5 2012d4de563c653f56f62ccbf46db598
SHA1 fb24881003593f1ceb79019e52ce5ee9e94c889c
SHA512 c03d6584395c1c97c75af7dc6df57df358d3957035521bb6833c538679683aebe0410bb12586472b84dc98111e703984dd37868464fa9c66fdafb423e763b555
TLSH
T10CF00E829C3E25C086E90F7FE44725F840C46517B0883879088DE9D8813A40F11414BE
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 612B
SHA256 98d9b184e4c7220b5aaf7ae412b0c1b3f32e3dc4933afcf852538b8082017b9e
MD5 c20138f2b92ee0645ce99eebc563daa6
SHA1 8e20392ea25dec3d3cef957c8ebbe1a0c589ea3b
SHA512 151098a27cb44d715d48210b12b95a9d1341beb7ca1de3096edc0434ba70c3d274e446604c7692d7a4d92af7b41872166747a30fd452fd0279407a6993fc02c0
TLSH
T15DF00CD28C3E21C2C5EA0F7ED04B2AF884D46507F0887439088DEAD4C17A80F118247E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 732B
SHA256 a5548ca519cf47ecb420c8f1299a8a50517fa463459a704ef2ff17c4db35117a
MD5 b2c40634bbfa57be0d4fad8adfbd6ccb
SHA1 6f8b9ba2f40d9aa42d217ed2bc6dbcdedd1763ad
SHA512 3cfbef4e4a4a7d8fa1530c69ea34fbc3b84627888361a9d201b21e6ead15f5d4e51fea8bc95edd07415b6d2d06a3c19beb1bcea3195e05a6d8af4939b95f77b5
TLSH
T1220110D29C7E26C2C5AA0FBFD08B26EC44C4A516F098747A1CCCF9D4823980E148243E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 972B
SHA256 590065152acec5cf42dffc28eb04749514feaa899eb2ae04edce7d38a148fbda
MD5 30ae49636160992413baf749cf492c9d
SHA1 93edd7244143177356c931699cb8a266bad04660
SHA512 b986d2486431c75ee9ea0acd7d891c2d40042dfe9185910eedc52db52d68de586df47518bb97647f325416a600eb0e7b794c9d5db9242f3417882791a266829e
TLSH
T11E1114D25C7E26C2D5BE0FBF90877AEC44C4D616F194347A1C88ED94417981E154147E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 852B
SHA256 142a7cc7a4933a976aae32a9d04e1758464486092207243f09edbbad51f1d934
MD5 95fe84d83629d03e0bc6e035f44a5cae
SHA1 2af304ef821c70f2d00b47a3e3872c17d33e40e7
SHA512 266ac6fd03731d757bebdacd0d27aa0326e022f9791d7892445f595285b17def95b722da875c974360a7567be530324d0d91a3310008958cbca0f09f04676301
TLSH
T14E0112D25C3D26C2C5BE0FBFD08776E844C4911AF19474BA1C8CE994827980E208243E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 757c40068c8b44526fedddbae76f4ef49d46e6f99e9c5b6ac7daee04f31c52bc
MD5 d3c09492385327b4a73e8682955af55b
SHA1 240fab0985703fee85cf6f4073e03764bdb8aa5c
SHA512 09a4d78749d0d19904aa74f079fa2811f4b5de2b62305c89fc775606945a876578959e3f95cfb06258b2450dae9c4ed8a80ecdef86debcfb139ef6a47615ec6c
TLSH
T15A11F0D25D6D19C2C5BE0FAFE0877AFD40D8D216F194707A1888ED54427991E114147F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 7ae3abeff1a7ac2b396b3e38dc9d2900c37a4fa3623cd6a74cdc34b502978149
MD5 d7023fa4d2528dc28cb0aaefeff697bf
SHA1 a9d914b66ca62916a33ca38b55ff971687cec7f8
SHA512 a12e587ee1c0f13ff6b3da22343b7611d6985799073cd0898decd626042b0e3a69747a3419b461a74ae1dee8d439eef7f39e61fafbf6bc2d3be40d501161b36b
TLSH
T13221FEE26D6E1AC2D1BE0EBFE0873AEC54D8D21AF1D4347A1888ED94923D91E154187F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 21075672ed04fcc0ad86c96036a015a0479bc539f9eb22ed2ee07d5f51ed51d5
MD5 a8b716843d7c8f9dba996daed984824f
SHA1 0c96d6d123c2416eb76b7da62e37d23071beadb7
SHA512 5d339045c75561891f8b131b85aa5713a39f0c762a24cffd19d9577849262e259f66a06264e6b97d4d7a2b39170891003f4bfd55c6f8d31f9da107ab6548e117
TLSH
T1DE21F0E15C3D2AC1D1BE0EBFF0873AEC90D89216F5D4347A2898ED94823D91E158187F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 2b7c607fd6a639934c6f7311f36aa760dd4a600f84b9f8e2d066832856488091
MD5 a36353281ee63c90e6d74b67255fe9ed
SHA1 f8aa66a70fe63c5f2aae1964243c68b3617d9c57
SHA512 9950368809a0ccd2b7cadae6c5ad4af6b981a19210a81b38ebe99aa0a683ffdc822d6bec67c6e4cf1ddbf1d47b71b7aeae4380c6552f5d5b6298fb649949ae69
TLSH
T1D3312FE25C2D1AC1D0BE0EEFE48B29EC84E8D216F19434392898ED94567D91E258087F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 ae32d9950928870c88235c4c17204b62b83ed38c436c2dd65ff80e018454fd14
MD5 1242319dd708adac46dfcb9d40c77068
SHA1 dff7fdf5059dcaa1f995142f3980df184021fc44
SHA512 5d2bd511e97055ebc6b00ef355284a011fa67ec5483ad8ca69504713c30386e967955c27411472de128ed8661c16bd2a8289de30d9be2b75dc6ae33bcf2e2395
TLSH
T14B311FE15C3D1AD1D4BE0EFFA08B29FC84E8D216F594343A2898ED98567991E254087F
MD5 SHA1 SHA512 TLSH

Submit Download

0b1cc7d0-fd44-4b50-adb1-6cde49f7a7a4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\0b1cc7d0-fd44-4b50-adb1-6cde49f7a7a4.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json~RFe598f17.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json~RFe598f17.TMP
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

86af74b4-9254-4591-988e-a76f322b0eb1.tmp

Path C:\Users\Admin\AppData\Local\Temp\86af74b4-9254-4591-988e-a76f322b0eb1.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3700_2065039431\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3700_1396964535\LICENSE
Size 1KB
SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
MD5 ee002cb9e51bb8dfa89640a406a1090a
SHA1 49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2
SHA512 d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c
TLSH
T17D31535723840B9306DA2B4566AEBDC4B0DDC02D7F27AE05186EF394537B52ED8B3443
MD5 SHA1 SHA512 TLSH

Submit Download