87beb55eced881a50501cc71bcd6f8fdd62432dba39cab81f28c2ff77cc5aebe

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 06:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
mixpadpsetup.exe
Size 4.1MB
Sample260730-hatypascrf
SHA256 87beb55eced881a50501cc71bcd6f8fdd62432dba39cab81f28c2ff77cc5aebe
MD5 eefcdfd01856cafadc9b1ea8a55a7a8b
SHA1 1c61d617cb2945a47e83ee5a9181a933c35f5333
SHA512 16716f0133601b90673be68724a35731ee0efd51d4273160ac516fb2ff42bd69dfea689f0628ba3cc62538020804bcde884525858aba8b42da5979543e826027
SSDEEP 98304:2nUq8oAagpM/Kh/dyll4wkntfRtLEURlEqP++lw:UJAcyRdu4wktfRtLEiud+l
TLSH
T1A816337C671D4ADCCD3EF43160A04F377DAB1D5F288686F2A14A9D3D14A0286C2CAF96
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\MixPadInstall = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mixpadpsetup.exe"	nchsetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\MixPadInstall = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MixPad-5628-1\\Installer.exe"	nchsetup.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
9	4632	nchsetup.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1704_1587547758\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1704_1587547758\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1704_1587547758\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1704_1587547758\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1704_1587547758\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1704_1587547758\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1704_1587547758\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1704_1587547758\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1704_1587547758\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1704_1587547758\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1704_1587547758\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1704_1587547758\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1704_1587547758\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1704_1587547758\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1704_1587547758\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1704_1587547758\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1704_1587547758\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1704_1587547758\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1704_1587547758\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1704_1587547758\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1704_1587547758\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1704_1587547758\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1704_1587547758\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1704_1587547758\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1704_1587547758\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1704_1587547758\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1704_1587547758\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1704_1587547758\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1704_1587547758\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1704_1587547758\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1704_1587547758\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1704_1587547758\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1704_1587547758\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1704_1587547758\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1704_1587547758\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1704_1587547758\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1704_1587547758\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1704_1587547758\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1704_1587547758\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1704_1587547758\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1704_1587547758\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1704_1587547758\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1704_1587547758\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1704_1587547758\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1704_1587547758\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1704_1587547758\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1704_1587547758\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1704_1587547758\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1704_1587547758\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1704_1587547758\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1704_1587547758\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1704_1587547758\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1704_1587547758\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1704_1587547758\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1704_1587547758\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1704_1587547758\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1704_1587547758\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1704_1587547758\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1704_1587547758\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1704_1587547758\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1704_1587547758\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1704_1587547758\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1704_1587547758\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1704_1587547758\_locales\vi\messages.json	msedge.exe

Executes dropped EXE 6 IoCs

pid	Process
4632	nchsetup.exe
904	nchsetup.exe
2284	Installer.exe
264	nchsetup.exe
4788	Installer.exe
5308	nchsetup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mixpadpsetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nchsetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mixpadpsetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nchsetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nchsetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nchsetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Installer.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5980	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134298668554954594"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2301830172-776172150-2531349243-1000\{4B8F7442-D4D5-46D1-AEF7-D8525A685576}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 21 IoCs

pid	Process
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4632	nchsetup.exe
1704	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4744 wrote to memory of 4632	4744	mixpadpsetup.exe	89
PID 2360 wrote to memory of 904	2360	mixpadpsetup.exe	92
PID 4632 wrote to memory of 2284	4632	nchsetup.exe	94
PID 2284 wrote to memory of 264	2284	Installer.exe	95
PID 4788 wrote to memory of 5308	4788	Installer.exe	98
PID 264 wrote to memory of 1704	264	nchsetup.exe	99
PID 1704 wrote to memory of 5364	1704	msedge.exe	100
PID 1704 wrote to memory of 5652	1704	msedge.exe	102
PID 1704 wrote to memory of 5980	1704	msedge.exe	103
PID 1704 wrote to memory of 5652	1704	msedge.exe	102
PID 1704 wrote to memory of 5652	1704	msedge.exe	102
PID 1704 wrote to memory of 852	1704	msedge.exe	104
PID 1704 wrote to memory of 852	1704	msedge.exe	104
PID 1704 wrote to memory of 1200	1704	msedge.exe	105
PID 1704 wrote to memory of 4344	1704	msedge.exe	106
PID 1704 wrote to memory of 1200	1704	msedge.exe	105
PID 1704 wrote to memory of 1200	1704	msedge.exe	105
PID 1704 wrote to memory of 4344	1704	msedge.exe	106
PID 1704 wrote to memory of 4344	1704	msedge.exe	106
PID 1704 wrote to memory of 2724	1704	msedge.exe	107
PID 1704 wrote to memory of 2724	1704	msedge.exe	107
PID 1704 wrote to memory of 2724	1704	msedge.exe	107
PID 1704 wrote to memory of 3180	1704	msedge.exe	108
PID 1704 wrote to memory of 3180	1704	msedge.exe	108
PID 1704 wrote to memory of 3180	1704	msedge.exe	108
PID 1704 wrote to memory of 2196	1704	msedge.exe	120
PID 1704 wrote to memory of 2196	1704	msedge.exe	120
PID 1704 wrote to memory of 4960	1704	msedge.exe	111
PID 1704 wrote to memory of 4092	1704	msedge.exe	112
PID 1704 wrote to memory of 4960	1704	msedge.exe	111
PID 1704 wrote to memory of 4092	1704	msedge.exe	112
PID 1704 wrote to memory of 4696	1704	msedge.exe	114
PID 1704 wrote to memory of 4380	1704	msedge.exe	115
PID 1704 wrote to memory of 4380	1704	msedge.exe	115
PID 264 wrote to memory of 2428	264	nchsetup.exe	117
PID 1704 wrote to memory of 4180	1704	msedge.exe	118
PID 1704 wrote to memory of 4180	1704	msedge.exe	118
PID 1704 wrote to memory of 4180	1704	msedge.exe	118
PID 1704 wrote to memory of 2196	1704	msedge.exe	120
PID 1704 wrote to memory of 2196	1704	msedge.exe	120
PID 1704 wrote to memory of 4640	1704	msedge.exe	121
PID 1704 wrote to memory of 1180	1704	msedge.exe	122
PID 1704 wrote to memory of 4640	1704	msedge.exe	121
PID 1704 wrote to memory of 1180	1704	msedge.exe	122
PID 264 wrote to memory of 2664	264	nchsetup.exe	123
PID 1704 wrote to memory of 5860	1704	msedge.exe	124
PID 1704 wrote to memory of 5860	1704	msedge.exe	124
PID 1704 wrote to memory of 5860	1704	msedge.exe	124
PID 264 wrote to memory of 5252	264	nchsetup.exe	125
PID 1704 wrote to memory of 4320	1704	msedge.exe	126
PID 1704 wrote to memory of 4320	1704	msedge.exe	126
PID 1704 wrote to memory of 4320	1704	msedge.exe	126
PID 264 wrote to memory of 4980	264	nchsetup.exe	127
PID 1704 wrote to memory of 4544	1704	msedge.exe	128
PID 1704 wrote to memory of 4544	1704	msedge.exe	128
PID 1704 wrote to memory of 4544	1704	msedge.exe	128
PID 1704 wrote to memory of 1108	1704	msedge.exe	129
PID 1704 wrote to memory of 4528	1704	msedge.exe	130
PID 1704 wrote to memory of 568	1704	msedge.exe	131
PID 264 wrote to memory of 3256	264	nchsetup.exe	132
PID 1704 wrote to memory of 4692	1704	msedge.exe	133
PID 1704 wrote to memory of 4692	1704	msedge.exe	133
PID 1704 wrote to memory of 4692	1704	msedge.exe	133
PID 264 wrote to memory of 2480	264	nchsetup.exe	134

C:\Users\Admin\AppData\Local\Temp\mixpadpsetup.exe
"C:\Users\Admin\AppData\Local\Temp\mixpadpsetup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4744
- C:\Users\Admin\AppData\Local\Temp\n1s\nchsetup.exe
  "C:\Users\Admin\AppData\Local\Temp\n1s\nchsetup.exe" -installer "C:\Users\Admin\AppData\Local\Temp\mixpadpsetup.exe" -instdata "C:\Users\Admin\AppData\Local\Temp\n1s\nchdata.dat"
  2⤵
  - Adds Run key to start application
  - Downloads MZ/PE file
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4632
- - C:\Users\Admin\AppData\Local\Temp\MixPad-5628-1\Installer.exe
    C:\Users\Admin\AppData\Local\Temp\MixPad-5628-1\Installer.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2284
  - - C:\Users\Admin\AppData\Local\Temp\n2s\nchsetup.exe
      "C:\Users\Admin\AppData\Local\Temp\n2s\nchsetup.exe" -installer "C:\Users\Admin\AppData\Local\Temp\MixPad-5628-1\Installer.exe" -instdata "C:\Users\Admin\AppData\Local\Temp\n2s\nchdata.dat"
      4⤵
      Adds Run key to start application
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:264
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.nch.com.au/general/eulaconfirm.html?software=MixPad&appname=MixPad&version=14.20&bootstrap=false&installer=https%3A%2F%2Fwww.nch.com.au%2Fmixpad%2Fmpfreesetup.exe
        5⤵
        Drops file in Windows directory
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:1704
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ffcccbec188,0x7ffcccbec194,0x7ffcccbec1a0
        6⤵
        
        PID:5364
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1976,i,10093811573134473601,18138340240562894409,262144 --field-trial-handle=2520,i,12990233960453156464,16293420307210443953,262144 --variations-seed-version --mojo-platform-channel-handle=2508 /prefetch:2
        6⤵
        
        PID:5652
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2156,i,8519222219552977392,7076398863931828575,524288 --field-trial-handle=2520,i,12990233960453156464,16293420307210443953,262144 --variations-seed-version --mojo-platform-channel-handle=2864 /prefetch:11
        6⤵
        System Time Discovery
        
        PID:5980
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2644,i,12878428838486554773,14694557388248563701,524288 --field-trial-handle=2520,i,12990233960453156464,16293420307210443953,262144 --variations-seed-version --mojo-platform-channel-handle=3248 /prefetch:13
        6⤵
        
        PID:852
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3572,i,17513386665746387991,465733869400883820,2097152 --field-trial-handle=2520,i,12990233960453156464,16293420307210443953,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:1
        6⤵
        
        PID:1200
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3576,i,15230159054920258855,13592602550614045078,2097152 --field-trial-handle=2520,i,12990233960453156464,16293420307210443953,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:1
        6⤵
        
        PID:4344
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,17736825626470932062,4605851981742205179,2097152 --field-trial-handle=2520,i,12990233960453156464,16293420307210443953,262144 --variations-seed-version --mojo-platform-channel-handle=4904 /prefetch:1
        6⤵
        
        PID:2724
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4224,i,10681672358843906881,15003994166271777498,2097152 --field-trial-handle=2520,i,12990233960453156464,16293420307210443953,262144 --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:9
        6⤵
        
        PID:3180
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3724,i,18225115530735128623,2774395846026893358,524288 --field-trial-handle=2520,i,12990233960453156464,16293420307210443953,262144 --variations-seed-version --mojo-platform-channel-handle=3720 /prefetch:14
        6⤵
        
        PID:2196
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3644,i,10261551209143644559,734093963356538616,524288 --field-trial-handle=2520,i,12990233960453156464,16293420307210443953,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:14
        6⤵
        
        PID:4960
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5292,i,232002126453021110,14785389318087874206,524288 --field-trial-handle=2520,i,12990233960453156464,16293420307210443953,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:14
        6⤵
        
        PID:4092
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5920,i,8737641968034263144,7449202653273101106,524288 --field-trial-handle=2520,i,12990233960453156464,16293420307210443953,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:14
        6⤵
        
        PID:4512
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5920,i,8737641968034263144,7449202653273101106,524288 --field-trial-handle=2520,i,12990233960453156464,16293420307210443953,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:14
        6⤵
        
        PID:4696
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6244,i,14206221959182540678,18016110201792294937,524288 --field-trial-handle=2520,i,12990233960453156464,16293420307210443953,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:14
        6⤵
        
        PID:4380
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6436,i,17186909019733252974,10957362365266195508,2097152 --field-trial-handle=2520,i,12990233960453156464,16293420307210443953,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:1
        6⤵
        
        PID:4180
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6852,i,13832099274879474432,16256836333153968147,524288 --field-trial-handle=2520,i,12990233960453156464,16293420307210443953,262144 --variations-seed-version --mojo-platform-channel-handle=6860 /prefetch:14
        6⤵
        
        PID:2196
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6964,i,12748797365998031709,14154732652418880644,524288 --field-trial-handle=2520,i,12990233960453156464,16293420307210443953,262144 --variations-seed-version --mojo-platform-channel-handle=6976 /prefetch:14
        6⤵
        
        PID:4640
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6836,i,18372126734113050567,9216773882623729306,524288 --field-trial-handle=2520,i,12990233960453156464,16293420307210443953,262144 --variations-seed-version --mojo-platform-channel-handle=6944 /prefetch:14
        6⤵
        
        PID:1180
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6928,i,7637792397838470102,1092174265337032390,2097152 --field-trial-handle=2520,i,12990233960453156464,16293420307210443953,262144 --variations-seed-version --mojo-platform-channel-handle=6920 /prefetch:1
        6⤵
        
        PID:5860
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=5960,i,2535930662509361417,16963047417410037414,2097152 --field-trial-handle=2520,i,12990233960453156464,16293420307210443953,262144 --variations-seed-version --mojo-platform-channel-handle=6916 /prefetch:1
        6⤵
        
        PID:4320
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6172,i,9486974937399083952,14751204532888518602,2097152 --field-trial-handle=2520,i,12990233960453156464,16293420307210443953,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:1
        6⤵
        
        PID:4544
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1408,i,15672264386905056625,2786812975300516817,524288 --field-trial-handle=2520,i,12990233960453156464,16293420307210443953,262144 --variations-seed-version --mojo-platform-channel-handle=1276 /prefetch:14
        6⤵
        
        PID:1108
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1284,i,2857778105160214580,12598189508701933569,524288 --field-trial-handle=2520,i,12990233960453156464,16293420307210443953,262144 --variations-seed-version --mojo-platform-channel-handle=1388 /prefetch:14
        6⤵
        
        PID:4528
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1292,i,4416909543091216042,13351421669516577957,524288 --field-trial-handle=2520,i,12990233960453156464,16293420307210443953,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:14
        6⤵
        
        PID:568
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6836,i,6403124885572293577,16572022337386182960,2097152 --field-trial-handle=2520,i,12990233960453156464,16293420307210443953,262144 --variations-seed-version --mojo-platform-channel-handle=1392 /prefetch:1
        6⤵
        
        PID:4692
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7328,i,6784803992565041164,16326561797750626605,2097152 --field-trial-handle=2520,i,12990233960453156464,16293420307210443953,262144 --variations-seed-version --mojo-platform-channel-handle=7340 /prefetch:1
        6⤵
        
        PID:4696
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7400,i,8750512660177552137,3866228290174614933,2097152 --field-trial-handle=2520,i,12990233960453156464,16293420307210443953,262144 --variations-seed-version --mojo-platform-channel-handle=7408 /prefetch:1
        6⤵
        
        PID:2704
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=7552,i,16989519831825433335,15254430436947044209,2097152 --field-trial-handle=2520,i,12990233960453156464,16293420307210443953,262144 --variations-seed-version --mojo-platform-channel-handle=6768 /prefetch:1
        6⤵
        
        PID:2664
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=7688,i,17642379055504251180,10153473912155342978,2097152 --field-trial-handle=2520,i,12990233960453156464,16293420307210443953,262144 --variations-seed-version --mojo-platform-channel-handle=7648 /prefetch:1
        6⤵
        
        PID:2480
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7864,i,10832649754557352103,10138790776065386305,524288 --field-trial-handle=2520,i,12990233960453156464,16293420307210443953,262144 --variations-seed-version --mojo-platform-channel-handle=8016 /prefetch:14
        6⤵
        
        PID:5872
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=8148,i,13267057743513601415,7792828528013715028,2097152 --field-trial-handle=2520,i,12990233960453156464,16293420307210443953,262144 --variations-seed-version --mojo-platform-channel-handle=8152 /prefetch:1
        6⤵
        
        PID:468
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=8156,i,8438972263521443264,15486845715673624620,2097152 --field-trial-handle=2520,i,12990233960453156464,16293420307210443953,262144 --variations-seed-version --mojo-platform-channel-handle=8416 /prefetch:1
        6⤵
        
        PID:1400
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7820,i,4275412360945275199,18146799713834810987,524288 --field-trial-handle=2520,i,12990233960453156464,16293420307210443953,262144 --variations-seed-version --mojo-platform-channel-handle=8616 /prefetch:14
        6⤵
        
        PID:5832
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=8784,i,6419216553781817045,15412509652281472408,2097152 --field-trial-handle=2520,i,12990233960453156464,16293420307210443953,262144 --variations-seed-version --mojo-platform-channel-handle=8804 /prefetch:1
        6⤵
        
        PID:6228
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=8564,i,5390147458523927706,4734984509083452238,2097152 --field-trial-handle=2520,i,12990233960453156464,16293420307210443953,262144 --variations-seed-version --mojo-platform-channel-handle=8748 /prefetch:1
        6⤵
        
        PID:6516
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=8636,i,18210639619891975431,2314148853705547149,2097152 --field-trial-handle=2520,i,12990233960453156464,16293420307210443953,262144 --variations-seed-version --mojo-platform-channel-handle=8908 /prefetch:1
        6⤵
        
        PID:6748
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8988,i,16944400278266210577,3211543462498189619,524288 --field-trial-handle=2520,i,12990233960453156464,16293420307210443953,262144 --variations-seed-version --mojo-platform-channel-handle=8984 /prefetch:14
        6⤵
        
        PID:6868
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=9128,i,4130778598490530661,4097722659723019657,2097152 --field-trial-handle=2520,i,12990233960453156464,16293420307210443953,262144 --variations-seed-version --mojo-platform-channel-handle=9104 /prefetch:1
        6⤵
        
        PID:7072
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=9192,i,2652225262678227287,6264466179529230347,2097152 --field-trial-handle=2520,i,12990233960453156464,16293420307210443953,262144 --variations-seed-version --mojo-platform-channel-handle=9208 /prefetch:1
        6⤵
        
        PID:6336
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.nch.com.au/general/eulaconfirm.html?software=MixPad&appname=MixPad&version=14.20&bootstrap=false&installer=https%3A%2F%2Fwww.nch.com.au%2Fmixpad%2Fmpfreesetup.exe
        5⤵
        
        PID:2428
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.nch.com.au/general/eulaconfirm.html?software=MixPad&appname=MixPad&version=14.20&bootstrap=false&installer=https%3A%2F%2Fwww.nch.com.au%2Fmixpad%2Fmpfreesetup.exe
        5⤵
        
        PID:2664
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.nch.com.au/general/eulaconfirm.html?software=MixPad&appname=MixPad&version=14.20&bootstrap=false&installer=https%3A%2F%2Fwww.nch.com.au%2Fmixpad%2Fmpfreesetup.exe
        5⤵
        
        PID:5252
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.nch.com.au/general/eulaconfirm.html?software=MixPad&appname=MixPad&version=14.20&bootstrap=false&installer=https%3A%2F%2Fwww.nch.com.au%2Fmixpad%2Fmpfreesetup.exe
        5⤵
        
        PID:4980
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.nch.com.au/general/eulaconfirm.html?software=MixPad&appname=MixPad&version=14.20&bootstrap=false&installer=https%3A%2F%2Fwww.nch.com.au%2Fmixpad%2Fmpfreesetup.exe
        5⤵
        
        PID:3256
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.nch.com.au/general/eulaconfirm.html?software=MixPad&appname=MixPad&version=14.20&bootstrap=false&installer=https%3A%2F%2Fwww.nch.com.au%2Fmixpad%2Fmpfreesetup.exe
        5⤵
        
        PID:2480
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.nch.com.au/general/eulaconfirm.html?software=MixPad&appname=MixPad&version=14.20&bootstrap=false&installer=https%3A%2F%2Fwww.nch.com.au%2Fmixpad%2Fmpfreesetup.exe
        5⤵
        
        PID:5516
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.nch.com.au/general/eulaconfirm.html?software=MixPad&appname=MixPad&version=14.20&bootstrap=false&installer=https%3A%2F%2Fwww.nch.com.au%2Fmixpad%2Fmpfreesetup.exe
        5⤵
        
        PID:200
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.nch.com.au/general/eulaconfirm.html?software=MixPad&appname=MixPad&version=14.20&bootstrap=false&installer=https%3A%2F%2Fwww.nch.com.au%2Fmixpad%2Fmpfreesetup.exe
        5⤵
        
        PID:5252
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.nch.com.au/general/eulaconfirm.html?software=MixPad&appname=MixPad&version=14.20&bootstrap=false&installer=https%3A%2F%2Fwww.nch.com.au%2Fmixpad%2Fmpfreesetup.exe
        5⤵
        
        PID:2912
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.nch.com.au/general/eulaconfirm.html?software=MixPad&appname=MixPad&version=14.20&bootstrap=false&installer=https%3A%2F%2Fwww.nch.com.au%2Fmixpad%2Fmpfreesetup.exe
        5⤵
        
        PID:5452
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.nch.com.au/general/eulaconfirm.html?software=MixPad&appname=MixPad&version=14.20&bootstrap=false&installer=https%3A%2F%2Fwww.nch.com.au%2Fmixpad%2Fmpfreesetup.exe
        5⤵
        
        PID:6212
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.nch.com.au/general/eulaconfirm.html?software=MixPad&appname=MixPad&version=14.20&bootstrap=false&installer=https%3A%2F%2Fwww.nch.com.au%2Fmixpad%2Fmpfreesetup.exe
        5⤵
        
        PID:6500
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.nch.com.au/general/eulaconfirm.html?software=MixPad&appname=MixPad&version=14.20&bootstrap=false&installer=https%3A%2F%2Fwww.nch.com.au%2Fmixpad%2Fmpfreesetup.exe
        5⤵
        
        PID:6732
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.nch.com.au/general/eulaconfirm.html?software=MixPad&appname=MixPad&version=14.20&bootstrap=false&installer=https%3A%2F%2Fwww.nch.com.au%2Fmixpad%2Fmpfreesetup.exe
        5⤵
        
        PID:7056
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.nch.com.au/general/eulaconfirm.html?software=MixPad&appname=MixPad&version=14.20&bootstrap=false&installer=https%3A%2F%2Fwww.nch.com.au%2Fmixpad%2Fmpfreesetup.exe
        5⤵
        
        PID:6320

C:\Users\Admin\AppData\Local\Temp\mixpadpsetup.exe
C:\Users\Admin\AppData\Local\Temp\mixpadpsetup.exe
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Users\Admin\AppData\Local\Temp\n2s\nchsetup.exe
  "C:\Users\Admin\AppData\Local\Temp\n2s\nchsetup.exe" -installer "C:\Users\Admin\AppData\Local\Temp\mixpadpsetup.exe" -instdata "C:\Users\Admin\AppData\Local\Temp\n2s\nchdata.dat"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:904

C:\Users\Admin\AppData\Local\Temp\MixPad-5628-1\Installer.exe
C:\Users\Admin\AppData\Local\Temp\MixPad-5628-1\Installer.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4788
- C:\Users\Admin\AppData\Local\Temp\n1s\nchsetup.exe
  "C:\Users\Admin\AppData\Local\Temp\n1s\nchsetup.exe" -installer "C:\Users\Admin\AppData\Local\Temp\MixPad-5628-1\Installer.exe" -instdata "C:\Users\Admin\AppData\Local\Temp\n1s\nchdata.dat"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5308

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:576

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4464

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b53c58762bff2a5723ae446675e8f65fd50818b95383c8f3c7efef01af06e466
MD5 629a18fe1b7a241215c77a30d7d8d7ee
SHA1 5e7bd5b514f4e46a4b986c8b89d0025cf81a1f36
SHA512 04fd58619789dc107f680a57dba3aec42e4bab7c29c0defd7e1b8ca2d078ca4c91317932ff076171bae60d370b28de32c94039c6ab690d5004ddcb857977f38a
TLSH
T182D09BD575146914C5A1303E21D2935392504835601945874051E56D5C5479743FB5AD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c36ac766a384a109222b8b647d2f5c1c2e6c4672a4a2c6b8a01f6eac0a5df074
MD5 f9f896b0e6f281d55b1ca3fa3c1ccdcd
SHA1 db44df3874cd86a961c82d25f3ae2004f249b2df
SHA512 6b8c8d305c2d7e4a3b5efb6e1967d7db1b1ffdb7979edd315013037da369c923060dae4ef8a7219176aa7e0bc1fa4cb98e48470ea2f569243a95d3301f5a40bd
TLSH
T160D09BD575046A14C5A1303A21D1935392604835741945874051E55D5C5479743FB5BD
MD5 SHA1 SHA512 TLSH

Submit Download

f_000080

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000080
Size 129KB
SHA256 46061edd51100b000a05507304a6f850f838876a3c85e30eb0acc077febfd27f
MD5 0e7d2a0af3a3b5a588fdde181fffeb4d
SHA1 a39197f3279d28fef9f9d194d3d4dfc564dcd844
SHA512 74aefd0bfa70374bce802417043e8a58c30da696cf16c7ba1ca234bf963dd608be92ad402c719161d7d4ddc27bb51c8980856ea21c1f890821c89bb359775919
SSDEEP 3072:HMAJJTwWVf5n4fPq5STG3PkoXUn1cwlr15aIWR2q+Ikck8:sA7d5qPqc6//Enrh0IBkRl
TLSH
T1AFD323981ABBC60C4938DDCA94F4E7A1D25D2669F880524DF7A1E0B76E0173B360DE1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000081

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000081
Size 177KB
SHA256 320e64589d0d8b63037efcd8792c847de7b65f6211aedd87cf0bd6758c6377e3
MD5 c47b4088cbdd95da5590fca302d52d6d
SHA1 0fe31a7f9cb79fda9ade8b6de353e08a83afb7c8
SHA512 50b015ba04da84a2665f429490b8eb4da40ab3dbcad53a1bce45ed95f68570af1cb850f1afc3699a1ec52a77c0643485d23a81a2a3b02ef8e4c38bea0c05f6ed
SSDEEP 3072:7987Ys5nY5CW64/l4uMh8K2IyLb6++yGQYekFdsgwc1a3wqDNAb2El:UnY55+Fhj2IyLu+JYe06gBqZA9
TLSH
T1D904120E52648420E5CA4E14759FFFDEBCB9FCA8F1D6994344465AF22EA84330B94DF8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000082

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000082
Size 20KB
SHA256 57e12433622a0f043d950bc766a5bc423008d0468cab6497f3ead4e55df7c1c7
MD5 8bd8220ca4c1c9bf2756086b9cdd2737
SHA1 c4b09065bdb49f26cb911e6c724d49cdaa771b6d
SHA512 16c22bb9f89d11df3db453ab71365fd27de31ffe97b1159b5ba940932773b0c4fd02903d9ed55cb1f05eb88ede1b3561ee555e90a0a592abda4f826ebe5eb691
SSDEEP 384:BoikZS4VhesCQMQABVDUA+6SxKg8Z848u3eI2Vci2jRYxqEafv:dGcsCQMQCVDUA+VxKg8Zv8VGi6GPan
TLSH
T11E92E17988A32D89689D4E44A3FF6B5A5E09C94B1D2F05FE59181CC863D4E8BFC2C45C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

24b6fbd0b47d8255_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\24b6fbd0b47d8255_0
Size 260B
SHA256 1735709818d2b8b61b2e67bbe879ce95956895e55f0e78ba68aff707bdf5bbbd
MD5 ce344a74de2dbcfaf65a82adc61949e1
SHA1 e6687390455840b7e5a74d3c39a7b5d83dad3de3
SHA512 ef3f0133d9522ce9096fac8433d470eed18a5c4206db5424ece91feea596abced55dae17db0695dcf9dbf84a42e2ceac3a117a3c880a0cf4aa9831e5535600e7
TLSH
T10ED0976BC8402660CD9B86F2FB7A3A4A15231018A86FE0C10065023147028B6EBB0142
MD5 SHA1 SHA512 TLSH

Submit Download

2d351e8a190c5317_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\2d351e8a190c5317_0
Size 3KB
SHA256 6e01ad281a3066172708bded2d3daa4e338f9f842ae0e24e58dbadfdd244a276
MD5 02b8d851a2608c464fd98fe08136b1a7
SHA1 72275a25b195d3a4c051ea2122191eab76b86ee8
SHA512 cb939fec6ddb431e8a833de29432c9fd4961b1c8abf201c45f7d29f2fb82d777d8fb0b36cf4ad0ac2aa853ca41a09b116e97ab6a1da36662a3dff098f7ad36e3
TLSH
T13F71E922D384340EC511A1F9AD73CF2A7212B05E9BFBC67B242137725C592E64FA754A
MD5 SHA1 SHA512 TLSH

Submit Download

59f3c72217270b3c_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\59f3c72217270b3c_0
Size 79KB
SHA256 db65f2813a8f5b020f904235244b4ddbafb4b3d7313fbd125fa38a050d44ad76
MD5 08bcdcb1fe125c93271bc38239159a96
SHA1 b2ffebd41898358a47011aea252de66abdde9398
SHA512 f23b144c30482f0f0499e86ac1994288eb4ae623b4b3705c9adbc5390d9ea9ed08713d6aad822df80a96c9be0c5a0b94827b4266a2f314004a2ab54564bf4c7f
SSDEEP 1536:Jo7O71UkfDrXhL9kMW1k5KjRyos7NroNhVsoi+DTXB:JQE1R7rsd1k5KZspUNhpx
TLSH
T1B683F7142751B97ACF2743B6A5B68817B23502CD7EE3920617E0B3353C662F65E8EC4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6411216df07126e7_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6411216df07126e7_0
Size 250B
SHA256 757592f7d5c844f4101331d269a26f92b78b48ead79657da039f5b41e9deaa18
MD5 f257f694aebaa9f05dd9d9196be00d37
SHA1 442fb2c1956852695fe1ce44ac14a0ca4ec4085f
SHA512 2f58bfef23056ebeaad2e9cc64943f29f24382d7e27aa0718e645c9590f1a1df588a65981afcd80e5626a775cacf115fe0f546dedd98f81299bfea5a8c5b52b5
TLSH
T124D095D348346801CDC5C7F142E57E48AB35066456C885D1413115660304D613F88145
MD5 SHA1 SHA512 TLSH

Submit Download

896846343fb215f9_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\896846343fb215f9_0
Size 923B
SHA256 1cd6757c7dad9f9c2f0ec88eab6731c096fc56979bba13ccb30e9daef42a4029
MD5 34cd28253346b45dfb87c540ce435c95
SHA1 3468dac9931c697854d1cbc3ff7908e8a670a59a
SHA512 55033fc7daaca4e16e297778330cfbc400ad9fa4dad4f7944e69d8d40cb01c5fdecb3e5f201af92e154776b23df5eecfc41807ff1914aba657388743052f5fce
TLSH
T12911465B8743B894C61817F2B1E98317E33354CE6F9BC70D8161053E1C161B67D34002
MD5 SHA1 SHA512 TLSH

Submit Download

8deedfd7dc551451_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\8deedfd7dc551451_0
Size 891KB
SHA256 4c1e5cd14c4fe5c695e74b05b4a52ab5ae6a6735a6e370a53fdaa6f089a9de15
MD5 5a4df278d2eea77d89d8d666786c7637
SHA1 9d9d1d9a249ec4bbeddaa24a393686045520c5b4
SHA512 2f26d8a1898f049b19e1dcf223a595ea04efcb9a0c3e48444c5387ee98273a071aeb9d5229e42480ae87b7f51959a6334c175fa2e75c170bc326d218e96c4eac
SSDEEP 12288:RPNwfYIyfqldkTj9KPbMN10svh6q3p1Z8:RPuFyosMh8
TLSH
T19415A504DF807F31CBF647B642E3C47A7139415B2DA291439260BA266C2D2D76EEB85F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aeac8f8262b708e8_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\aeac8f8262b708e8_0
Size 277B
SHA256 b908eb0a0a4288b1c003bd9b324acff52aecdf9bc2dbefe1ad863e0a5319f0a9
MD5 16821f63ad70436518f63e58086417a6
SHA1 1e4442bf4a5123759187c589dae4d1f8d3484d07
SHA512 0d76b6c736a504f7ee7720413abdd6c2162f1dbbbc085f1de1400372f9a182c805e78987e15e8ee1857a41814fc90c54a03b3e301c4caa90e654b4447aa83c8c
TLSH
T100D02B57C1102910D62E86F2AB774309D443FD49614968841D46953521802A69658642
MD5 SHA1 SHA512 TLSH

Submit Download

bd8028aaf0debe86_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\bd8028aaf0debe86_0
Size 11KB
SHA256 fdd0c288281c2b46899a093e8c5d71fe32834a9a76ac95b379ebda609addb39f
MD5 b9fe1456b27e866446079f2041e9fbdd
SHA1 d9cc9f58b60b50dc1b3f5e0c3a8ef6dad916d5ea
SHA512 6095f95524fc920bb8412a41a9a9931b2eec5c4fb143c78c34988305fce20fbfcea2f52420765b5242d3804fc2943a759d0c2ed1e3e5dc2226c9363b3a751ae4
SSDEEP 192:F3uS3bkHT1B4Fe4C3ckHJLd5Uo8Xw7A5hiGi9Gg1RZjn8iQ4eMj7:Tbk5CFCMcJL3STiZD8p8j7
TLSH
T12D324CA0E7226097D0671BFA95A6DA27D330E54D17C3567FE2E12A642C293F342DA904
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c1f4429843212d1a_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\c1f4429843212d1a_0
Size 508KB
SHA256 c3c0bd6c83ae269774dfa0394e840f6cfa29e5d91ec8d957102f9f771f7cd505
MD5 97818d6172a63a3486e442c440d10587
SHA1 36577f02f2cdd24a6d902d484f31a331f054dc84
SHA512 1e9dccf44cad1128aae35dac8a4e9aac34c96c7e470830e78f1e0b24163e91def4f8cbabd00560e5da5375f279b02894ce5cd97358790b5db0c5c23a3ba18f5f
SSDEEP 6144:xS2LlSEAq7PCKRNKFWZ3RAj8BLWx/avtqe6WobU/bqj4RDAe54h3HCRL4:xp/Kk3RAgaSvGWvxDsto4
TLSH
T15EB4D901DB91BF75CFB217F64292C5677236415D2ED3920322A0AF292C2E2DA5E97C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 f22c23d445c0106b908f93a7d8c3f7ef9a3e7b41d9033e4cc62d3a8f866f41bb
MD5 60b4030242720d8ef14f1c3312aec9da
SHA1 825854739cc15c5961fcd6fc26c63a49879e1599
SHA512 c80efa1f76180b407384adfae2ec8a609c7148f0df09520ca2e6f7a43b4d0863ed1191cc81333ec9b97684dc30dfb9a010587aca09156360d85d4e9ff154330e
TLSH
T157618DF3C2D8862DC95156F1B614BF2BDE1D1A14432D3D2688D4AF1B93F2471E14169F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 a6f15683b9439f1181ba7cb47d32c3fe1ae9352f8adc356561c0123d3e73876a
MD5 1872bbf83afb43b08b686b1bcc263451
SHA1 7bfef3ae91ca9a047e1998752fe6564f1a6ae3ce
SHA512 e007f18aa91763efd9ed763be19da40cb025a3627374ea1b98bc46c60944d8e0b7b3626085d7b6f49fc43f669f96b6fc8df879f94f257eb03e31a547dd5ac45c
SSDEEP 192:sxR3R5CI/fesF8hHZDzoA8peY/g6+WNP1dpatZ6ubxoJMFGqIgDRA8ZJJ:sxR3qI/fesF8h5yv/5DpLGz
TLSH
T1D342C75A6A28993B9CC7D219FB55BF53E6F95032A1D05E84EBFC8B0C04E76CD620740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 1c4127728c1ac43a4823ccf41a15fad746df3e82163faabec165c95b5435a61c
MD5 e9eea90d1d7b7f661e508b383f3e2789
SHA1 f4a6cfa989dcd0dc521ea5825fd2e7fea1d1b083
SHA512 ba440b62d1e02a78e7636ebdec92e05f9c61f87f097ebc7aaebc669846a85ee4e3623c61a648c16239dbd8f541637d323cb2e45df4deda9606e3e8652f1bbaf7
SSDEEP 192:sxRIR5CI/fesg8iHZ/zoA8peo/g6+WNPrZfataB1xYJMFGqIgVA8ZJJ:sxRIqI/fesg8i5WD/5VfEGj
TLSH
T10142C7566A28993B8CC7D219FB55BF63E6F95032A1D05E84EBFC8A0C04E76DD530780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 adf52aa8b269de2adc21cb68dbee402686367b3b9d30d36c6f14c18e32e3fa3a
MD5 4c007a8a0c688e7da4ca47dddb88ac1a
SHA1 bd1024627376fb80ee27dd0900b816a25bec6957
SHA512 7d91d4c8c33ad6a56f1725cc952147d1794f489651175f2eede0ac5439d3ff80983372cf605535277737c568377bc735fb13142bc31a59240088c544aabf4672
SSDEEP 192:sxR3R5CI/fesF8iHZBzoA8peo/g6+WNPFqZatpk6yxCJMFGqIgDzA8ZJJ:sxR3qI/fesF8i58n/54ZUjGh
TLSH
T1A742E85A6A28993B9CC7D219FB55BF53E6F95032A1D05E84EBFC8B0C04E76DD520380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 ac413c64788b9956475a66b9c30872ee3a910727012e5c2c28c0a58ff8d7047e
MD5 2f711aee77834f45440360d13f3b12a5
SHA1 c919b1e7551c1c4c92b08ca6b2f082397b9885f2
SHA512 acb747f8e45f60c9db355eaa052e02eb141398b0bb1d3908ca7d338412e1869e400c78b64a30839f7b1259edad86c318a473881cfee40dabdb5d77a5ae41e353
SSDEEP 768:0YEyOi7pLuLfojWgbrfp18F1+UoAYDCx9Tuqh0VfUC9xbog/OVeO/rVaQroRRCwd:0YEyO6EfojWgbrfp1u1jahO/pa7RRxd
TLSH
T1A7D2B97B740CCB7E4F804ADDAC197ADF7DA802CB96D8C98447FA941C03C6BEA51164DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 d787f2c26b4e16b7467646f7674bb734aa26d1d5321f59c0582e89fa9146143d
MD5 4b96a37bc187d3bb656091f4f61cac2d
SHA1 3222df6dcce3fd312141c36c4b72e556f7c4ca81
SHA512 1b54f5d1d22c54f922d9d348d90ad98ec3a324aa9553e2f67af23b0e9872d4394632f81268d949584036477529daa614cbac78163be83956955adc3f37de42d5
SSDEEP 96:KwzeKEguclIhFH//+FPql3l+KfL3D+r9lyvMgKF+WD:I1clIhFH//uPqVllL3Da9lyAvD
TLSH
T163913D91703A538438FE6A0D9594D56ACAC2F1733518E56B3BF900A60F67E029DFECC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3a4b1843-f132-47d4-ab8d-5fb5dad0922d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\3a4b1843-f132-47d4-ab8d-5fb5dad0922d.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 576bcad00f5f4208127b54000673964ce0b9a4e5ce1412214b787aead75f2a72
MD5 3fa8340de50c64130a2ebd6bbed77f6f
SHA1 777e323eacd872424bacf4cc244348c5ed3730f5
SHA512 0d5ed7852aac02cf69ac170e6e599c0d8b84dbbf8fea84171bd9f553c4b2195a360e3f7c0ab97546d16feaa822d40bd9217720ccaecd0f039405106783e8a345
SSDEEP 768:qKa3QGkKL2SjjF669yrqUjWiIwwxMtreb9M+:qKa3qGjF66INWZTMUb++
TLSH
T1EDF2BEB0AC659EB3C9F6D751B2523782AEF050B3C6D84F88E6DD970E09474DC1B0B42A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 34b2d91398ef88157e8f1be8968fdeec3ba7a1f9fd4d09752ceaf91bfa1fce5c
MD5 074e14a92772cdb08ff727154e8d2dda
SHA1 7c36532819991dafb773a1f6d22f9c0c32c7b192
SHA512 751b032ee042729a8387d0be632aab909d653344e156ab7b22014d4343403dc50585808195e3f15e79aef9ae5d719368e8d891618fd21078986c32b73d2955e8
SSDEEP 768:qKw3AykKL2SjjF669yrqUjWiIwwxMtreb9M+:qKw3+GjF66INWZTMUb++
TLSH
T159F2BEB0BC659A73C9F6D751B2523782AEF050B3C6D84E88E6DDA70E09474DD1B0B42A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 ecc02b797f18caf092ee362110e9ee94e7dff27baa5d48e7c284c4adb0bf61b4
MD5 ba64a0b9b7b9748b416361fe3844bf45
SHA1 dd1c1e8dbad7c1379518f09b1f10f9c9b04c8f33
SHA512 7315c8c0b52d77fc48c8dd4cbd81e858a6f4675549fe1556ad7a4402c90810e851facea4b533d07965405f5e1fd17e127fb7a31c1afba62895e5197e9181cf42
SSDEEP 768:qKt3SqkKL2SjjF669yrqUjWiIwwxMtreb9M+:qKt3AGjF66INWZTMUb++
TLSH
T11EF2BFB0AC659E73C9F6D751B25237C2AEF050B3C6D84E88E6DDA70E09474DD1B0B42A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 ae543b0e79ac4d54d6414e62e8525fb70eb8683bb6fac1c9429686e087dec704
MD5 83580ebe468ea50725cb48619589cb8e
SHA1 66bb9903e35eeabf01d3554adea65a1d1ee0af99
SHA512 6de5508ceb7e7b05179171c793f49b76bc255fc952a49728f4319c1ec77cba80081a3e147b1602f9895954a0239dc1a2fc0e9a6e446ec43cde67913d04f07788
SSDEEP 768:qKJ3L2mkKL2SjjF669yrqUjWiIwwxMtreb9M+:qKJ3LgGjF66INWZTMUb++
TLSH
T1B5F2BFB0AC659E73C9F6D751B25237C2AEF050B3C6D84E88E6DDA70E09474DD1B0B42A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 75cb68c030e9b3e33ceb0cd4c6fe20c48061de44a7eccec823f2ca0ea6295eae
MD5 112a6f5a28917084db156a350efa5545
SHA1 3c09e7c55935ad614f75dd6412a94401c11e8f61
SHA512 0469f0b58097e85161fb634302487c76d86d49e5bf26b1cd667ce87fc5d4e8a3bc1cbe1869497b92cdf61267de23d20a65feb974009d9bf353fc7602aba26460
SSDEEP 768:qKw3cykKL2SjjF669yrqUjWiIwwxMtreb9M+:qKw3qGjF66INWZTMUb++
TLSH
T10FF2BFB0AC659E73C9F6D751B2523782AEF050B3C6D84E88E6DDA70E09474DC1B0B42A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 09fa0a3dbb16044c55d8ecd3c023752f7ad4d3ec9e4e3c6c0a324dbf25b013c3
MD5 f96f44736ea001533ff8b092ce709d51
SHA1 06d0434c65d7ef3d3885ba7f95631e5de64352c5
SHA512 0520f429ddb0e2eecebfc83320e964befd878f15dfb3a25ef7d90e67e1be993855a58bc93cd8f161cf14a2765604b14b2f5b8fd0fdfa969122654b6871050e3d
SSDEEP 768:fN3CWkKL2SjjF669yrqUjWiIwwxMtreb9M+:fN30GjF66INWZTMUb++
TLSH
T18CF2BFB0AC659A73C9F6D751B25237C2AEF050B3C6D84E88E5DDA70E09474DD1B0742A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 38ae20e3b70274723bf19009c43a7a6be19f81e33724291399d18dffa3c20ae9
MD5 fc28c23ec1a07a2ec773954995bc0439
SHA1 dccb73f25d09a8586fb36059bb24877cb5ff9483
SHA512 2c01c8276f853b56e631f9497bc715aa62bc7e9bdb84b3eff4fc7808126614313c2bc613ff62b37d4c07117f615c2f83855d978e01fadde751e4a6f8396b0db4
SSDEEP 768:SqFQK3UwgAT4sfF669yrqUjWiIwwxMtreb9M+:SRK3vfF66INWZTMUb++
TLSH
T136039D75ECA4CA7BD9F6CB81B3527686DEE050B3C6D88DD8E6C99E0D04870DD070B829
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 35e10b395c00b748487dc5d08b0d6e7a1d618dce103c6b85f3a62a5e0c690c8f
MD5 fb8f7b55499e21c5a9cd91ac3b0473fd
SHA1 20dbd927706ddfc0fe47103a2f563bb7f9fe5f72
SHA512 6125f94ebcaa46ff17838e8fb4d21ad312ffb4eabb19e4adb4377ce2f70529109e37866ca94b7dfae9b66203c6d3dda2bad77290c8ca5f9c79e81d4368d119fd
SSDEEP 768:fz3tmkKL2SjjF669yrqUjWiIwwxMtreb9M+:fz3LGjF66INWZTMUb++
TLSH
T19DF2BFB0AC659A73C9F6D751B25237C2AEF050B3C6D84E88E5DD970E09474DC1B0B42A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 cffc8ba179e1a4193f2d5d4bfc1a1a5a0b8b6e6cce4d2e52899549afc2715f78
MD5 23f59e65a6c377539c8872ae629377a7
SHA1 c4d72831cf7d05abe5ec541007c370c9a4dc7f48
SHA512 e7e58b555d1cff225fc2712c0c0ba0228b0d026359e9e8dc1d1bd67befe5c066892041d4e5f288faf7e55a2cb129a7016b084d436d6069de55d5c1b50c76be09
SSDEEP 768:prv+4UNbdm3oikKL2SAjF669yrqUjWiIwwxMtreVf:pbsb83m7jF66INWZTMUVf
TLSH
T1AE03BF70B8689AB38DF6D781B21377C3BFB410A38AC50F98D9D96B0D454B4DD270B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 114a0d9ab96692238fcbe6d393d70803c2ce19176c894d0845d6de6f73610fdb
MD5 739099c94fcdcce0e8e24189821aeb49
SHA1 818e021a931f213906b06277d65e691f2d14ac25
SHA512 80c01a35d05d8dabbb4daa5fd046b08b11e12cd3faafabff0b4d7e86ebb6f51602f0553cd1b911e68c0f7adf588deab3d7169957d1f3358b10a0d930006230aa
SSDEEP 768:arv+4UNbdl3ePkKL2rpjF669yrqUjWiIwwxMRSUiler:absbX3VTpjF66INWZTMYUsQ
TLSH
T1E203CF34AC589AB7CDF2D28672433783BFB4509396C50B88CACC270D469B0DD2747A2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 f40f5842e292b99bd97d61ffc407cab04c973e114a17d9ff7c3ccc127fd0cfd7
MD5 f5298d3c0701ed92249515baa93a135b
SHA1 ee1b0f4672ef519d56a3778b6da2bce53516e0f8
SHA512 4454d38967eb6a174bb0099c94b15f994e7bb36ca3e9d49ee67a3d79c76a9a42e5f442a0c48a74f28db0000bd5db560d3d5fe5c2e3f5f77e1ba157987ce3c2c4
SSDEEP 768:fR3IqnkKL2SjjF669yrqUjWiIwwxMtreb9M+:fR3uGjF66INWZTMUb++
TLSH
T140F2BFB0AC659A73C9F6D751B25237C6AEF050B3C6D84F88E5DDA70E09474DC1B0742A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4d5c9d45-5f0f-4ed7-9ad5-8621888defdd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\4d5c9d45-5f0f-4ed7-9ad5-8621888defdd.tmp
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a9943c8e-3ed4-4099-a413-29b683c8ad7d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\a9943c8e-3ed4-4099-a413-29b683c8ad7d.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json~RFe59b377.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json~RFe59b377.TMP
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

02b7ee57-7fe5-458c-a8cc-fc176a811d4c.tmp

Path C:\Users\Admin\AppData\Local\Temp\02b7ee57-7fe5-458c-a8cc-fc176a811d4c.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

Installer.exe

Path C:\Users\Admin\AppData\Local\Temp\MixPad-5628-1\Installer.exe
Size 4.1MB
SHA256 d57fbffc85025664bd4d554d3f96c6985aeb19464af3b9c912d11e0745a2dcee
MD5 4fe43cc347664e895131ec743bbf5c01
SHA1 543b125866879f4949230ddf07a5794cdefd3934
SHA512 40e6db60ec9a32087f11623fd2fe6b62a55a713a50f35f393d0940b515a8120d136cec4f77ec82233f2cc00baa911d3210d3ebc48c3e76d1e5ef3e5cccc77488
SSDEEP 98304:ZI+IJUqRe2A7fRtBWnS/YEgZg9XvD3qa2vW612HJzLvjuK7I9EOM5iRYD:ZI+GVA7B9Yfa2ucCJzjarHM5iiD
TLSH
T12B163330C388F6B8DF6A1AF5A3F39925C7269314EE496B975310E1BB1D81DB38570A07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nchdata.cab

Path C:\Users\Admin\AppData\Local\Temp\n1s\nchdata.cab
Size 95KB
SHA256 7a2425ee85a01604f9e1f1d903fb050eacc2086e0a549084380bf3ac13b84aee
MD5 f741e89e6cc89da4d39013eb36741d2b
SHA1 f6475dea544881fa69e086b9960ccd7cd27d40fd
SHA512 826b3ab2809d143198727521e632f28ebd5530e4322fa1287297e8324d090fe239f1548e3c5b13b9f900b08d25ddcbc9832f6bcf042004dc587848054c38b130
SSDEEP 1536:FvaHS6uMytrRnGwyybDtAHXNcg9gXPPbbzUIAJaFxhAOnRV1A3Q0gnq+vPDiTpGz:FyyVNtrRnGJybKH9l93PaFxCawQ07+vD
TLSH
T149A3121D9DAEF307A72EE782B6B07A5DD5FE045340B87BD78F40221E6C611C6A086C63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nchsetup.cab

Path C:\Users\Admin\AppData\Local\Temp\n1s\nchsetup.cab
Size 4.0MB
SHA256 256cc1cc3c0f2a8508ff61a0d571e245b88a8a278fe93b627aac98b156aefb7f
MD5 c721593f23bb66a326c93ef4b58b2892
SHA1 1a9aea149173c57db643dba8cfa52734dd67fc4a
SHA512 5e9b13c3f4c95debd9a894d59457e8d3bf839bce290e286f1c21863e9debbda14386d297628e53b635a30f1729ab54effe5629315d696c4048d2361f689b6b11
SSDEEP 98304:G+IJUqRe2A7fRtBWnS/YEgZg9XvD3qa2vW612HJzLvjuK7I9EOM5iRYD:G+GVA7B9Yfa2ucCJzjarHM5iiD
TLSH
T1EC163330C388FAB85F5926FA93B39975C3168328EE496B975360E1FB1985CB34670D07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nchsetup.exe

Path C:\Users\Admin\AppData\Local\Temp\n1s\nchsetup.exe
Size 10.5MB
SHA256 a8406207e485f99843f0f60d36398117f6b6b9e6026d33a6d731aa7645d1d87b
MD5 9c9f0e7812073f2d7e11f80905a192b6
SHA1 14fa41b88d12735208ebf20bcbc1f02641aeac51
SHA512 76c02df73b2610a7a96d3baa4846f4893907404c8348f41fd8b2a025b609734541fded0b9b1bf1895779b18142d0584abc1551df6982006b5f1dfd9c5855e002
SSDEEP 98304:WfxDx32l/GdGKYJMJnptBW1kBocmYoltLTP7mjHlmR0FiEvEfKlNrv3B:yxDx32SliYUSBocOTPTcHkSBEfEN7B
TLSH
T128B68D47E78EC571D44D13B08CAB63AAA336FD1057F543C39BA93D6AAC703E12935286
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nchdata.cab

Path C:\Users\Admin\AppData\Local\Temp\n2s\nchdata.cab
Size 95KB
SHA256 f11d1c57945caf8b05cf6f7e74f5735da7a0398b2767e7d1831109e0bc221747
MD5 fbf6925904633bb02b5b540f6c725c6e
SHA1 27d6eb4986731707de6f992d2b424f491d55baf2
SHA512 8889bd105acd1903c2519736704240e1fc5e31bd5dcaabbd1996d03823ba64f3f66185eb754f5d5d11ba0b5820f77ccca5fdf2f101def5a106fcc20941fa0737
SSDEEP 1536:rPZFxc7srrsNPHdfL3HJCT7rZMSj6xxKRXT8agNT0nntuGs6r8o/Sn3cbL9KL2Ds:rPVnrsNHdfL3EHrZMm6zKiagpAtHFIo8
TLSH
T11CA3129DFC045FF66BDDDC34A1557C0626C9ECA40DA2E4C1E2F4B58ACF413936B821AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nchsetup.cab

Path C:\Users\Admin\AppData\Local\Temp\n2s\nchsetup.cab
Size 3.9MB
SHA256 82e0747886699d7135bc2520e5c775c3bbaa7bf206ad8bab8f0e287b7bd7745d
MD5 9762e443beb39c0f47e87f26b34fde42
SHA1 7c9b93debccec54d8ca3425d9e04a4043b3f9e4f
SHA512 731c5905e5b24958439e49666dbb34ac839b659f3051e8c7780584200ab4fd8c74c28345cebb576559d99aeb2a5b5c8b32d05d8536f486a1d3fb7ade0844b3f5
SSDEEP 98304:Hq8oAagpM/Kh/dyll4wkntfRtLEURlEqP++lwa:4AcyRdu4wktfRtLEiud+lt
TLSH
T1D716337C672D8ADCCD3EF07261A04F377DAB0D6F388A46F5610A9D3914A4197C2CAE85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nchsetup.exe

Path C:\Users\Admin\AppData\Local\Temp\n2s\nchsetup.exe
Size 10.8MB
SHA256 22b257d233568a84f9395d7ecaf552198d00ccd05dc629c9cf1219997b2fcd2a
MD5 bf06ca071eba5db6125abef14c426c32
SHA1 0a4e0821cb9accf3640ad2639901f862a9c51955
SHA512 6ae549fcf93370abfdddf5e357cf5baf6e6a4e60b10a563e92aaf236da2dfb49811f73e81bd9cc87328b79da94208057c750c829da150977c6878376774134a6
SSDEEP 196608:rYdFtGng4gBFOnqAPDd8bIixcY49BEfmNJ0M:rOt0gBF74B8kK6/r
TLSH
T1D1B68D02F7818671E9AD17B088FBB3696739BC119BF68ACB56943D2E6C713C11C34762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1704_1214975048\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads