992dd363de760008b267cd0779affc8c9a9bdfd95f74f78f89a86ee938dff7f6

Resubmissions

31/07/2026, 18:05

260731-wpn8msee397

30/07/2026, 19:02

260730-xp6claeb457

Analysis

user interaction
yes
max time kernel
513s
max time network
511s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
30/07/2026, 19:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Usuário suspenso por inatividade.eml
Size 21KB
Sample260730-xp6claeb45
SHA256 992dd363de760008b267cd0779affc8c9a9bdfd95f74f78f89a86ee938dff7f6
MD5 c04f9d9a5ff67dbd34f27c3bdca238e4
SHA1 0502f43cd295efa8e38981d18a1b1b81861c11ab
SHA512 43d46069e7f878e7e35cd868918e44f85422198db4c9134bef671c6f2ff83cde61930ff8803ad617fe6912af1be0bb05513b9b20a015e2b1308c39566848f55b
SSDEEP 384:6plkjacrJUj7zVHJ7VjJK7xLYfuDYsKKYewIIPEYaVCBKn5D:6pm4nJJ5JK7xLYfuUsKKYevpYaVCC
TLSH
T1A5A28C26B9192D0522FED2D5B711343AC75629E7811CE0E8791D038B0FF5E9F6BA20E7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2680	msedge.exe

Drops file in Windows directory 38 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2680_1795957752\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2680_1795957752\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2680_1142743663\autofill_bypass_cache_forms.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2680_1142743663\edge_autofill_global_block_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2680_1165917472\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2680_1000590255\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2680_1158099164\crl-set	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2680_1000590255\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2680_1000590255\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2680_533464483\travel-facilitated-booking-bing.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2680_975115046\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2680_2027368904\deny_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2680_2027368904\deny_etld1_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2680_1414109926\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2680_533464483\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2680_975115046\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2680_789186782\domain_actions.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2680_533464483\automation.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2680_533464483\classification.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2680_533464483\extraction.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2680_533464483\travel-facilitated-booking-kayak.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2680_2027368904\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2680_1158099164\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2680_1165917472\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2680_1795957752\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2680_325006142\arbitration_metadata.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2680_1142743663\regex_patterns.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2680_1142743663\v1FieldTypes.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2680_1795957752\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2680_975115046\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2680_1809540205\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2680_975115046\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2680_2027368904\deny_full_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2680_325006142\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2680_1142743663\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2680_789186782\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2680_1414109926\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2680_1000590255\smart_switch_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3104	msedge.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	OUTLOOK.EXE

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\OUTLOOK.EXE = "10001"	OUTLOOK.EXE

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134299118556468625"	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2058276091-3280583803-376660292-1000\{0C9FCF31-2463-40B0-A8F1-1D3CA3C189F8}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
5112	OUTLOOK.EXE
5112	OUTLOOK.EXE

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5112	OUTLOOK.EXE
5112	OUTLOOK.EXE
4740	msedge.exe
4740	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe

Suspicious use of FindShellTrayWindow 12 IoCs

pid	Process
5112	OUTLOOK.EXE
5112	OUTLOOK.EXE
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe

Suspicious use of SendNotifyMessage 9 IoCs

pid	Process
5112	OUTLOOK.EXE
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe

Suspicious use of SetWindowsHookEx 30 IoCs

pid	Process
5112	OUTLOOK.EXE
5112	OUTLOOK.EXE
5112	OUTLOOK.EXE
5112	OUTLOOK.EXE
5112	OUTLOOK.EXE
5112	OUTLOOK.EXE
5112	OUTLOOK.EXE
5112	OUTLOOK.EXE
5112	OUTLOOK.EXE
5112	OUTLOOK.EXE
5112	OUTLOOK.EXE
5112	OUTLOOK.EXE
5112	OUTLOOK.EXE
5112	OUTLOOK.EXE
5112	OUTLOOK.EXE
5112	OUTLOOK.EXE
5112	OUTLOOK.EXE
5112	OUTLOOK.EXE
5112	OUTLOOK.EXE
5112	OUTLOOK.EXE
5112	OUTLOOK.EXE
5112	OUTLOOK.EXE
5112	OUTLOOK.EXE
5112	OUTLOOK.EXE
5112	OUTLOOK.EXE
5112	OUTLOOK.EXE
5112	OUTLOOK.EXE
5112	OUTLOOK.EXE
5112	OUTLOOK.EXE
5112	OUTLOOK.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5112 wrote to memory of 2680	5112	OUTLOOK.EXE	88
PID 2680 wrote to memory of 1272	2680	msedge.exe	89
PID 2680 wrote to memory of 3104	2680	msedge.exe	90
PID 2680 wrote to memory of 4136	2680	msedge.exe	91
PID 2680 wrote to memory of 4136	2680	msedge.exe	91
PID 2680 wrote to memory of 4136	2680	msedge.exe	91
PID 2680 wrote to memory of 1612	2680	msedge.exe	92
PID 2680 wrote to memory of 1612	2680	msedge.exe	92
PID 2680 wrote to memory of 2036	2680	msedge.exe	94
PID 2680 wrote to memory of 4216	2680	msedge.exe	95
PID 2680 wrote to memory of 2036	2680	msedge.exe	94
PID 2680 wrote to memory of 2036	2680	msedge.exe	94
PID 2680 wrote to memory of 4216	2680	msedge.exe	95
PID 2680 wrote to memory of 4216	2680	msedge.exe	95
PID 2680 wrote to memory of 4040	2680	msedge.exe	96
PID 2680 wrote to memory of 4040	2680	msedge.exe	96
PID 2680 wrote to memory of 4040	2680	msedge.exe	96
PID 2680 wrote to memory of 2592	2680	msedge.exe	97
PID 2680 wrote to memory of 2592	2680	msedge.exe	97
PID 2680 wrote to memory of 2592	2680	msedge.exe	97
PID 2680 wrote to memory of 552	2680	msedge.exe	99
PID 2680 wrote to memory of 552	2680	msedge.exe	99
PID 2680 wrote to memory of 4240	2680	msedge.exe	100
PID 2680 wrote to memory of 4240	2680	msedge.exe	100
PID 2680 wrote to memory of 2116	2680	msedge.exe	102
PID 2680 wrote to memory of 3504	2680	msedge.exe	103
PID 2680 wrote to memory of 2116	2680	msedge.exe	102
PID 2680 wrote to memory of 3504	2680	msedge.exe	103
PID 2680 wrote to memory of 3284	2680	msedge.exe	105
PID 2680 wrote to memory of 3564	2680	msedge.exe	106
PID 2680 wrote to memory of 3564	2680	msedge.exe	106
PID 2680 wrote to memory of 3260	2680	msedge.exe	107
PID 2680 wrote to memory of 3260	2680	msedge.exe	107
PID 2680 wrote to memory of 1228	2680	msedge.exe	108
PID 2680 wrote to memory of 1228	2680	msedge.exe	108
PID 2680 wrote to memory of 1904	2680	msedge.exe	109
PID 2680 wrote to memory of 1904	2680	msedge.exe	109
PID 2680 wrote to memory of 3780	2680	msedge.exe	110
PID 2680 wrote to memory of 3780	2680	msedge.exe	110
PID 2680 wrote to memory of 1604	2680	msedge.exe	117
PID 2680 wrote to memory of 464	2680	msedge.exe	118
PID 2680 wrote to memory of 4832	2680	msedge.exe	119
PID 2680 wrote to memory of 3976	2680	msedge.exe	120
PID 2680 wrote to memory of 3976	2680	msedge.exe	120
PID 2680 wrote to memory of 3000	2680	msedge.exe	123
PID 2680 wrote to memory of 3000	2680	msedge.exe	123
PID 2680 wrote to memory of 3992	2680	msedge.exe	124
PID 2680 wrote to memory of 3992	2680	msedge.exe	124
PID 2680 wrote to memory of 4600	2680	msedge.exe	125
PID 2680 wrote to memory of 4600	2680	msedge.exe	125
PID 2680 wrote to memory of 5008	2680	msedge.exe	126
PID 2680 wrote to memory of 5008	2680	msedge.exe	126
PID 2680 wrote to memory of 4740	2680	msedge.exe	127
PID 2680 wrote to memory of 952	2680	msedge.exe	128
PID 2680 wrote to memory of 952	2680	msedge.exe	128
PID 2680 wrote to memory of 1756	2680	msedge.exe	129
PID 2680 wrote to memory of 1756	2680	msedge.exe	129
PID 2680 wrote to memory of 3224	2680	msedge.exe	131
PID 2680 wrote to memory of 2856	2680	msedge.exe	130
PID 2680 wrote to memory of 3224	2680	msedge.exe	131
PID 2680 wrote to memory of 2856	2680	msedge.exe	130
PID 2680 wrote to memory of 3392	2680	msedge.exe	132
PID 2680 wrote to memory of 3392	2680	msedge.exe	132
PID 2680 wrote to memory of 3304	2680	msedge.exe	133

C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE
"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\Admin\AppData\Local\Temp\Usuário suspenso por inatividade.eml"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://neopoc.simplesmenteuse.com.br/SuseToolsWeb/login.zul?chave=akYwSStQeHM5RUY4TDMrVGh3aTcxRlh2bE5Ua21lTTNNNGYzeU1RM1FXS0xhb2xrS1BvbXhoOWYzTHhPUmFOR2lYY0RETi9CRjB5dFY2dG10RCtiV2c9PQ==
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2e8,0x2fc,0x7ff90072c188,0x7ff90072c194,0x7ff90072c1a0
    3⤵
    PID:1272
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1908,i,4974998895350237103,17142600582481389176,524288 --field-trial-handle=2340,i,4422405889430172820,860642983289509096,262144 --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:3
    3⤵
    - System Time Discovery
    PID:3104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1680,i,11495367765851320374,14916584797859675051,262144 --field-trial-handle=2340,i,4422405889430172820,860642983289509096,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:2
    3⤵
    PID:4136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2588,i,11871535280447225245,15756279344559066494,524288 --field-trial-handle=2340,i,4422405889430172820,860642983289509096,262144 --variations-seed-version --mojo-platform-channel-handle=2472 /prefetch:8
    3⤵
    PID:1612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3508,i,1417035674591503926,11763783283736607995,2097152 --field-trial-handle=2340,i,4422405889430172820,860642983289509096,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
    3⤵
    PID:2036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3512,i,4657765182225222091,184556663606991945,2097152 --field-trial-handle=2340,i,4422405889430172820,860642983289509096,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
    3⤵
    PID:4216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4292,i,9473013985289856440,14366381244069693334,2097152 --field-trial-handle=2340,i,4422405889430172820,860642983289509096,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:1
    3⤵
    PID:4040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4308,i,818848956087241064,5367569237632121284,2097152 --field-trial-handle=2340,i,4422405889430172820,860642983289509096,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:2
    3⤵
    PID:2592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4304,i,10262206998095146587,12577434024291545270,524288 --field-trial-handle=2340,i,4422405889430172820,860642983289509096,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:8
    3⤵
    PID:552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5300,i,3769484407862881029,5955119046710107098,524288 --field-trial-handle=2340,i,4422405889430172820,860642983289509096,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:8
    3⤵
    PID:4240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5256,i,17926469872087734345,15717774976095025911,524288 --field-trial-handle=2340,i,4422405889430172820,860642983289509096,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:8
    3⤵
    PID:2116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5316,i,14817263510312712231,13942780945710162124,524288 --field-trial-handle=2340,i,4422405889430172820,860642983289509096,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:8
    3⤵
    PID:3504
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5744,i,6534111660442583283,9686968577971519591,524288 --field-trial-handle=2340,i,4422405889430172820,860642983289509096,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:8
    3⤵
    PID:3620
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5744,i,6534111660442583283,9686968577971519591,524288 --field-trial-handle=2340,i,4422405889430172820,860642983289509096,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:8
    3⤵
    PID:3284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5956,i,105981514270498861,4702490726459040655,524288 --field-trial-handle=2340,i,4422405889430172820,860642983289509096,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:8
    3⤵
    PID:3564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6152,i,7855917617314327644,7101340433391099195,524288 --field-trial-handle=2340,i,4422405889430172820,860642983289509096,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:8
    3⤵
    PID:3260
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6156,i,13036134829597624199,14832115387721747513,524288 --field-trial-handle=2340,i,4422405889430172820,860642983289509096,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:8
    3⤵
    PID:1228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,5677381278443774762,14509387537691217223,524288 --field-trial-handle=2340,i,4422405889430172820,860642983289509096,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:8
    3⤵
    PID:1904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6240,i,15677668916317537681,13739371332286288116,524288 --field-trial-handle=2340,i,4422405889430172820,860642983289509096,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:8
    3⤵
    PID:3780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4356,i,13242209573632613920,2801889051181692560,524288 --field-trial-handle=2340,i,4422405889430172820,860642983289509096,262144 --variations-seed-version --mojo-platform-channel-handle=4424 /prefetch:8
    3⤵
    PID:1604
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4344,i,15594222036806881176,6829435656077882686,524288 --field-trial-handle=2340,i,4422405889430172820,860642983289509096,262144 --variations-seed-version --mojo-platform-channel-handle=4696 /prefetch:8
    3⤵
    PID:464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4712,i,10516160598459960267,18191238858236039426,524288 --field-trial-handle=2340,i,4422405889430172820,860642983289509096,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:8
    3⤵
    PID:4832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2036,i,16298945330911694309,16708340762156926904,524288 --field-trial-handle=2340,i,4422405889430172820,860642983289509096,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:8
    3⤵
    PID:3976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,13284906014916008040,14302248319169475730,524288 --field-trial-handle=2340,i,4422405889430172820,860642983289509096,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:8
    3⤵
    PID:3000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,8011420617178442343,6119962050526744275,524288 --field-trial-handle=2340,i,4422405889430172820,860642983289509096,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:8
    3⤵
    PID:3992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4348,i,18194877659161201955,15209905738109262527,524288 --field-trial-handle=2340,i,4422405889430172820,860642983289509096,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:8
    3⤵
    PID:4600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5532,i,14550533667182023704,13900001362747993904,524288 --field-trial-handle=2340,i,4422405889430172820,860642983289509096,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:8
    3⤵
    PID:5008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5540,i,9128506946601148703,6442301511662405919,262144 --field-trial-handle=2340,i,4422405889430172820,860642983289509096,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6456,i,18278134279583096675,8409970040164213021,524288 --field-trial-handle=2340,i,4422405889430172820,860642983289509096,262144 --variations-seed-version --mojo-platform-channel-handle=4020 /prefetch:8
    3⤵
    PID:952
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3444,i,2102226787713642867,3243838049301661069,524288 --field-trial-handle=2340,i,4422405889430172820,860642983289509096,262144 --variations-seed-version --mojo-platform-channel-handle=6456 /prefetch:8
    3⤵
    PID:1756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3572,i,15271298842874172689,5624562825779560852,524288 --field-trial-handle=2340,i,4422405889430172820,860642983289509096,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:8
    3⤵
    PID:2856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5444,i,17358285527722225239,9473824880562775843,524288 --field-trial-handle=2340,i,4422405889430172820,860642983289509096,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:8
    3⤵
    PID:3224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5540,i,8662673288338668974,10370680493411965053,524288 --field-trial-handle=2340,i,4422405889430172820,860642983289509096,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:8
    3⤵
    PID:3392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6212,i,6173109278133717317,5992581270153532781,524288 --field-trial-handle=2340,i,4422405889430172820,860642983289509096,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:8
    3⤵
    PID:3304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5552,i,8099779120267405624,12945863636500149028,524288 --field-trial-handle=2340,i,4422405889430172820,860642983289509096,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:8
    3⤵
    PID:3496
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,439059459434494431,640148566495551079,524288 --field-trial-handle=2340,i,4422405889430172820,860642983289509096,262144 --variations-seed-version --mojo-platform-channel-handle=3212 /prefetch:8
    3⤵
    PID:1732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4656,i,14487775468486728952,7891551061055139042,524288 --field-trial-handle=2340,i,4422405889430172820,860642983289509096,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:8
    3⤵
    PID:3632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4696,i,5276854119293217695,4453302167899304877,524288 --field-trial-handle=2340,i,4422405889430172820,860642983289509096,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:8
    3⤵
    PID:4280
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6204,i,6856414449921754814,16580546266586903850,524288 --field-trial-handle=2340,i,4422405889430172820,860642983289509096,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:8
    3⤵
    PID:4472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6008,i,17997310749196063958,12476867645299455847,524288 --field-trial-handle=2340,i,4422405889430172820,860642983289509096,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:8
    3⤵
    PID:3408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6036,i,8457759993261199012,12204179738159618288,524288 --field-trial-handle=2340,i,4422405889430172820,860642983289509096,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:8
    3⤵
    PID:2344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4360,i,5334268123437708985,3113386553865378870,524288 --field-trial-handle=2340,i,4422405889430172820,860642983289509096,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:8
    3⤵
    PID:4284

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4244

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f581ea565cf0ece39a0cfdc05cae1573d34e8544d3d072c3f0598034de5e42f8
MD5 c80cb3ee13f62b490ae95d8bb68bb8fa
SHA1 a3baa3d078eae3e3de53faaf8b92df67f056d9e2
SHA512 f385ff91fe9914b069144548f6f36759de4228b81878118a49bc5d05a8f3055bf5724ef0be68d53b91691f095dc1736b8d3458eace80a0e31689f3d0c8f3f5eb
TLSH
T168D09B34F75AE445D1074531582C4711D9199DD014A6870B5160D41CABA401C73BF457
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 7KB
SHA256 0f3d565f772ac593ec4b52450e41378c941bb4dd7d4d0db1f3e9f2786027b7fb
MD5 01ae39c2da94326b4345dbd8ebbeb550
SHA1 9c63b6eee472c865e5482849842d6bdb143ab966
SHA512 5fcbf137f61b03e9cc4090a0b99d6940bff1fa70be76b696b8fc76f20691d0f0e37bb9437472cddcc65cdd7528301497cd717e0f630ec6285071950964b7bb73
SSDEEP 192:Aj6CBNNCNNNNNNNNNNNNNNNNNNNNNNNNNNNNNMxLO:Aj6CBNNCNNNNNNNNNNNNNNNNNNNNNNNr
TLSH
T1FBF1425687D9C39BDF09208A4E5453DD20B03B0DEBFCD90D238D89E9314D49AF6A1AF1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 7KB
SHA256 cae837e9db21b5a286441d48a496f18306d69b23b1852cc2679e14547243518d
MD5 d7f5118102f6e27f6e25df54ad9cfefc
SHA1 bac88310b42f4563b8b8ad713226a1487c48f62d
SHA512 8410bc434916fb8cd8fd8a1d67a3e0e09d3e8e20e45cd0f50043728838df8e88470b97c37d43de2fd04beb062878a56ac4a5a7b18a3683fdf6c039994d3cc915
SSDEEP 192:pjfb4m4j8Ege62aKccpppuuL9CCPPP555sNAihREMsLO:pjfMdj8Ege6XKccpppuuL9CCPPP555s9
TLSH
T11EF14D87C6D5C3BBCF25109A49A4539D60B13B09EBDCD508134DADEA314E8EAF5A26F0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 7KB
SHA256 e44e5dccf36a44694db50f531b8dc775c100c2c6902291efbf5ff708bf3a6c00
MD5 013b5b98c7cacdb4c134a8d44f3836cc
SHA1 c0a6a37f5c3cb26f3d0247ff27aab7de8eed4e62
SHA512 ff45aade45621e495a575d2768204fe1dac38b55eb52efa8645d1efbab9f55a07e708ac2dc0b38bf2e3cc6f3bb712ee9887a0d0a231665ba9759f45e22f94a92
SSDEEP 192:BjUnKbb+bbbbbbbbbbbbKKKKKK+++++++++++MCLO:BjUnKbb+bbbbbbbbbbbbKKKKKK+++++E
TLSH
T114F18C17C6D5C79ACF0510CA4AA462DE20B07B09EBDCD50813AEDEEE314E4DAF5A56F0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 2c2f57796b57581e68e7d4e8ca81fec1018be10cd9bd72f11b0dd187a15dbc1f
MD5 aecc5a239e591b6765ac6bad5628f04d
SHA1 a76116fa46d27029b84e9d94fc8da40a487389b9
SHA512 4f2e84b40dd5ec8c34581aceaa07f250454c88e38c341402940106a731e4587fb9a9f9ebbcf99a39b742d4ff46f30581a99e0da7c881286fcec78118483f18ee
TLSH
T12661F71305916010EFE2C3F3DAD0C9C4B23686B5F9E75E6215405F369A9EF8DF02E268
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 c3cf7b3db0f1c2471507b48d8e358e92d3bdbacf0349ee4909546de304856a6d
MD5 df909cbf3cfca02c4428bd6da70e3038
SHA1 d6ea1537f535c58bdbb38d2779127082ad647ee6
SHA512 754a558126aa1dfd4af878612be14bb632062b3c237ac0c0e61aae172382fae934ad59f55517b0c373327e40ec5e1c900cf5f14abfb66a34631e8f59b33c748c
TLSH
T1AA612C0305916450EFE28AF3EBD1C9C8B63346B5F9D31E2611005F369A4EFADF02E1A8
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 655ce14068838b8a4bfea04e066a678408131b0a9bf77da11ee559d25a85d3b5
MD5 7e6799480b22494ea785d5ec50d1724f
SHA1 e63ce373a9ef778f17d995168230849614b2563d
SHA512 9db21c1d2d7d65e0b04a1765d0b5959f99590151a4cc84d8ddc7857df95bf7facec639c959421a9aff7db22bc74b085751cb603a59a9178f44250fbebbb4f3bc
TLSH
T1EB417CF3C3E4856E8A0156F0AA24BE2BDE1D0611832C3D5A85D4AF1B93F2471E14195E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 50ec01f2dba511ad9947b9ddf92a9203a63da98e45126c4a00716e5612fedd07
MD5 a45224f4886e367c38e51f88291344f1
SHA1 26316ad23067a259595e433c8eb2428a170b2fcd
SHA512 99cf9970b9de2c824878f30a27b94228b03c37d54f3dec35a9cf14fb0a62b7edc7795875053b213ac1c20a83ae43c27123b924131a4ab911349298e38ae63a73
TLSH
T11D41BFF783F4856ECA0196F0EA18BE2BCE1D0511436C3DAA85D4AE1B93F3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 7e545fe42906396973482ba2b6b2138e1f3d9abe356eb57e691f3bdfb742298d
MD5 4393477f522071c52125440a4f462931
SHA1 854b6d95eda2ee8bc9138d148ba654e826a6d934
SHA512 5550f6656443fc863bbfb73d826e125ddd44fbfa25c0954dbe3efb69cc04f43005d5f50b842cf31c2ef8363daf43560b261f5f1ab371df760a51f4ff828918b2
SSDEEP 192:sxZio6kRnyM/jK1Ml8Mi4/fLs6hP+t4uIdpnxyHW6+WNuyI//YriZP7nFIg4J:sxZioJ1q4/fLs6hAYxyHb1M/xZJc
TLSH
T16F52E916AA349977CCDBD209B545BB53D6F94472E2900D48A9FC8A1C04E7BED2317C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 8056b6faa3c35840570658ef1dc73ee72452cd6c694ac50b16d48c5ee395561c
MD5 3288f29ab7b5f0ef64193afe9eec3696
SHA1 f9c9ef738a239afe038b3fe7ff132dca61512cdf
SHA512 715f7f26989ef9ce37323d8a37e92e1f7b22224d9cbf4a0afcceab7122c9315395db47b95bd296945f93eab80a4edea3486140bfc8bc7cd621c2a1bc7ad7889b
SSDEEP 192:sxZio6kRnyM/jK1Ml8UQMk4/fLs3wP+t4uIdpRxyHW6+WNuyI//YrFZKznFIg598:sxZioJ1qX4/fLs3wAY3yHb1M/IIJ49
TLSH
T1A062E916AA349977DCDBD209B541BF53D6F94472E2900E44A9FCCA1C00E7ADD2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 5d45270703d47fc51c793dc4080a23da25e3bf25bd04329de369a8dbc2ba9991
MD5 952617e930f0912f9dbc075ec202af60
SHA1 9960673183a8e8d8790e7d12ba29fe3b3b466795
SHA512 e8036e4fe423e6c1c70aa01b79b98410e4e5adeb28d590532112f6773aa0eb01603f08198c87ce6909e8a5821603f489ce483632ba57978d604f0cf9b4f9c5c2
SSDEEP 192:sxZio6kRnyM/jK1Ml8Mk4/fLs3hP+t4uIdpnxyHW6+WNuyI//YriZP7nFIg5HErJ:sxZioJ1M4/fLs3hAYxyHb1M/xZJi9
TLSH
T16052E816AA349977CCDBD209B941BF53D6F94472E2900D48A9FC8A1C04E6AED2317C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 28KB
SHA256 1e7beffc1bdcdf78d37ab282ee51cf5e7aefcdad230afa80f469929803f562cf
MD5 6add8523b9bd5b88fc8c8289cd1d296f
SHA1 12023d450a53fcf9a6b2fbd01433b7ebb72c8aea
SHA512 0191148049c2b374101e8e8a63c6fb7fa917ceda35161c958237ca720d7c4ca52d5aff46ac50986a448c6db09cdafea11166286dc455a43b15aa2f7aa12f6dbb
SSDEEP 384:sxZioed1qX4/fLs3C66s8qMpRiYnazAW8pZS15posJWeT+DrYHbOdXdIHv:sakX4/f8C4Mnc7WeT+DkHbwSP
TLSH
T189D20805A924C8779EC39D19743D7E33DAEC40626285CEDA19ECCA1C01AE5FDAB47827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 6c2dc86329bcffce360cde4e2886acab30db26cb5f13b3a17482baf65c9c342f
MD5 0ef8c0decc0063392228c61f799e9313
SHA1 4cf7a83d5feee911f9c1035418e16b180acb3852
SHA512 8a656bbffcf30b7e328532e93add65023b785a4376740e3e1fc56c8fd3c7fe7840d7c21a02cc7d368930ad675a5a126201ee0eaeed78f168a3ce925a0c5cabb7
SSDEEP 768:lygL6W37pLuLfieWviSZq8F1+UoAYDCx9Tuqh0VfUC9xbog/OVKwSJLlZzaRyroN:lygL6WxEfieWviSZqu1ja/wSJL7+RpWG
TLSH
T101F2FB3B6D0CCB7E4F844E9CED2A7E8B6DE8018B9698899447FA444C03C66EF11175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\eef384ec-15c7-4de7-abe6-da43d791fa25\index-dir\the-real-index
Size 552B
SHA256 aadc91292785cea9d9e2623d6da9d5c5a7ff3b6078540d9557d0986c591816d8
MD5 12e54249ec6979d46b092520dfb21b02
SHA1 637c86b3ec0b69ceddd485d8b452fbaeb340e13f
SHA512 4a7ce7fc238af79bd10e1488a7152b0a38c7c58db67bd995833d14ea02cfcfa862822f7664c22c1e5de4ee3ee872448b2877f40c58177503a56ccece97be0ad4
TLSH
T10CF0AB220FA11C5BE8210AB629F151A8B13189EC9321C8675C2D06362CA3348552A2CC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5d1679.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\eef384ec-15c7-4de7-abe6-da43d791fa25\index-dir\the-real-index~RFe5d1679.TMP
Size 576B
SHA256 482867e9b9487e2f126a0fd8d40bf5e60fef687c148f4239f596b0c5daf029eb
MD5 81c36da5bb89c6adfe3506a4d1d8e90c
SHA1 5c70fdc2078d92f4f462b3e61dbefde92b91f0e0
SHA512 322820c4097873066b7f53fa85ee431c734b5dd79d0078145f0c3f779eeb36902de5301c5e5bf624371e779b3f0002eda9e31f1c8a8efa95725f0cbc3a232627
TLSH
T176F0F1A9CBC14E11E844157B2EF594B8F2304C40A727F5A3742C656DAC397CC69020CD
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 0f2fbd60e0c4a160ca4263363e5e3ac991ba4578469f68699a4bdacf2c60f60a
MD5 6e5953244ea2ff6a9449ec764ffbc296
SHA1 97bd1293ad23fe9ec3945eeff8f053c2fa267045
SHA512 1fe8392ee80ffb87bac6b3bbfc2129301ad1ff7b9b405eac71acb474084735c240dfc5d49d3bf1862b6b027d88c810bf6421e7e9009e8535461a68a45e585631
TLSH
T1FEE0C0FB2CDB1918FC7BD3D324314CA80140BC84C844ED0E1029A28351F235D3019CB1
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 c9a116acd890d427189c8f12b03a80c10234a3bfd37523729bee63e4978cc9d5
MD5 a32d27b5a21f3312eabaf3e343d121c9
SHA1 1d070e076f5c7158c5487abfb4c1f9bdf5e7ace9
SHA512 2018a7fd2257ec22b2e99fc845b612415249196c53d23abdcdaff6a3a39816cf025a0f74f6ce897c66f99da4a9abe8d9b83777378212452bad77f8324789fb2b
SSDEEP 48:KsWT8Ae0k1VIRIIqo1K3E/u1r2lQ5MtIlKWwwfIFKkEofyRaIPKTKs4:KwX+KUsytSKWwwfmKkE6CaoKTKT
TLSH
T14CB1FF03317E020238BD2548A6A6A637DE4271A73554F8EF7FB954A2CE26E110DBDCDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

domain_actions.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Domain Actions\3.0.0.18\domain_actions.dll
Size 83KB
SHA256 d35c8efcb710239f009633bcc5ae904ac6dafa985d451bedf791cf6909f014d4
MD5 956f610121cd5827fd5549097b79cd9f
SHA1 dbd23f99895a3a92fbe04c3c35d475a6f6998fd0
SHA512 3cc4712f64474497495d229ddd743c6bf25c30c3fbfca2525f46227d99a59a0f9e80e2119ffb40bc8a707b539f65f907e2e1565ea937e0387db47cf7269944e6
SSDEEP 1536:sNGnmI1FOxAdgxBf8paY3JQzQik428fKagFVbydki8yyafuzWk:sNG91FPgrfrPza428fIenya2Sk
TLSH
T16D83F180DF58411BF86F4835E0B269857A78E6B50FE092DF2376C9590E12FD1AF39705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5953a4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5953a4.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 e2e1bc7a7cd7b4e692d4f2ee33d95a9283fb3aabc059d58a3edcb7dae350d2aa
MD5 59cd92d6560e59ed71d35593dd9f4c80
SHA1 392c25b78c0b52b8a3a290e8cfbf025c6e6c78b1
SHA512 8ec96fd4aa611fea1e37622ba15c4ca64b9d029bab08553064621d7d05024a9d6e5f4b145c50091a67e263d0e5b34c81139446b9317f284663b03dec1b4bcdd5
SSDEEP 384:nYiFiZcIKHsN18TUNTUlIlkJyIlsg8/Rs0DfQ8uO8susIc6uDoiSOObjI9G6w7iQ:jFQSMwgtY8nz1IPMov29MiQ
TLSH
T1B5E2C5F698D78936E8AE5783A77D2D468EBCD023B5885984B7C85E0CCC865BFC306C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 fc9543a1b8796fdf4b0bd65b4b2cf5146e7229cebaacb9448680054ef6f980ce
MD5 281cd2c68ba51b7e816bb91cb0ff70dc
SHA1 2f1cbae49393e9c173f71e9b42a8c5cf99c3a168
SHA512 b0f8c952cd862a0a4cddea0eebebafdb69515ec88326057b26632d2804fe2f0b7e261a56120657778d485eff0711c10528926ba5b64f7f83273490921f922721
SSDEEP 384:nwZcIhsNrkQyIlsg8dPs9uO8susIc6uDbiSOObjI9G6w7iQ:Oh7enz1IPMbv29MiQ
TLSH
T1DD928E76AC399C32ADA7B911F48636175FF86037EA941F48E5E8AF0C05D799C2305C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 536d26d201eba1be805ce1ca6dd001c5695883be2e638df22ffa3e33625b8b3c
MD5 55de23cf2e997f2b3ec1b1d54eb94536
SHA1 5e3088115d29c03608df2b7a150f98dda16fdf73
SHA512 2134b7bed7378af3a8ca5b49367f8a11eb28cb856ad06dc3477dd8ed55f74629233f79d1b0ba415c92d525eba2497164ae1078cef3ef778a15647f918ce4a53d
SSDEEP 192:YON86LCWtDQmiUyAKILSuOCzBSus62zRYcSsE5IU6:YON86mg1UImuO8susIcaSU6
TLSH
T15B02D83AA96C6C779EB36E45B58737176FA51027E9912F44DBE82F0C01DB64C2306C36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 45ed32e7a1af10648f581d9ad4b8ab1bb6b9ca67e5e5c05cfe31dcd327d1afe8
MD5 de6d4396e3b56961534ec04f5f4d44c5
SHA1 3a7e725cd78aef5afa44a3e145362c2f2e2698e5
SHA512 c3a6e46d53c581e8466ba4b17821dd5d2d12af450909e457fdc904723ff5d51411611cbd6767c3b6ec9e761c5ae3095dc59238bc90ccc4503d1c1d8a2ef14b51
SSDEEP 192:WONW6LCWtPQmiUyiK8LSuOCzBSus62zRYcPSuDCI/ibqUKU6:WONW6mgRc8muO8susIc6uDdiSU6
TLSH
T13712F87AA86D9C23ADA37940B58736575FB52137ED406F48EAD81F0C05DB68C370AC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 c6f0f0960d34a4217bbf94787182ee55824fab1496b92dca80fef647aa21bfee
MD5 2e700df4c2f58d4e3cda1f9760804ebe
SHA1 9038e8271184d3856161b1df82f5371080850965
SHA512 34304f2605e3737829bbe62591c5747e6bc8b0d3cd57d1fe6f219f04f7fb06737981876af416320dda3be535a6cb971716722c30847a353ea258a660f514275d
SSDEEP 384:noZcIlsNrkJyIlsg8/Ps9uO8susIc6uDbiSOObjI9G6w7iQ:Wlmenz1IPMbv29MiQ
TLSH
T1E1928E76AC399C33ADA7B911B58636175FF86037EA941F48E1E8AF0C05C799C2306C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 e689592738a046e72d2792ff6889b676c33061afed5e9694f560e568ce4a7e19
MD5 ef75ab09993ff70d69a9b6e9355659a2
SHA1 90b62e676d6a8c1cc5399886e9a808cda03022e1
SHA512 4ad32c14c411705fc37667fba875c38f5733a12b0f9703a794e6f4f7bd2c00024bc4a7c861ca35e51758a393c5c552d7970939edab59e5c3c6d4382fcabade12
SSDEEP 384:nwZcIlsNrkQyIlsg8/Ps9uO8susIc6uDbiSOObjI9G6w7iQ:Ol5enz1IPMbv29MiQ
TLSH
T17E928E769C399C32ADA7A911B48636175FF86037EA941F48E5E8AF0C05D799C2305C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 756ef3483952cd4f6f9b80821083dfbdf9bccdec392e28a2854f00ab9fd415ee
MD5 a5d8f3ba10a699f2b50cc8c1ed38bf37
SHA1 6d425c4f51f9dad92dae1d394bd3ee6fc81d3e6f
SHA512 8f5ea964e29453421e34eba8b37e4acc6dc0b4b7c5f89b5fb9aebe6b034a36a6e8a0373193f023de0a7f66ab8862ad8ffd7ce6177cf2d479f623e035d2160c44
TLSH
T1512111E1183A1EC2D5BE0EAFA0872AED50D8D216F1E434791888FD54963E55E215187F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 732B
SHA256 cf5e5467ab3de71fcb419acbbb754c3effd5e787864ffa7c767f24ff9bbe5ae3
MD5 87299a8105078d6252386ba9d333ff05
SHA1 c43e027b4174d2ae2c7f138de07b18ac0407148a
SHA512 f6678cce079ae97838bf5aebf3c195a2c82d27dd6546fd7e5428396130ca4bd2c809f2d2edca4f130da479624c3418beffe998ae1a032451706b9a47bad62885
TLSH
T1670110D14C3E1AC3C6B90EAFE04717EC40C89512B0D8387818CDF8A4917A41E345182E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 852B
SHA256 51fa2add3b372e4d932d6926ca9be223a98d6ad3b63fcf099338f199d0a4ad28
MD5 0bc15719fed893a50e7e1a0840cebcc2
SHA1 b6b38e62996bd5e878b8bdb423c8908c2c7952d9
SHA512 e8025d1cc226ac64ba4fa534aa9a692475cc6f90a825329d6a12e01c23821f5e08fbdc188e3ec58612b5fc7bedb6f5a7f294d0f22467098763b8949281bee090
TLSH
T1D9011ED158391AC6CA7E0EAFA0472BEC44C8952AB2D834B908CDE8A4957985E304183E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 7f131d386f527dab6f8a4235038935e733d69317d35dc5eb69c52d96bf5b75d0
MD5 dd06dac0059d3cf25ad6de81afc96289
SHA1 38918b3e27aaa6d6adbeb99998847d2ea5649c09
SHA512 2cfd11f573eb223b18eb9882182d481ed6dbf7ec2357286c8210d4285f689d38e1e6cdce4e81f7880da9e59d1f0a7873374a7a32a0d86f20fb288f86fad7ac5e
TLSH
T1DA2142E0183E1EC2D17E0DEFB0472AEC90D88216F5D434792898FC64963E51D214087F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 e56e2e8c12c30aeb3647379105e6cc00fb874ae60db91a7e65912c81acd272cb
MD5 4fd39e59059f75a9ced12b25de6be901
SHA1 d942bc4fe9fe1f73e1bbe6647bfa093ce7449556
SHA512 23ee132546b4ee2a51fa5a3c985b815d25beaa211114e7bf11bd3d405e3225c8d2f048f8c898338119b29d18f39f785fc26810ae2e4fc11137d14bf0526a1121
TLSH
T12C3122E1583D1EC2D57E0DEFB44B2AEC90E89216F5D434382898FCA4567E51D254087F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 612B
SHA256 918167fab0fb4435546513252415c1a2e44b6e8e60caf6f31d07587ba0a71ab0
MD5 5ca920f0e1c81dfb329b916e242a4065
SHA1 1d068ad79883fd23c27647c98e761858e46f48cd
SHA512 2b99239123f922883dea3137835bb8b74713799981e5aa1434ea70db85e7666f2372db684f94bb599ecff70c8c31d02286b0587ffe620333eb1d4bbc7feb84b8
TLSH
T11DF002D04C3E19C3D5B90E6EA40717EC50D45517B0D8383804CDE894D07A05E315183E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 972B
SHA256 6bbc409c6c8e5287723de210e3463bc9873d0adfd3542a753ad8169fa6342edd
MD5 a4942446efe6c44ae76e03f049f85743
SHA1 501f2a79ecaee0f14e1e17bbd93516fc73cb8cf7
SHA512 b8cb3908d88cca44b260e44c81f0a093cb6b4c92d9225a93390f336b886fd571202edb51f98654dcb7c80c411f600f090de5af458ffd3adcea3b636210b7b69f
TLSH
T18F1150D14C3A1AC2D67E0EAF60472AEC40C89626F2E434B808C9E854517945E314183E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 0f4851d2d08fedaaf8104a0fbdc543c6f5a7c82fd67345db7d671b449362cfbb
MD5 77f71a1a262c4e86361de3a90207fc3b
SHA1 1c96628f1863ecce746b8e03e244004ff89393c0
SHA512 d32e215753da8220e7f2c1bd8d9b9f882706314869fa45afae698cfc032947bf8759f3f403076a1d8f69bb591edca53da629484ac186d9fd0c6d98d19b36c6c4
TLSH
T19A111FD1183A1EC2D5BE0EAFA0873AFD40D8D626F2E430B918C8ED54567955E215187F
MD5 SHA1 SHA512 TLSH

Submit Download

1b6506be-01c8-49e9-aa4c-e7dc2e08f7a8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\1b6506be-01c8-49e9-aa4c-e7dc2e08f7a8.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres
Size 2KB
SHA256 2e75ccb4cc7dcad6cfdfefb1bde0bc755d2f8cc4193dbe34c494c39d3bb86d06
MD5 2600ffba2c7617300de6187c3694f23f
SHA1 f9018bdd1e82252d16cc4bfb7b3dfae0d086c1d5
SHA512 3fde629b65c81a54cf02764f6eb65fecc6d20c6eaf212510bbe33bc6272c0e2b177b9b22e4cd2a3eed1577bd37964744271ad3b64405ac7fa8d4f78ec70a905d
TLSH
T12B412758AAF91118B3B76F5A9BF6A86E487B7D271F07D45E10110E4F0636A40CC61B37
MD5 SHA1 SHA512 TLSH

Submit Download

49dbe2955480c7f6ef8cec9c4320c9868d9293fd.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\49dbe2955480c7f6ef8cec9c4320c9868d9293fd.tbres
Size 2KB
SHA256 28916277cf1b61005d425f3718848e9055983c51613b846611ff210f631fc0f4
MD5 70a3dd196f3ac19ad846ee9915194656
SHA1 a93966b3d81bd86827ca79221a9595678a8980f9
SHA512 dba5e95685618fbda1e22de932555b2fef12d8c52b3d23a89e53abcd040493252ef212cdb6742835887a82fdf6acc6b5d44e2d859a0a662d476bd875aa9468c9
TLSH
T17F514E58A6E91104B3B37E1A9BF6B96E887F79332E46D49E00110E4F4A63E40D8B1737
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 9b1e235f437cffd3ba06c31557a6029bdc77ce650b9652c52f1914f74151df9c
MD5 a4065e32a338edfabd895439afac8421
SHA1 e778b99c46457b06a0dbf61b68f03a14cc3368d8
SHA512 c2e19662a82ad66da34dd51ff4ec630b727bf7abfe5384c0e4bb5147430ce2f8bfd20068fa52d43c401534db119813d05207a5eaa9a22bf9816c957dcb36a47e
TLSH
T18F41385CA6FA1148B3B76F56AFF6A96D447BBC772F0AD49D00010D4F0626A40C8A2B37
MD5 SHA1 SHA512 TLSH

Submit Download

d02b698d-7be4-4660-8ca7-b9b7cb2e36df.tmp

Path C:\Users\Admin\AppData\Local\Temp\d02b698d-7be4-4660-8ca7-b9b7cb2e36df.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2680_1469996039\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CUSTOM.DIC

Path C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

LICENSE

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2680_975115046\LICENSE
Size 1KB
SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
MD5 ee002cb9e51bb8dfa89640a406a1090a
SHA1 49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2
SHA512 d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c
TLSH
T17D31535723840B9306DA2B4566AEBDC4B0DDC02D7F27AE05186EF394537B52ED8B3443
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5112-62-0x00007FF92D190000-0x00007FF92D388000-memory.dmp

Download

memory/5112-16-0x00007FF92D190000-0x00007FF92D388000-memory.dmp

Download

memory/5112-13-0x00007FF92D190000-0x00007FF92D388000-memory.dmp

Download

memory/5112-15-0x00007FF92D190000-0x00007FF92D388000-memory.dmp

Download

memory/5112-0-0x00007FF8ED210000-0x00007FF8ED220000-memory.dmp

Download

memory/5112-12-0x00007FF92D190000-0x00007FF92D388000-memory.dmp

Download

memory/5112-18-0x00007FF8EA9E0000-0x00007FF8EA9F0000-memory.dmp

Download

memory/5112-11-0x00007FF92D190000-0x00007FF92D388000-memory.dmp

Download

memory/5112-9-0x00007FF92D190000-0x00007FF92D388000-memory.dmp

Download

memory/5112-7-0x00007FF92D190000-0x00007FF92D388000-memory.dmp

Download

memory/5112-1-0x00007FF92D22D000-0x00007FF92D22E000-memory.dmp

Download

memory/5112-19-0x00007FF8EA9E0000-0x00007FF8EA9F0000-memory.dmp

Download

memory/5112-17-0x00007FF92D190000-0x00007FF92D388000-memory.dmp

Download

memory/5112-14-0x00007FF92D190000-0x00007FF92D388000-memory.dmp

Download

memory/5112-10-0x00007FF92D190000-0x00007FF92D388000-memory.dmp

Download

memory/5112-8-0x00007FF92D190000-0x00007FF92D388000-memory.dmp

Download

memory/5112-6-0x00007FF92D190000-0x00007FF92D388000-memory.dmp

Download

memory/5112-2-0x00007FF8ED210000-0x00007FF8ED220000-memory.dmp

Download

memory/5112-3-0x00007FF8ED210000-0x00007FF8ED220000-memory.dmp

Download

memory/5112-4-0x00007FF8ED210000-0x00007FF8ED220000-memory.dmp

Download

memory/5112-61-0x00007FF92D22D000-0x00007FF92D22E000-memory.dmp

Download

memory/5112-63-0x00007FF92D190000-0x00007FF92D388000-memory.dmp

Download

memory/5112-5-0x00007FF8ED210000-0x00007FF8ED220000-memory.dmp

Download

memory/5112-64-0x00007FF92D190000-0x00007FF92D388000-memory.dmp

Download