a3d35ee83acec6682335b2e9a053af9cabde9453d3850346d40f3f5acdeaccfb

Analysis

user interaction
yes
max time kernel
1049s
max time network
1021s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 17:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ret.ps1
Size 192KB
Sample260803-vtxvxawxe1
SHA256 a3d35ee83acec6682335b2e9a053af9cabde9453d3850346d40f3f5acdeaccfb
MD5 07bb8d35136b1b213bc3691df921ffaa
SHA1 30dd33e38fae52e07d75a75be5a6246df72dbf32
SHA512 a454e5e44f93f001220a8632eecd89d210cead71f860a70b0b39ad76e5fff3c105bb0e58b727aed38d01ac6bf40a04ea99ae401aea68b4f3146b005282af33c6
SSDEEP 3072:mFrMw1QLJLDI0+lTKpPMbtDsknWm0iGImSmmcn8aXdd:qrMw+xoWm0ommcn8aNd
TLSH
T11814D522CD6904324373D98D9D33C857F21543479A3569E3FEEC86482F743A2EAF199A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
6068	msedge.exe
6068	msedge.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_1308183521\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_155135850\Mu\Other	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_155135850\Mu\TransparentAdvertisers	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_1745599275\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_1334424917\us_tv_and_film.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_1308183521\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_1308183521\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_1308183521\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_119039688\autofill_bypass_cache_forms.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_119039688\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_155135850\Sigma\Cryptomining	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_155135850\Sigma\Fingerprinting	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_155135850\Sigma\Staging	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_1308183521\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_1308183521\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_1308183521\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_418988719\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_1643048496\ct_config.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_1334424917\female_names.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_1308183521\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_1308183521\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_1308183521\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_1308183521\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_799276141\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_1266683444\safety_tips.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_155135850\Sigma\Social	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_418988719\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_1308183521\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_1308183521\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_1308183521\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_1643048496\kp_pinslist.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_1308183521\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_1308183521\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_1308183521\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_1308183521\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_1308183521\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_1308183521\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_1454930458\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_1017146425\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_6068_1179429635\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_108_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_1308183521\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_1377532238\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_119039688\v1FieldTypes.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_155135850\Mu\Staging	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_1308183521\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_1308183521\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_155135850\Sigma\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_1308183521\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_1308183521\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_1308183521\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_1334424917\english_wikipedia.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_1308183521\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_155135850\Sigma\Analytics	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_1334424917\test.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_1308183521\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_1308183521\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_731260244\classification.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_1308183521\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_1308183521\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_1308183521\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_1017146425\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_523466315\deny_etld1_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_1266683444\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_1308183521\_locales\no\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4308	PowerShell.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2852	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134302510851644891"	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{9A74D515-D74E-4F22-9234-A3A9D5167A23}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4308	PowerShell.exe
4308	PowerShell.exe
2860	msedge.exe
2860	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
6068	msedge.exe
6068	msedge.exe
6068	msedge.exe
6068	msedge.exe
6068	msedge.exe
6068	msedge.exe
6068	msedge.exe
6068	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4308	PowerShell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
6068	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 6068 wrote to memory of 5956	6068	msedge.exe	91
PID 6068 wrote to memory of 4892	6068	msedge.exe	92
PID 6068 wrote to memory of 2852	6068	msedge.exe	93
PID 6068 wrote to memory of 4892	6068	msedge.exe	92
PID 6068 wrote to memory of 4892	6068	msedge.exe	92
PID 6068 wrote to memory of 6016	6068	msedge.exe	94
PID 6068 wrote to memory of 1176	6068	msedge.exe	96
PID 6068 wrote to memory of 6016	6068	msedge.exe	94
PID 6068 wrote to memory of 1176	6068	msedge.exe	96
PID 6068 wrote to memory of 1176	6068	msedge.exe	96
PID 6068 wrote to memory of 252	6068	msedge.exe	95
PID 6068 wrote to memory of 252	6068	msedge.exe	95
PID 6068 wrote to memory of 252	6068	msedge.exe	95
PID 6068 wrote to memory of 4044	6068	msedge.exe	99
PID 6068 wrote to memory of 4044	6068	msedge.exe	99
PID 6068 wrote to memory of 4044	6068	msedge.exe	99
PID 6068 wrote to memory of 4124	6068	msedge.exe	100
PID 6068 wrote to memory of 4124	6068	msedge.exe	100
PID 6068 wrote to memory of 4124	6068	msedge.exe	100
PID 6068 wrote to memory of 2076	6068	msedge.exe	101
PID 6068 wrote to memory of 2076	6068	msedge.exe	101
PID 6068 wrote to memory of 2676	6068	msedge.exe	103
PID 6068 wrote to memory of 4252	6068	msedge.exe	102
PID 6068 wrote to memory of 2676	6068	msedge.exe	103
PID 6068 wrote to memory of 4252	6068	msedge.exe	102
PID 6068 wrote to memory of 1056	6068	msedge.exe	105
PID 6068 wrote to memory of 728	6068	msedge.exe	106
PID 6068 wrote to memory of 728	6068	msedge.exe	106
PID 6068 wrote to memory of 4812	6068	msedge.exe	107
PID 6068 wrote to memory of 4812	6068	msedge.exe	107
PID 6068 wrote to memory of 4340	6068	msedge.exe	110
PID 6068 wrote to memory of 4340	6068	msedge.exe	110
PID 6068 wrote to memory of 5800	6068	msedge.exe	111
PID 6068 wrote to memory of 5800	6068	msedge.exe	111
PID 6068 wrote to memory of 2920	6068	msedge.exe	113
PID 6068 wrote to memory of 2920	6068	msedge.exe	113
PID 6068 wrote to memory of 2920	6068	msedge.exe	113
PID 6068 wrote to memory of 4900	6068	msedge.exe	114
PID 6068 wrote to memory of 4900	6068	msedge.exe	114
PID 6068 wrote to memory of 3328	6068	msedge.exe	115
PID 6068 wrote to memory of 3328	6068	msedge.exe	115
PID 6068 wrote to memory of 3328	6068	msedge.exe	115
PID 6068 wrote to memory of 1680	6068	msedge.exe	116
PID 6068 wrote to memory of 1680	6068	msedge.exe	116
PID 6068 wrote to memory of 1680	6068	msedge.exe	116
PID 6068 wrote to memory of 2516	6068	msedge.exe	117
PID 6068 wrote to memory of 5360	6068	msedge.exe	118
PID 6068 wrote to memory of 4304	6068	msedge.exe	119
PID 6068 wrote to memory of 3152	6068	msedge.exe	120
PID 6068 wrote to memory of 3152	6068	msedge.exe	120
PID 6068 wrote to memory of 4616	6068	msedge.exe	124
PID 6068 wrote to memory of 4616	6068	msedge.exe	124
PID 6068 wrote to memory of 2900	6068	msedge.exe	125
PID 6068 wrote to memory of 2900	6068	msedge.exe	125
PID 6068 wrote to memory of 5924	6068	msedge.exe	126
PID 6068 wrote to memory of 5924	6068	msedge.exe	126
PID 6068 wrote to memory of 5960	6068	msedge.exe	127
PID 6068 wrote to memory of 5960	6068	msedge.exe	127
PID 6068 wrote to memory of 2860	6068	msedge.exe	128
PID 6068 wrote to memory of 1908	6068	msedge.exe	129
PID 6068 wrote to memory of 1908	6068	msedge.exe	129
PID 6068 wrote to memory of 4724	6068	msedge.exe	130
PID 6068 wrote to memory of 4724	6068	msedge.exe	130
PID 6068 wrote to memory of 2756	6068	msedge.exe	131

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\ret.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4308

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\PublishLock.html
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:6068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffa77fcc188,0x7ffa77fcc194,0x7ffa77fcc1a0
  2⤵
  PID:5956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1972,i,3162535686055862387,7157167271582866977,262144 --field-trial-handle=3048,i,5194107633192122611,7258390102286969807,262144 --variations-seed-version --mojo-platform-channel-handle=3044 /prefetch:2
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2144,i,6470393297723566141,1710961716719684333,524288 --field-trial-handle=3048,i,5194107633192122611,7258390102286969807,262144 --variations-seed-version --mojo-platform-channel-handle=3080 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2520,i,186471700559332276,15002423409911446547,524288 --field-trial-handle=3048,i,5194107633192122611,7258390102286969807,262144 --variations-seed-version --mojo-platform-channel-handle=3416 /prefetch:13
  2⤵
  PID:6016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3336,i,15790538652820231219,3859296299599974949,2097152 --field-trial-handle=3048,i,5194107633192122611,7258390102286969807,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3340,i,4015433174129018318,4210904051286682533,2097152 --field-trial-handle=3048,i,5194107633192122611,7258390102286969807,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
  2⤵
  PID:1176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4244,i,12308399483139355418,14330430812987448073,2097152 --field-trial-handle=3048,i,5194107633192122611,7258390102286969807,262144 --variations-seed-version --mojo-platform-channel-handle=4820 /prefetch:1
  2⤵
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4296,i,15916667681853623830,16844559610948276427,2097152 --field-trial-handle=3048,i,5194107633192122611,7258390102286969807,262144 --variations-seed-version --mojo-platform-channel-handle=4852 /prefetch:9
  2⤵
  PID:4124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4280,i,12303436195369438405,12659691003925788549,524288 --field-trial-handle=3048,i,5194107633192122611,7258390102286969807,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:14
  2⤵
  PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5252,i,14053574602620523621,17449353456041698064,524288 --field-trial-handle=3048,i,5194107633192122611,7258390102286969807,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:14
  2⤵
  PID:4252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5328,i,6071498132390450946,15208716734861935375,524288 --field-trial-handle=3048,i,5194107633192122611,7258390102286969807,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:14
  2⤵
  PID:2676
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,3458312484457925705,15897886619666595138,524288 --field-trial-handle=3048,i,5194107633192122611,7258390102286969807,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:14
  2⤵
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,3458312484457925705,15897886619666595138,524288 --field-trial-handle=3048,i,5194107633192122611,7258390102286969807,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:14
  2⤵
  PID:1056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6316,i,11973147252436897802,12415719986708718810,524288 --field-trial-handle=3048,i,5194107633192122611,7258390102286969807,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:14
  2⤵
  PID:728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6472,i,13880462420954351544,7008708899597857687,524288 --field-trial-handle=3048,i,5194107633192122611,7258390102286969807,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:14
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6448,i,16541433725088180216,1270207248255228115,524288 --field-trial-handle=3048,i,5194107633192122611,7258390102286969807,262144 --variations-seed-version --mojo-platform-channel-handle=6436 /prefetch:14
  2⤵
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6480,i,4735133633607255291,14220730923513261362,524288 --field-trial-handle=3048,i,5194107633192122611,7258390102286969807,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:14
  2⤵
  PID:5800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6508,i,16578741351464844144,2874704821757209729,2097152 --field-trial-handle=3048,i,5194107633192122611,7258390102286969807,262144 --variations-seed-version --mojo-platform-channel-handle=6764 /prefetch:1
  2⤵
  PID:2920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6452,i,8789908113219026525,159962958368863247,524288 --field-trial-handle=3048,i,5194107633192122611,7258390102286969807,262144 --variations-seed-version --mojo-platform-channel-handle=6592 /prefetch:14
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6128,i,10491141672222992375,5246695100806879417,2097152 --field-trial-handle=3048,i,5194107633192122611,7258390102286969807,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:1
  2⤵
  PID:3328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=3816,i,9199265812303737638,1479098524964013319,2097152 --field-trial-handle=3048,i,5194107633192122611,7258390102286969807,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:1
  2⤵
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1260,i,9448355968001729381,3101017117013569121,524288 --field-trial-handle=3048,i,5194107633192122611,7258390102286969807,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:14
  2⤵
  PID:2516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1280,i,8110146364683186413,2836151401581589280,524288 --field-trial-handle=3048,i,5194107633192122611,7258390102286969807,262144 --variations-seed-version --mojo-platform-channel-handle=7052 /prefetch:14
  2⤵
  PID:5360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1284,i,7182273815204712965,9628516554712715839,524288 --field-trial-handle=3048,i,5194107633192122611,7258390102286969807,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:14
  2⤵
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5520,i,12871720141409349632,17887085019910452987,524288 --field-trial-handle=3048,i,5194107633192122611,7258390102286969807,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:14
  2⤵
  PID:3152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7036,i,9946924460818939062,10810946743119566232,524288 --field-trial-handle=3048,i,5194107633192122611,7258390102286969807,262144 --variations-seed-version --mojo-platform-channel-handle=6996 /prefetch:14
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7048,i,703141861690935320,11986295483856991559,524288 --field-trial-handle=3048,i,5194107633192122611,7258390102286969807,262144 --variations-seed-version --mojo-platform-channel-handle=7220 /prefetch:14
  2⤵
  PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7204,i,3568364540537997759,7810301906852291686,524288 --field-trial-handle=3048,i,5194107633192122611,7258390102286969807,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:14
  2⤵
  PID:5924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1428,i,6050186476132181027,6542778434263322841,524288 --field-trial-handle=3048,i,5194107633192122611,7258390102286969807,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:14
  2⤵
  PID:5960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6092,i,150503857068247945,13703277265409551337,262144 --field-trial-handle=3048,i,5194107633192122611,7258390102286969807,262144 --variations-seed-version --mojo-platform-channel-handle=7176 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5356,i,7101805384462013359,4666021682517967523,524288 --field-trial-handle=3048,i,5194107633192122611,7258390102286969807,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:14
  2⤵
  PID:1908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6012,i,6150321061006800384,8900574177849453740,524288 --field-trial-handle=3048,i,5194107633192122611,7258390102286969807,262144 --variations-seed-version --mojo-platform-channel-handle=3212 /prefetch:14
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7188,i,7737776639029683474,1383577373834534110,524288 --field-trial-handle=3048,i,5194107633192122611,7258390102286969807,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:14
  2⤵
  PID:2756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5188,i,3063875449900271622,11621210380779311986,524288 --field-trial-handle=3048,i,5194107633192122611,7258390102286969807,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:14
  2⤵
  PID:1988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7260,i,8679489817011175564,14383472631825519538,524288 --field-trial-handle=3048,i,5194107633192122611,7258390102286969807,262144 --variations-seed-version --mojo-platform-channel-handle=1360 /prefetch:14
  2⤵
  PID:5836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6356,i,11032576835837746120,11838205973292743135,524288 --field-trial-handle=3048,i,5194107633192122611,7258390102286969807,262144 --variations-seed-version --mojo-platform-channel-handle=7308 /prefetch:14
  2⤵
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6792,i,17521976793157285596,8553855000724998164,524288 --field-trial-handle=3048,i,5194107633192122611,7258390102286969807,262144 --variations-seed-version --mojo-platform-channel-handle=1284 /prefetch:14
  2⤵
  PID:904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6740,i,744981689250612191,9046044880934297006,524288 --field-trial-handle=3048,i,5194107633192122611,7258390102286969807,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:14
  2⤵
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7304,i,7541370056656877277,12881888753139981603,524288 --field-trial-handle=3048,i,5194107633192122611,7258390102286969807,262144 --variations-seed-version --mojo-platform-channel-handle=7224 /prefetch:14
  2⤵
  PID:2360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7072,i,14926733045197326802,17699162865350559650,524288 --field-trial-handle=3048,i,5194107633192122611,7258390102286969807,262144 --variations-seed-version --mojo-platform-channel-handle=7348 /prefetch:14
  2⤵
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5964,i,555231304261639216,6445721987580948321,524288 --field-trial-handle=3048,i,5194107633192122611,7258390102286969807,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:14
  2⤵
  PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7352,i,16111334261849608186,6531828478736711035,524288 --field-trial-handle=3048,i,5194107633192122611,7258390102286969807,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:14
  2⤵
  PID:3148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6568,i,9276118359886988025,7206750741971315309,524288 --field-trial-handle=3048,i,5194107633192122611,7258390102286969807,262144 --variations-seed-version --mojo-platform-channel-handle=7352 /prefetch:14
  2⤵
  PID:2596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6992,i,7583563067324265173,17305884588806185848,524288 --field-trial-handle=3048,i,5194107633192122611,7258390102286969807,262144 --variations-seed-version --mojo-platform-channel-handle=6772 /prefetch:14
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6728,i,13687683151108212978,5926046613072973373,524288 --field-trial-handle=3048,i,5194107633192122611,7258390102286969807,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:14
  2⤵
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6740,i,5909318005978836588,4383640369022670673,524288 --field-trial-handle=3048,i,5194107633192122611,7258390102286969807,262144 --variations-seed-version --mojo-platform-channel-handle=6964 /prefetch:14
  2⤵
  PID:5544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6848,i,18414914926088269781,6441379661871102698,524288 --field-trial-handle=3048,i,5194107633192122611,7258390102286969807,262144 --variations-seed-version --mojo-platform-channel-handle=6960 /prefetch:14
  2⤵
  PID:5664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6972,i,9646918850406115519,4562972480755253848,524288 --field-trial-handle=3048,i,5194107633192122611,7258390102286969807,262144 --variations-seed-version --mojo-platform-channel-handle=6776 /prefetch:14
  2⤵
  PID:3656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6960,i,1754106696095100396,16191911412363424385,524288 --field-trial-handle=3048,i,5194107633192122611,7258390102286969807,262144 --variations-seed-version --mojo-platform-channel-handle=6728 /prefetch:14
  2⤵
  PID:2676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7072,i,4531560763704194079,5292232588441718518,524288 --field-trial-handle=3048,i,5194107633192122611,7258390102286969807,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:14
  2⤵
  PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6568,i,15132057093599895643,1288814980681069201,524288 --field-trial-handle=3048,i,5194107633192122611,7258390102286969807,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:14
  2⤵
  PID:5936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6020,i,13870090040417657395,12955605044502732310,524288 --field-trial-handle=3048,i,5194107633192122611,7258390102286969807,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:14
  2⤵
  PID:5704

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5788

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:628

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4740

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:3396

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8aaa68aad07ba45abe53bd513aa5f7e7b21bd1b29db6e1d5c1e0a79a5f4eb890
MD5 74012bbce5fada7634c1da1b567562b3
SHA1 09db27f38f27e35986cfd407b57f6f83c8fc59f8
SHA512 c1a6a98f972793c84274c29552107bfe07b775c7c8121e5fdf137ebf9a7cc3f4eb43fe9eadfc842e7b92ca7281bbcea3d660bdd8fc9adc56add068510c41e48d
TLSH
T1FBD02BE07640890CC980203335F75240920189108401D1480040F335CC845C1257E0CF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e413e02b9e80ee8d76d52c1043fc32251e2d7634d4b2fbd970df9ace9d91831a
MD5 22959b3a06a842ac30237dd57e8a3801
SHA1 0b7c28071a592034aa2607038000f085c7bb6362
SHA512 644add9ab912ad7fdfc55bc7a1b84482c75cc9bc69a59d169bae63a0400619d999846ebbadb0ef2bd6d35c2bd08a5f07053b600874dd5dfcbda7e8f3076131fe
TLSH
T1A5D02BE476408A0CC980203335F6524092018910D801D1480040B325CC845C1257F0DF
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG
Size 331B
SHA256 ff9b2e9f03c58d85578916c6e1c9775f3954904fc9c080205a79bf20da9f8b49
MD5 53c312da3caf724b33defe6094b16c46
SHA1 30afe4e87e6115017455314c4946675b6b687dfb
SHA512 e1a2852cd0ee3e1e4db1d03adfa639fd152b317a2e1de53fc0fe352a8afab5df7101a13f936a64f0754059d76a746b41affacdbb6067589342d1a902a15d72e2
TLSH
T128E020D815CCC2ED5E016547517CA74C81F0360EE7C8AD451F208C4A7441084B285BE0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 c2fb3eaea46542b57908de59b138630413a82bd550bc3a4055b58ec286e1be81
MD5 698d1e58219befdb8e1514cfee5342e8
SHA1 bbba51b74bb4a2c5a02ad282de30f0b8a7e9bc3c
SHA512 3231594394aa6d3e750ccf820bd3d412297e41d20ae2ad177b7a12d21734c5cc1789db6854a3d099dd97be8fe90ac2906c0a24c60ea334bb0b7e35aa81f7cb87
TLSH
T1A7E0208C18C9C76DBF416447517D930CC2C03A4FA6CCE9061B14C58974021807381B60
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 fec7180a509492715a79fb5ddabaa3719d1970f16f7c0cc7743c5d3091c61cce
MD5 83a0c16490a3d6e4461631e96d010919
SHA1 12def9499ebc19bdf4d70ad655001c9a5fd8388a
SHA512 7026185d6a378be8976d66f1b56170ac03255b77e9edeb11d21ed2db0ca7638ddc7c2dee8f28664266f4f380fe4c3e23c3fd405a3ba8e311adbb71f55f2cb55d
TLSH
T127E020C815C5C25D7E406447529C730CC3D0364BF7C4AD4E1F14848A7445084E699960
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 68430f8ec3309c5ca4e41843295f9d9db359a5489118b962949430654bfaef32
MD5 5e49599c53fefbc72586aa3e832953ac
SHA1 80f3276b9036b02bbb9a8b36dcba862374539d06
SHA512 5e9b0d8be06036d048ba095fdaaa9c155c9fdeb6a923814280b85ff728c332cf2ef15d2d7371075f40baad4006d214d29d7486f3db5a693b52067a6e5689c25f
TLSH
T13FE020C418C4C62D6D40E44752B8930CC2E1368FAFC4B9552724848A744158063D3AE1
MD5 SHA1 SHA512 TLSH

Submit Download

f_000075

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000075
Size 60KB
SHA256 fd394cc3c5cbc059b945afc60e24a873c79e4e9f9ba018e12f0133b74a344cac
MD5 a2b0e8c0eccd89e78e88b3a5f26be72b
SHA1 2e8f79a77fd3b93f4a57adde378cb799535a2e0d
SHA512 97187f5b12ae4639f569d8931a14c913016478e3e3e559f6a1ecd201d8e9f5b8d7a836925d6aafbf28dda5a81777b91bfd6bcab7ff921a4f834c5f4368d79308
SSDEEP 1536:pGs0//BOPTNfTOT3m2axThH+N1XohWskES2cDj0AX73Fpk:DE/BCTN7Ota3sohWxjDj3rFu
TLSH
T15D530299F60C307956EC6B4B1E0DBA87CA2F3A0C3B44CF287676334966CE6B55A4540B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000078

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000078
Size 72KB
SHA256 f85f421527528f92927ea93b9979c306ec54682fc95c5e76eee0ea5110f0667d
MD5 2ec5d3df896759ae7d3c27233b722826
SHA1 65b989c57886bc7a6cf7f551a66905a23eaf05dc
SHA512 dfc89a839b52791a8ed8fd4a5933add4605e3eda9ba65574c4242526fd7ed85a760c5754765626cf8969cd4007524ac32c53374d5ce1970b1d8285740a16e73d
SSDEEP 1536:aqqNyol5hICcSYsHPrtqkUB2bqjqs5p9QdwulnOwxd2cBNXVQBLarEKp6qzv9:arvIClYCrtqvgZs5kdwynOwx0Orzrzl
TLSH
T1E573122F4FBA86F8C732856287820A2ED851C85FE9C09AD453ED5CEC87706640C3B5A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 fdc8fadbec17f5e020cbe9f30744223560a69556a1ad78905ccbd39ae51c63ed
MD5 20024f56ac06fac199d8724d71b494bc
SHA1 80f39da8e9c84afbbe10aa1354c9c56c58933365
SHA512 78481b235c608407f0ed1e0a78b25d28777e9d573cd178a1d071721ffb5db53b5637ebad90bc0e041a0a2f0d99c9821990622ca4df7bda8d583b75b0b805d5c0
SSDEEP 96:ert4Ik8aJLIViT+2JaLQcARuAM1twkxYaoN3Gpb:eu8aJLIcJTcARupqvnN3s
TLSH
T16ED189A861F01592DFACE4BA11D76D95B1F6042024071FF722426DB879BEFE4DCD8853
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe59ec2b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59ec2b.TMP
Size 3KB
SHA256 2cffe6a48a54205f5cf1e173ab1cb9c43f36cd1221f0a4414025022b06a2f531
MD5 4226ce94fc4d15da4bc2b68dc9bfbd2a
SHA1 f18733a35d5fbaa559f68ba20802d7760bad87c9
SHA512 e8b0f15acb3ee72376dfbfcd74dcd7cd875b134f2ce8842c0e1d2b1f08c242a19a561bc7e9fff3fa1c304885ace6c6b71add87395f3b2db20a77976b59318aee
TLSH
T16661415963210EE3EBE5C9F196E1B48831F78C61450BAB3A4293ADF06CAAF7851DC417
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 41d045a371d63d15623a01e1cc159865328a82d9165dc57683cfe283a0fbeda4
MD5 6cddb82fa16671d42fb4cd85442ce3b6
SHA1 7b432e4a1909ad94db0c3ea7e7fda8212e629486
SHA512 2f0259661439ef6be42964fc8f0ecbd09e1d3daa81d719b0a4a19fa059e0bb4fe2992d30049d3823316f3579bd4ffdbb2a6af1a7f740728b529ee1a208495016
SSDEEP 96:D/O1MvF2fLpaHgazBiZiIEBzvcGt/tj4/F/GwQ:DW1MvF2fLpaHga1iZiIgzvcGt/tj45GT
TLSH
T1C391ACF783F5826ED91195F0EA086F1BCF1C0452436C7DAA85D0AE1BA3F2471E181B9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 2c916bac66daaeb32c9666df71d39ec5a19bdd8dfac7213caba4a5c1e45c1689
MD5 e6b1eb111cd03333df196a5f1f6d98c7
SHA1 de55a716f656144db056fe936dbf62f0b694ac17
SHA512 bd46ec221b2b9d2d3ea37348b1adc13fe70536dce1668345b5cadc6b6c9c6a0d7962834a871ee2a6a226135b8c79f3baec738771bc913344df87f82f2974548b
SSDEEP 96:D/O1MvF2fLpaHgazBiZiIEBzvcGt/twBGj4/3:DW1MvF2fLpaHga1iZiIgzvcGt/tkGj4v
TLSH
T153919DF783B5826ED91195F0DA08AF1BCF1C0452436C7DAA85D0AE1BA3F2471E191B9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 b59cda0278a395a53526436d292c6c71607b42d22f937ea342663faaaa60bc5b
MD5 fe21d3750305744572625973edcca6ad
SHA1 6e82ba9c267e0045dfb0da56679fc77d4e47c19b
SHA512 bb76a8c50edfc1387fcd4f9600a9fae7df7430b7c4e97a7d42b348318a3dbfa2a90932df5ba3c7b3d3e8bfd9df61c174b8c1a69100eac765ff9ee5f9bb0ef14a
SSDEEP 96:DEODs0DAKozpaHgdzviZiIERTzG8GwYf/k:DPDs0DAFzpaHgdjiZiI0TzG8G5f/k
TLSH
T188B1ABF3C3E9822DC91152F0AA187F1BCE1D0955436C3D6AC4E4AF5BA3F2471E191A9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 6c49916219c62270a906b3fc480dfb3dbc2c77cf447ec983fb6d1dd2161020d1
MD5 935972ecbc8d42202677c31c12a0e1b0
SHA1 922c3dcfe75aadbf64bd7f1797d2c958169c07fc
SHA512 0e299757faff98ac36b3d88ab20b3dbb52eb33dae9883a3ae10a86c457e0e91ae74ce8e76afdf6bd3584d1cbdc8d03f43b3b2df60bd55697dad712805c6acf98
TLSH
T1E5D022632210B0B6A96C3ED2606AEECFD33610710842EDD520E0A89A15324AC064B686
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 7d25951ca064acc5e85914d8cfea0da9ab25bfac4ed44ff600d363292cd6ada5
MD5 c9a95002fc9e0472faa77284c56a1160
SHA1 f3425c3159d9baa3ff95aafa04468185f7ae9e46
SHA512 67517bcb40d1da4a1cf70e4d54d3b09dadb4a3ed4178ae09e3b9dcbc58a241a14abd563df3f96f8bc3611c1fc47d941cbad0e0d55784e0c4e7e5a17b9d771513
SSDEEP 192:sxRXR6xP/fRslPqZFVSoiFoA8pJFs/g6+WNPsr/Ynm3hoGbIgVSWSJ:sxRX+P/fRslP8F0s8/5I/fRfE
TLSH
T15D42B7166A68693B8CC7D21DBB15BF63D2F95032A1D41E58F7FC8A1C04E66DD620780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 9d01ebbf6632f57094f5d9a691ac4f6620c7db46735aa8a15c0a1da73fbb4932
MD5 63c29afd0ae55082c1c04ee1da2df02c
SHA1 313bf373de1ea9c336e1ab18400e2fabd412417e
SHA512 dd6cb422dce3a9e21d1d78cc71686e820ae40112d8fce5bce95e1f87c2ec70af6dd8ea8d95d3b8eb67a147b85788e974bc0e2a6212b330e3f30b8f12f75067c6
SSDEEP 384:sxRsLm1P/fRsVR8F0Pfc/5McNu9/rvcfALT37oC2:sgLm1P/fyRXPk/5McIBrvcU37I
TLSH
T1A872E717696499778CC7D61DBE31BF66E3F9102298911E5CABFCC91C04EA6ED2203C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 1b458f756f649eede9d57bab58a22130367876e46838d030bf4d6092ea92bc35
MD5 b8c0295700e5eec6cd0a84e78de0ab29
SHA1 489437a75e36022293a4fffb9069e3d15f283d3a
SHA512 bc60fb370d9f215b4eb6b22720ea9468aab9a290f9ec3bc972e5eb196c813720c138c76a514d1cefbfc80c3ef408c4e0233a9e484bbbf60224b6cc1301826288
SSDEEP 384:sxRsLm1P/fRsVP8F0PTc/5McNu9/rvRfeLT37oC2:sgLm1P/fyPXPg/5McIBrvRK37I
TLSH
T1A372E713696499778CC7D21DBE35BF66E6F9102298911E9CABFCC91C04EA6FD1203C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 31KB
SHA256 4dff38630dee8ddfa32b196bad99c787a0aef60b29adabe04cbd28dcf27aac3c
MD5 a2af70ebf90779e5a9b541e87140ca20
SHA1 dbd07736be87f1adb95f34990e9dffe3e47a8758
SHA512 7ee46e185cdde6a9ba1a6a59166b956d7869d7806b60c0faccd933b71d464ab47a9832bd591e50a49b7afcb4d50076f261455ebab22592202c1938bd5f9e7b81
SSDEEP 768:sgLm1P/fyE4Mnc7WeT+cXP6/5McIBrvcU37I:bLm1KlMmWGf0srX37I
TLSH
T122E208069920C8778EC35D1CA93D7E32EAAC505259C5CEEE66ECC91C019E1FDAF07867
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 be30b5dc3ca9610e2bfd6df987bda048e5538b7ad40cc55ef62e24b0e106ddc1
MD5 a0418b516196fcb25fc00e4fe25fc9eb
SHA1 7da7140295bf70dd825f69367c4b5d8ace0b4abe
SHA512 10f486ea20676fca13c2dedbf275521c5845cabdee4ae42461e3174f5893258a9a4781c9052aa878a847cf8d3c637335295337172e08abbcbb0d65669a92808b
SSDEEP 768:wb8dRx7pLuLfR6Wgouf6M8F1+UoAYDCx9Tuqh0VfUC9xbog/OVE4mu46ErohCq5U:wb8dRnEfR6Wgouf6Mu1jar4mV6PZa
TLSH
T11ED2DA7B744CCB7E4F800ADDAC19BE9F6D6802CB96D8C94447FE941C02C6BEA51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8ee8ad58-4f1c-459c-bc95-4ac98d1cfc38\index-dir\the-real-index
Size 3KB
SHA256 ff74cb1c7da110592ba60bfa986f60f3f50603cb8c905c538d23157fa7f8982f
MD5 42135d915126518f3e19baacc7518d1b
SHA1 256284927c7651589bdccfedbe495a71e786f5b2
SHA512 d4908be2980307f2b5052690dd1703d4c1a752026a00735106f33e30cee358b3be1fc216a50574278e04512e0c7fed0ba45ee38e3a37f0c1c0724f5b19cc36af
TLSH
T12851C70E8D4A2EAEC9AC04726DFA158437756CEE8B45ED1B669D90307CD333A1E19106
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8ee8ad58-4f1c-459c-bc95-4ac98d1cfc38\index-dir\the-real-index
Size 360B
SHA256 45d495f372c263d4d42758dbb0da551981a8cc24c4e972c89249e796230ab180
MD5 133877118c76a2b25c74ffb69bb450d7
SHA1 77d3cbbd752dfd15b760a158ca6ee12803ecd389
SHA512 9ecde7635395c00fc64e82119a4b920206735d03e0514c4742f43e313e4c6d73d00c21709aefa75258aa77f0e33f301e6347a4032a103cde93d74a1731b1ac6f
TLSH
T185E02B9EDC634517CA26287709B6252D333B0BFD2905AE6A10FE041EAD9163C424175D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5940b8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8ee8ad58-4f1c-459c-bc95-4ac98d1cfc38\index-dir\the-real-index~RFe5940b8.TMP
Size 360B
SHA256 1b4e8ec38cc2dda79f4281bf93eed8057ce5aca5f5380ab0cee6ed175437e6fe
MD5 6838affd6e0dc2228ed665629f13f2ab
SHA1 2cc432e6bd7c2d7ef72372c45c8ec478dcc8c9db
SHA512 c6247ed6fbad6fef53068a3f75caa403dd2551d6928b3b4e9ac465d7fa8764d85c14e0dc328875b8fd91b3997ee2d2000061768ea176d6a0a015be74333e897e
TLSH
T1FCE02BCF40916E52CE2659351542652A333F08242505EA2A10DF545E19617AC864560A
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 6e6c749331e9154dcf3cc27af71b426519d9ed777ee6bd2ebb1d6f1032b6c125
MD5 55d56909a39f3649173eb4dbf45de6e3
SHA1 b26a899c6d4cf928da60b4ff8880adf7638ab3af
SHA512 7008e0927e1b3a93cbf3117960594acbdd5abfb3a032394e1ff8fc6a761ecc6465b72fe48d56741aa1a27cb95f800740e4faafd181a580fef1e28d3dbcc8e393
TLSH
T1CBE020773EF72804ECFFD7DA1831649105507454884EBD4FA815E3D714B235434AAC61
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 a26d2c2ceb4931b422a90830d13e04c09af2329ac331b72b82e3faef1f9be3be
MD5 28f840cd0784402b8fe28e7f7583bc33
SHA1 44a9581672d86485eb73d3fc56a57dae5063ba97
SHA512 9cebd76e5753e0ff0520956c740bfbc5adc367df47472556ba1273d5f4f2f927149efc008f1123ab0f7149893b8e6e1fbb8db6b2a473b13965642f44679f207f
TLSH
T145E020773EF72804ECEFD7DA1831645105107458844EFD9F6815E2D710B235434E9C61
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 ff19c54c91618a5569067b5cbdbbb06bc8dff3d10e7ec3e20cc3ef06630e52a1
MD5 dc2c998e00222984adda8999123ec50e
SHA1 206202eec73109f6a815aba5d1289252c4a44545
SHA512 9d8dd7e04a777d9b8a347549e55f99792fdd8d6d0324bdc960c7bcc6c95a51e8188c4dcc0791051de000ba1f917ed5a627014f2383297d96b8a77d38489056e1
TLSH
T174A002B5CD5C80CAD1400279906A298566249CA8E705233240EF02548DAC1504DEE224
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59e48a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59e48a.TMP
Size 48B
SHA256 a9440b3ec18d5bc82211235282e5c8c144c533fe18450eec6c62994413d6057b
MD5 fd9fba673d4c63b73e347e9c00e47759
SHA1 e865c58d29e924bf9fd5f4b594cd086792a4a75d
SHA512 82ab790a76d546ecca6200198992b14de5f45a7b0dc13bfb7b4fce60107cacaf10f90773ac34ba0479de84205425d3936cf76cd21e05ab2a01bf68e3b60caea0
MD5 SHA1 SHA512

Submit Download

domain_actions.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Domain Actions\3.0.0.18\domain_actions.dll
Size 83KB
SHA256 d35c8efcb710239f009633bcc5ae904ac6dafa985d451bedf791cf6909f014d4
MD5 956f610121cd5827fd5549097b79cd9f
SHA1 dbd23f99895a3a92fbe04c3c35d475a6f6998fd0
SHA512 3cc4712f64474497495d229ddd743c6bf25c30c3fbfca2525f46227d99a59a0f9e80e2119ffb40bc8a707b539f65f907e2e1565ea937e0387db47cf7269944e6
SSDEEP 1536:sNGnmI1FOxAdgxBf8paY3JQzQik428fKagFVbydki8yyafuzWk:sNG91FPgrfrPza428fIenya2Sk
TLSH
T16D83F180DF58411BF86F4835E0B269857A78E6B50FE092DF2376C9590E12FD1AF39705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6503ee23-f9d7-45bd-807c-e6eabc4cfde6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\6503ee23-f9d7-45bd-807c-e6eabc4cfde6.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 3babae436aee8d28df3c20e9662ac6e7ba3a93f70f85d44477aba45de2ef56c7
MD5 161337e5465e3812c7082be5124cc6bf
SHA1 a44df850dc626f6ec2ffab431a01dc85d7751f10
SHA512 2fb2ef30fcc387b320e0c0ba898ee5506bf6fdad5ebf66133beff400062f35ea3b5b8abe1f4741b20f4e7636dfb949fe6d3a7972488fb7478d8d3b1b71e3b74a
SSDEEP 768:Tz3zFRBDZIO033uNzc4ReyIsPIthy6DqI:Tz3btc44bsSTT
TLSH
T127F2C030A8B89D73ACEEA249F6073642BDF45127D1D81E94D6ED9F1C09432AD0B5F827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 3008936dbb50b72ef64c4a53e2a51c290246ff45a4a8fa72b7e2e784032f1622
MD5 8fb7a995d9417591b80f5598e53b963d
SHA1 b7c5812d3f6c91182ab2477352dd65643776b0dd
SHA512 2af081b394df6d9e4eb957fb77183d3cc8bebc5fd96f06a1d761d1ea06fe11bc2ed24a2174388b4d4ccfc8fc090ee0d4102409f9fb67363bdf1655ec010022cf
SSDEEP 768:6rv+4UNbds3qHDZIO03SNzc4ReyIsXqeVH1S5D:6bsbS3Otc44bsaEH1Y
TLSH
T18903CE32A868D977ACF6A786B10775533EF8512B82C81ED0C9DE6F0C4A4B1DD131B923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 bafff36eeaf10307e7f0bde01cc71b6463798c2c516ee4ec31b09a00daa81ff1
MD5 8e95ddb411f2ac0cc87b180dd0686093
SHA1 022c9c2be44f3b602465a2641b7302bf2cea684c
SHA512 0e7d723c9270e1cdb9f06f0033a478eb9963cfe11bb38370dd9ab2b4a62101a44b53e3e955a9ec722eb2ce05270a1b199990dbf997d0354a513f2f38790b7c85
SSDEEP 384:nEZcIz38Nw0dD8O8og2JDZNfNoXOVSUUHXCDOH6ETRzcoXfK86sfxEZxxsIj4lBs:iz32lXDZIO033FNzc4ReyIsPIthy6DqI
TLSH
T12FF2BF30A8B88D73ACEEA249F50736927DF46127D1D41E94D6ED9F1C09432AD0B5F827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 8ef6d6be6f65484bf6431dc4c4ebfd6d5302a0c59b80fe25032f595903ffd1d0
MD5 8018437586b64bbffcd01d256b7047bc
SHA1 b276c753ee555af066c3181b4922fe328b3db63c
SHA512 ba4ed16d41870972de57b852bf7f24cfd74592148a3e026c70fa3eb49faa933f038845e5acf7b431efe4d0a8b21626b80935f203aa002afa04e66c13c9568738
SSDEEP 768:9FQs3zwg/TRQZR5O033qNzc4ReyIsPIthy6DqI:Ms39tc44bsSTT
TLSH
T1AA1316F198E78936E8AE5747A73D2D42ADFCD063B1885994B7D95E0CCC821BFC70A811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 dad021d9de5a11df6818b33d26b379b38eea543e852c8f0bad020b9525669bb4
MD5 735eb5ee3d0240b093e9c1b15cfd96fd
SHA1 03ad81878a3ac5c55ad6c609832b8c2f0206682d
SHA512 52ba6365130fead88608c3133bacef6531351e4c808703b4272d77d1a603cd71f803c876f0e1497863e74813b6fbff634bf5eaeadbabbc77765dd128f53d4281
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe5964fa.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5964fa.TMP
Size 392B
SHA256 b1ae1014e53aa02f735e67dbf38a9b8c0851ebf3358e4d121ec2938c961e8b4d
MD5 a90af87086938976998c4e12a8166bfd
SHA1 39af7af2de15444d59194865e3387b6079e84f50
SHA512 920d85fb2b5bf12985eeb5b281b96deb872bd9f09e6111379e1422fa28121f73554bf57713d8b7cd802be5d793f91dac203349f9ddd30a27674866161324a647
MD5 SHA1 SHA512

Submit Download

well_known_domains.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Well Known Domains\1.2.0.0\well_known_domains.dll
Size 572KB
SHA256 2778063e5ded354d852004e80492edb3a0f731b838bb27ba3a233bc937592f6e
MD5 f5f5b37fd514776f455864502c852773
SHA1 8d5ed434173fd77feb33cb6cb0fad5e2388d97c6
SHA512 b0931f1cae171190e6ec8880f4d560cc7b3d5bffe1db11525bd133eaf51e2e0b3c920ea194d6c7577f95e7b4b4380f7845c82eb2898ad1f5c35d4550f93a14b6
SSDEEP 6144:XbBXgDO9CyiiKPFv3GPkDNiTHoIDiXkCBIvzVXCfwX5pWr+W1gUe3h576:XbBQDwi5FvGPkDNirYBIvzVXCoXWiWr
TLSH
T130C49E02B7D846A8D07AD0748A574642EA76BC950F74A6DF02E0B27D2F77BE45B3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 15d589c36d26b879ab9b6778f60b9708da588ead5d56887eea839678186b9c93
MD5 4f07be8d4ba4d971cab71ddafcbe2b70
SHA1 6b8f42628a5a5c3db81fa91582701e76515de3b8
SHA512 2c411a14d28fec7bc9545e9221d04287e99da7781dcb97ca1dcf40a8ebba498aeb75f2232eeee0851cdc4a254934c31244648cd3f0051c71edfeffe0192349b2
TLSH
T1D2411EE058391AC1D4BD0DAFB48B39FC84D8D726F590307828A8E958967D65E254483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 f02a7bd3b771879961428f883cc74267f62795d12233237f35bfd3c4c48dce64
MD5 720cbaa1daf0bfa34c779a917c251458
SHA1 9a1b20164d36666ec94e22b20126dd9575b62556
SHA512 0164a6059883ed2f1bbf4e316e5808af07034fa8105cecf6f0e3fcc82f35ae4b4d501b06f2759e8b2f3529eead2bd23618f463372eb60c33d1e955e2903b6780
TLSH
T16B4141E04C391EC1D4BD0DAFB48B39FC84D8C726F5A4307868A8EA58563D65E354083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 b0ee55f589d16555cf255bfd077f5ec484df7e47de7270ff68a7da238dfc1f68
MD5 ef803b7b4ec38cf2ffc28d1e9dd78182
SHA1 3919e3291c14ccc80a13ea4788ef360165e57653
SHA512 3ca496542be223eb6082af9251a300be7543911598f4eb8c58189e7e869cc3e198334fdacce30ad9e5fc9e304688a9637a41f5f2797ecb025fa8890fa048b255
TLSH
T1834140E04C381AC1D4BD0DAF749B39FC84E8D726F5A4307868A8EA58567E65D354083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 732B
SHA256 cf5e5467ab3de71fcb419acbbb754c3effd5e787864ffa7c767f24ff9bbe5ae3
MD5 87299a8105078d6252386ba9d333ff05
SHA1 c43e027b4174d2ae2c7f138de07b18ac0407148a
SHA512 f6678cce079ae97838bf5aebf3c195a2c82d27dd6546fd7e5428396130ca4bd2c809f2d2edca4f130da479624c3418beffe998ae1a032451706b9a47bad62885
TLSH
T1670110D14C3E1AC3C6B90EAFE04717EC40C89512B0D8387818CDF8A4917A41E345182E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 852B
SHA256 51fa2add3b372e4d932d6926ca9be223a98d6ad3b63fcf099338f199d0a4ad28
MD5 0bc15719fed893a50e7e1a0840cebcc2
SHA1 b6b38e62996bd5e878b8bdb423c8908c2c7952d9
SHA512 e8025d1cc226ac64ba4fa534aa9a692475cc6f90a825329d6a12e01c23821f5e08fbdc188e3ec58612b5fc7bedb6f5a7f294d0f22467098763b8949281bee090
TLSH
T1D9011ED158391AC6CA7E0EAFA0472BEC44C8952AB2D834B908CDE8A4957985E304183E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 972B
SHA256 6bbc409c6c8e5287723de210e3463bc9873d0adfd3542a753ad8169fa6342edd
MD5 a4942446efe6c44ae76e03f049f85743
SHA1 501f2a79ecaee0f14e1e17bbd93516fc73cb8cf7
SHA512 b8cb3908d88cca44b260e44c81f0a093cb6b4c92d9225a93390f336b886fd571202edb51f98654dcb7c80c411f600f090de5af458ffd3adcea3b636210b7b69f
TLSH
T18F1150D14C3A1AC2D67E0EAF60472AEC40C89626F2E434B808C9E854517945E314183E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 e56e2e8c12c30aeb3647379105e6cc00fb874ae60db91a7e65912c81acd272cb
MD5 4fd39e59059f75a9ced12b25de6be901
SHA1 d942bc4fe9fe1f73e1bbe6647bfa093ce7449556
SHA512 23ee132546b4ee2a51fa5a3c985b815d25beaa211114e7bf11bd3d405e3225c8d2f048f8c898338119b29d18f39f785fc26810ae2e4fc11137d14bf0526a1121
TLSH
T12C3122E1583D1EC2D57E0DEFB44B2AEC90E89216F5D434382898FCA4567E51D254087F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 3a81a4eee729978393cff7718a9d8a74fd3f6f122297e9c12a11b4658834411e
MD5 fa6015a8dc98e735976dc38a0990672b
SHA1 5f2e6427fd32691058b5ae21d18f6695efe6fe87
SHA512 d3f3db3b730235d6df3b555174dbedf1b51d5b0f5b0dba88e7a6cd2e8de59ade2baabb191a30d0a6b914411256972c8663b48057a0b017df2de09a08c241d930
TLSH
T1FD313EE158391EC2C4BE0DAFB04B2AFC84E8C326F5A434382898ED58563E55E214083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 0f4851d2d08fedaaf8104a0fbdc543c6f5a7c82fd67345db7d671b449362cfbb
MD5 77f71a1a262c4e86361de3a90207fc3b
SHA1 1c96628f1863ecce746b8e03e244004ff89393c0
SHA512 d32e215753da8220e7f2c1bd8d9b9f882706314869fa45afae698cfc032947bf8759f3f403076a1d8f69bb591edca53da629484ac186d9fd0c6d98d19b36c6c4
TLSH
T19A111FD1183A1EC2D5BE0EAFA0873AFD40D8D626F2E430B918C8ED54567955E215187F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 4064f883ab03274d942d9669bcd8d2fb6cdbe53cae07e7c3c45eedb4fa0ce127
MD5 3d7f13d024e13960d589424710ae35af
SHA1 84cec1f45f7181378af3169fa664f2ef1630e695
SHA512 7fc51183bc0811cce4f00965b6c8a3874b0fc32432865df5d92b419cc72889a834c7d01b69720d627448553d9bf07e1f20998b00e93d2170e102da3db578bf2f
TLSH
T1443120E158391EC1D47E0DEFB05B29FC84E8C226F5A434392898ED98567E55E254087F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 8bbdde884f76a239161544bdc5dd38be45fcd38b4172bbe8630dd3f69056c302
MD5 bc4b668c701adc7329247ed782c1bd46
SHA1 ebe3892787b431850782dd1a2d4b5638859a4845
SHA512 23913959b3ba221f4eb9dd87ce08a8dd49eff4e204107e1b5ec8a1119d6c33a533fdece0909b21f80ec9f35299d0ceaa0c3f040332f3101b6a955189a380ac25
TLSH
T179311DE058391AC2D4BE0DAFB48B39FC84D8D326F5A430386898E968563E65E354083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 c987630a02243607bbfbd5adeeae50f61a98fdc7b8ef4dda749e30e3d42031e5
MD5 f095b9c0b5a43a61354a6fb170e88e0a
SHA1 d253127f942eb3fe1cd72c32252c1d4d092a6fdf
SHA512 5fbca901399660410656d9967cbc38effc371254485cbff20165cf0361845a757e18fa0ac626b2c695e2a95a239b5c8437c8f6cbe301e3749dc93ae2d8b08c8f
TLSH
T1504140E04C391AC1D4BD0EAFB49B38FC80D8C726F5A034382898EA58567D61D354483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 612B
SHA256 918167fab0fb4435546513252415c1a2e44b6e8e60caf6f31d07587ba0a71ab0
MD5 5ca920f0e1c81dfb329b916e242a4065
SHA1 1d068ad79883fd23c27647c98e761858e46f48cd
SHA512 2b99239123f922883dea3137835bb8b74713799981e5aa1434ea70db85e7666f2372db684f94bb599ecff70c8c31d02286b0587ffe620333eb1d4bbc7feb84b8
TLSH
T11DF002D04C3E19C3D5B90E6EA40717EC50D45517B0D8383804CDE894D07A05E315183E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 7f131d386f527dab6f8a4235038935e733d69317d35dc5eb69c52d96bf5b75d0
MD5 dd06dac0059d3cf25ad6de81afc96289
SHA1 38918b3e27aaa6d6adbeb99998847d2ea5649c09
SHA512 2cfd11f573eb223b18eb9882182d481ed6dbf7ec2357286c8210d4285f689d38e1e6cdce4e81f7880da9e59d1f0a7873374a7a32a0d86f20fb288f86fad7ac5e
TLSH
T1DA2142E0183E1EC2D17E0DEFB0472AEC90D88216F5D434792898FC64963E51D214087F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 756ef3483952cd4f6f9b80821083dfbdf9bccdec392e28a2854f00ab9fd415ee
MD5 a5d8f3ba10a699f2b50cc8c1ed38bf37
SHA1 6d425c4f51f9dad92dae1d394bd3ee6fc81d3e6f
SHA512 8f5ea964e29453421e34eba8b37e4acc6dc0b4b7c5f89b5fb9aebe6b034a36a6e8a0373193f023de0a7f66ab8862ad8ffd7ce6177cf2d479f623e035d2160c44
TLSH
T1512111E1183A1EC2D5BE0EAFA0872AED50D8D216F1E434791888FD54963E55E215187F
MD5 SHA1 SHA512 TLSH

Submit Download

0400c0e2-869b-4190-bd7d-29223cbc6d64.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\0400c0e2-869b-4190-bd7d-29223cbc6d64.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json~RFe59405b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json~RFe59405b.TMP
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

778c6f57-cc8d-4dde-a95f-ac7106befb27.tmp

Path C:\Users\Admin\AppData\Local\Temp\778c6f57-cc8d-4dde-a95f-ac7106befb27.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6068_713767424\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Staging

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_155135850\Mu\Staging
Size 36B
SHA256 411a706def2e70f96a507208bf80bceb93e950c4c2d671cd1ddb4134ce54b2a9
MD5 0163de1b14421d4eee3757ff76fd81e4
SHA1 96c75c4fe1e3f33a367f45293bd1bd8bff1c06f4
SHA512 80114d59db8f3654dd6821589e5ad03daa923a35610a372756a8865b3e769621e32ef2aed92c2494de2b9fc06d9796b12f1e3bb75873ed794e8c9ae8a0d5e965
MD5 SHA1 SHA512

Submit Download

LICENSE

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_418988719\LICENSE
Size 1KB
SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
MD5 ee002cb9e51bb8dfa89640a406a1090a
SHA1 49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2
SHA512 d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c
TLSH
T17D31535723840B9306DA2B4566AEBDC4B0DDC02D7F27AE05186EF394537B52ED8B3443
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4308-12-0x00007FFA77650000-0x00007FFA77FF4000-memory.dmp

Download

memory/4308-15-0x00007FFA77650000-0x00007FFA77FF4000-memory.dmp

Download

memory/4308-11-0x00007FFA77650000-0x00007FFA77FF4000-memory.dmp

Download

memory/4308-17-0x00007FFA77650000-0x00007FFA77FF4000-memory.dmp

Download

memory/4308-7-0x00007FFA77650000-0x00007FFA77FF4000-memory.dmp

Download

memory/4308-13-0x00007FFA77650000-0x00007FFA77FF4000-memory.dmp

Download

memory/4308-5-0x000001F9FE7E0000-0x000001F9FE802000-memory.dmp

Download

memory/4308-6-0x00007FFA77650000-0x00007FFA77FF4000-memory.dmp

Download

memory/4308-2-0x00007FFA77650000-0x00007FFA77FF4000-memory.dmp

Download

memory/4308-0-0x00007FFA777DF000-0x00007FFA777E0000-memory.dmp

Download

memory/4308-1-0x00007FFA77650000-0x00007FFA77FF4000-memory.dmp

Download

memory/4308-14-0x00007FFA77650000-0x00007FFA77FF4000-memory.dmp

Download

memory/4308-10-0x00007FFA77650000-0x00007FFA77FF4000-memory.dmp

Download

memory/4308-18-0x00007FFA77650000-0x00007FFA77FF4000-memory.dmp

Download

memory/4308-9-0x00007FFA77650000-0x00007FFA77FF4000-memory.dmp

Download

memory/4308-8-0x00007FFA77650000-0x00007FFA77FF4000-memory.dmp

Download