killmbr | hxxp://google[.]com

Resubmissions

02/08/2026, 17:30

260802-v25kqadl7y10

02/08/2026, 17:19

260802-vv41lsdb8910

02/08/2026, 17:11

260802-vqa7qstthx10

Analysis

user interaction
yes
max time kernel
505s
max time network
507s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/08/2026, 17:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
http://google.com
Sample260802-vv41lsdb89

Score

10^/10

bootkit discovery killmbr persistence trojan wiper

Malware Config

Signatures

Family: KillMBR
KillMBR is a trojan that attempts to overwrite the Master Boot Record.
wiper trojan killmbr

Detects KillMBR 1 IoCs

resource	yara_rule
behavioral1/files/0x000700000001db74-1149.dat	family_killmbr

Downloads MZ/PE file 1 IoCs

flow	pid	Process
289	2000	chrome.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	MEMZ.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	MEMZ.exe

Executes dropped EXE 7 IoCs

pid	Process
1888	MEMZ.exe
5224	MEMZ.exe
372	MEMZ.exe
1504	MEMZ.exe
2916	MEMZ.exe
4404	MEMZ.exe
5740	MEMZ.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
206	camo.githubusercontent.com
207	raw.githubusercontent.com
289	raw.githubusercontent.com

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	MEMZ.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping472_1978747938\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mspaint.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe

System Time Discovery 1 TTPs 11 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5388	msedge.exe
2252	msedge.exe
4700	msedge.exe
1336	msedge.exe
5960	msedge.exe
3940	msedge.exe
2000	chrome.exe
5020	msedge.exe
3376	msedge.exe
5668	msedge.exe
5000	msedge.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe

Checks processor information in registry 2 TTPs 20 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 33 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 11 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134301647834353986"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 41 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{24A7EAFA-F5A3-43DE-AF1D-187A3D70B129}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{ED2018A2-BCE1-4BB3-8F4D-26111A0C57E8}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{9160B1A4-E253-4438-8F94-9C18AC9F52FC}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{CBE0ED50-E677-4299-A495-9DA21549E1B5}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{678C89C4-DCFC-4CE3-946C-719A34A40796}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{1489B51B-208F-4036-A61F-4003C41550EF}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{4A1ECCB8-797A-4540-A41A-32ED8AB2654F}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{DE1EF8EA-A7CA-49E1-B1DE-45871F04B03C}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{B6FE442D-8E4F-4AA7-B811-5C9F251020CD}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{E880488D-255F-412F-BF56-354BA8343481}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
2972	msedge.exe
2972	msedge.exe
5572	chrome.exe
5572	chrome.exe
5224	MEMZ.exe
372	MEMZ.exe
5224	MEMZ.exe
372	MEMZ.exe
5224	MEMZ.exe
5224	MEMZ.exe
372	MEMZ.exe
372	MEMZ.exe
372	MEMZ.exe
5224	MEMZ.exe
372	MEMZ.exe
5224	MEMZ.exe
5224	MEMZ.exe
5224	MEMZ.exe
372	MEMZ.exe
372	MEMZ.exe
4404	MEMZ.exe
4404	MEMZ.exe
372	MEMZ.exe
372	MEMZ.exe
5224	MEMZ.exe
5224	MEMZ.exe
2916	MEMZ.exe
2916	MEMZ.exe
1504	MEMZ.exe
1504	MEMZ.exe
5224	MEMZ.exe
5224	MEMZ.exe
372	MEMZ.exe
372	MEMZ.exe
4404	MEMZ.exe
4404	MEMZ.exe
4404	MEMZ.exe
4404	MEMZ.exe
372	MEMZ.exe
372	MEMZ.exe
5224	MEMZ.exe
5224	MEMZ.exe
1504	MEMZ.exe
1504	MEMZ.exe
2916	MEMZ.exe
2916	MEMZ.exe
1504	MEMZ.exe
1504	MEMZ.exe
5224	MEMZ.exe
5224	MEMZ.exe
372	MEMZ.exe
4404	MEMZ.exe
372	MEMZ.exe
4404	MEMZ.exe
4404	MEMZ.exe
4404	MEMZ.exe
372	MEMZ.exe
372	MEMZ.exe
1504	MEMZ.exe
1504	MEMZ.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4616	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 51 IoCs

pid	Process
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
3016	chrome.exe
3016	chrome.exe
468	msedge.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
468	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
472	msedge.exe
472	msedge.exe
472	msedge.exe
472	msedge.exe
472	msedge.exe
472	msedge.exe
472	msedge.exe
472	msedge.exe
472	msedge.exe
472	msedge.exe
472	msedge.exe
472	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3016	chrome.exe
Token: SeCreatePagefilePrivilege	3016	chrome.exe
Token: SeShutdownPrivilege	3016	chrome.exe
Token: SeCreatePagefilePrivilege	3016	chrome.exe
Token: SeShutdownPrivilege	3016	chrome.exe
Token: SeCreatePagefilePrivilege	3016	chrome.exe
Token: SeShutdownPrivilege	3016	chrome.exe
Token: SeCreatePagefilePrivilege	3016	chrome.exe
Token: SeShutdownPrivilege	3016	chrome.exe
Token: SeCreatePagefilePrivilege	3016	chrome.exe
Token: SeShutdownPrivilege	3016	chrome.exe
Token: SeCreatePagefilePrivilege	3016	chrome.exe
Token: SeShutdownPrivilege	3016	chrome.exe
Token: SeCreatePagefilePrivilege	3016	chrome.exe
Token: SeShutdownPrivilege	3016	chrome.exe
Token: SeCreatePagefilePrivilege	3016	chrome.exe
Token: SeShutdownPrivilege	3016	chrome.exe
Token: SeCreatePagefilePrivilege	3016	chrome.exe
Token: SeShutdownPrivilege	3016	chrome.exe
Token: SeCreatePagefilePrivilege	3016	chrome.exe
Token: SeShutdownPrivilege	3016	chrome.exe
Token: SeCreatePagefilePrivilege	3016	chrome.exe
Token: SeShutdownPrivilege	3016	chrome.exe
Token: SeCreatePagefilePrivilege	3016	chrome.exe
Token: SeShutdownPrivilege	3016	chrome.exe
Token: SeCreatePagefilePrivilege	3016	chrome.exe
Token: SeShutdownPrivilege	3016	chrome.exe
Token: SeCreatePagefilePrivilege	3016	chrome.exe
Token: SeShutdownPrivilege	3016	chrome.exe
Token: SeCreatePagefilePrivilege	3016	chrome.exe
Token: SeShutdownPrivilege	3016	chrome.exe
Token: SeCreatePagefilePrivilege	3016	chrome.exe
Token: SeShutdownPrivilege	3016	chrome.exe
Token: SeCreatePagefilePrivilege	3016	chrome.exe
Token: SeShutdownPrivilege	3016	chrome.exe
Token: SeCreatePagefilePrivilege	3016	chrome.exe
Token: SeShutdownPrivilege	3016	chrome.exe
Token: SeCreatePagefilePrivilege	3016	chrome.exe
Token: SeShutdownPrivilege	3016	chrome.exe
Token: SeCreatePagefilePrivilege	3016	chrome.exe
Token: SeShutdownPrivilege	3016	chrome.exe
Token: SeCreatePagefilePrivilege	3016	chrome.exe
Token: SeShutdownPrivilege	3016	chrome.exe
Token: SeCreatePagefilePrivilege	3016	chrome.exe
Token: SeShutdownPrivilege	3016	chrome.exe
Token: SeCreatePagefilePrivilege	3016	chrome.exe
Token: SeShutdownPrivilege	3016	chrome.exe
Token: SeCreatePagefilePrivilege	3016	chrome.exe
Token: SeShutdownPrivilege	3016	chrome.exe
Token: SeCreatePagefilePrivilege	3016	chrome.exe
Token: SeShutdownPrivilege	3016	chrome.exe
Token: SeCreatePagefilePrivilege	3016	chrome.exe
Token: SeShutdownPrivilege	3016	chrome.exe
Token: SeCreatePagefilePrivilege	3016	chrome.exe
Token: SeShutdownPrivilege	3016	chrome.exe
Token: SeCreatePagefilePrivilege	3016	chrome.exe
Token: SeShutdownPrivilege	3016	chrome.exe
Token: SeCreatePagefilePrivilege	3016	chrome.exe
Token: SeShutdownPrivilege	3016	chrome.exe
Token: SeCreatePagefilePrivilege	3016	chrome.exe
Token: SeShutdownPrivilege	3016	chrome.exe
Token: SeCreatePagefilePrivilege	3016	chrome.exe
Token: SeShutdownPrivilege	3016	chrome.exe
Token: SeCreatePagefilePrivilege	3016	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
1888	MEMZ.exe
5224	MEMZ.exe
372	MEMZ.exe
1504	MEMZ.exe
2916	MEMZ.exe
4404	MEMZ.exe
5740	MEMZ.exe
5868	mspaint.exe
5868	mspaint.exe
5868	mspaint.exe
5868	mspaint.exe
5740	MEMZ.exe
5740	MEMZ.exe
5740	MEMZ.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 468 wrote to memory of 636	468	msedge.exe	88
PID 468 wrote to memory of 3940	468	msedge.exe	89
PID 468 wrote to memory of 4356	468	msedge.exe	90
PID 468 wrote to memory of 4356	468	msedge.exe	90
PID 468 wrote to memory of 4356	468	msedge.exe	90
PID 468 wrote to memory of 1096	468	msedge.exe	91
PID 468 wrote to memory of 1096	468	msedge.exe	91
PID 468 wrote to memory of 1984	468	msedge.exe	94
PID 468 wrote to memory of 3496	468	msedge.exe	93
PID 468 wrote to memory of 1984	468	msedge.exe	94
PID 468 wrote to memory of 1984	468	msedge.exe	94
PID 468 wrote to memory of 3496	468	msedge.exe	93
PID 468 wrote to memory of 3496	468	msedge.exe	93
PID 468 wrote to memory of 3408	468	msedge.exe	97
PID 468 wrote to memory of 4656	468	msedge.exe	98
PID 468 wrote to memory of 3408	468	msedge.exe	97
PID 468 wrote to memory of 3408	468	msedge.exe	97
PID 468 wrote to memory of 4656	468	msedge.exe	98
PID 468 wrote to memory of 4656	468	msedge.exe	98
PID 3016 wrote to memory of 4040	3016	chrome.exe	99
PID 3016 wrote to memory of 1828	3016	chrome.exe	101
PID 3016 wrote to memory of 1828	3016	chrome.exe	101
PID 3016 wrote to memory of 2000	3016	chrome.exe	102
PID 3016 wrote to memory of 3604	3016	chrome.exe	103
PID 3016 wrote to memory of 3604	3016	chrome.exe	103
PID 3016 wrote to memory of 4940	3016	chrome.exe	105
PID 3016 wrote to memory of 4940	3016	chrome.exe	105
PID 3016 wrote to memory of 2848	3016	chrome.exe	106
PID 3016 wrote to memory of 2848	3016	chrome.exe	106
PID 468 wrote to memory of 4324	468	msedge.exe	107
PID 468 wrote to memory of 4324	468	msedge.exe	107
PID 468 wrote to memory of 4324	468	msedge.exe	107
PID 3016 wrote to memory of 4896	3016	chrome.exe	109
PID 3016 wrote to memory of 4896	3016	chrome.exe	109
PID 468 wrote to memory of 3888	468	msedge.exe	110
PID 468 wrote to memory of 1408	468	msedge.exe	111
PID 468 wrote to memory of 3888	468	msedge.exe	110
PID 468 wrote to memory of 1408	468	msedge.exe	111
PID 3016 wrote to memory of 3736	3016	chrome.exe	112
PID 468 wrote to memory of 5348	468	msedge.exe	116
PID 3016 wrote to memory of 5816	3016	chrome.exe	117
PID 3016 wrote to memory of 5816	3016	chrome.exe	117
PID 3016 wrote to memory of 3844	3016	chrome.exe	119
PID 3016 wrote to memory of 3844	3016	chrome.exe	119
PID 468 wrote to memory of 3336	468	msedge.exe	121
PID 468 wrote to memory of 3200	468	msedge.exe	122
PID 468 wrote to memory of 6120	468	msedge.exe	123
PID 3016 wrote to memory of 5500	3016	chrome.exe	124
PID 3016 wrote to memory of 1300	3016	chrome.exe	125
PID 3016 wrote to memory of 3284	3016	chrome.exe	126
PID 468 wrote to memory of 4908	468	msedge.exe	127
PID 468 wrote to memory of 4908	468	msedge.exe	127
PID 468 wrote to memory of 5640	468	msedge.exe	134
PID 468 wrote to memory of 5640	468	msedge.exe	134
PID 468 wrote to memory of 2972	468	msedge.exe	135
PID 3016 wrote to memory of 5572	3016	chrome.exe	136
PID 468 wrote to memory of 4816	468	msedge.exe	137
PID 468 wrote to memory of 4816	468	msedge.exe	137
PID 468 wrote to memory of 1820	468	msedge.exe	138
PID 468 wrote to memory of 1820	468	msedge.exe	138
PID 468 wrote to memory of 5724	468	msedge.exe	139
PID 468 wrote to memory of 5724	468	msedge.exe	139
PID 3016 wrote to memory of 4620	3016	chrome.exe	140
PID 3016 wrote to memory of 4620	3016	chrome.exe	140

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://google.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x264,0x7ff9c878c188,0x7ff9c878c194,0x7ff9c878c1a0
  2⤵
  PID:636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1972,i,6574280560760818770,13695926410963394343,524288 --field-trial-handle=2320,i,12940629205272715131,7553031083402122350,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1716,i,2720767881871114675,16332966937482837713,262144 --field-trial-handle=2320,i,12940629205272715131,7553031083402122350,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:2
  2⤵
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1940,i,13886049010433964539,8326560052008043532,524288 --field-trial-handle=2320,i,12940629205272715131,7553031083402122350,262144 --variations-seed-version --mojo-platform-channel-handle=2580 /prefetch:8
  2⤵
  PID:1096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,321589861245464996,14885430993001328912,2097152 --field-trial-handle=2320,i,12940629205272715131,7553031083402122350,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,6166697676830779252,15694664492158121169,2097152 --field-trial-handle=2320,i,12940629205272715131,7553031083402122350,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:1984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4144,i,13493847897805087774,13856499901065707798,2097152 --field-trial-handle=2320,i,12940629205272715131,7553031083402122350,262144 --variations-seed-version --mojo-platform-channel-handle=4564 /prefetch:1
  2⤵
  PID:3408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4156,i,2540153577117857505,14707265893850860195,2097152 --field-trial-handle=2320,i,12940629205272715131,7553031083402122350,262144 --variations-seed-version --mojo-platform-channel-handle=4624 /prefetch:2
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4996,i,7711936537156018477,1919585195440226696,2097152 --field-trial-handle=2320,i,12940629205272715131,7553031083402122350,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:1
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5168,i,1455523575158743615,9417473364986867276,524288 --field-trial-handle=2320,i,12940629205272715131,7553031083402122350,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:3888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4548,i,8891574030988983488,5310493881591099077,524288 --field-trial-handle=2320,i,12940629205272715131,7553031083402122350,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:8
  2⤵
  PID:1408
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,11046010695535653732,15922334296351766770,524288 --field-trial-handle=2320,i,12940629205272715131,7553031083402122350,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  PID:5328
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,11046010695535653732,15922334296351766770,524288 --field-trial-handle=2320,i,12940629205272715131,7553031083402122350,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  PID:5348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6356,i,14174393385434845772,12670243043316736655,524288 --field-trial-handle=2320,i,12940629205272715131,7553031083402122350,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:8
  2⤵
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6364,i,1876575037471588084,2475708841405268211,524288 --field-trial-handle=2320,i,12940629205272715131,7553031083402122350,262144 --variations-seed-version --mojo-platform-channel-handle=560 /prefetch:8
  2⤵
  PID:3200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6368,i,7375409027916585231,8844874660193722295,524288 --field-trial-handle=2320,i,12940629205272715131,7553031083402122350,262144 --variations-seed-version --mojo-platform-channel-handle=4772 /prefetch:8
  2⤵
  PID:6120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2884,i,8210014915428928598,6334669805891881393,524288 --field-trial-handle=2320,i,12940629205272715131,7553031083402122350,262144 --variations-seed-version --mojo-platform-channel-handle=4152 /prefetch:8
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5244,i,16105595999184668272,1871301750618446290,524288 --field-trial-handle=2320,i,12940629205272715131,7553031083402122350,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:8
  2⤵
  PID:5640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1216,i,5802412763774927433,1107342663551699644,262144 --field-trial-handle=2320,i,12940629205272715131,7553031083402122350,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5248,i,12414725789903026778,4977666588217857382,524288 --field-trial-handle=2320,i,12940629205272715131,7553031083402122350,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:8
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3780,i,10456513668837401298,18200121967851099693,524288 --field-trial-handle=2320,i,12940629205272715131,7553031083402122350,262144 --variations-seed-version --mojo-platform-channel-handle=3776 /prefetch:8
  2⤵
  PID:1820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,12809500638561948585,3543289101142449540,524288 --field-trial-handle=2320,i,12940629205272715131,7553031083402122350,262144 --variations-seed-version --mojo-platform-channel-handle=3248 /prefetch:8
  2⤵
  PID:5724

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1720

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff9ba89c728,0x7ff9ba89c734,0x7ff9ba89c740
  2⤵
  PID:4040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1692,i,6338963520083147366,12306839992865556879,262144 --field-trial-handle=2024,i,10834396253245405591,6262908838881198417,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2020 /prefetch:2
  2⤵
  PID:1828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2208,i,4756870215124480961,10880819045596621924,524288 --field-trial-handle=2024,i,10834396253245405591,6262908838881198417,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2216 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:2000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2388,i,8171443181208799049,257799889895771481,524288 --field-trial-handle=2024,i,10834396253245405591,6262908838881198417,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2556 /prefetch:8
  2⤵
  PID:3604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3240,i,13030291128174958429,13839191581230679674,2097152 --field-trial-handle=2024,i,10834396253245405591,6262908838881198417,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:4940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3260,i,10517751435847182420,14035859106491724834,2097152 --field-trial-handle=2024,i,10834396253245405591,6262908838881198417,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:2848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4488,i,8164383213198303417,2082125961501684942,2097152 --field-trial-handle=2024,i,10834396253245405591,6262908838881198417,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4460 /prefetch:1
  2⤵
  PID:4896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5352,i,12521181955011422332,4941698471005827245,524288 --field-trial-handle=2024,i,10834396253245405591,6262908838881198417,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5348 /prefetch:8
  2⤵
  PID:3736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5400,i,17739499531715759231,16709420995560065491,2097152 --field-trial-handle=2024,i,10834396253245405591,6262908838881198417,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5412 /prefetch:1
  2⤵
  PID:5816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4616,i,12519512492133804843,1783944135809834616,2097152 --field-trial-handle=2024,i,10834396253245405591,6262908838881198417,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5704 /prefetch:1
  2⤵
  PID:3844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3460,i,5169383397836593732,1382435082321305133,524288 --field-trial-handle=2024,i,10834396253245405591,6262908838881198417,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3484 /prefetch:8
  2⤵
  PID:5500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3292,i,6276667128711848563,15664550333473514064,524288 --field-trial-handle=2024,i,10834396253245405591,6262908838881198417,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3468 /prefetch:8
  2⤵
  PID:1300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3248,i,15915167771064586308,17504186242542761307,524288 --field-trial-handle=2024,i,10834396253245405591,6262908838881198417,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3356 /prefetch:8
  2⤵
  PID:3284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5876,i,11024890054087149724,13311266517431927547,262144 --field-trial-handle=2024,i,10834396253245405591,6262908838881198417,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5856,i,13362482866288443752,11252002549219275319,524288 --field-trial-handle=2024,i,10834396253245405591,6262908838881198417,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=864 /prefetch:8
  2⤵
  PID:4620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6100,i,15999081035300786948,17270295258979490529,524288 --field-trial-handle=2024,i,10834396253245405591,6262908838881198417,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6104 /prefetch:8
  2⤵
  PID:4224

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4112

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5256

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4516

C:\Users\Admin\Downloads\MEMZ.exe
"C:\Users\Admin\Downloads\MEMZ.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1888
- C:\Users\Admin\Downloads\MEMZ.exe
  "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:5224
- C:\Users\Admin\Downloads\MEMZ.exe
  "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:372
- C:\Users\Admin\Downloads\MEMZ.exe
  "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:1504
- C:\Users\Admin\Downloads\MEMZ.exe
  "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2916
- C:\Users\Admin\Downloads\MEMZ.exe
  "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:4404
- C:\Users\Admin\Downloads\MEMZ.exe
  "C:\Users\Admin\Downloads\MEMZ.exe" /main
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Writes to the Master Boot Record (MBR)
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5740
- - C:\Windows\SysWOW64\notepad.exe
    "C:\Windows\System32\notepad.exe" \note.txt
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+to+send+a+virus+to+my+friend
    3⤵
    PID:2944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://google.co.ck/search?q=how+to+send+a+virus+to+my+friend
      4⤵
      Checks processor information in registry
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      PID:4652
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x25c,0x7ff9c878c188,0x7ff9c878c194,0x7ff9c878c1a0
        5⤵
        
        PID:3056
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1868,i,16765122556549968824,153669716590598698,524288 --field-trial-handle=2240,i,14318074750436518571,2308815805564738546,262144 --variations-seed-version --mojo-platform-channel-handle=2404 /prefetch:3
        5⤵
        System Time Discovery
        
        PID:2252
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1744,i,6002625600073900861,13407071497173070041,262144 --field-trial-handle=2240,i,14318074750436518571,2308815805564738546,262144 --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:2
        5⤵
        
        PID:5432
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2600,i,3628418282558087661,8310398438945627835,524288 --field-trial-handle=2240,i,14318074750436518571,2308815805564738546,262144 --variations-seed-version --mojo-platform-channel-handle=2804 /prefetch:8
        5⤵
        
        PID:4936
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3412,i,4998660700396612456,9657243564710917132,2097152 --field-trial-handle=2240,i,14318074750436518571,2308815805564738546,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
        5⤵
        
        PID:5604
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3416,i,3361895110268902251,5350988722188163272,2097152 --field-trial-handle=2240,i,14318074750436518571,2308815805564738546,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
        5⤵
        
        PID:4856
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4936,i,3214814354842045148,14909538888965075720,524288 --field-trial-handle=2240,i,14318074750436518571,2308815805564738546,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:8
        5⤵
        
        PID:5544
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5056,i,12389074959477538916,10467477852530695325,2097152 --field-trial-handle=2240,i,14318074750436518571,2308815805564738546,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:1
        5⤵
        
        PID:60
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5072,i,14358086459738512793,17771381877961246080,524288 --field-trial-handle=2240,i,14318074750436518571,2308815805564738546,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:8
        5⤵
        
        PID:4248
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3696,i,4477801519468433548,7242833571413590026,524288 --field-trial-handle=2240,i,14318074750436518571,2308815805564738546,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:8
        5⤵
        
        PID:2984
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3700,i,21947317630916389,14963055145058743957,524288 --field-trial-handle=2240,i,14318074750436518571,2308815805564738546,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:8
        5⤵
        
        PID:4376
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5676,i,17579591007057675459,9292690360647262752,524288 --field-trial-handle=2240,i,14318074750436518571,2308815805564738546,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:8
        5⤵
        
        PID:4596
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5676,i,17579591007057675459,9292690360647262752,524288 --field-trial-handle=2240,i,14318074750436518571,2308815805564738546,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:8
        5⤵
        
        PID:180
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5864,i,1671417278048765201,16832373553166849162,524288 --field-trial-handle=2240,i,14318074750436518571,2308815805564738546,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:8
        5⤵
        
        PID:3944
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6036,i,4778720866437062446,2474577690550173975,524288 --field-trial-handle=2240,i,14318074750436518571,2308815805564738546,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:8
        5⤵
        
        PID:2408
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6192,i,5804013494064241129,6319766047362355504,524288 --field-trial-handle=2240,i,14318074750436518571,2308815805564738546,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:8
        5⤵
        
        PID:5828
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6008,i,2985544579548110123,1415193731794320296,524288 --field-trial-handle=2240,i,14318074750436518571,2308815805564738546,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:8
        5⤵
        
        PID:5840
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6520,i,11193930320588657385,1128579010091232802,2097152 --field-trial-handle=2240,i,14318074750436518571,2308815805564738546,262144 --variations-seed-version --mojo-platform-channel-handle=6540 /prefetch:1
        5⤵
        
        PID:3596
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6508,i,17623609552117908682,10901856024680147886,524288 --field-trial-handle=2240,i,14318074750436518571,2308815805564738546,262144 --variations-seed-version --mojo-platform-channel-handle=6660 /prefetch:8
        5⤵
        
        PID:4920
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
        5⤵
        Checks processor information in registry
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        
        PID:2388
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ff9c878c188,0x7ff9c878c194,0x7ff9c878c1a0
        6⤵
        
        PID:4832
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1956,i,13248751345297883566,9676567990912955288,524288 --field-trial-handle=2228,i,8437691618343376046,12180654282628955927,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:3
        6⤵
        System Time Discovery
        
        PID:5020
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1716,i,10797254095142725250,16393777670969614924,262144 --field-trial-handle=2228,i,8437691618343376046,12180654282628955927,262144 --variations-seed-version --mojo-platform-channel-handle=2224 /prefetch:2
        6⤵
        
        PID:1820
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2516,i,12636051028825067230,11356340424168204086,524288 --field-trial-handle=2228,i,8437691618343376046,12180654282628955927,262144 --variations-seed-version --mojo-platform-channel-handle=2540 /prefetch:8
        6⤵
        
        PID:5844
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4500,i,4895198540596621332,8840857438261465500,524288 --field-trial-handle=2228,i,8437691618343376046,12180654282628955927,262144 --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:8
        6⤵
        
        PID:5112
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4500,i,4895198540596621332,8840857438261465500,524288 --field-trial-handle=2228,i,8437691618343376046,12180654282628955927,262144 --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:8
        6⤵
        
        PID:3776
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4892,i,3402921199079810790,52226974737558244,2097152 --field-trial-handle=2228,i,8437691618343376046,12180654282628955927,262144 --variations-seed-version --mojo-platform-channel-handle=4936 /prefetch:1
        6⤵
        
        PID:4988
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=4900,i,15078594692169898685,3150554727660841352,2097152 --field-trial-handle=2228,i,8437691618343376046,12180654282628955927,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:1
        6⤵
        
        PID:1940
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5380,i,15102344940645779772,9416239460270411868,524288 --field-trial-handle=2228,i,8437691618343376046,12180654282628955927,262144 --variations-seed-version --mojo-platform-channel-handle=4876 /prefetch:8
        6⤵
        
        PID:3476
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5432,i,10511075463099262976,2343059533000536565,524288 --field-trial-handle=2228,i,8437691618343376046,12180654282628955927,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:8
        6⤵
        
        PID:5380
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5952,i,12983927220450456121,12233707721787408538,2097152 --field-trial-handle=2228,i,8437691618343376046,12180654282628955927,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:1
        6⤵
        
        PID:1300
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5244,i,5733148616539015859,5761862277021334144,2097152 --field-trial-handle=2228,i,8437691618343376046,12180654282628955927,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:1
        6⤵
        
        PID:5124
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
        6⤵
        Drops file in Program Files directory
        Checks processor information in registry
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        
        PID:472
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x240,0x244,0x248,0x23c,0x220,0x7ff9c878c188,0x7ff9c878c194,0x7ff9c878c1a0
        7⤵
        
        PID:4812
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1816,i,7379055035338505246,14537758960847881426,524288 --field-trial-handle=2352,i,1214982736226074435,17257427204873930063,262144 --variations-seed-version --mojo-platform-channel-handle=2380 /prefetch:3
        7⤵
        System Time Discovery
        
        PID:3376
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1676,i,1739761487123339198,5507224119513566719,262144 --field-trial-handle=2352,i,1214982736226074435,17257427204873930063,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:2
        7⤵
        
        PID:1064
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2332,i,14932653175732345930,18427197317825344472,524288 --field-trial-handle=2352,i,1214982736226074435,17257427204873930063,262144 --variations-seed-version --mojo-platform-channel-handle=2608 /prefetch:8
        7⤵
        
        PID:3460
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4372,i,1976404482988383326,15760049046926901835,524288 --field-trial-handle=2352,i,1214982736226074435,17257427204873930063,262144 --variations-seed-version --mojo-platform-channel-handle=4416 /prefetch:8
        7⤵
        
        PID:240
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4372,i,1976404482988383326,15760049046926901835,524288 --field-trial-handle=2352,i,1214982736226074435,17257427204873930063,262144 --variations-seed-version --mojo-platform-channel-handle=4416 /prefetch:8
        7⤵
        
        PID:1768
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4484,i,17782325100854613622,13435058936022559632,524288 --field-trial-handle=2352,i,1214982736226074435,17257427204873930063,262144 --variations-seed-version --mojo-platform-channel-handle=568 /prefetch:8
        7⤵
        
        PID:3936
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4416,i,15188026697873849612,16642324967109606758,524288 --field-trial-handle=2352,i,1214982736226074435,17257427204873930063,262144 --variations-seed-version --mojo-platform-channel-handle=4820 /prefetch:8
        7⤵
        
        PID:3760
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4488,i,3345803707513989825,15255082052060446660,524288 --field-trial-handle=2352,i,1214982736226074435,17257427204873930063,262144 --variations-seed-version --mojo-platform-channel-handle=4760 /prefetch:8
        7⤵
        
        PID:2084
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4912,i,9664866567309573454,4807664334406165763,2097152 --field-trial-handle=2352,i,1214982736226074435,17257427204873930063,262144 --variations-seed-version --mojo-platform-channel-handle=4928 /prefetch:1
        7⤵
        
        PID:1340
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4916,i,8156803934152660760,14716622221409555147,2097152 --field-trial-handle=2352,i,1214982736226074435,17257427204873930063,262144 --variations-seed-version --mojo-platform-channel-handle=4952 /prefetch:1
        7⤵
        
        PID:4808
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5416,i,5498537644086486781,15729567094880269479,524288 --field-trial-handle=2352,i,1214982736226074435,17257427204873930063,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:8
        7⤵
        
        PID:1524
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5420,i,16338516493034136731,8647193697602746907,524288 --field-trial-handle=2352,i,1214982736226074435,17257427204873930063,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:8
        7⤵
        
        PID:5380
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5924,i,12852287395567151156,7708452693202710737,2097152 --field-trial-handle=2352,i,1214982736226074435,17257427204873930063,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:1
        7⤵
        
        PID:3408
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4952,i,10945303311156252050,1747064347545292347,2097152 --field-trial-handle=2352,i,1214982736226074435,17257427204873930063,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:1
        7⤵
        
        PID:3108
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6312,i,17657283675308882269,7417081129546066082,2097152 --field-trial-handle=2352,i,1214982736226074435,17257427204873930063,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:1
        7⤵
        
        PID:6064
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6392,i,15164864572750143460,4546955797367435824,524288 --field-trial-handle=2352,i,1214982736226074435,17257427204873930063,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:8
        7⤵
        
        PID:5384
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6772,i,12211108756294658471,14837073512995648750,2097152 --field-trial-handle=2352,i,1214982736226074435,17257427204873930063,262144 --variations-seed-version --mojo-platform-channel-handle=6740 /prefetch:1
        7⤵
        
        PID:3300
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6856,i,6015100599887795832,3947649776500992319,2097152 --field-trial-handle=2352,i,1214982736226074435,17257427204873930063,262144 --variations-seed-version --mojo-platform-channel-handle=6892 /prefetch:1
        7⤵
        
        PID:1600
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=7056,i,3298308033775184922,1054828515773498037,2097152 --field-trial-handle=2352,i,1214982736226074435,17257427204873930063,262144 --variations-seed-version --mojo-platform-channel-handle=7076 /prefetch:1
        7⤵
        
        PID:4648
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7036,i,10951236703722268869,10226237947013562736,524288 --field-trial-handle=2352,i,1214982736226074435,17257427204873930063,262144 --variations-seed-version --mojo-platform-channel-handle=7008 /prefetch:8
        7⤵
        
        PID:6028
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7380,i,3051743457002124207,11467135176437308567,2097152 --field-trial-handle=2352,i,1214982736226074435,17257427204873930063,262144 --variations-seed-version --mojo-platform-channel-handle=7364 /prefetch:1
        7⤵
        
        PID:4180
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6988,i,4621498760695968780,15169233512579583458,2097152 --field-trial-handle=2352,i,1214982736226074435,17257427204873930063,262144 --variations-seed-version --mojo-platform-channel-handle=6956 /prefetch:1
        7⤵
        
        PID:4772
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7308,i,7824385134327103884,4874927650410573898,2097152 --field-trial-handle=2352,i,1214982736226074435,17257427204873930063,262144 --variations-seed-version --mojo-platform-channel-handle=6744 /prefetch:1
        7⤵
        
        PID:3408
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7028,i,592184832781177485,11405515843165355936,524288 --field-trial-handle=2352,i,1214982736226074435,17257427204873930063,262144 --variations-seed-version --mojo-platform-channel-handle=7180 /prefetch:8
        7⤵
        Modifies registry class
        
        PID:4788
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6900,i,11716386852887861854,8297646179481758980,524288 --field-trial-handle=2352,i,1214982736226074435,17257427204873930063,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:8
        7⤵
        
        PID:176
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
        7⤵
        Checks processor information in registry
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        
        PID:2252
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ff9c878c188,0x7ff9c878c194,0x7ff9c878c1a0
        8⤵
        
        PID:1360
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1884,i,17026586953220677337,8854032901259489831,524288 --field-trial-handle=2360,i,16366006425986730676,2509110549899570590,262144 --variations-seed-version --mojo-platform-channel-handle=2388 /prefetch:3
        8⤵
        System Time Discovery
        
        PID:5668
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1776,i,2545682302535165244,17364935027149426802,262144 --field-trial-handle=2360,i,16366006425986730676,2509110549899570590,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:2
        8⤵
        
        PID:4808
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2604,i,1879140507128996589,11649222368099462341,524288 --field-trial-handle=2360,i,16366006425986730676,2509110549899570590,262144 --variations-seed-version --mojo-platform-channel-handle=2596 /prefetch:8
        8⤵
        
        PID:5780
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4504,i,12288574647855070710,10040239975107798709,524288 --field-trial-handle=2360,i,16366006425986730676,2509110549899570590,262144 --variations-seed-version --mojo-platform-channel-handle=4520 /prefetch:8
        8⤵
        
        PID:5380
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4504,i,12288574647855070710,10040239975107798709,524288 --field-trial-handle=2360,i,16366006425986730676,2509110549899570590,262144 --variations-seed-version --mojo-platform-channel-handle=4520 /prefetch:8
        8⤵
        
        PID:5940
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4952,i,13179175695177166382,1599799719416712212,2097152 --field-trial-handle=2360,i,16366006425986730676,2509110549899570590,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:1
        8⤵
        
        PID:3736
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=4956,i,1662172907060662468,10197053928534210902,2097152 --field-trial-handle=2360,i,16366006425986730676,2509110549899570590,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:1
        8⤵
        
        PID:2112
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5516,i,7141313888210118410,12426697923877148889,524288 --field-trial-handle=2360,i,16366006425986730676,2509110549899570590,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:8
        8⤵
        
        PID:2200
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5520,i,2166133917877367286,16080918905643017652,524288 --field-trial-handle=2360,i,16366006425986730676,2509110549899570590,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:8
        8⤵
        
        PID:3360
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5800,i,13832972605557798166,5843887239706004555,2097152 --field-trial-handle=2360,i,16366006425986730676,2509110549899570590,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:1
        8⤵
        
        PID:4564
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5260,i,6286289073892197657,14285131918053152465,2097152 --field-trial-handle=2360,i,16366006425986730676,2509110549899570590,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:1
        8⤵
        
        PID:1120
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6168,i,12169865297775224319,3699856555413125489,2097152 --field-trial-handle=2360,i,16366006425986730676,2509110549899570590,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:1
        8⤵
        
        PID:3964
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
        8⤵
        Checks processor information in registry
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        
        PID:1240
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff9c878c188,0x7ff9c878c194,0x7ff9c878c1a0
        9⤵
        
        PID:1852
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1960,i,4124724914016335948,15186432088258179905,524288 --field-trial-handle=2900,i,5184451180666092558,15228421615875488921,262144 --variations-seed-version --mojo-platform-channel-handle=2960 /prefetch:3
        9⤵
        System Time Discovery
        
        PID:4700
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2228,i,577250557587280035,1807697991377940874,524288 --field-trial-handle=2900,i,5184451180666092558,15228421615875488921,262144 --variations-seed-version --mojo-platform-channel-handle=3040 /prefetch:8
        9⤵
        
        PID:3720
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1732,i,16498399263018501877,16551639573930167636,262144 --field-trial-handle=2900,i,5184451180666092558,15228421615875488921,262144 --variations-seed-version --mojo-platform-channel-handle=2888 /prefetch:2
        9⤵
        
        PID:5292
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4448,i,18168529807478616347,6934592919841375447,524288 --field-trial-handle=2900,i,5184451180666092558,15228421615875488921,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:8
        9⤵
        
        PID:5136
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4448,i,18168529807478616347,6934592919841375447,524288 --field-trial-handle=2900,i,5184451180666092558,15228421615875488921,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:8
        9⤵
        
        PID:5636
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4868,i,13039567516248117064,7135077761542319410,2097152 --field-trial-handle=2900,i,5184451180666092558,15228421615875488921,262144 --variations-seed-version --mojo-platform-channel-handle=4900 /prefetch:1
        9⤵
        
        PID:4596
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=4880,i,6884072164781036505,12237890556389133929,2097152 --field-trial-handle=2900,i,5184451180666092558,15228421615875488921,262144 --variations-seed-version --mojo-platform-channel-handle=4968 /prefetch:1
        9⤵
        
        PID:5192
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5416,i,15444789324392760957,16345408956377811228,524288 --field-trial-handle=2900,i,5184451180666092558,15228421615875488921,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:8
        9⤵
        
        PID:4056
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5420,i,6715366882279582778,2125502156117232980,524288 --field-trial-handle=2900,i,5184451180666092558,15228421615875488921,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:8
        9⤵
        
        PID:3812
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5880,i,13318044242798014461,2650923515806837533,2097152 --field-trial-handle=2900,i,5184451180666092558,15228421615875488921,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:1
        9⤵
        
        PID:5564
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5700,i,7135033112242516326,14475120348718951392,2097152 --field-trial-handle=2900,i,5184451180666092558,15228421615875488921,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:1
        9⤵
        
        PID:2592
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
        9⤵
        Checks processor information in registry
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        
        PID:2680
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ff9c878c188,0x7ff9c878c194,0x7ff9c878c1a0
        10⤵
        
        PID:5588
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1880,i,4702952003016751046,2846846962125460522,524288 --field-trial-handle=2588,i,6037932694448287763,8291789671653100879,262144 --variations-seed-version --mojo-platform-channel-handle=2620 /prefetch:3
        10⤵
        System Time Discovery
        
        PID:5000
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1668,i,14461842420393829820,8638718180842922234,262144 --field-trial-handle=2588,i,6037932694448287763,8291789671653100879,262144 --variations-seed-version --mojo-platform-channel-handle=2460 /prefetch:2
        10⤵
        
        PID:5100
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2316,i,16828569531762984002,14828277221484574125,524288 --field-trial-handle=2588,i,6037932694448287763,8291789671653100879,262144 --variations-seed-version --mojo-platform-channel-handle=2628 /prefetch:8
        10⤵
        
        PID:5700
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4480,i,1251848967280513111,17366200263975903476,524288 --field-trial-handle=2588,i,6037932694448287763,8291789671653100879,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:8
        10⤵
        
        PID:816
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4480,i,1251848967280513111,17366200263975903476,524288 --field-trial-handle=2588,i,6037932694448287763,8291789671653100879,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:8
        10⤵
        
        PID:828
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4892,i,15304075071280291984,11848291107718672358,2097152 --field-trial-handle=2588,i,6037932694448287763,8291789671653100879,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:1
        10⤵
        
        PID:4784
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=4904,i,1012685071304165379,8902826758181988831,2097152 --field-trial-handle=2588,i,6037932694448287763,8291789671653100879,262144 --variations-seed-version --mojo-platform-channel-handle=4952 /prefetch:1
        10⤵
        
        PID:4648
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5516,i,14245890524926757488,14151686627623496460,524288 --field-trial-handle=2588,i,6037932694448287763,8291789671653100879,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:8
        10⤵
        
        PID:4856
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5520,i,4842815068227428511,4974126042610002424,524288 --field-trial-handle=2588,i,6037932694448287763,8291789671653100879,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:8
        10⤵
        
        PID:4600
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5944,i,14962287115632820204,15801672665086779620,2097152 --field-trial-handle=2588,i,6037932694448287763,8291789671653100879,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:1
        10⤵
        
        PID:4996
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
        10⤵
        Checks processor information in registry
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        
        PID:3476
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x240,0x244,0x248,0x23c,0x274,0x7ff9c878c188,0x7ff9c878c194,0x7ff9c878c1a0
        11⤵
        
        PID:5496
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1920,i,18020185615732520256,11279680720454933502,524288 --field-trial-handle=2344,i,5207361182968117626,10592255333116678511,262144 --variations-seed-version --mojo-platform-channel-handle=2944 /prefetch:3
        11⤵
        System Time Discovery
        
        PID:5388
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2360,i,3257223745419241701,9743070802912477916,524288 --field-trial-handle=2344,i,5207361182968117626,10592255333116678511,262144 --variations-seed-version --mojo-platform-channel-handle=3384 /prefetch:8
        11⤵
        
        PID:5180
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1716,i,2238552981335708929,371537315793080594,262144 --field-trial-handle=2344,i,5207361182968117626,10592255333116678511,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:2
        11⤵
        
        PID:1916
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4424,i,6757186974301137411,617868685675787234,524288 --field-trial-handle=2344,i,5207361182968117626,10592255333116678511,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:8
        11⤵
        
        PID:1684
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4424,i,6757186974301137411,617868685675787234,524288 --field-trial-handle=2344,i,5207361182968117626,10592255333116678511,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:8
        11⤵
        
        PID:4172
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4860,i,1987635557683118362,9530512586402272014,2097152 --field-trial-handle=2344,i,5207361182968117626,10592255333116678511,262144 --variations-seed-version --mojo-platform-channel-handle=4900 /prefetch:1
        11⤵
        
        PID:4552
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=4864,i,10150506517344723354,12893545693474285157,2097152 --field-trial-handle=2344,i,5207361182968117626,10592255333116678511,262144 --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:1
        11⤵
        
        PID:5724
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5448,i,2729867350622795849,13788783480164225125,524288 --field-trial-handle=2344,i,5207361182968117626,10592255333116678511,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:8
        11⤵
        
        PID:3384
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5456,i,8616118092472756908,15773321267147685200,524288 --field-trial-handle=2344,i,5207361182968117626,10592255333116678511,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:8
        11⤵
        
        PID:5656
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5908,i,11116269700921853817,17097720196802587596,2097152 --field-trial-handle=2344,i,5207361182968117626,10592255333116678511,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:1
        11⤵
        
        PID:692
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=4996,i,596778261723323473,334728140883655458,2097152 --field-trial-handle=2344,i,5207361182968117626,10592255333116678511,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:1
        11⤵
        
        PID:2112
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
        11⤵
        Checks processor information in registry
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        
        PID:5040
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff9c878c188,0x7ff9c878c194,0x7ff9c878c1a0
        12⤵
        
        PID:5832
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1824,i,4021131607701105226,2870786987252291850,524288 --field-trial-handle=2340,i,16772455683619808041,2381116839535356925,262144 --variations-seed-version --mojo-platform-channel-handle=2400 /prefetch:3
        12⤵
        System Time Discovery
        
        PID:1336
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1692,i,7865082002815177962,2108520849875984459,262144 --field-trial-handle=2340,i,16772455683619808041,2381116839535356925,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:2
        12⤵
        
        PID:6052
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2376,i,5973696595960278863,5763473923663551679,524288 --field-trial-handle=2340,i,16772455683619808041,2381116839535356925,262144 --variations-seed-version --mojo-platform-channel-handle=2484 /prefetch:8
        12⤵
        
        PID:4892
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4492,i,10620937832153663691,16367031631574294019,524288 --field-trial-handle=2340,i,16772455683619808041,2381116839535356925,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:8
        12⤵
        
        PID:2332
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4492,i,10620937832153663691,16367031631574294019,524288 --field-trial-handle=2340,i,16772455683619808041,2381116839535356925,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:8
        12⤵
        
        PID:6132
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4892,i,10997192116790267078,15917293678967107633,2097152 --field-trial-handle=2340,i,16772455683619808041,2381116839535356925,262144 --variations-seed-version --mojo-platform-channel-handle=4948 /prefetch:1
        12⤵
        
        PID:3364
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=4896,i,5038281610438560772,1709222819592139853,2097152 --field-trial-handle=2340,i,16772455683619808041,2381116839535356925,262144 --variations-seed-version --mojo-platform-channel-handle=5016 /prefetch:1
        12⤵
        
        PID:3776
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5464,i,13269482228861314585,6464429578863140499,524288 --field-trial-handle=2340,i,16772455683619808041,2381116839535356925,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:8
        12⤵
        
        PID:4576
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5468,i,4580828084149267930,10391347253132655011,524288 --field-trial-handle=2340,i,16772455683619808041,2381116839535356925,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:8
        12⤵
        
        PID:3108
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4876,i,4872470356647229825,3639730113216641849,524288 --field-trial-handle=2340,i,16772455683619808041,2381116839535356925,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:8
        12⤵
        
        PID:1472
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=6036,i,17450033805767913140,17940886011167243778,2097152 --field-trial-handle=2340,i,16772455683619808041,2381116839535356925,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:1
        12⤵
        
        PID:3656
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5056,i,11900266861496652595,2698167599684314490,2097152 --field-trial-handle=2340,i,16772455683619808041,2381116839535356925,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:1
        12⤵
        
        PID:3276
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
        12⤵
        Enumerates system info in registry
        
        PID:4388
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ff9c878c188,0x7ff9c878c194,0x7ff9c878c1a0
        13⤵
        
        PID:5816
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1844,i,5978940343002709961,3662709341860485487,524288 --field-trial-handle=2284,i,15909681120670751529,10317832668060368368,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:3
        13⤵
        System Time Discovery
        
        PID:5960
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1720,i,7038124465188411603,2806122914892796798,262144 --field-trial-handle=2284,i,15909681120670751529,10317832668060368368,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:2
        13⤵
        
        PID:5608
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2460,i,12954593577487804215,78329287681219688,524288 --field-trial-handle=2284,i,15909681120670751529,10317832668060368368,262144 --variations-seed-version --mojo-platform-channel-handle=2584 /prefetch:8
        13⤵
        
        PID:816
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4508,i,17017525001595801181,5217669900946614253,524288 --field-trial-handle=2284,i,15909681120670751529,10317832668060368368,262144 --variations-seed-version --mojo-platform-channel-handle=4528 /prefetch:8
        13⤵
        
        PID:5488
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4508,i,17017525001595801181,5217669900946614253,524288 --field-trial-handle=2284,i,15909681120670751529,10317832668060368368,262144 --variations-seed-version --mojo-platform-channel-handle=4528 /prefetch:8
        13⤵
        
        PID:5520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=dank+memz
    3⤵
    PID:4032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://google.co.ck/search?q=dank+memz
      4⤵
      PID:1656
- - C:\Windows\SysWOW64\mspaint.exe
    "C:\Windows\System32\mspaint.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:5868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=batch+virus+download
    3⤵
    PID:2844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://google.co.ck/search?q=batch+virus+download
      4⤵
      PID:4128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=half+life+3+release+date
    3⤵
    PID:5528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://google.co.ck/search?q=half+life+3+release+date
      4⤵
      PID:5112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=virus.exe
    3⤵
    PID:5236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://google.co.ck/search?q=virus.exe
      4⤵
      PID:1364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+to+remove+memz+trojan+virus
    3⤵
    PID:3188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://google.co.ck/search?q=how+to+remove+memz+trojan+virus
      4⤵
      PID:4376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://play.clubpenguin.com/
    3⤵
    PID:4008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://play.clubpenguin.com/
      4⤵
      PID:5960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=what+happens+if+you+delete+system32
    3⤵
    PID:3168
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://google.co.ck/search?q=what+happens+if+you+delete+system32
      4⤵
      PID:5428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=my+computer+is+doing+weird+things+wtf+is+happenin+plz+halp
    3⤵
    PID:1212
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://google.co.ck/search?q=my+computer+is+doing+weird+things+wtf+is+happenin+plz+halp
      4⤵
      PID:4060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=half+life+3+release+date
    3⤵
    PID:4172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://google.co.ck/search?q=half+life+3+release+date
      4⤵
      PID:2428

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3600

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2644

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:420

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:3940

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x310 0x3fc
1⤵
PID:3200

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
PID:3284

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4316

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3460

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6052

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5352

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: GetForegroundWindowSpam
PID:4616

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3508

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:692

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 f1516cccfe0e692bc9f5c7180aa91241126464b8929ccde707fb60bcd231c679
MD5 1d976ea1397bca0ffdd4d262c6784ec6
SHA1 7b85dfccb5f69d4f2e70df406e51205b5a527063
SHA512 5ec307e7f71b9f4fd2815fac0d10854ab2cf89c2efec812cd0ebc8b14083869889cac1c3daaba12ed1cf24b596494d864e79d08fc1454343bd2a4b155ca15fb9
TLSH
T194E0E5BAD921AC2B68F9172850440B4AE64023572B90895F363C9109CFB9A37024681C
MD5 SHA1 SHA512 TLSH

Submit Download

f_00000c

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000c
Size 436KB
SHA256 0b320d2cf00e9215763a5377904e2301b2edb7a5d299bd319259714cf8bcd9a9
MD5 38e965609b7e0769e6754549cfa3c2fd
SHA1 8ef9e62fa3ae6d8b371f5a9e9344a6cdf31515fe
SHA512 18cff962b979abf3e3d06261422f35502463a0e196aa0cf801cadcff8833a83f20c9e9f22fb3133041e406fdf2304088a0a5eaa4bbb8aff07ab15a0c1b46b0e4
SSDEEP 6144:HT+7EhQjYpz+XUGr9+7Km54TxcjJJEWv6p0qOJ7kuKtAiDL6GnkES7+S8HBWzDi2:6vj0iUI9EKFEJdU0p7riDxw7L8oviJ3c
TLSH
T147942367DF08D99BDA158361EA30EBDD1158EB6EE00A3CC844BB462CE54C0F9F6913C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000025

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000025
Size 50KB
SHA256 3335512b4f861601c9fc6d17f1653f0bcc80ecc02c07ab7952513ed19f24337b
MD5 4995b6852fdd0c81fefd4a34a0694b9f
SHA1 8286781cb6eb56ff859d4d4d11f75cc32817fc79
SHA512 1337dc69bac3609be8117444723e747b33c47a97f43f375e0cae0351ba978539eddd94569a22f8764198b9da059c49ad193b3005a3211ccce0651bb4c4346fd6
SSDEEP 1536:pJi6QZfTbSDqQEvnglwJd7F+pC5y2AAIG8vaJ2Hy:p4BZf3WEvnVJOkoiI4X
TLSH
T11F33F13487DE9E5D51B916FD18B3E01F31CC67C6CAFA82C59E880E4A03D4B854842BF2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000027

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000027
Size 60KB
SHA256 6ee71a401d4d4e624092011cbb2ab0250b378ffe8c2d1c3f331489e4a78b415f
MD5 5ba80189d0893ea3fd5fcc316b749f91
SHA1 15eac1f6f4a8474a6a5236b202641ac408ac5d8c
SHA512 857d131b4ef22f4bfed903dc3ff64eaa8ec9b3b6befcf21a76a6bea9a5630b2933e1d673fa1ca4760150540a1589a82b387eaf646b8b62824a22e1511c88b49b
SSDEEP 1536:NTjflZlPyj3gWz3mbsFtm4cIqWjJim757AgteuQhti0QVxT:NTj9ZwbgWzWbu44cJWjwY5kFuMWT
TLSH
T11D530234AE666C401C3D75F749A489626F8324615C2FABEABC0033D17DB0A9B229D597
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000028

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000028
Size 56KB
SHA256 a8f7cfdfae75a61bfac8b7496b41f59edd4cfca9fbb88f5c247390db3911dcd2
MD5 ae9f8f89c55326d51341e61d7949690c
SHA1 577760d4a1d0845d26f4c848eae8610020d7f78b
SHA512 6f93811e9682992b117597e24aa991bb5983c34cb820b7881549bc3a432c694bc42e6739ece2d202315c35abeb1e88d94b4c3c84d7c177f3d168dc0d09da9fb0
SSDEEP 1536:h/7gj1Cfn9esS0YhHxGfmQcUPeCWINStmPg:1a1qMV06ycUPeCWJig
TLSH
T19C4302C7FA00111310A494D2A42DACFEEFE9B830F457B527769408BF596B2800747F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 2b2a11a196f8563442bf58ae8b9b970e6cf3cea145b43624e207d5c7f0dea0ab
MD5 0ea865556e7a796d7324a119cbddec20
SHA1 20cd0c0be1cad8997f2e59e1511b4152a6a0faf5
SHA512 fac6213f0affba2d3cff5ae2f42b631eb5849dca18cd53b98c58518053025c4ce93c22bf582b9f73c7d954617254d61f672e9f2c235baa6bde6b49e776c708bf
SSDEEP 96:y0yInIGyr4eB7O94TtJYKHpipzpex9+JLE1FfmQU2bze7UjmraCViPsSZ2XMuwsN:1Cc2mlh0qn2cN
TLSH
T118A1E9975278F8EDE7A8F6B144B1C2927E72D65801DB2EEE531102357B80FB632D8108
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_github.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_github.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 30e002fc92e2be70d84a2ad6cdd1b2ac31dceb6018fdea63a3e74f37abe02129
MD5 1c8263cec6cbbdabf05cc89ea671f3a7
SHA1 1cb257cde4f5bfa143804cae3929bd29b7245add
SHA512 ea5ddcfb7f9d406bbad8656050ae23d64b97c569266fe895c13276be878103707bd81e20fe6434366a9443c0a7310dc8847ab7bc81c10ee04e93600e3fc9c75f
SSDEEP 192:DPge9xkjoQmImjmESaITWh1dT1uRJItIrIiIM8IV+XdNPBmJTHmGmDmzmgmtmm:DPge9xkjoQmImjmESaITWh1dT1uRJIt3
TLSH
T16402BEF7C3D8862D891156F4EB15AE1FCE2A0A18431D3C76C8D8BE4B93E2872D21575E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 a7c01877aa6ff8a26d02a479b7ea7bec1ca3c83575b3d67e80c735cfc9e2ee0d
MD5 c35de9ef0670c0185a28e6c004c20753
SHA1 d3db23cf18c4aaf7399be088cfe4663f3bc7630c
SHA512 df0db094e6a5275ee756fe8951594d14634943213f95980e061d560eecdd1ba256f8944d161da4b123fd0c648eb4ef1ab05f1f86afc4837e1923ad3f14d6082e
SSDEEP 192:DPge9xkjoQmImjmEqDaITWh1dT1uRJItIrIiIM8IV+XdNP9ZmGmDmzml5Mmmmtmo:DPge9xkjoQmImjmEqDaITWh1dT1uRJIu
TLSH
T10C12CEF3C3D5862D891156F4EB15AE1FCE2A0A28431D3C7AC8D4BE4B93E2872D21575E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 1097921e68cf339ba7a180f745bd2e21a6e3b4e9f2b8b73a0fc4124a95201e08
MD5 6f50e36645037087dda10216762c434f
SHA1 229508d9643479675a15e2aff7bfbd03e40ca3b6
SHA512 5aa7b9cc903a961d9bb321ae4abdfa0d88e80e72ace0f9faf34ce1355380ba4b811549098d28dca0644bd2f2d8554557534ed2001f8ff945eaf4034c4bdf8b7a
TLSH
T13931C0E796BE741B007C586B1D04BC096DBEE43A4252ACF4DF67C12EE0826FB1B22016
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 37cf47f300fe6ece22f048e3a50f413326d92965417e29ebaf7f13fb5c204718
MD5 f87ff7d7f88b7a5e4ffea998750a8fd0
SHA1 c07903bb74d5c4081fbfbe18d1abc50dc47a53ae
SHA512 2bf37a303e401e8a975de127864a7b29f66e3decbcb698b55b1c26267768f8fcd79e522c58083486fbc05fa9de39c6cc35275b4af02738000b43b2742b953de2
SSDEEP 192:BRWIcBhuxwrAv78pMPRpCb177/9DHsb+WNedt1I2KMui2u+FdWMt24V+D29zVyI6:BRPmhuyrc4kX45w+8Y2lze
TLSH
T10D52B56BA9102A7BECD7D225FD11BB27E3F2202665E02E94E6FC892C14D76CC3217107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 8b216dea14b7a50dee048b365f3023e7d8b8e85cfb505b0f342a5cdb266631a0
MD5 8351fc05acaaf14f877acb3216e2cd3d
SHA1 532d99839778dbe79426cd0b1498da5bb5a252c7
SHA512 82875618b1b9b693f9982a38f8f93f2a06753b05a67f48a51dae561ae514d318ad817740d2a7b19de19401a4b662cb7125ea5250efef6efbfa804cebf5cb22b3
SSDEEP 192:BRWGcBhuxwrev78pMPRpCb177/9DHsb+WNedt17ui22+FdWMt24V+D29zVyIsnAq:BRjmhuyra4kX45w+X2Nze
TLSH
T1E052B66AB9102D7BACD7D225FC12BB27E3F2102665E42E94E6FC892C15D76CC3217107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 f23c144896db19d0fe9e1e9568b0fa1264dbcf7ae8f6c14b29aac3f4a18ddaee
MD5 083aaa4897e9cc8691505baa59825b68
SHA1 77388a421082453e51f7706b4601c94603eeca73
SHA512 a0749034d4b80588e752c24f0f81f99cb52940cb6d84c221a0313b73ebdd3c81559b1e381513e47f638d0ed553f1ce35c987d98e29e7f569853a40148b08f3e7
SSDEEP 192:BRWlcBhuxwrAv78pMPRpCb177/9DHsb+WNedt1I/cc/ui2P+FdWMt24V+D29zVyr:BRCmhuyrc4kX45w+zU2mze
TLSH
T1CC52A56AA9102E7BECD7D225FC15B727E3F2202665D42E94E6FC892C14D76CC3217107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 7b06ad7ff135178d6a4619c407e2860b73083dedac045faa6a66bb342fcb1e5c
MD5 34548fb394fb7a65bdd0f4ce55ad1f0d
SHA1 7408545dc23760c58d9244fd385bd7d4ab507f96
SHA512 26de664dd9ecaed6b3709f94d4138613a5388b5dcdb96396fbb742432980d183ed6ddc71a7851661d2b0d5920809c09ec4a9591a28928814537012ee7d2f6f47
SSDEEP 192:BRWGcBhuxwrTv78pAPRp2ZD/9DHsb+WNnt17ui2L+FdWMt24V+D29MVyIsnAUgtK:BRjmhuyrr4UXg5wTX2668
TLSH
T1C942D72AB9106A3BACD7D315FD22B727D3F2102664E52E94EAFC892C14E75CC311740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 33325b8ec46dd3f49fa075a4d3ac8ade58153996095aa63edf8e29d068d7edcd
MD5 fd239a91237687d3e41764268ada66f9
SHA1 8d58d19190015d7d2da9becc24cc70510df570c1
SHA512 cdfe30fcaeacf783cce55b1bd5cb9ee65633336af1c483ad08b450f6225cc2bfec460d21106481af3d13ce11507158fb81390266f26b375957a583c8917c2fc6
SSDEEP 192:BRWlcBhmxwrAv78pMPRpCb177/9DHsb+WNedt1Irgoui2T+FdWMt24V+D29zVyI6:BRCmhmyrc4kX45w+Ts2Cze
TLSH
T1E352B56AB9102E7BACD7D225FC11BB27E3F2102665D02E94E6FC892C14E76CC3217107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 3426e293396fa1424a09f9423424627a398157ab7bfc3ec06964ae1df493a1c5
MD5 be6f9d6a2cbcb56c02708e735863c266
SHA1 974f8ac2aeecd275c490a6e72bf1549cc608ea18
SHA512 5d06f958f136237f1a30c847cff1a2af158baf7b8f8804d6c444ebc126d222c22c946442ed853f321e6823a9c6894841dac031de891b36a87a920630130e9eec
SSDEEP 384:6QjOp7KxkXqKf/pUZNCgVLH2Hfgsl9RXODOB+ErU3ymHG/5Ut4vtEp:6UOp7KxkXqKf/pUZNCgVLH2HfgsL1OSK
TLSH
T1EE52E867648D9A3B0FC8D58DDC16BF4FADB6015766780C7452FA5C0803A97CB124A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 c0cc4f1af41716639465a2cd6e02ceda304a2f92332c9a5d4c4665d194ae4ce8
MD5 c7e0d54aa7daab9271e87fe099384892
SHA1 4e715e0980b95c0622cf585b5e6993f5107e693d
SHA512 9d83752425b908477192d85575e910052c3c5766fd64dd8bf14bd67e5601a092d7470dab58f59a197817a4b86c556b90bfeecabf52c80809b113d8c54eef9473
TLSH
T128B0223A08008822C00C03B88FC02C80F3238E203383C002C0E00800CCE2202F308382
MD5 SHA1 SHA512 TLSH

Submit Download

a1208980-9673-426b-ac51-d2ba58d57c72.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\a1208980-9673-426b-ac51-d2ba58d57c72.tmp
Size 12KB
SHA256 3035ea05ed374d1a6fcb002fa582ff75b62a2f2a5e54f4898097ca0b60204e31
MD5 4f6ec56b9b20735de2367a502d6d2a27
SHA1 830a0b46bf9a40ad2a048d1b8d087a8af321b0a6
SHA512 3f4f4d3aebac57e0b1b5e03d165f71f2ff8cef6211dd32eca0acc2e6d935aeb2320332905c9cb72be391729719d476190fec7d00e7edebfcd1f727005c574487
SSDEEP 192:BRWGcBzuxwrTv78pAPRp2Z8H9DHsb+WNnt17ui2b+FdWMt24V+D29MVyIsnAUgtK:BRjmzuyrr4UXh5wTX2q68
TLSH
T1E142C72AB9146A3BACD7D315FD62B727D3F2102265E52E94EAFC892C14E75CC311740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 30e5b39c5fabb4491109ae47bee8577b249528c738fe87ee081cb0a450ddce6c
MD5 41cc4941e2e1462e6d95aff60df17046
SHA1 cb9f5fb24d6a2ba3af35ff5dc096b62b678bbfeb
SHA512 82bdcdcb392cfa07f5c16f4326e61623b1ac31fa09f4b983e0802b0a095814b04f8c7fc60b6d00160bab2c2db318aa63e527fd9577d0b042ead98beb2c9f60e8
SSDEEP 6144:i1v8i0Aw9NDv+qw5ZtA1m7Rkm1tYpBeh2BAoN:2veNO5ZtL9oBGcAoN
TLSH
T1C43412375E22DC779ED87A1E640F5B0F1EF0AD2AC914DED698C47B08636E6DD180A530
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 237KB
SHA256 b7807ffd50558ea420884ce212d08b77f977b5ba061b9029a7042592ea14d942
MD5 2f74c1574bea2f38380a5df5f3da9296
SHA1 ea00f87d1965f51aa883a901b6579a78ca80d80a
SHA512 5b24a0d8dd163ac78c81390d4f738b1e86c54adaf62478f954f9ca8ee13b86dd7c115458ad2de65f144c8f196130af71a31c04a791e8d51e6e7e003eaedb08ee
SSDEEP 6144:B128i0Aw9NDv+qw5ZtA1m7Rkm1tYpBeh2BAoN:L2eNO5ZtL9oBGcAoN
TLSH
T1CD3413375E22DC779ED87A2E640F5B0F1EF0AD2AC914DED698C47B08636E6DD180A530
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 ab8c6395cd517eccf3a1f4c500a50e94e6f592ba97ca034fda0f848215efccf8
MD5 88751bba6208fbff1aafa426b25bcc10
SHA1 25b9fd7f9ff7532c08678fe5db630feab68a3bae
SHA512 66967aa4c3a365ea89d3e6c44081cc0dd0010b3055b7cc92657f499f5991b6e0be93749c9cb2c0e804cd125d8b3342639eb8a4b2750b2b3ee6f8944ddc75b206
SSDEEP 6144:cv8i0Aw9NDv+qw5ZtA1m7Rkm1tYpBeh2BAoN:cveNO5ZtL9oBGcAoN
TLSH
T1613423376F22DC7B9ED8762A640F4B0F1EF0AC6AD914DEE788C47B085369ADD141A530
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 0a17c032688845c3b6a3831f2b9a0cb55d996859eedd7f6343f25db6bce70a81
MD5 a6dcbd00025fe6a7f15d6fff15a0b965
SHA1 adc60d74b76aadcb9ed122a94c5c686156f26655
SHA512 f0222d67bbc72bc5249bf888974b37538630fc66eb6d763ecf428b649943970e5ff7fbaa67b8535b2328bb0cbefee8f97a7248b5791771db35e141edc281ba4f
SSDEEP 6144:m1v8i0Aw9NDv+qw5ZtA1m7Rkm1tYpBeh2BAoN:qveNO5ZtL9oBGcAoN
TLSH
T14734133B5E22DC779ED87A1E640F5B0F1EF0AD2AC914DED698C47B08636E6DD180A530
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 6ce4ab2ce53723a6f648f369635f107651437abcec3f41ea76a562813f0bfc5b
MD5 b9bcadf633a92b6694e712c4ec45f523
SHA1 9ce5e65c5d239b6d57adff7fcb6947c0bc9ab7b6
SHA512 959eee6cd325f72ab863f6cf79460f1d1fdf90849de12186a5a67487968c02aadd6757a6b97ed5b1f7f748eff55d71493ea5ebe9a53d3eea7df75f73b2318631
SSDEEP 3072:JGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMO:om7Rkm1tYpBeh2BAoO
TLSH
T1F7C3123B5D75E9375D79A70EB48E0B1E1EF249A6C930DE42C8D86A0437FA7CC1A05A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 b6f03a942677ee31999d36d3ecf6a48a005a79e56d24a2414ce79db57e26864d
MD5 e79b5ac9faa7ad769c7199e550db30a4
SHA1 8fd7c06a8b9065f03a83f8395ee5697732d7ff9e
SHA512 3f909ea8023cd853081fab5f1e1308b0b2fb3af0be00b75bce6864c18843dfc0146438c352fe0b05fe6ec588af9d2b2e41ce33a6ffc77d7f7815f68b9f1cedd0
SSDEEP 6144:dv8i0Aw9NDv+qw5ZtA1m7Rkm1tYpBeh2BAoN:dveNO5ZtL9oBGcAoN
TLSH
T1983423376F22DC7B9ED8762A640F4B0F1EF0AC6AD914DEE788C47B0853696DD141A530
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 170dba82c3c1d375809e04168f3ebcd24865503047beaae16ac5acd42a07e369
MD5 3c9aded40c22ce6c2d048535ace0e977
SHA1 c74250e15a13c5f5ac83039050878df1298c44c9
SHA512 2e57432b8359c45e46f3d05d9c6a57eae6ada11c95810c76be1c532993d0a00b71e958c5a942913acd811290e76a78a313f0d89e6f1b2d2cfed07734a97e03a6
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7s:fwUQC5VwBIiElEd2K57P7s
TLSH
T1E6B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 814d47aad78c212b52568b9c7b58d242899d490d3afebce66181cae50c880df5
MD5 8c7cdfea4284ba987d295d82a9c7ddd6
SHA1 7d1a3a66f2d64a383b230196ba89a263ce7ee957
SHA512 59c8229e834c944265aed4131c79f41f9f940a48651b9fb18800cef5bae36d17c7fd5880120c6fee8ce22a157b65bc63846b65765bc4dc86e15926dcce400d0d
SSDEEP 12:sf9iXhV0xoUZxCe+JKlkQuMRxCb8TXuYJ0IJpPK6BsyW1inPiz:U9iRqxoUZxWMk8xVTeYWI31BtXP
TLSH
T105724C85B34498FFC8835E7189BD27903774F6DF1F02866B6A6A760E2E271C84F44224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ce6612fa5fcb5a512497cb33ab0a3f706834ad222b5696f08863894b1e22f287
MD5 b61a574baf562cd71b636a2b715fa711
SHA1 1fe7a2a795a9ea179937e2326d82f7d0c1f76cbb
SHA512 57b5f9e658e9938a2274a5d040d251b026a2fcdbd7196c08e91c9c8804e840797cfa3f824cd2d748b67ff79abda6aef8ac5f973bef648bd0029490924828ef28
TLSH
T141D02370B83193D0D219003C0450B5011218877236674362E140880CAD3200083C69D1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a3ad8da863c5f2a6652054134ccb5da1235a2e88b6324c6275101835cab6c4d1
MD5 1a7ab346e57d36c771200cda3680c876
SHA1 ec6e949e20a202cd8e240edab02090a70a3e73a0
SHA512 28f85c09cd18bd1b28e20171f59f994cc0a151609b6c93a46f3186286206a6ec9209f0093a534f19daafadc984db0773b5f1535be33f1cf1f730a7f5a89f9f44
TLSH
T1ABD022B4F731C760C24A00396C91F6126366D77434ABCB73E0A0984D79AA028D3DE0D5
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7dcd594f6f18ef805f198bb5182e5107870f1e1ac4352ac42e1cc55195d99f65
MD5 5d0081fe0cbe43dde4e2f8cee3bff47b
SHA1 011c00a81faaef18c57e7817766bda984c2742e3
SHA512 c5b470478c5b8eff234ee038b44e59e756c977f2a2e42fd4b4a0e63b24feb8da73b2febf1cf58a203150ed9e3a3573c6e60a1b92daee1577824b558f87690f82
TLSH
T1D7D023B4F731C750C24A00395C50F6126365D774346BCB73D050944D695A014D3DE0D5
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3f908cbf0a1614f32fad567a60725cfaa3c528d5d44fd0e0e2af4a8321cd6454
MD5 d2edb899d4320e70680a30c3690d2af5
SHA1 ef879405fe58c9ab3f165743ece83cd08a5d4e9a
SHA512 2542a67bd652e77e8f7d9af9b43dfa32fa4151e02f84a548e13f9756192ff4ced3f87c5b4da486a7581a2d654de16c03599711d5a82962143c14a1c24dca148e
TLSH
T19ED022B4B731C760C24A003D6C91F6126366D77434ABCB73E1A0E85D69AA028D3DE0D5
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f792ee00e716f7a25225ee67dfa5d4cbbfd7e436c4f3b93d615d82762861bb2b
MD5 079ac95425fa6e99e13199b4925b99e5
SHA1 de27663360ce4958f8848b0b30d1c494d61624a6
SHA512 d4bd45b4437b77eb80d49a5f9c3fd53ad64deaa0b7e48726d68f21045a254ec33744b0b7edc39a5c287476d3ebe1ef5c97b796095bab71e18fd410ece7c6b1f1
TLSH
T142D023B4B731C750C24A00395C50F6125375D774346BCB73D050944D695A014D3DF0D5
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1c8e6fcbb66aba64fe595f222fc4117e00e82ccdc0eef2100a1b4f7babb04f87
MD5 398d1e7948d46a763209c466fdacd0fb
SHA1 b26f2c32bc106089a59ce779d792beaba59f92bf
SHA512 a0bbf31d803e7333d004f03de9c261732d00cceb5d82dd64b5f0decf8adc8b840891187c72bb21cce83873e6d4dd2fab89d4c7efa320afe2ef3589678dcb1424
TLSH
T1B6D080277A196004F3964175A483D7061319956129575711F310C44CA9775D553C11C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 20a8a9466ec4652338f46fa4287f11bafb28970cff96e94d6894a119cec93ddb
MD5 9a63f0495cbf06cdc9ba7978162748dc
SHA1 b51162a446f8588a19552217c18aa27ec17950d0
SHA512 9c3134c3cb74048a4ff23b53c3cd5d4b3df0a040b0eae57d0f4bee21513ce575fc21f8485363e3086dbc05b151b14762eeab1b081d3aa8ceae3805232695ec85
TLSH
T105D022B4B731C764C25A00396C90F6226366D77434ABCB73E0A0984D69AA028D3DE0D5
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85e90176ea1e2d4389be870753bd893b7f25601e207e99c4887e4abbbdaa7a9a
MD5 e95ad0d5175237f245466e42aa3a51b4
SHA1 f59b6a73033e84e4e535456cd223db6786074e1a
SHA512 d5a398a7f288b98fbc5086f856b5d59a88055231b0b268b647074cc9afb9149f6ffc1a7e2f983f84710f879b9bbb98ece2d66e44c5357525a21f87849d7bb096
TLSH
T1E6D022B4B731C760C24A003A6C90F6126376E77434AFCF73E0A0984D6DAA028E3DE1D5
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 038dc3c95f8dafca0cc825877a83c309ac64720138c20cb669b0449b77c9ddac
MD5 0ad1daa41122183c79d9b912ee75f14a
SHA1 bd9e3367449a6afdd39c3425f2f3e83e6ca5fbd7
SHA512 443f6ad0fbb400c993bffaa01eb7a862f24be2c2690ff971b74d6535ff74ce730821f6458b2c10422e14a34611a62797118af9d24845c69af668bfdbd36bbd40
TLSH
T182D022B4BB31C760C24A00396C90F6126376D77434ABCB73E0A0985D69AB028D3DE0D5
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d3cacc59fe9b7b634a5f2adc198a0d6ab23a4628fac7abf18e9c8514c3cacf1d
MD5 667bd65a33f6a6db3f8dd44937b96b83
SHA1 80eb01b8d333f9d6e05a7868274032d84a2f62a2
SHA512 aa7fda6439d7ead5ef8e59a88bfa74fe622b4e6d946d34bd94bf6db5595c65e0d53a55fb4f6346a4080726ab55ac5b52781d06708f75b0ee283ca78e9a0fda00
TLSH
T120D022B8B735D760C25E00396C90F6126366DB7434ABCB73E0A0984D69AB028D3DE0D5
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 98105f6020d66d4a55c917a38872cd990c3c6132005fa9b91143ec3e02a6316c
MD5 f91caf3187171476dfd4ca7aa03d9072
SHA1 56a628165e0fe4e223c7fbdda2e5d3373c106fef
SHA512 c99af515d9834e2f09d7baaee739d5f1a0a0bf79e7da9ac6d2f339228aaa922babe20fb531187d95ede0e8152536050d3c817b8ab6d6040806fa46134f966288
TLSH
T194D022B4B731C760C24A00396C90F6126366D77434ABCB73E0A0984D79AA038D3DE0D5
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5d2c4e39ddbeb0ac61628bae04f1ac5787600ec893b0e230d1a84d61470771a9
MD5 cd6e704306442404371caebfec7f5b29
SHA1 e4beab8b7820af3633bf7c75a5498a958a95832e
SHA512 de66681a9245e8ece7d7e2ea2080251c395f2aeb8a885ac007eaf16f2ee3a3e36610d2afc17be964a038704371cedfbe4da91143ebed5adac20dbda97768d6e6
TLSH
T13AD080273A196404F7964175A483D7061319956129579712F310C44C99775D553C11C2
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 352B
SHA256 75b3b9b1ed14fbd10faccf8bab05e0aa60bc5fd34f8515733c296990fa898f21
MD5 302cc5dfaefa7da4223a934a01110dab
SHA1 42546f0024574c381ac61bf6854e8e94af2695a9
SHA512 ad0e0448545872a18fa32abc33e8e3822785837151ffb6c20365c6ddfbcbd4be8510e703bc8121e9c7b1bb7c8f0545e1e3fe5903c7666b850c3d97ecdf87d616
TLSH
T170E0DF551E84CDA4BE839487A14EE718C8D4B187DECCC4DE3216A49D6E846019799AB8
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 158B
SHA256 9348d432e06f74d951db7f8e1614fd5c17a944bcfe3da81a90e03707060d50aa
MD5 0c322daaa89f4064e13b86d401d8f364
SHA1 3767156ca999aa0aa2ddba1717fd2a641f2ce31a
SHA512 7d9a9595bcf9d305ed1f98e30e00e9fecd5ad5b1b76ebb2c6a30cf2cfb4abc6fd1a7d96dbcf51fcf947e2af0a3a831987f34be39a13c1e7dcb5d7b0361db1455
TLSH
T12AC08059BD4C845FC28018BE5726F000176055519417D6570650FDD032407A01F2D264
MD5 SHA1 SHA512 TLSH

Submit Download

f_000092

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000092
Size 38KB
SHA256 7165713d3e1a610399471a5e93d5677508f62ef072c1151e72273bf4bd54f916
MD5 9436affc97843765a966b3568fa7e5ec
SHA1 7bfda74bb30589c75d718fbc997f18c6d5cc4a0b
SHA512 473ec3a843c33e18d6d194651fe11353fcd03a7959225faeabf8c77484155ea6a7bccb72dbaf2093ed53c408faa3be9f6fc907f7a5ddf8223375f9d09b504456
SSDEEP 768:eUEh2+iKBVQbBhu8vjenqz2Ez6Y/AxHLEaP72sV9qKYbDblXqhP8qwFSE3uk:eUEEoBVQDjeQaLnP2pfZTqgSEB
TLSH
T11703F112148F7FA1C244F224A4EFE416ACC3F565ABA15E6980B8B7C7010E3C657A46FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000095

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000095
Size 84KB
SHA256 b02d81653438f2206e406fe74f198c4081b749f7ab9e5a2de8c1fcf349bf0f82
MD5 a06a101f4e9ae9bc3c7185f29d973177
SHA1 71ad19396030d4f261a2b79d182e107583b81016
SHA512 b022a01a0aadcaa3e9f8ede517d02121f852b5d20a3f0e07f76a01d73c412caff82f6ed33f8e8b459706741720002af2c8047988e7c4d96d360348d73cb8c1f4
SSDEEP 1536:X/Vo6Xtocjv/2uDQOwVIC+Qo+kgi1GbP5xunBQ+JPqiCEyDddmWOGPR7hjMHy5sK:X/Ntnj3BwVNfzq3lCEyYGPQHymvMNrY+
TLSH
T10A8302D04C3B7A5463A19924C5CF3A4CD4E1A65F9F97E8AD8C89B39B11F640E3C0E84C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000b8

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b8
Size 71KB
SHA256 fe41a8ee2862830877db416957252330ba89e83e1dea0f0819237907dc8869f5
MD5 1a2113829d30197e2492efdf5a810092
SHA1 3d88627768c2ce95f371df9be51aa5282ac72175
SHA512 18879951bf0ef41e174c13ecfc408ac6ec8399b61deaa4575e4b051db184cd2fd4c53e79fbcc8f63d0f771366dd809c56a1ca7a828d229959b3a453a23fb3756
SSDEEP 1536:b1G2xqsEC6EB9qpGznjlQs8fws0VaQZ575m9i54LRZtb:c2vFR/qpWjj8Is0oWH5kZtb
TLSH
T16D7302C191B67C87AC463222378C137B4167EF898BDC9138BC07455A9D699C99E14FB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000da

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000da
Size 16KB
SHA256 dd1b1bc1b12378c3f2d5257e13fce269351f7205c0b1d9a353bb6519020cd4dd
MD5 1828eec30395f0667811a9b55c744f2c
SHA1 62389846e8e32746da94a1cd5874918bc6f61cbc
SHA512 a5baf8d674ec9368cc53cf6074f6734dd5c01a7372bac636df0b064617759485d480b6dbc4036edbfaf5e54da5c44363fd51d76897fad1e959033897b377510c
SSDEEP 384:WBY2ZpX4PZRjQrzKRr39XXU0AoL6RHYnF+CP9JhBI9V6oB:WBV4PZCKV60AoLaYnY294Vv
TLSH
T1E172C0D059E96EF459DA15C4083D61105F23B520ABD3C7829BE24A72EEC27FC16FB490
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000e5

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000e5
Size 36KB
SHA256 57817ef6d0681f1ddfa0d3e07cf28a53dd54b949514c4a1b232fcdbadb67c596
MD5 0c8800c6bc03d240d0998883263dfac7
SHA1 a5f70cc9715a13a8676377fdf0c7cb729f33669c
SHA512 228747ba85b28af4da83ffc1edde736c9dfd6c07ade2973f06cab260710ceab2d4b574951ac336f5466e4a8be328f378dfe6faf1104b2e98032714bd31949396
SSDEEP 768:OHnY8GOdX2rOVNtT1z89b1sBPQbImxsKy6zTn0n40b+rvAkLOj8:+RX2+5I9RsBPVmGKVzvFb
TLSH
T11503F12F0776683A415AC98D89AA1A350184DB580339E03DADD166F0D43A729FB7BC3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000119

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000119
Size 72KB
SHA256 e3711caddf7afa2add3d7f3698a3776abcd58f100a74e2d53b1d391a44f0120a
MD5 a947eb6ad3c15f86b033134fe02ff99e
SHA1 b1fbcc9aa04104a5f326130b485a1ba8432d16dd
SHA512 25aba48af3a59c45f3914e3de8f4e0a546b7829e7631366587b1b9198c3e53be805e836c8b793aaed6d5938034baa08ea6f34d2a0e9323c00c3781b1a595bac5
SSDEEP 1536:YNXczn15vJrQgoncja0StJCfUx4lxGHqyvNOt6o:YNXcTxs4+JaUAkHNpo
TLSH
T1827302E5B6F9C81E17732A239CBFCC55E1E269F9D4C024F1066A7B951B09AA4310F3E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00011c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00011c
Size 204KB
SHA256 d7deff178f931abcb4cffc9500b26a5223686cf05c5e38add2baeee49353fc46
MD5 5fa6f6e9c52db2db8bc51969279b2257
SHA1 8e20f4298a83a5015fc7884590138a0368b5bb40
SHA512 4b4fc76da36ef268488b86a05e89ad3843fcccce0ef2d4cfb41f8fb33c642e4f0177db71bdb627dbc9732d6352fd346e7452f467ce3dd69ae8c74ca8cac93813
SSDEEP 6144:7HLEU5wm9Kkv+6HOkxaWOf+t28WoTDXbX:TFam9Kk2IxgHf+sYX7
TLSH
T1841413D832EA506B132C3156B80A215F89E154DC94A87DD9A2E287DDFC4DB317073BED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000122

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000122
Size 189KB
SHA256 5e9d3c123d3a400fc3ecc55bd3c25490a1675d8889f23dbd378a44cf42068cc1
MD5 e7efa1b0b0d6991e7f99998dedeaa220
SHA1 fc37aca8c69f10e21c1df60f1347fdba008a1608
SHA512 ae0ea539d5c8e64095dc39a595f187f532a78672bc188bbecf6fb98271862da15a18f86aacfe0f4edd2e9df01b416f3efb539a6b56f88f88af8477ac05a64f76
SSDEEP 3072:HDBY6gb7SEA0cfZb4sTymJWzMP2aUEZtmjStRxp9nxgMk+HBrAY7nsd2IKyT+eZe:HD89A0YKK1JW4PhZt9vxgX+hgd2yyka/
TLSH
T1981422EE2163C75AB1A7EC0C601C55F6EBF4FA7D1BB72AE080D835D199D5611C00B3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 9KB
SHA256 c9f74930d8cb21a4f0ab7d39df07612a5e31336943faccc6a82b09364b761b61
MD5 8a8fa8348f8a80f4430d5e152f313811
SHA1 9c44455fbc3afac8f9b97b27863678a71ea75598
SHA512 b24e7751559ee693db5a46ec7b5da27ca67a8ba0f1a4da5155f92f76170ac93b49eccfabe5e6eb8a7826232492c96908819bdd44af90d0b48d030b297074ae02
SSDEEP 192:YC3+G8IlGgCqHMQgwnF90+29apP+f7Eu5Y577:T7RCqHMQxB29ap8E+Y577
TLSH
T184122DFE3592855AEF5DC0BD00A6E41DE9A580E9F00F8BCB79204C28744BEE0F559B9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 1e6b4dce695a72438cc68d63fa05e4bb3bfc7aece0bf1f9087b1ee3b02f1c687
MD5 0eccda444e7502c97d128c3f8e728703
SHA1 1f6651c9b3fa5451907ac38f7405da69914dde38
SHA512 63286f266d0bae359aa53b9b96d12c0b77d309ff0666d5cba410783a01f7c50eb3b5d99d77b0e0d808686a4e104e1fb49e8cf333f1e6003388bb7ea3eef20d55
TLSH
T1BE714BFD2A62419BF354C27B40F2C1043AE196E8F50FCED97D908C302952FA5D269F98
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 d273770d9f768ca25339d6c37556f779295e68705057e885448be578f3349f0d
MD5 50aa56f04a9deff753c2bb985d3f3168
SHA1 1376c4d49afa131a106ad69bd2dc19162ad558f1
SHA512 5d1afb9df0b48c8485cba1625607176c0943cc2c3df3b1ebb3648313acac52dadf6c64c2e253cd6c5db8f49ee14966ae1c1ba12a646dca98aa7baa1ffee6bdba
SSDEEP 96:B5Wf7JzdB91QSCRtcxXif3Ce6ucK9Q1Q16V1m:B5UVPZCRCmeutwQ16Xm
TLSH
T197A172FD2641419BF75AC17A40E2E00439E195E8F10FCBC9BE5048347567FA4E26AFD4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 fdcf1d6bcbbedc46f6dcd2252556c23e099a4f9f705656a1bc88fe619e4b80fd
MD5 3f6d761dc1a0bfeb3a4f5bbb2a97111e
SHA1 0bc166585cfcb4bde9f14319492dd52d4ca2f05b
SHA512 c985d80e1afb5dc41d70c85a122c6140de730b22509c7489b042e31af4c820955ce3bc94b3d077d28a5f14cc5ef3b3374c2e7982083b34c051abee58ea060e02
SSDEEP 96:RycxuhT+SyFV9+U+7bihzei5avwpBpUTjW+0rPlQYw+:RyyuhTRyEXgqQdDp4jW+0Ht
TLSH
T1EAB1A5FE2511429BEB5AC17A00E2E01535A141E9F10FCBCA7E504834B567FA4F25ABD4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 f9db4d04d16c18f588cb782a0dc4d0da1931c5e8f65fd7d219708de2e60d3437
MD5 64c72b3caf7592cc758a6bb86f503b05
SHA1 5ab25c843903b70b2eee37e15c637b65af4eb8b1
SHA512 85dc339925115bad67534c189b2a870ee8765fe7761f2f471935eb3b8800aade06949d8083229db322e26044c78893950daf57776add769d6fe8d8fd8fc58999
TLSH
T19B715BFD2A52419BF354C2BA40F2C1043AE196E8F50FCED97DA04C302952FA5D269F94
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 9KB
SHA256 ebec22b5c20358c942bbe64c7e3450572196588d14fddccf8f8ec718381bbe0a
MD5 b2ac2891c9829a8e0d8aaa3391a59f8e
SHA1 b22189585e8cf34bce7c9035e4832f1babfcdda0
SHA512 c6d029406409cff85e4fec9b4aeba369af51a56a5fbdd3a68fe1682eede6cdd48e05cbe4950e71a665e5f524bbd9abaf42e4f227a423250a3e7254d314422a4c
SSDEEP 192:IyIWoy8Hs/kohMF7xSYIbcfy5606LAVOYhGK:IyIWis/koQy56pstl
TLSH
T1B71230FD7252915AEB99D1BF00A6E81CE5A180E9F10E8BCB79104C347487EF0F556BAC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 9KB
SHA256 a813b4bf6fb10f9a89a8abc271079e85fae0ccb5d49ea6793224c91fc19f49ac
MD5 644314492af2b4921b3b024826dd7d85
SHA1 191a9ede7c176be7de2e716cdf5305ffa6082fc6
SHA512 2dc45f138eeffd708da9c8922c8cfbbd45b3d65788784f64a025a43b853cd8c33eb3e964413d3e04231cfd3888cca058158bb4027b20334e538ba0252ba7de7f
SSDEEP 192:PA82FwRHLpz//bOCm/rmD34YKnHLptuex41WpWI:PRND/bOXqoVNtS1Wph
TLSH
T16E2252FD3252515AEB99D27E40A6E82CF5A180E9F10E8BCB79104C347487EF0F546B9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 9KB
SHA256 d861396004369fd0d70a2a1df99b681bcde31296fb863289c7d8c8d554adf6b1
MD5 bd457b03f221b4b720db78c424c72b14
SHA1 82fcbc3b9ed4da1dd37de71deda7232b6c605b6f
SHA512 b2c2bf7d2675bd9915803a9f218b0d5af1524480724eb7cbaf2144d30ec88bb4a0ff9882b9d39bd37e2235fb0f3d95a9be90463f2d15c8932c2aa619346f539f
SSDEEP 192:eUObfM+X5h5uewd/v/dSm+v8+bynXCwe+dA:ehrM+JqeisZv8+4ol
TLSH
T142122EFD7252925AEB99D17F00A6D81CE5A140E9F10E8BCB79104C34748BEF0F54AB9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 10KB
SHA256 0da9de1a34f66259bb5e8816a15d3af50efcb983b069e257d5edb692be3a0f6d
MD5 c8338d5d0a35028a93946220e65b282c
SHA1 b68aa120ca9875bc8f7c5adee91f8d6355f41796
SHA512 d53f17db54ff6a4ae2d5b921b5facc99ab26bd7c8b6a24ae7eca57f360f5230742deec6d1c18844d363181d6757e18d9a51b3a5ad7f48bd762eb53c928745e77
SSDEEP 192:rX3DALnM+15kkmLIYfOFHM9OYaEp4dbJ8B8hOpY:rkpvkfLI/HEOYakc8a
TLSH
T1E12244FD7292555AEF9DE17A00A6E818E5A240D9F10FCBCB79108C747887EE0F146B9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58e635.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58e635.TMP
Size 3KB
SHA256 c3880084a379f269a4d61790cab6df178e692b4b69a95ce41390cdac6c8e4386
MD5 dd088eec6a1f8c10eb3f12664bfc1e08
SHA1 ca05f2a2c33651b41aa02e7a9346da5b6df7bd8c
SHA512 006280d4371cf5604c10ba56eaca1638cb73945387b01c7e2546df860dc0076b830004ec8f74cb12947838b523b2575097d132101692e3b238dd165439b9f160
TLSH
T18B714CFD2A52419FF354C2BA40F2C10479F195E8F41FCECABDA04C302616BA5C269B98
MD5 SHA1 SHA512 TLSH

Submit Download

DIPS

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DIPS
Size 36KB
SHA256 8d62c6742c139b451b525b4edd4f9231426e2cdd23bc2628fef34e3d01562fb3
MD5 9863ea3920f3c427981116ed06bb8f59
SHA1 210bee9ff675aebd8f5bfc10423cde5575526c3a
SHA512 f79f4e79ef740471e9a3a0309164273263c15d5f7bf63284b1a2ab747a9accf36b22d5dffcc979d70c9c6d8677f31b1b7e3ba932c82017a5571f82ce7617e3cd
SSDEEP 48:TJqQq3qhmr/O43b/Y8uaLNW9WjWbfl4pwU1cx2Bk7:tCEmrm43b/LuaLNW9WjWbfltxWk
TLSH
T1E5F253478F396C52D4C6C73689C28AFA0F3E0718862F9EE849A808724DC1A4481FB0F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 b0df4f0f77e8f79b0973d1e74912d557f3f3ddc12893d82007273a049ac55084
MD5 6aa4af326d5aa09903bf1b50910e1d3b
SHA1 4ee052f5760a61ec36764234798f6c5dddb724b9
SHA512 c84fc8e3adad9ea3746076f6630edc078b73918c3d978c676a6857e2182f6ee46831d45476a856f78dd42e4f50f4ffe697d2b862e3d88c45c07fb6853e82f4a5
SSDEEP 3:MsEllllkEthXllkl2zEClluJ0Gllll:/M/xT02zh46G
TLSH
T13A44041CFFD44505C50450314011D3500370D510DF1177C334511D13FDC5D401D0741C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 24KB
SHA256 c6d4916afe377791d738646738c38049076bfc6fef3fd5b415953feccd83da47
MD5 f58402fd4d4277f1129571c0906655c5
SHA1 96cac92b71fec57b456c42673d7d175206b6bd65
SHA512 7fc4b5340a763627984b3eb6dcc796bfd2992dc92524fc022dd740dc8c8964a20cd57f23db44ab8aa05d01d526b73a150a73df13a8cf1a4593bec657fe9dc31e
SSDEEP 48:IzBmw6QU1PzFCD5ByzkeQepPoR8/ZadHetZWpfpkAAXsqY2jEUEXhmGv12mT8p:UBCxwlBbepQRIadHetgUAEYOPA1Q
TLSH
T151B206CF2F343823DF590CBA213A5974DE7BD21C6F6ADCA5382048210CF8A4650296BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 204KB
SHA256 22aa7135b71c4d42b65d0cfc494317fc57397733a8964656452497e42ae77a6e
MD5 46c1314e5343dd15838c30b324ff4bda
SHA1 07bd378d2a5b7824bfc317529222568dec1671e0
SHA512 bd335bc039af24558c87a69c8922342935d89ef4793eb9436b4a7db502fc994d4cd098f035daa6b2a05850d746f4b5956d9e1403e5cff3123ddca959f21970c2
SSDEEP 96:7jYIU+bGz83uy3+u4tgp4DLjGQLBze9z3IFjBHMsDEuspU0wbtqrOQpPfR4J+MCN:vYf+G83uy3Ct7XBBKc3H7DXspU3if
TLSH
T10A14221F5F342712CDBD817669FB44A35D7DF03F8B1266CA68611474CEE2A52A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

00b0cb3d-3773-43e9-8050-3a2730e31686.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\00b0cb3d-3773-43e9-8050-3a2730e31686.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 796b41d3f56260153099a90745e955fc7df1a4026a5c5c97d0e9c5bcbc322529
MD5 cf90a12fb8c2635b5c6188b480130b2e
SHA1 19145e6f5912683308b4be34af2b2f7e2dc380a2
SHA512 a17373c4d4bd0433a30647ebf4a84a893e0deaf4f2e91c971f734cf1235792d1a1ced9e059d7c982d5b3c4c0cc4e99422b4165a804103b37a2bbff300175be45
TLSH
T1B38179F7C3D9822E895116F49B15AF1FCE2E1A18431D3C2AC8D8BE5B93E2431D11565E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 13KB
SHA256 38a5f96a7e1d44cece736333247ec83e6161d7071465599189fb556f2fdbae11
MD5 24a6fa28fc02c18bc0a47ec5761bab69
SHA1 8a012c4fc1447ea57e0eb73571d6af253c750e90
SHA512 ebec8c1d711ce47188c426e43d8a777dddd85d3e0da09cd82a7eb2806279aa14c3ff11ea9ba9ff4ed34711da9e2103e8800992d17125a946dccffeb956eb98d9
SSDEEP 384:DGWWlt0x+ksXX44YR1JgJnk44FBxv14uQqZLU2KatievL3Gc57AnXaE71/ZXP2zS:7m97Oet6o/P
TLSH
T17152CCF7C3E8862DCC5156F49B267F1FCE1E0928422C3D2AC4D9AE5B93E2871E11564E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 5128db26c790ca6cee86ed1af14a536896beead9262efad0193e112d679dc22d
MD5 1150ad020c9d1fd848997a77db0c91b3
SHA1 1003e1482bd3eb52dbe5b500acad7aff33f664ca
SHA512 01fd04298b8ce44b4518cf8842340ef76afff38ea31e8876a1112d8b76ea59a60282a687e4a5df32a8b417a5d8c18b10fabd81b87f0a2d7da63785b357ae9516
SSDEEP 192:DZTnsXCF0yxSqBd3mF9uzZHLWNTxGicN1ynIkMgDPDaVHQPgnVxMPAnInmXu:DZTnsXCF0yxSqBd3mF9uzZHLWNTxGicc
TLSH
T17122ACF7C3D8862DCC5156F4AB266F1FCE1E0918421C3D2BC4D9AE6B93E2871E20465E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 3185d3be41e9709b3354f63ed10f22d45aa2025bd6c2b27452b3973f012aaac4
MD5 68c7c23d659aab29840b283e6a275506
SHA1 7a78efc5d75b078593b600634753dfd8ce101f38
SHA512 0567c1f2e32e5a328cac2446dffb99de7f4a4751d823a948afa2466774b7e943c0160c439630e0f482c7b90b45797935495b004c8f9ff976e14e620b426375df
SSDEEP 192:DGWWlt0x0yxSqBdL414uQqZLU2KatirGIsuGDVJqndenfnCn3DPDayQPNVMPju:DGWWlt0x0yxSqBdL414uQqZLU2Katire
TLSH
T15D22BDF7C3E8962DCC5156F49B266F1FCE1D0918422C3E6BC4D9AE2B93E2871E10465E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 351f0f016558eb5a5e9d5a2e026ce4b6568a10ba1cdd0a79b970ff188b4861f2
MD5 95631ae50eac44f9ce72dc5e03891b4a
SHA1 67acd6de24b731393652796fb632eb37cd051839
SHA512 20f81164a3bd3537b31a46e2bbabbdab5f206734c48e734d8ace3a503c07e942536fedb7f871997bbcdc51e6b22238cd794e726cbb0961b5c9bbe189e8d4e266
TLSH
T1427189F7C3D9821EC95116F49B15AF1FCE2E1A18432D3C2A88D8BE5B93E2431D11569F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 e406f835cc610dd0b7c33c9d91b2c2b5d092834593f45d5df8218359ec7c6124
MD5 2b41e6adac5f36e6bc7f5cb0c7bdea92
SHA1 e8edfbb41f046f5bac5cb3a08c00c021efc92e6c
SHA512 b85a8ff6ed5f36b187d80d41b0f27d657ce2d8968bc322800f24ba31b645cc71ce4d5ca400c528084667e72261b7af094efd2ba81b46c53bbaedc25647869f95
TLSH
T101215CA3A1BEB4272079097B1E047C46297AA83586427CF9CB6BC13EE0825F71B16057
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 af5920dae6cba7d67a7d658c6f29b279dab25805df4c10a8e4388de198126d81
MD5 fa1e57bf206f12800bf6409b408c9bc5
SHA1 7057d5d7c1c5ac08ca8eeac06a47d3c525f5b473
SHA512 13447c8351f395da28e1345fd9d3b78fce966acd5662d497aa70df707e15a0d000781e66bc8073a5326d2115260812b8a0375e260eb7201b31cd79176f1d66e5
TLSH
T146217EE7A1BE78271039097B1E457C462976A83585817CF8DBAAC13EE0D25F70F1205B
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 a2e3d7136198a5c4ce2729eb4da220fbfbb658c08d7609503da64ec1e9706587
MD5 a621e483ce0b07a0f5276ae6fecac308
SHA1 ca9e69364cd8cb04cda754053db0c5f0c12389e7
SHA512 408ce71ee345e07574494d4ffe0edb9411f31c3630309a4f92389c6454851d52b7dd08ba94cea8cf540d3d38be674d7f70b62e30a4acbb778b51b6b729d61a81
TLSH
T175217CA7A1BEB4272079097F5E047C06297AA836854178F9DBABC13EF0C15F71F12057
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 687B
SHA256 926d600f00c3d652a339fff289ee7b6c5498a853b6a359917a76170c65dc74d2
MD5 317e0566241d732695b08ee3ff2b3fe2
SHA1 8a1183499e1d956390f0965ca582de90d629f612
SHA512 95e6cecea678ca2ab0f76ebe773b3be4c421b2a2ad9bbdb60cba7be96f00052bbaadf98cdf4e5d24e5dc158ba2a0f0ffde4698e244c5734521dcf9f41018c41d
TLSH
T197017BA7A6FAB423142A05BA2F807C097A75E43D454268F8CE6AC13EE0821F71B21033
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 2b83a1149bf70b579302dde0018d407bef6417391c21c921b7330edfaf53d61b
MD5 57bd2b1045c80e40c6cec7b52a233351
SHA1 4fb6f791a4141b16c06be47073a4a9f0f77ff037
SHA512 12e82f6e4bd1f3801cb7074fd1f3ea87297583519598570d26b83e514c2735a43acedde2763a01b9bb30437fdd4d6c3b4331c8db6f8f2167ca5a64d14a2cbe3b
TLSH
T1DF219EA7A1BEB42B2039497B6E047C4A2976A835814578F8CBABC13EE0815F70F12457
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 691B
SHA256 335a2379c6ddd157c7809367f3e4730184b5be305b1de93d148e387c7d82aa7b
MD5 0afbd7a4b6af10b8f21022cdda4ddff9
SHA1 9e7f8971e81e711f8527588a95623f0d7d034c7b
SHA512 8a14f612fa324a268b168df85f9427aed13a4020a9454fe1352bdb8b6d80d739b3367b0e613bbeb448a0dada8caaa5c72bf9f9758317547b5f8a01b1701aea46
TLSH
T1F4017BA7A2BEB4675039097A6F407C096A72F43D4543A8F8CE6AC13FF0925F71B11013
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 1f2e99e4dcb1b5d16ccc7c40c9956c9cb91edc93b84b68f12939eab3e37f51bc
MD5 d6bfca99abca2e3d353712a10192f93e
SHA1 a87bb42c5d3d8c4f32629b86deb749c3a03f7771
SHA512 21ed9f42fda5bfb90a86b4a92b4a5bd46ff9b696d753906b7909f699dc57f3b4cc0d84e5fa90a631b69e780f2ea07d7a5f6afc082bb87c0e5f0cfe0c27c5c665
TLSH
T1BC215AE3E1BEB8272069097B5E457C06297AA83986517CF9CBAAC13EF0855F70B12057
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 71f6673be3813640220b0c4fabb2549ccef865dc18a00b8fe42020b96b10d999
MD5 aabd52d813f61f8d58c5af7bd89b5008
SHA1 de6dd3705efba6c682916a5ddb9c0e6509c28c6e
SHA512 b9f049852c62d8af492ac2ca2f4d7a7a561b090410ca4c5b5abb9f34e7334425c85d4cbb8b8193ff30f39d9cf9f8afb3e9217f753887d7018fd4e4d92785b914
SSDEEP 384:sxZzXq56t/fVsDWvPm8xufdtaHbkGT/cBDlVgtv3:sL656t/fSYPm8yKHbVkDWv
TLSH
T1D192F506A9345D7BDDE7D218F806BB63D6F8142385904E54AAFCDE1C04E7BED620382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 45bf2cf85733379af59c9241f411fa0d451a0bdb47d9e55fa043399886a037ce
MD5 b0dfff5afc0a2d1f75946283254a2cc5
SHA1 004c773bd931c0e844de4819656b53f086c13281
SHA512 0c0bd921e13a853ce2ea79799867601d93cf55d56997b2e7ee16b39e3baae86a3606bd0dc05ef18a111af7b0e5f4bc551acdf91a2d9469fe47accfd93986dffb
SSDEEP 192:sxZzRWyM/jK1Ml8Mkt/fVs3ImUCyIdpqc9HW6+WNrla/YCBsy1cIgrJ:sxZzcMt/fVsYmv7pHbA/Tm9
TLSH
T1DB52F8126A34A977CCCBD209FA55BF53D6F9053292941E54A9FCDA1C00E7AED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 37360ba4699b0169f48f359132d942f0a05eab8eb288996c19b5f8ab9703eb36
MD5 2a63ec11f6ae0ff40df4a3e6dd77ec6f
SHA1 1cff1967ebe1bcedd8c1abed7fffc982ccac0bed
SHA512 40d0e14896cd7001101501ca1957b08f2cee61c5bb6753414dc10c5954e30409c436f855cbbe6cb3b714267ff13f1976696fd859e03afd3e0bb19ef34ad85fe5
SSDEEP 192:sxZzRWyM/jK1Ml8UQlyt/fVsGImUR7Idpoc9HW6+WNrla/YCxXp1cIg5oJ:sxZzcq4t/fVsrmEkrHbA/vmi
TLSH
T1E552F712AA349977DCDBD20DF951BF53E6F4043292941E54AAFCDA1C00E7AED620782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 20KB
SHA256 8cdaa551b0e0cca7609466ebd891880bf11fd84d36153066ab46abaf46a2214b
MD5 d37e92c0591db5c67b9ac9f11078a3d2
SHA1 eb78128e79ff34e10894473bfbc7c4c3f4891d23
SHA512 4f065812626fe26c58fd6551a92fbd1b449f788daeea23f9ba217fd95125e87d726a68b9222000dbe93b50c62f194fd34c135f737fe2bf5ccdc4621fdc1cd302
SSDEEP 384:sxZzYqS6t/fVsKWvPm8xuf/gLFHbUHj/cKDleygtv3:sL/S6t/f7YPm8y/cHbGTDEtv
TLSH
T162920616A5344DBBDDD7D218F912BB63D6F8143385805E54AAFC9E1C04E7BED620382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 e446fd96f5b55e796cd5a9fdbb3e77a54c41e3af18ad1066c254e7407b2e2f2e
MD5 b4260307421a572dfd86e62824889a6f
SHA1 e9034e2feb4d5325e62f16e224436290bc2836a3
SHA512 d3b611f1dfbd9e246b03656c5d05b586d9e497c078e4ac7a1b70d5399a1ddf786a9059d068b970941b7de2ec070673362695698ec854b07600706d17fd85eb68
SSDEEP 192:sxZzRWyM/jK1Ml8UQikt/fVsGNWpV7mUR7Idpoc9HW6+WNzSla/YG/RpIOIgboJ:sxZzcqht/fVsqWv7mEkrHbR/LlY
TLSH
T13862D612AA349977DCDBD20DF951BF53D6F8043292901E54AAFC9A1C00E7BED620782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 0b084c139f5a56a805f36bec01f33f8696901658a2db9c99dc1163a1ddf66b6b
MD5 a39908b1289e1e524ee6d0a416a67a8b
SHA1 9503dbf010b93614525d185ae898f6279f259784
SHA512 14f5fc9946b96666c061df4372b3fd1d71162f104f68bdad53c85dd3ec8e3382000beac0eb07af88c40693e25438448ade171ef9a13ee21b64c9d3365c1af1b3
SSDEEP 384:sxZzXqo6t/fVsDWvPm8xufvELYHbHbZ/c7Dlbgtv3:sL6o6t/fSYPm8yvpHbRmDQv
TLSH
T18A920606A5345D7BDDE7D218F902BB63E6F8143385905E54AAFC9E1C04E7BED620382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 4107f1db28a4ce7456ff79f874ab031de509348f0083dc695eee8df2ae1cb4f7
MD5 7252094de77458f7e806e28d78b62fff
SHA1 0794522d0f94d16a2475179626cdd7cac8b4c6d5
SHA512 7dc90e86755b89d3437ba0b41b433f8f5e56e52ea244d5ddfb89018969c01ad14f38691f9c7dd8b76849aac6068fda58f8d5e8180332ba1a52926fda1217a02c
SSDEEP 384:sxZzmqQt/fVsGWvPm86ufUrHbf5/clD2F:sLpQt/ffYPm8ViHbVIDa
TLSH
T1BF82F616A9345DB7DCDBD208F951BB63D6F9142391901E54AAFCDA1C00E7BED620382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 03ead26d9cb150a07b18fe66efa653c59118e05bb159f01da94133a39ed261b4
MD5 373cf8f16938548c7b2258b990bb0b04
SHA1 2cf283cc3040536e58381db998ddbc37bae29d40
SHA512 7e050aad20a673db8947a333dbfb77ff4f1c6f9287fad8a9e798c9c7e92667dd7c3dce9a325113464929dee29605d9d187f46de665313d6f12acc2eefaf7a427
SSDEEP 384:sxZzXq5nt/fVsDWvPm8xuf/kHbX1P/cN8DlVgtv3:sL65nt/fSYPm8ycHb5S8DWv
TLSH
T1C582E616A9349D77DCDBD208F955BB23D6F8143391901E54AAFC9E2C04E7AFD620382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 4d25aa03ee4438178fce19b461502f71512b0efd0b2963cfd66fee393032e750
MD5 43356d2941fde811904f6333a7017fe9
SHA1 fde05050faa74e05615b79aa43d788cd7479d06f
SHA512 bfa0fdc599860b6d715c05ca59b4c694022af8b9698fdd71727bf3e3e9ed32e2f18294610d8a20618670e841f0f260f9b87ecdd95a52b0b8feb84a112b60acca
SSDEEP 192:sxZzRWyM/jK1hl8UQ2Ckt/fVs6WpVPmURG7dzodpPbHK9HW6+WNyOtm7+la/YGYj:sxZzRqQt/fVs6WvPmE62OHbOZ/SrF
TLSH
T1E572E716A9349D77DCD7D219F951BB63D6F8043391901E54AAFC9E1C00E7BED620382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 20KB
SHA256 ee8441981af705863d73df3db904c757b77c6ab2a3c204f0ea91967ea9edc038
MD5 6263f78b9e6f8e9379d242916e2a85aa
SHA1 e102e86f4b41a1eecb00b57aa55a93b34f85703c
SHA512 67ea7e0e1e63f7730b403cde6235adf42aecd5c853174cb9ff5e655ccd3daf39ce8dc25ff6709694f7bb80694860d135ce468514d61db53e1a88a0409c2697f5
SSDEEP 384:sxZzyq86t/fVsUWvPm8xufggLLH+ZPL/c5Dle3gtv3:sLd86t/fxYPm8ygqH+9kDEav
TLSH
T111A20606A5744DBBDDD7D218F952BB67E6F8142384804E54AAFC9D1C04E7BFD620382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 e0e687369f354bb4266a2abded6c219f1b28caa1ed28bfabb8659d056316a763
MD5 9e4b088fee3897af1fa9a6b2ae4f3853
SHA1 d55f29fb1cee76bb919008b93a02a613842493f1
SHA512 af3fe93a348ad5897975e360f8438917d2c360d9743c5bdc3e83a4f5719742458f6dd82a77184ef525bd5d2183d53b608e7c20e3da74a6c5bc4afc3be7812d52
SSDEEP 384:sxZzmqot/fVsGWvPm86ufIrHbK5/cpDl9F:sLpot/ffYPm8VGHbGyDp
TLSH
T1BC82F616A9349D77DCDBD208F951BB63D6F8143391901E54AAFCDA1C04E7BED620382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 21KB
SHA256 7bed18d0eceead9f5fe073d19614a4304ea24378fa54fd901ba43041f1071ee3
MD5 c030b14cc8c2b0f558a0fdc723fa6808
SHA1 e1f8274b3f08821e18002e43dec84f2460cf2a61
SHA512 4ab9e396976dbc3ff1392348b5fbfedcce5e3abe2e84f80e052c7f8187afcd8d587677807a241e31ce36ca37bcdc2aa024e198f12b9d530726e26cd3f70d8dd1
SSDEEP 384:sxZzUqM7t/fVs5WvPm8xufLgLIH+n+X/cuDlefgtv3:sLDM7t/fUYPm8yLxH+IrDESv
TLSH
T1C2A20616A9744DBB9DD7E518F952BB63D6F8142384804E54AAFC9D2C04E3BFD720382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 20KB
SHA256 b640edaa6f6086b4b5961b61135ea6800a88a9d24bd300d0b07ad4a774724bd9
MD5 4fb70488631af0b7f5db5326c56bf898
SHA1 e1c52f5cd125c0c6f378413ea1fc36fa48649c8f
SHA512 c461afbc4c0f770f97c65d45d79f62791f81c43230b96cf19293d5bdf5fc78cc4bbf1369fc596d3c80a18ea15661883dc8001a9bc7046f9e4cc86c790330920e
SSDEEP 384:sxZzYqo6t/fVsKWvPm8xufxgLFHbHHj/cPDlRgtv3:sL/o6t/f7YPm8yxcHbbwD2v
TLSH
T16B920616A5345DBBDDD7E218F912BB63D6F8143385804E54AAFC9E1C04E7BED620382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 20KB
SHA256 9f479e80fbb59613e92ed74cd3efd02ea0a7ff64c78844ebb39fdeff21f451f6
MD5 34ec39b9288b665dab538afecb8b857a
SHA1 61c5b8431a84c4c478f91fe792aa03a854b6813d
SHA512 97fc603c40ade3fdad1152d47f8146be149df0a9153211cf2ba18e73bcc9559fb2b84bfd3c4934e260d4011e7a284117f8152eee3b07993eba61ce935567f46d
SSDEEP 384:sxZzVq66t/fVsUWvPm8xuf/gLgH+UHj/chDlehgtv3:sLE66t/fBYPm8y/pH+GwDEcv
TLSH
T18A92F616A5344DBBDDD7E218F912BB67D6F8142385804E94AAFC9D1C04E7BFD620382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 2361c4dab32229e75c2f9f7318cbfe6da2853aeb1c0416c1238dcd90f865cb89
MD5 bf762b4dbea0c319db16f1768527b64a
SHA1 db506d727337bc0b663ef84817aa83497482bafa
SHA512 fbaff5dcaca0018880a86bdcdb410da04311cfaf8f866cdd6c57b6b065a36f98e80ded876829dd3f636ea5043ea5098d554d4bb7799d45dbcb903985d3ac5aa8
SSDEEP 192:sxZzRWyM/jK1Ml8Myt/fVsGImUR7Idpqc9HW6+WNrla/YC4Uy1cIg5oJ:sxZzcat/fVsrmEkpHbA/6mi
TLSH
T1C852F812AA349977DCCBD209F951BF53D6F5043292941E54AAFCDA1C00E7BED620782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 21KB
SHA256 b1b436a0046ad89e45242579d2cec3e2045c3c2aaa80a523f19c6672d7be1d0f
MD5 87545ddd5e1d120ff807a7d62aa0d59d
SHA1 652da6221e136ae3af4c3f892ae3a52602ab5629
SHA512 d684842ef761ef84536695688f87c4fbf8f1d49fb9228dfc7141af3fe38b850cfdb463c3ee5b2d9ce92e3cc4a2ceb4b01df981c45ea9c0cd61fef4cb3c39f4bd
SSDEEP 384:sxZz7q+6t/fVs7WvPm8xufdgLkH+6Ff/cCDleQgtv3:sL2+6t/fyYPm8ydxH+C7DEDv
TLSH
T15FA2F606A5744DBB9DD7E518F952BB67D6F8143384804E94AAFC9D2C04E3BFD620382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 b76c8a7cb8a675a25b64ccf10ef3b73c180d311b48259a3ed790d8283ac7ad1b
MD5 a99b1b42232f4f2e4b18cd058899f30e
SHA1 55cfe41fae7f8d9930725c38bad8d1ee1e2c7954
SHA512 37d03de05fffcfeceb90812cc6afc05477e6ee16d7c2644e815e74516382bfdb03c0751e729e87f0362a87eadf5919e2d08f761b48506c14074a91f98bcc9db7
SSDEEP 768:AN8bqn+WvSCt68F1+UoAYDCx9Tuqh0VfUC9xbog/OVnZLlRTKVLro1:AN8bqn+WvSCt6u1jaCZLbWV41
TLSH
T11ED20B3B280CCB7E4F845E5CDD26AF962DD801CB6B988D4447FA894C03C76EA512B5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8210ceeb-345c-4f71-8a03-ccbc41551587\index-dir\the-real-index
Size 72B
SHA256 cc6a316b433fb0892ba1ae3d455ce6e162646bf79e1f44c69c350185b1bd1533
MD5 1ad8eca5d6eddac6f4f136a3881a625c
SHA1 a49265780602041f7c7c99e164e40fcf01331684
SHA512 55ce946439743ddf6da5be028e3d7f4b8c1d07e098ceff342e4bb8267566dd8aae091ded79d1b0df9ea892d9c47ab06379b97321648d86d06daac318bb371b5d
TLSH
T158A002B413760C51F01215B2930246511345DC150832C3455AD0046E8866AA9B511848
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b72c29a0-bd55-435d-8f59-04769e50d179\index-dir\the-real-index
Size 72B
SHA256 2e9e7df9bf71f99f021528d7fdee88b509ec5b8a6c63f947ad4a743b9c53b05d
MD5 a2a1737552d7c387de9cc6193a682518
SHA1 859cbccf429aeb1335c0849a29c1bcb10617e200
SHA512 7976cea8a9b09819beca6a23047dcd9bd9e26d2661a53c18a3eff5c8c2d93d62e901df97a95ba89626efd98bce9d7bd4b972ad8867ba2351656ed24217ccc594
TLSH
T1C8A0023602857111D01312F269D7426136105DD4420613258690488CE8E5745E94305C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b72c29a0-bd55-435d-8f59-04769e50d179\index-dir\the-real-index
Size 72B
SHA256 c1e606bab954b60f19e1bb08290fac8f43e63e6ab2b9e3e6bf5795cb153397f3
MD5 0dbde4d164e33244e6c2ed65ac3b3192
SHA1 278e3b00d5d6d1db5266bf171bf75ea56c7d2fc3
SHA512 09b8f0d9fdfcfa9de0c0cae7e1f93d7810af9a9cd75736346689ef83f02306894e2e518b392079c254de4022a4756dbbb3e15d3e69e2e9df3792093fcbf10f20
TLSH
T1D9A0025003828405D52222F1BD5622463305CCA02100930751AA9084CC54550CDC600E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\dfa4cd3b-6396-44b1-9341-22ecfa35924f\index-dir\the-real-index
Size 3KB
SHA256 5bcdbe2b1b029a043123c3cd2a8f2a3cf3927ac834aed9de77931f4a657de7c2
MD5 c8eb1f7c079ac365850fedb0a18051d1
SHA1 b10a6c8b86fd83ef3d62c5216726761080615940
SHA512 fb341ffb8e821a1f512543e13dde4b01cc81c63761a5b3b55c49cfe4801653732ea051d434e2d05530768e8ae4ae78af967750ddf04c7102c8546872f4a6831d
TLSH
T10751B50E4D463ABACD9C14B31CF618C5333668FE5688DF47949CE8307CC36252D2D52A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\dfa4cd3b-6396-44b1-9341-22ecfa35924f\index-dir\the-real-index
Size 1KB
SHA256 8c549727e7754bbff428d401556cffd94b09be6a76db0a42b65c44f698131052
MD5 b2445ed98603e578804ca5a2f34172fd
SHA1 5ce6b926367cf59b2452fabc4e0788fe6e3d6159
SHA512 d97f868c288d801206b1f799357e1caa49ae21f8874ff81d23f77b35682ddb31858592d7dac235db2991d9dd8362daddb7b3e831a1e4fff624ad46e0d9e3b633
TLSH
T11541838A8D9495AFDC9409B204B2A0A83374CDCC2B019283587C72767C6372A1E4B1AC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5e5503.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\dfa4cd3b-6396-44b1-9341-22ecfa35924f\index-dir\the-real-index~RFe5e5503.TMP
Size 1KB
SHA256 ca0280fb507689e1c96106f05e6e95a502be9c685b4ba22ece589a9c424c0f9e
MD5 7346b5c8add04f26684a5316f363a785
SHA1 1075518cd011450b36503193fdf24999b336bf71
SHA512 ac0d8186cffd753b888584e312d363b7cb44b9c7b8d5f1c220802f3d9db06d74ea55ec1d828ef69f33ef04d8d287f34cfa079c405efc9df25b841271cf01e57e
TLSH
T13A41878A4E45851FDCD0007206D3A4B83379D9406312778794B856397CF57BD2D4F1D8
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 5410f450eb7383639445141f68815186e0499df614294aefed158bac85277c48
MD5 3ab2936164d1aaa4f618de08dffb836a
SHA1 7741adc75b6489a4b2bb8b9a0ba85ae3d9009bea
SHA512 6d4b9fa01f8ee3167638c9533023c33326cfbcc7f741d1b58092bb47d43bf9255c320ecc6eb8d351ea9c888bdc7b42daf2f00c821c18d803a5b9280de35e0bcc
TLSH
T199E068FA29E72860BC7BA3F5247048E0024AB988C94AFC9E0069A1D710B3362285AC60
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 373B
SHA256 a5a43871e4bb730f072ff7e14d411dfa30715e8ad71bb42c016171c4559326b2
MD5 ff49de6e0385588ca8022b1fb5843d50
SHA1 5c7478121d81e21ce3730eab492a1bb9af6f0e52
SHA512 e0aab45b414a3623de9786d04898f67d20c7c9e2ccd1f00981cf4aadb06bbddd94be2559f07d4d3b028be96b3df93feeace33577f7007c8e79e60e456b9601e9
TLSH
T117E068FA2DE72864BC7BA3F5147058E0024AB988C94AFC9E0469A2D710F33223859C60
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 716889ec876d4a69989d521f3eee283aa11718e43521c221fc8a24bac8d5f753
MD5 4b6fc8010704bd1c9f6fc16148678447
SHA1 b69ed2d1fe0d50334aeb268b60a58bb0872deca6
SHA512 9a2a2face8c1e7fec143d1e0703d7a2a1c75c8a5446edc2625abefe49ee7d615f05ac848763a9b19cff33b4e63f3a3729795d0c931d5833b463d400533f7cb0e
TLSH
T12BE026900AC8C9BE785720CB4339A30882F87447EECCBE033F21DB847947584B29A692
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 3430ab1ae8efbc9704d8175b7f8261db0e1c926544bd16df0a38e0aca9bd9ce7
MD5 55219a044412071201efee8bf5ca9f84
SHA1 debbb32dea2617d0773f2ebc6d978fa48cb22d2b
SHA512 a8e17aeca4e2d0cb42408fffe234215d0e47af773a3e9298319a0d08863021e91081114f7c9871ee5945d8615d3d44e044540a81006d4d107d7e5a11bf580fcf
TLSH
T14FA00271CD6C91CBC00006B0D1B10285A2109C9CAA09371141EF16B4E87A55555EA105
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5eac99.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5eac99.TMP
Size 48B
SHA256 8921f9aa1677771facc323a6097fb73bd9312b2fd18b079e20f98e26cda57d42
MD5 e45ecb6534f9d373c7b72dfacbc635ab
SHA1 a712b330d6b8c6a7bcffa2e2761cd5bb80d869b4
SHA512 e16d217058f0581248c71129d4a9ed2822f4016d0e28790be48ed0d18c4e3abdefbf74918eb46a21932770ba35ab8fb22d26aca49c21259ffb0c2b667aa13044
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log
Size 34KB
SHA256 b9221230e5f29426ddb5083bd10efa78c448c2d4ee1209be87b633ddb46c4844
MD5 655a4b61d6c6f793d34024546b4f82ce
SHA1 ece165cd62f908c9a0e00edd8b76080ea2fb1909
SHA512 5afabcfcd93a7f5221677a6d3f466cafd0914378b324b980f5f3b6541cf10e8b92c87bf4f0a7bdfdb3de8cff0135523ded07d48602f73fbb4463da5fb810015d
SSDEEP 768:LRbNUeU3B5ketqs6jketqso6zBFTIkrubFPD:LRqtz0tzJuRL
TLSH
T1CAF2D35AFBEA505DF7FF8E7518712099593EF8562C4CEC8C019106DD0D36B48D8B2E2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tabs_13430164988973004

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13430164988973004
Size 1KB
SHA256 ef98aa15e196e578975098033e1dfbf54f94aef3a4d7882ebaf09bd7562d4ee6
MD5 7303f7950a0d9f75fc733466176d9246
SHA1 1a76f4d9d4778aa5fd1322e871a20f1ccd78f27f
SHA512 7914617148a2e750311c3a55540692c39c416b7d6da01e7a35764f8d31138bcb6712108dd4e2072ca42953712d162c597c3bbfa90ad42bae04cd7ac36cd5737e
TLSH
T1B031F017E6A40879E07CC53565FA33B49EB86917A4E5DC1B604182012CE3C462B38FD9
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 b6025cc69bfa83020fb08c468602dd0aa13e7b9c81aeba9a4f2ea457ce76ab6f
MD5 60b078f8d8f7abd3702fcd737808f091
SHA1 62420cfb68e3f600d12c2df6eeef03be394bbb6d
SHA512 4a2e155ca9d3302e1d5b524d8dd5dc1ceceab69ee9855581f4c301ee278336f4b07931bb424337e1d59cfb4869e5c47547d24f4f8f771bb867d1f88303e742f8
TLSH
T1E1A0025447C12836EC1A527014819742A35469544525C20342940046ACB21405D2E841
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 120B
SHA256 d7659de88edc44a7cb4933490253bd94172b64ffe1f2a2ac4802a5332d9d5d37
MD5 fe0230edf75ecb553e9c92d164080779
SHA1 5a4f9c9711a435bbb2966dfbff718881218943e5
SHA512 6767fd13fea195c0a8313c47300ebd7361088660dae4b7b999a4666919b90ed74b7837e8d9e602969750d5af4a6b3b6791c8bb338357b44a7e104a5bf769027b
TLSH
T19FB01204BCC11C21EF041034A180A58223082C3105288313414404005413051922B441
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 115B
SHA256 b61eb451ce40cb3d2ea8e2d0bb7aaa63b05ae5e8dc5e65d44be57760456c420b
MD5 eb32035230f76ac4dc01ff83a9d121f6
SHA1 aff34bd3f2f6806765ca16e81df0c0d53c0f6e23
SHA512 39a7761b904dba84951a4558e76a00051360a1c1f11117071af5004d39206c19da693fbb376116a7bd088231a49c76319b85c3e509a82d7e69344286ef7cee8d
TLSH
T150B012447F28B009EF840A7228C157806B10B524D09341BFD8609E505D067B46DF6DF1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 b0868f39c3ceca74a638513bf3ee0dfeaba1dd2f4368bab849b11e0f2e80d5e5
MD5 e915b4b12564319330b160e1ae7d51d2
SHA1 d94d9bd944418ed1b5a000fbfd86a344827461eb
SHA512 047c62ef1cba5af42c52cd7c91cd5ef7b9214adb55abc081f8cc18effdd6b77f35b978d0e369f34692d5c1433496f80d2a5c0bec448b392fc5262a18fa42c269
TLSH
T1ADE0D8701AC9CA2A758720CB632DF30881F27443EECC69172B1CD644720B240B34B652
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 207ef8b4994f6479cda3c28210adbbad131ea9e4002199d2f2996224eefe6978
MD5 3a336526bf50b908c1821e476aaf9974
SHA1 4b9128765b7da5424c8f92e1a6922add4d8373f7
SHA512 69b4ab916ab4b52809fb50aee7f534a62a2f7c47a49a6703bbe75bf32e04283c263cbaeaacf22e78d6d8364f20361b55db647b27a17851434dff70d79c6eea4f
TLSH
T158E020B04AC4CA7A784160CB8378A71C82F07847AFCC7B03671895847902140736D691
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 e1c52ccd73f8878ec6901fcb66e655595920b96671ac6016255877ca2bf73376
MD5 dd395e8f93f406be86399d2e9f06aba7
SHA1 8613e63328ae0cc0c22ab85961dfd90f99568947
SHA512 b766c08078d74c62c28166e3b74a9e8a529ac683fda9cfb2753e4405d30652fce839ec54d7ccce763f5e82b9ad17bab3605afca474e4cfe81ff9de693256c9f7
SSDEEP 96:KA/ArPNhtY5p+L/HYKn9/lYTHnOlP1W9KKe8CaMAKdqL:ynBtXo
TLSH
T10191F362727B130338BE690DA659873B8D5132E33865A46F7BFD40910A77E212EBC4DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

db3c4df3-3c0c-4097-9844-2a684c8a2eff.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\db3c4df3-3c0c-4097-9844-2a684c8a2eff.tmp
Size 414B
SHA256 464b07f56badbcaf7f1b54f47c2ec1c9521f4471b39e687c1033e3386ee5d93b
MD5 aa908537507cb37c91ee6000a553aa0f
SHA1 cea7a112c2f16447d71888722b597b527dc97035
SHA512 f032a42a533b6247d890d5b555e6af424eb6126384984c48faa50f336adce55f4651f9bbdebc720001d93215d4b4eb112bf325d0e7da979b72b814a23b0e1864
TLSH
T19BE02BBAD825EC3B1DFD575C10410B4AE64113272A909D5B3A3DA00C8FF2ABA45C6D5C
MD5 SHA1 SHA512 TLSH

Submit Download

default_cloud_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
Size 13KB
SHA256 f9e4da319fe1f5a7d497c452421f4648a24ec7588f309ebea0f0cd61a6251eef
MD5 256c40bace492c4e28451ce149d2f9ac
SHA1 b48b0eaf986b9efc91d5c8dd394dccb6d82e2adc
SHA512 33b38d1ced015798722180fc8c8ce6daedb18cd5d0e4b3db27d6176c13cf3ccb1bd79f2e68ca390d6eb43ac508c29067e8f1a3ee9f0167cabe37ebbddf6b0ec0
SSDEEP 384:l7BJeojewj9mg1IZyvASoIL5QJwTcoEnE0YU/VwTcoEnE0GU58:l7BJeojewjcg1IZyvASos5FEnE0YREnA
TLSH
T12452007AD2211C7719B8636858BC4692F524137F8281C81F78BC656C8F7FA79A089FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe596f89.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe596f89.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser
Size 120B
SHA256 9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4
MD5 a397e5983d4a1619e36143b4d804b870
SHA1 aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4
SHA512 4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816
TLSH
T1E0B012203BF9062CF3F74D00AA73AA3428BFF4080A14811D505102080C33E19C478FA3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 872e37cb90b2ad9790500657545fef38e31e1c636e78c7f2f8a6567beac18b94
MD5 f429a87c2f95bf4ddb172e80219058bc
SHA1 8b384548f55e2db7d7b426802289ed46ff8ac879
SHA512 2d7bebcfb378c3299bc52ed2d5c4586e5c3b1e3ce9c8152b0a7eb88564f5472ade912f31db002086e13533847787d2850f13b6277fc5891d0f0571be0ccb6b0d
SSDEEP 384:XZcIhsNpRcRs2Ea+UOH+MH6ZnTKwBODNZOC3KDu:fhslaJOHZaZnewBKZOUl
TLSH
T108927C766C3C5C779DE2A448FC4732178EF84073E6D92B98E6ED6B1D00EA658130BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 13c75e841ce4af6e85b1ea16ace276e28e70889a566fc7626c784577ef36d237
MD5 2cf366cf2c5e62a7722e6b0c830dfa2d
SHA1 cff90915975b967822fc48f6d76fef0b2c019a2a
SHA512 fa75ba1728aeeff92db0fff30b80eff1a597cb5cd3e12a461127ac1cc0cf6e29d3ea8f5e552a1e478acd6c1b9241f3b2aead80951900c764ecd6952df906f37d
SSDEEP 384:9iFmZcIZKsNL8TUNTUlIlocRT2Ea+UOH+MHjZnTKwBODNZOC3KDu:0F08KwgplaJOHZDZnewBKZOUl
TLSH
T1C5D219F218EB4836D9AE9747EB7E2D138EBCC063B4956654B3D85A0CCC9617FD30A811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 c834096089ed9049a5504e483d9f263620bb9a11028d27e8ce948fa5bec91266
MD5 df1481bfb156fe45a0d8a1a22ef58eda
SHA1 c51bbdae2ef88f31c12cc2e7c9e602bdb25789a0
SHA512 b15292b267b4f008346872b937d2e299536659773ca16d131c5c6324daee3990fd50b7d1a5d5671221975d6646fd78ce6a9986eb065444a436202798f91185b4
SSDEEP 384:nriFfZcIZQsNw8TUNTUlIRxTrhq32aDfxxa+UOH+MHZy5fnTKwBODNZOC3KDHHxU:GF3CHwgg3nxaJOHZ5knewBKZOUX
TLSH
T165E2C5F598D78976E9AE5387A77E2E029DFCC063B4884994B7D85D0CCC821BFC30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 0334cf1265c4ae4b451218a21764d05348cdbaf26e1433579ab801f6bd9a9fc8
MD5 e11dbc0c294365216fd76d91cda5ebee
SHA1 eca23230fa48a5958efa257901f3ac550ee2d789
SHA512 60805c6c3d3b099bd019149d723377f9e383539fad04bbeb681acbeaf24ec527896947d650e6c773d8a9e5f6e094718ca2b89494b09df060750749185de317f8
SSDEEP 768:GFDwHwg83nxaJOHZZOSFgKsOt2newBKZOUX:Ww7AXgKBt2nevZNX
TLSH
T1880380F194D78DB6D89D97C79B2DAD0269BCC033B4884548B7E9692DEC8B0BFD306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 9061518d64120a58dda6a01736fba9afe339235b3f245025c6436958005e6960
MD5 a4158928cd0f0df56e5a24ab2832a227
SHA1 904fde8f05ebe17d9ccedfc00564a5ea75481fdf
SHA512 a60f055013e9c6d2c80420aef09ed1924c2f5c047ed83cae09890ed79fd64204fd2c12d5631b5ebc9229d193f8371e8f834f188bf1c25d079df87d458fed57e7
SSDEEP 384:9iFDZcIZKsNk8TUNTUlIRoLaP2Ea+UOH+MH/wWAStma/kY+5mkcFknTKwBODNZOG:0Fb8bwgnlaJOHZfgS695UOnewBKZOUl
TLSH
T14FF28FF198D74CB6D89DA7C7A77DAD0259BCC033B4491558B3E86A2CEC5A4BFC306860
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 499c5a21e72ec4a38f8774eaad5a161504eaebff918b8cfc06b6c1ed7909e1d2
MD5 e2aa1e6e59331072caf9ba9711fc3980
SHA1 953745bca96833d63af53bdc10810e58d25e8c6b
SHA512 101de2106e1db854b58fd6d2f8e697646d1b258ce43f21de4a56611ee0033b713267ab9ead976aaf14058f8e4833c80229c0f1946df0a29eafc86059c14b714b
SSDEEP 384:9iFDZcIZKsNk8TUNTUlIRoLaO2Ea+UOH+MH/wWAStma/kY+5mkcFknTKwBODNZOG:0Fb8bwgmlaJOHZfgS695UOnewBKZOUl
TLSH
T105F28FF198D74CB6D89DA7C7A77DAD0259BCC033B4491558B3E86A2CEC5A4BFC306850
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 b45c945dc05c40700c795a1312aa9331ffb04da936402bb58a5316aeffcc3c43
MD5 11edc5fa5cbd045f879962113065321e
SHA1 3bd3795f884b8caebd5e185e090cfda174170fd4
SHA512 da54b85102aaeb93c48194b3134ed27b119a1aa59806e15eeca188e9bbc672ffa196b8f2d76afe29a8f73ca496a9bccc99d31315f244221a6bbdac8a6c63414b
SSDEEP 768:GFboqwgS3nxaJOHZ8Y8Ln5b4MkShnewBKZOUX:youAw5MNShnevZNX
TLSH
T1D4038FF598D78CB6D89D97C7577EAD0269BCC023B5884588B7E8692CEC5B4BFC306810
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9d7ec9866bf54c9c1ada9bed7e41a3f2415318ad7efae57a8df113408c51c234
MD5 c086a7b884c39770cdc9bb341ba995ae
SHA1 5cb3420907a1f655d5c3ba80d3a25ae805f6e5c8
SHA512 8c19e0187843476a7830bbe6d2c4e06d3c774a7cb7d19ad7579be02c784442160bc070d1845ace99c91d42fcaee7a4d4c92ac35cc65bd05c744abc6656f30571
SSDEEP 192:vONJ6Db6QmiUyhZHBa+joOmw+4sRgZCU6:vONJ6uCHBa+UOH+WwU6
TLSH
T1C502E835693C6CB79EA26E45F88B37279F94203BD9566B95D6D81F0C00D764C2307837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9a60acc21103a3b5f553cbaa30d937be06e34f227351d750ac32c07d3c642e10
MD5 d17771bbadf5d42260ab474201c9a409
SHA1 701dfa5b5d6ee52619b11e014566303e8e722354
SHA512 05bfa8b008ec763fb8a75aa72d726489da637661c5a89fc2ba3418aa249dbf2ba7567a96b25dd85e39e145836cdfe0c352ccfcafeb34baf0092bbb4c37dd97f1
SSDEEP 192:dONU6DbeQmiUyiZiBa+joOmw+4z5FJNzsrqbU6:dONU6CniBa+UOH+MH/ZU6
TLSH
T1A4121936783C5C775DE2A584F88736279FA85027DA8A6B91D6DC2F0C01EFA5C130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 95c116f2e6c42d29be33100629489a2be60db5528a2921bc71111fdb028f87d6
MD5 248e2755f70108027584a6ed3db713f9
SHA1 43d96feac7d453493548401e43116c51179dc082
SHA512 49be0f1f3714aa8db53278e855557a36ae0a32085cda1e8f4a4256017b09f73fa6b6f10546266897e64e2bfb400f8c6410e0a90793b496f0aab708ec0d2f0802
SSDEEP 768:9F9l3SwgMlaJOHZvXSJn5b4MktunewBKZOUX:Zl3oAC5MNtunevZNX
TLSH
T191F2B1F298D74CB6D89D97CB5B7DAD0269BCC033B4495518B3E8692CEC5A4BFC306860
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 da4655a42a8043fe8d2a98fe55337e71458e2080b79741254d6c17042e8b8292
MD5 776536be9c013f6965a547150361a750
SHA1 d29641756b81afac36b68ebac2c573a4f4797156
SHA512 fe1c2f08f4cbb8946ef94e1ba4a4d84eb0ec42f828b1a8bc5a4ff42cf2ad8eaa9036acacf88fae43205fcf948e1a4fba48f48c889bf722f6c69293b75e6361b8
SSDEEP 384:nriFPZcIZzsNh8TUNTUlIRxTrZw32aDfwxa+UOH+MHky5fnTKwBODNZOC3KDHHxU:GFHZawgS3GxaJOHZEknewBKZOUX
TLSH
T182E2C5F598D78976E8AE5387A77E2E069DFCC063B4884994B7D85D0CCC821BFC30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 d818881e9f5ef24e356222d595ba6e538b4e2a70deadda3771d8e78b3cb7cebc
MD5 5039d1e10406be1d9e10b8a2f55c3d8b
SHA1 7a4d2d24bb8628e08e859ca6283b92c2284d930a
SHA512 2fa75ff1500db98ba753f5d5bd0779320cff1eda205418f195712a80a5d3c7cbd7446f088f864cfcb2ab9e1a9fed2bc58d0bd5475333eaa5549a3fafacca19fa
SSDEEP 768:GF987wgj3nxaJOHZIlS4n5b4MkNOnewBKZOUX:k8qAC5MNNOnevZNX
TLSH
T193038EF598D78CB6D89D97C7577EAD0269BCC023B5884588B7E8692CEC4B4BFC306810
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 f146cce7fd635b62d83dcfbb4c92719e708d1eaa73dd0759ad686edd85cabb8c
MD5 e2824f86900eb82bfd78f69fa53d597d
SHA1 dc51202efbdb310c3e3b9103556b4c683540fe9d
SHA512 09def9c0b8c5e28ff345ff582f1deb6e343146da7e15190956fe07745e5d86f6deb69a8e06e0e8f934f08eb70803f76faa7eb805f7c6e81645bcf77b46157e44
SSDEEP 768:GFEiHwgV3nxaJOHZmRSGn5b4Mk86newBKZOUX:ZiUA+5MN86nevZNX
TLSH
T181038EF598D78CB6D89D97C7577EAD0269BCC023B5884598B7E8692CEC4B4BFC306810
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 c7224fdc3c1a675426e8e75e3349cc3e020d8b414dc133cb19bacbc56433db91
MD5 907bc4169e08158f86699e3e1cb7fe31
SHA1 37c9f9758a9bed3e346fb038d0825d0ec8cb5fae
SHA512 d70cfef774e789aa8b405f8a87ce045aaa1710be5d8be46ead0641db16f912201f5cf56398fc61c52d8f39b0256be64cb5dacf4ee58e50767b555bb8048cb3fb
SSDEEP 768:GFngQwga3nxaJOHZU/SMn5b4MkAlnewBKZOUX:2gMAo5MNAlnevZNX
TLSH
T170037EF598D78CB6D89D97C7577EAD0269BCC023B5884588B7E8692CEC4B4BFC306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 53eee9598d50c80df6c9acbbe3e98f88069c4f53e9d375c38e3e9e0e3ce82ded
MD5 9086ecc4ed44ac77188cf9081f2e0ab0
SHA1 0e48a925afd126e697a650428dd1bd1d9d8c62e0
SHA512 07ae523e6ae1323a18b90b4e8449f4a9d568c7d8f44cfe69c1042e3ead58019dc8b29f1bffecf524e7fa4abdc63957a77e2b3a4da52f3f7947fddc889b1f9929
SSDEEP 384:jZcIhsNpMcRs2Ea+UOH+MH6ZnTKwBODNZOC3KDu:7hBlaJOHZaZnewBKZOUl
TLSH
T1A2927C766C3C5C779DE2A448F84732179EF84073E5D92AA8D6ED6B1D00EA658130BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 29KB
SHA256 1030435746ffcbbb98da3633dfd46a9e3a55fba8f7f85af3882a493144bb1a1b
MD5 20d2ee10cc4d5c6172ed1fe8274ed4c9
SHA1 6ed68803a4b61d3211e42fde16a8f5674f427bea
SHA512 63ca30f7ad0ccd3a4cd13c9d24fbefd2bbcce7fb7ff0741c409b0995da46ab74d81ca1a1a15a63f7a5aee2840046719837f408c7b37802ddad3939864c59f5b4
SSDEEP 384:nWiFPZcIZGsNp8TUNTUlIR2LrN2Ea+UOH+MHPOEnTKwBODNZOC3KDHHx/7Izj:9FHESwgAlaJOHZv5newBKZOUX
TLSH
T1B0D206F518EB8876D9AE9707AB7D2E035EBCC063B4851A54B3D85A0DDC8217FD30B821
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 520aeb5797db2f4821fb102bcde099b06ba4284be5ea0f24c3141211fbb95c8f
MD5 7ac9815632d5d5cc17e66fc86aa2ea85
SHA1 a2727757ecf827050c261e3d7e6b97d5b68636a8
SHA512 058cb3c5bb737e3e7306beb393d9b0bf278ad15596de63bc27a0e4f2e80ec1353f936f0b244e7349e0df80b179987069413efda4cd69cbcaa9c4b57138744f16
SSDEEP 768:9FsfV5wgwlaJOHZ26Smn5b4MkjsnewBKZOUX:AfVzAf5MNjsnevZNX
TLSH
T11AF2B1F298D74CB6D89D97CB5B7DAD0269BCC033B5485518B3E8692CEC5A4BFC306860
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 1ef2b82bae114e97d49ac6e224dc09089a0f850d04868690d7a77a8a80e3ea5a
MD5 65c8101ed9bb67fce37e63d38fbe2ac2
SHA1 2a1efb2e9c9ad61a4fcc306c6ff4277ec0ea1d1d
SHA512 1544032f32e8d73fbedf3985a386c3db42b01134484fdbb1c994ba7fa062e3bbd580bd681da498950465506cb3a69da30120d1875c06a96d6de4da8a8571b3c1
SSDEEP 384:RZcIksNpocRs2Ea+UOH+MH6ZnTKwBODNZOC3KDu:5kBlaJOHZaZnewBKZOUl
TLSH
T112927C766C3C5C779DE2A048FC4732179EF84063E6D92BA8D6ED6F1D00EA658130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 205b54b31261c051c11e3db75a662cc45e3b1acf60d1db04d587fe9df870b0e9
MD5 112e87dea3daebe08ed150bd664bcc10
SHA1 5a44d1bdf3469ea97f4a0a707de9ec4bc833f231
SHA512 1e532275f433018e35800e197ffaa69cf4abf3f2fa65346a6b52da59ecb9c39e0cecbc1dd9e1d35a48c62e49e38e736108954a564e76c3bc09242d9330903a90
SSDEEP 768:GFRedwg63nxaJOHZcLSIn5b4MkkYnewBKZOUX:ceTAA5MNkYnevZNX
TLSH
T1AB038EF598D68CB7D89D97C7577EAD0269BCC023B5884588B7E8692CEC5B4BFC306810
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

campaign_history

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history
Size 20KB
SHA256 4f7577fa4028b0c1f58bddc6497ff016fa8055977a4d5f894d3737d0a1e91032
MD5 59cd6f953643317e57fb36978925a148
SHA1 a1977fd50087ac21e3e2e850d0fd45a5b0eee24d
SHA512 537780c1dd5e7ca8337f2610316eb68ea6e82e8fccaf7c29056bae71ac2acf91ed43581c9ada2b0c662d632698f87f0758184978da139415d9b379d5e9ff34f2
SSDEEP 12:TLyeSjPFUxOUDaaWZXiDiIF8izX4fhhdWeci2oesJa/Si3isZQQtyd9cqzQd9ktW:TLyT5UOl0afDdWec9sJf9ZB5fc
TLSH
T1D492AC376D252033EDDB4B3AB98349D10EBC125EC9A7B854DED049620DA1BC2A2991FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\OriginTrials\0.0.1.7\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 4521047e06ba70b0050b7f6dc4fca3c2e055fa0d47fd920f89b1a0082a415663
MD5 087f4f2cf1156430fc662aa394a200c0
SHA1 1cdd68f7477f194a3bfe6770d752815d99d5dff8
SHA512 1f0b32d993424b4d8324032f6e3fc53f4af829ea4dfa1fb8ceaf3374f70b10886397374bf68bd46989e73fadf5237bf2d886385ca2accc7f9edf9c6a6fa3c466
TLSH
T1D6E002825304007EC474033044831B3017C6D43010B00347492041447D231006F37BC4
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5e9e61.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5e9e61.TMP
Size 392B
SHA256 8c9ae51840019b651d334ce936402e5b6b0ae389388c2be06beb63bcb64bd0e7
MD5 4a5beba2774fe85d86016cf41377c621
SHA1 53d8adca18b5113497c08144e0223f1e66b09678
SHA512 14cdcc70117df21d3ceb3ef7780a2405d7e63ffb2ea754fb27392c5301934329ab51630440b137f7fb6ebeb96567d5c7275a07c1cb95887126b2bf58035b5d3a
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 bd1dea33eaf0eb30d7cc58b9008d9d1ea24c94779feee91c80aed4c4578cbfb5
MD5 ed1eb13d796b85e125dfe0b5f9e48213
SHA1 710bd01228c7db8e0cd7c70c023371636460c433
SHA512 260533a2670adfcc5a12a993b1dc32a81472030b04238e9758120dc229b432d1a78e01637e924fe59d88fb0a673b1350dbb8a1f228649aab67a0c7fa100ba5aa
SSDEEP 3:MsEllllkEthXllkl2zECllPT+lll:/M/xT02zhF
TLSH
T1B644040C7FD45505C51450704131D7500370D4105D11574374711417FDC5D401C41015
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 85B
SHA256 b26da4f8c7e283aa74386da0229d66af14a37986b8ca828e054fc932f68dd557
MD5 bc6142469cd7dadf107be9ad87ea4753
SHA1 72a9aa05003fab742b0e4dc4c5d9eda6b9f7565c
SHA512 47d1a67a16f5dc6d50556c5296e65918f0a2fcad0e8cee5795b100fe8cd89eaf5e1fd67691e8a57af3677883a5d8f104723b1901d11845b286474c8ac56f6182
TLSH
T1F2A0120384738407E4144051C45C1341287C84570119C0012068931304240CB039643A
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

09612aae-917a-4b31-9b91-628a232e94c8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\09612aae-917a-4b31-9b91-628a232e94c8.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 5968f461f663cae02bb7292ef9338018e5faa0571ab7359b5bcae795490a7e0b
MD5 5891f43e74ad65a6541601e3af547641
SHA1 e4e6b74cc3b5fb2876c9ee71aedd232630ab09bd
SHA512 b71042f3144a667474711ed8a0389a86a6a4697339538052816bdb5dec5636c8ac46532597210209a63613bec8484bc08be790e46ab0ccaa6db67ad0a6bdb983
TLSH
T1D6411958BAF91158F3B77E5AABF6A46D087BBD372E06945D10110D4E0623E40DCA1B37
MD5 SHA1 SHA512 TLSH

Submit Download

0478bc16-bd1e-4bb3-a2f6-d6598a5ebd97.tmp

Path C:\Users\Admin\AppData\Local\Temp\0478bc16-bd1e-4bb3-a2f6-d6598a5ebd97.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e6c58cf9-9093-4db5-8c48-5769a63554da.tmp

Path C:\Users\Admin\AppData\Local\Temp\e6c58cf9-9093-4db5-8c48-5769a63554da.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

b0d09c30-7abf-4d13-9190-d7873823d70d.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4652_1733389129\b0d09c30-7abf-4d13-9190-d7873823d70d.tmp
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4652_262905646\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MEMZ.exe

Path C:\Users\Admin\Downloads\MEMZ.exe
Size 14KB
SHA256 a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d
MD5 19dbec50735b5f2a72d4199c4e184960
SHA1 6fed7732f7cb6f59743795b2ab154a3676f4c822
SHA512 aa8a6bbb1ec516d5d5acf8be6863a4c6c5d754cee12b3d374c3a6acb393376806edc422f0ffb661c210e5b9485da88521e4a0956a4b7b08a5467cfaacd90591d
SSDEEP 192:sIvxdXSQeWSg9JJS/lcIEiwqZKBkDFR43xWTM3LHn8f26gyr6yfFCj3r:sMVSaSEglcIqq3agmLc+6gyWqFCj
TLSH
T180624BCFBE204417D8F0C57530659234DFBACABA1B968EDF9CF91E529AC4C072823265
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

note.txt

Path C:\note.txt
Size 218B
SHA256 8e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270
MD5 afa6955439b8d516721231029fb9ca1b
SHA1 087a043cc123c0c0df2ffadcf8e71e3ac86bbae9
SHA512 5da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf
TLSH
T1C3D0A719040784251C7052D17145A5A09B70562D77F626EB74DC690C212700F0B37C9A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3284-3020-0x000002BCCEA90000-0x000002BCCEA91000-memory.dmp

Download

memory/3284-3019-0x000002BCCEA90000-0x000002BCCEA91000-memory.dmp

Download

memory/3284-3013-0x000002BCCEA90000-0x000002BCCEA91000-memory.dmp

Download

memory/3284-3018-0x000002BCCEA90000-0x000002BCCEA91000-memory.dmp

Download

memory/3284-3012-0x000002BCCEA90000-0x000002BCCEA91000-memory.dmp

Download

memory/3284-3011-0x000002BCCEA90000-0x000002BCCEA91000-memory.dmp

Download

memory/3284-3021-0x000002BCCEA90000-0x000002BCCEA91000-memory.dmp

Download

memory/3284-3023-0x000002BCCEA90000-0x000002BCCEA91000-memory.dmp

Download

memory/3284-3022-0x000002BCCEA90000-0x000002BCCEA91000-memory.dmp

Download

memory/3284-3017-0x000002BCCEA90000-0x000002BCCEA91000-memory.dmp

Download

memory/4616-4328-0x0000022CC86F0000-0x0000022CC86F1000-memory.dmp

Download

memory/4616-4320-0x0000022CC86F0000-0x0000022CC86F1000-memory.dmp

Download

memory/4616-4322-0x0000022CC86F0000-0x0000022CC86F1000-memory.dmp

Download

memory/4616-4321-0x0000022CC86F0000-0x0000022CC86F1000-memory.dmp

Download

memory/4616-4325-0x0000022CC86F0000-0x0000022CC86F1000-memory.dmp

Download

memory/4616-4326-0x0000022CC86F0000-0x0000022CC86F1000-memory.dmp

Download

memory/4616-4327-0x0000022CC86F0000-0x0000022CC86F1000-memory.dmp

Download

memory/4616-4329-0x0000022CC86F0000-0x0000022CC86F1000-memory.dmp

Download

memory/4616-4324-0x0000022CC86F0000-0x0000022CC86F1000-memory.dmp

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads