hxxps://tinyurl[.]com/da85xaen

Analysis

geolocation tags

asiadelhiinindia
user interaction
yes
max time kernel
960s
max time network
961s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/08/2026, 03:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://tinyurl.com/da85xaen
Sample260806-edpxcssfka

Score

5^/10

discovery

Malware Config

Signatures

Drops file in System32 directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSStmp.log	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jcp	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.log	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jtx	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00001.jrs	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00002.jrs	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.jfm	svchost.exe

Probable phishing domain 1 TTPs 1 IoCs

Phishing

T1566

description	flow	ioc	stream
HTTP URL	53	https://doxbin.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=a26b131059f5fcf6	1

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3964	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134304617930562085"	msedge.exe

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{4385EC67-9562-4AB4-B6DB-89F380D8342A}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings	mspaint.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
552	msedge.exe
552	msedge.exe
2672	mspaint.exe
2672	mspaint.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
668	Process not Found
668	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 30 IoCs

pid	Process
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe

Suspicious use of FindShellTrayWindow 47 IoCs

pid	Process
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe

Suspicious use of SendNotifyMessage 36 IoCs

pid	Process
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2672	mspaint.exe
4020	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1664 wrote to memory of 1372	1664	msedge.exe	85
PID 1664 wrote to memory of 3964	1664	msedge.exe	86
PID 1664 wrote to memory of 3360	1664	msedge.exe	88
PID 1664 wrote to memory of 3360	1664	msedge.exe	88
PID 1664 wrote to memory of 4328	1664	msedge.exe	87
PID 1664 wrote to memory of 4328	1664	msedge.exe	87
PID 1664 wrote to memory of 4328	1664	msedge.exe	87
PID 1664 wrote to memory of 1520	1664	msedge.exe	89
PID 1664 wrote to memory of 1520	1664	msedge.exe	89
PID 1664 wrote to memory of 1520	1664	msedge.exe	89
PID 1664 wrote to memory of 3296	1664	msedge.exe	90
PID 1664 wrote to memory of 3296	1664	msedge.exe	90
PID 1664 wrote to memory of 3296	1664	msedge.exe	90
PID 1664 wrote to memory of 3724	1664	msedge.exe	92
PID 1664 wrote to memory of 1584	1664	msedge.exe	93
PID 1664 wrote to memory of 3724	1664	msedge.exe	92
PID 1664 wrote to memory of 3724	1664	msedge.exe	92
PID 1664 wrote to memory of 1584	1664	msedge.exe	93
PID 1664 wrote to memory of 1584	1664	msedge.exe	93
PID 1664 wrote to memory of 2128	1664	msedge.exe	99
PID 1664 wrote to memory of 2128	1664	msedge.exe	99
PID 1664 wrote to memory of 4160	1664	msedge.exe	100
PID 1664 wrote to memory of 4160	1664	msedge.exe	100
PID 1664 wrote to memory of 4728	1664	msedge.exe	102
PID 1664 wrote to memory of 728	1664	msedge.exe	103
PID 1664 wrote to memory of 728	1664	msedge.exe	103
PID 1664 wrote to memory of 728	1664	msedge.exe	103
PID 1664 wrote to memory of 400	1664	msedge.exe	104
PID 1664 wrote to memory of 400	1664	msedge.exe	104
PID 1664 wrote to memory of 400	1664	msedge.exe	104
PID 1664 wrote to memory of 2412	1664	msedge.exe	105
PID 1664 wrote to memory of 2412	1664	msedge.exe	105
PID 1664 wrote to memory of 2412	1664	msedge.exe	105
PID 1664 wrote to memory of 2780	1664	msedge.exe	110
PID 1664 wrote to memory of 2780	1664	msedge.exe	110
PID 1664 wrote to memory of 2780	1664	msedge.exe	110
PID 1664 wrote to memory of 2376	1664	msedge.exe	112
PID 1664 wrote to memory of 2376	1664	msedge.exe	112
PID 1664 wrote to memory of 2376	1664	msedge.exe	112
PID 1664 wrote to memory of 1080	1664	msedge.exe	113
PID 1664 wrote to memory of 1080	1664	msedge.exe	113
PID 1664 wrote to memory of 1080	1664	msedge.exe	113
PID 1664 wrote to memory of 4728	1664	msedge.exe	116
PID 1664 wrote to memory of 4728	1664	msedge.exe	116
PID 1664 wrote to memory of 4728	1664	msedge.exe	116
PID 1664 wrote to memory of 2444	1664	msedge.exe	117
PID 1664 wrote to memory of 2444	1664	msedge.exe	117
PID 1664 wrote to memory of 2444	1664	msedge.exe	117
PID 1664 wrote to memory of 3672	1664	msedge.exe	119
PID 1664 wrote to memory of 568	1664	msedge.exe	120
PID 1664 wrote to memory of 3836	1664	msedge.exe	121
PID 1664 wrote to memory of 3836	1664	msedge.exe	123
PID 1664 wrote to memory of 3836	1664	msedge.exe	123
PID 1664 wrote to memory of 3164	1664	msedge.exe	124
PID 1664 wrote to memory of 3164	1664	msedge.exe	124
PID 1664 wrote to memory of 3164	1664	msedge.exe	124
PID 1664 wrote to memory of 1356	1664	msedge.exe	125
PID 1664 wrote to memory of 1356	1664	msedge.exe	125
PID 1664 wrote to memory of 1356	1664	msedge.exe	125
PID 1664 wrote to memory of 1972	1664	msedge.exe	126
PID 1664 wrote to memory of 1972	1664	msedge.exe	126
PID 1664 wrote to memory of 1904	1664	msedge.exe	127
PID 1664 wrote to memory of 1904	1664	msedge.exe	127
PID 1664 wrote to memory of 1904	1664	msedge.exe	127

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://tinyurl.com/da85xaen
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ff8924dc188,0x7ff8924dc194,0x7ff8924dc1a0
  2⤵
  PID:1372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1952,i,111175705511293018,1300123758253452838,524288 --field-trial-handle=2312,i,13173981954391797777,12801661929765204182,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1696,i,2121651860119992307,16606476618619446542,262144 --field-trial-handle=2312,i,13173981954391797777,12801661929765204182,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:2
  2⤵
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2492,i,3914318837414955165,10276084936684467250,524288 --field-trial-handle=2312,i,13173981954391797777,12801661929765204182,262144 --variations-seed-version --mojo-platform-channel-handle=2848 /prefetch:8
  2⤵
  PID:3360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,11065877958093147923,17845455893459379383,2097152 --field-trial-handle=2312,i,13173981954391797777,12801661929765204182,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:1520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,3387308054563433768,13496316120857161373,2097152 --field-trial-handle=2312,i,13173981954391797777,12801661929765204182,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4168,i,12379912283343857870,4080794962839869264,2097152 --field-trial-handle=2312,i,13173981954391797777,12801661929765204182,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:1
  2⤵
  PID:3724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4196,i,4232255316089506538,8496841600544711898,2097152 --field-trial-handle=2312,i,13173981954391797777,12801661929765204182,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:2
  2⤵
  PID:1584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3668,i,11916356000093364926,16475150778850287197,524288 --field-trial-handle=2312,i,13173981954391797777,12801661929765204182,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:8
  2⤵
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3552,i,1377400821652828907,12241483959788100457,524288 --field-trial-handle=2312,i,13173981954391797777,12801661929765204182,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5780,i,14081387817404468618,8624143338489273259,524288 --field-trial-handle=2312,i,13173981954391797777,12801661929765204182,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:8
  2⤵
  PID:3380
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5780,i,14081387817404468618,8624143338489273259,524288 --field-trial-handle=2312,i,13173981954391797777,12801661929765204182,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:8
  2⤵
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6204,i,11372431489563699594,2913532013191625548,2097152 --field-trial-handle=2312,i,13173981954391797777,12801661929765204182,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:1
  2⤵
  PID:728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6332,i,14335131417247353779,7384652873249936119,2097152 --field-trial-handle=2312,i,13173981954391797777,12801661929765204182,262144 --variations-seed-version --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=3516,i,2928367098076955162,321543689856701706,2097152 --field-trial-handle=2312,i,13173981954391797777,12801661929765204182,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:1
  2⤵
  PID:2412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5824,i,12984092029649678001,10798207040209796023,2097152 --field-trial-handle=2312,i,13173981954391797777,12801661929765204182,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:1
  2⤵
  PID:2780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6336,i,17981645884087717617,8798816160524669983,2097152 --field-trial-handle=2312,i,13173981954391797777,12801661929765204182,262144 --variations-seed-version --mojo-platform-channel-handle=3948 /prefetch:1
  2⤵
  PID:2376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=1736,i,8711367094550184057,9055145788281783958,2097152 --field-trial-handle=2312,i,13173981954391797777,12801661929765204182,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
  2⤵
  PID:1080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=3908,i,3992879406912378500,18409699718867980824,2097152 --field-trial-handle=2312,i,13173981954391797777,12801661929765204182,262144 --variations-seed-version --mojo-platform-channel-handle=3924 /prefetch:1
  2⤵
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6252,i,18262708640377831371,13894278026213406873,2097152 --field-trial-handle=2312,i,13173981954391797777,12801661929765204182,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:1
  2⤵
  PID:2444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6640,i,1748972585504408422,4252498120218829003,524288 --field-trial-handle=2312,i,13173981954391797777,12801661929765204182,262144 --variations-seed-version --mojo-platform-channel-handle=3436 /prefetch:8
  2⤵
  PID:3672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3836,i,14469938883906475008,7555711975483807496,524288 --field-trial-handle=2312,i,13173981954391797777,12801661929765204182,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:8
  2⤵
  PID:568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4212,i,13896402038211869160,8345581997949282911,524288 --field-trial-handle=2312,i,13173981954391797777,12801661929765204182,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:8
  2⤵
  PID:3836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6640,i,18285681794140285051,115899169305428474,524288 --field-trial-handle=2312,i,13173981954391797777,12801661929765204182,262144 --variations-seed-version --mojo-platform-channel-handle=6948 /prefetch:8
  2⤵
  PID:3836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=5324,i,4424076237668610507,3167016204113934713,2097152 --field-trial-handle=2312,i,13173981954391797777,12801661929765204182,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:1
  2⤵
  PID:3164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7104,i,12808206809981544461,14873500209990319061,2097152 --field-trial-handle=2312,i,13173981954391797777,12801661929765204182,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:1
  2⤵
  PID:1356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5324,i,1573614898220510236,10081963423931628964,524288 --field-trial-handle=2312,i,13173981954391797777,12801661929765204182,262144 --variations-seed-version --mojo-platform-channel-handle=7108 /prefetch:8
  2⤵
  PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7188,i,8766307218032298126,18044289610954464688,2097152 --field-trial-handle=2312,i,13173981954391797777,12801661929765204182,262144 --variations-seed-version --mojo-platform-channel-handle=7208 /prefetch:1
  2⤵
  PID:1904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7068,i,17506565586733630259,13070793200215600186,524288 --field-trial-handle=2312,i,13173981954391797777,12801661929765204182,262144 --variations-seed-version --mojo-platform-channel-handle=7084 /prefetch:8
  2⤵
  PID:820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5376,i,2918844316697310393,1854524712960125028,262144 --field-trial-handle=2312,i,13173981954391797777,12801661929765204182,262144 --variations-seed-version --mojo-platform-channel-handle=7604 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,11865431078663183602,4444475693627040092,524288 --field-trial-handle=2312,i,13173981954391797777,12801661929765204182,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:8
  2⤵
  PID:948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5028,i,3134085815772527374,3674404759435846966,524288 --field-trial-handle=2312,i,13173981954391797777,12801661929765204182,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:8
  2⤵
  PID:708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1036,i,7023644619627484590,3358783957102997774,524288 --field-trial-handle=2312,i,13173981954391797777,12801661929765204182,262144 --variations-seed-version --mojo-platform-channel-handle=7296 /prefetch:8
  2⤵
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5376,i,3820284680321307187,8946990484713570120,524288 --field-trial-handle=2312,i,13173981954391797777,12801661929765204182,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:8
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5428,i,11944228377613918304,448683000790280043,524288 --field-trial-handle=2312,i,13173981954391797777,12801661929765204182,262144 --variations-seed-version --mojo-platform-channel-handle=2164 /prefetch:8
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=5060,i,12796621575570941067,1918567598064175259,2097152 --field-trial-handle=2312,i,13173981954391797777,12801661929765204182,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:1
  2⤵
  PID:440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7704,i,9892797925292448157,13453803997326854296,524288 --field-trial-handle=2312,i,13173981954391797777,12801661929765204182,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:8
  2⤵
  PID:1212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=7816,i,4795305785562317735,16774366701631214866,2097152 --field-trial-handle=2312,i,13173981954391797777,12801661929765204182,262144 --variations-seed-version --mojo-platform-channel-handle=7788 /prefetch:1
  2⤵
  PID:2068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=7972,i,14470568146759659626,1165331618585508710,2097152 --field-trial-handle=2312,i,13173981954391797777,12801661929765204182,262144 --variations-seed-version --mojo-platform-channel-handle=7896 /prefetch:1
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=8028,i,16653700255291750609,1257808056763024580,2097152 --field-trial-handle=2312,i,13173981954391797777,12801661929765204182,262144 --variations-seed-version --mojo-platform-channel-handle=7900 /prefetch:1
  2⤵
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=8372,i,10080016608873430282,1816371087641816373,2097152 --field-trial-handle=2312,i,13173981954391797777,12801661929765204182,262144 --variations-seed-version --mojo-platform-channel-handle=8412 /prefetch:1
  2⤵
  PID:3892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=3592,i,14044778056505321187,5502543348794340179,2097152 --field-trial-handle=2312,i,13173981954391797777,12801661929765204182,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:1
  2⤵
  PID:384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=8016,i,3611488774807097100,1937039012090615600,2097152 --field-trial-handle=2312,i,13173981954391797777,12801661929765204182,262144 --variations-seed-version --mojo-platform-channel-handle=8100 /prefetch:1
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=3688,i,7670861018799627296,17529795233234568610,2097152 --field-trial-handle=2312,i,13173981954391797777,12801661929765204182,262144 --variations-seed-version --mojo-platform-channel-handle=8080 /prefetch:1
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=8288,i,17112588727744713807,14711281556559142847,2097152 --field-trial-handle=2312,i,13173981954391797777,12801661929765204182,262144 --variations-seed-version --mojo-platform-channel-handle=8612 /prefetch:1
  2⤵
  PID:1984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=7824,i,15106588953603315690,14767742602986006586,2097152 --field-trial-handle=2312,i,13173981954391797777,12801661929765204182,262144 --variations-seed-version --mojo-platform-channel-handle=8332 /prefetch:1
  2⤵
  PID:1108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8588,i,12026989185153754853,6240944797046346289,524288 --field-trial-handle=2312,i,13173981954391797777,12801661929765204182,262144 --variations-seed-version --mojo-platform-channel-handle=8620 /prefetch:8
  2⤵
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=7812,i,12229487326689439582,12166703655686205666,2097152 --field-trial-handle=2312,i,13173981954391797777,12801661929765204182,262144 --variations-seed-version --mojo-platform-channel-handle=7628 /prefetch:1
  2⤵
  PID:2860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=8000,i,10127350886959320054,422381994705258032,2097152 --field-trial-handle=2312,i,13173981954391797777,12801661929765204182,262144 --variations-seed-version --mojo-platform-channel-handle=8660 /prefetch:1
  2⤵
  PID:2680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=8580,i,7378365022312045253,11352854645522962503,2097152 --field-trial-handle=2312,i,13173981954391797777,12801661929765204182,262144 --variations-seed-version --mojo-platform-channel-handle=8332 /prefetch:1
  2⤵
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7796,i,1738560437588836814,11994186918561639420,524288 --field-trial-handle=2312,i,13173981954391797777,12801661929765204182,262144 --variations-seed-version --mojo-platform-channel-handle=8564 /prefetch:8
  2⤵
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=8880,i,8255928960973473277,16827469847999765904,2097152 --field-trial-handle=2312,i,13173981954391797777,12801661929765204182,262144 --variations-seed-version --mojo-platform-channel-handle=8876 /prefetch:1
  2⤵
  PID:5040

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4196

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4832

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Downloads\echocini pc\screenshot.jpg" /ForceBootstrapPaint3D
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2672

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s DsSvc
1⤵
- Drops file in System32 directory
PID:2840

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4020

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_echocini pc.zip\Downloads\Google Chrome_Profile 1.txt
1⤵
PID:872

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\echocini pc\passwords.txt
1⤵
PID:2432

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Phishing

T1566

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 dc760089b58251aa624440ac4388bbbd289ec10223ec9554f5d41bc270f57b44
MD5 4e9b9a6c0f5bbd0f99ce5ffe1fd5c295
SHA1 89d31383164751070b94ffeda47b27773112c408
SHA512 f21176150727c4473bfe43fb0810af607ae79724d496fc5488bcf0f4c09fd473c78ac7335170c9d319d2e68f85d2f9742b21994cb9346ab1a3d8e7cb43f85ca6
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7+:fwUQC5VwBIiElEd2K57P7+
TLSH
T10CB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6de34b260036ecaa4ce5839bc4a7ff7495e50b7b94349b12d9f840ca0e76da3b
MD5 56d82099872fb501c566d072ae897035
SHA1 2c96501551fc13c09496780960d8e7ccb4957b77
SHA512 c4b4017256caf25e88f146e6104134cddfd15089203e8e74c5196627fc92897f9fe7e3fc5c8305032be88e9409cdbc5dfe1e81017fcd5e38b3579b3d823b4a41
TLSH
T160D0C073378C7C00EA090170D013C3031FA7855824C39F03B100C01C54B43D9738B093
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f5dece638cd89af82b06bd2fcb3d1738eef64d2275be237184ea8bff7af3fdfa
MD5 f19ec2293392af872f10929c41627e26
SHA1 0576f5277c470f5bb8c3f4d3786ca8d967d0a33e
SHA512 4cc85dc71d34bb516f8fe45b565a6a9b4cda255a931f33289247ed84150baf0e2df40fc87109df41771553b92545ed858197cdd3d673694c83458cf9812aa9dd
TLSH
T16CD02272268C6C00EA090170D01383021EA6855824839B03A100C01C44A52D9728A093
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 c1d525a68078d71ea63054bb2baa3d10c9f21ccbe9fe93852bf9a38b0354484e
MD5 115f00728b7cef7a7faf1b13d2773e8d
SHA1 2bf80a6cf9bf8e96434cbab3a29f507b776c7ef9
SHA512 f0847a4f2d1c3b04f0b9402d759b2703cca9ee74c553c31c2f6b89c7e5d52bfe03cc556c842743fd428f2885250cd58e56b1eb632a7bdf32b184f6d63e2e1107
TLSH
T1C8E08698D5CBC26FA658A58BD2BD430C82D1770B9BC8ABCE370484987641584A796AB8
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 813e1fd027ad591aaa10db9aaea723b5f26b25a246205d5cb8fb529436535c62
MD5 bea1bfdcc4bb88fa4961aaaac03756a3
SHA1 056aab3922260d013f9d949eb96372157aceecd5
SHA512 16a7b1be3f0f724c70d063769f7821aae30fa25c04c2a1a4c326a45ab54444d5837ac4de701377d283ab3ac38cf4618ad14d1b6b490a2a2cb3f4e539313484e8
TLSH
T1E2E0208C94DFC21FA594A48B929C830CC2C2370F96C4EADD3B008488350145463C2960
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 352B
SHA256 f8de91c23e956abd744f1fe985ec335a709a0930a82127554ae6f99af3fda3f4
MD5 c1ce0ae9cd493d5a6bd00dbc5298e58c
SHA1 678313e6cd76dc792bef61449b812ce7500f36b4
SHA512 10cc34e650e64fab65c0ded6461369b93770c7ba8acdc076c7626841520fed84e4b2f3ac1b9e7b5b41afa1febbfe192661db70732c56ff836ac32c4f7f9f9357
TLSH
T174E0DF5D2386CDA8390697CFF17F521C81D1F2079E8CD6AE3307689C2A40204E755AE4
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 158B
SHA256 249358b1eab901f0b034023569e7f01b1f94c9179591789d99d6f279761d6e1c
MD5 e3fe72c0f542fbb29d9eb8933eefb382
SHA1 fce9a5a6bf89b76d58b4c0f0c691531330ab3b3e
SHA512 f71315278d44c74df19833e56e16d62705ddd45cc9bbabd13be55f51927a3d7464736846a1c4bcda6770c5b8c0720e1defbfbddb5206de648079efb1a9250340
TLSH
T17EC080D9BD4D845FD385187E5716F00007906511942796171650FDC032419A01E29220
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00007f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007f
Size 123KB
SHA256 819043ca034f72bff05218f2f6965da741109509638cc0956d18bac083e498d3
MD5 46bd7c14069e397ef7ba44357eed4304
SHA1 955a4e0528bdff171c67ed1492095d9e425cc705
SHA512 5034f983017934c3793c0d3b3f0f62bf0357200efab2a047bc9de76706cec814cd6800c766d511e4410aa52507a8b48b1934f9403af28818dfcc15105c7732ab
SSDEEP 3072:11Ab2xpTk5amk6gmwc/V6V4dMSkbFoKyvMCu3zGpUl:11AbipQ2jmv6adMSSFN+MjDGG
TLSH
T17DC3134CFFCDBFCB563926B2965EF8F0463D5CA409386C90C63592A42F2CB932297065
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000080

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000080
Size 25KB
SHA256 8f80f993e523f2e6c2d097552740fd26331658da23ffad31d26edcdd3aeec370
MD5 dae1850484b86d299c31bc08aaa563cf
SHA1 dca808d6d16965c40bfba4e4b3c8a819f843890d
SHA512 69b34f2652aa731ad29fe49a8cea85ebe4ef402573a10048598667f94b7a7855e534121f22d7749b81762b3176f437de607745df82b71484c4ab7c9f8bfd40e9
SSDEEP 384:nYOl9Z/81DjYTaXQMfCMNASNEVM9mYQdpx1sLt/zEkNKxgmS8AXACAU:pJ8NY2XQk0omjdKvKxgCAXACAU
TLSH
T19AC2E13F487A2046C71227F8EE5FC9B571C360A35AB32345C26748650DB0EA93F86776
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000081

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000081
Size 47KB
SHA256 d8e4fe0452aa2076429a9bb5d8757d00a994dd95986cf950e9a1a371b9a072a0
MD5 dcf31ebe107435bd68e0164d59e19b87
SHA1 b68160c9333af833fe483928b3ef7128c07a56a0
SHA512 130cd52c3cccc36a7029bf92b2ddb363b8b36d206454aacc246739919552fccec5cacbad615ba4ac3817da3e83239371fe51324bdadd08357e3495087f62cb08
SSDEEP 768:Jzqdwl5YV7FVmpudK5a8dF8D8Z7J78VGnNFZEKh02dmSTPe9UiallHcOEi2c0NC1:9q+SYuMaVwZ7oGRNh02dd6UialBcOEpE
TLSH
T11623F218F29471F7EDECD4D500A18C72BAA528D442F116ED07B8D53CA36CA817A729FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000084

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000084
Size 42KB
SHA256 1404ca348bd75ef836f4dd8b6f2cc719458642d1237c368296b2fc652dca47dc
MD5 665db5e157d2138835c4037c971ff3a4
SHA1 41ca6b7e4818eb81531d8006ff7ddd971c640879
SHA512 6c999466673c9873b1b112d6ab95c7cecb99467ea156e3e046b54c5f3d109c3845b05cbb2a0245d178430c7b2ceacd5110f7d8faf7e041100f44852b0c29fe9a
SSDEEP 768:tMTmVhyXCrekkraPAjrWMMWD3UJmw0FRwoglekm+hQ7//geceSF/mEQBPMAmDu5:cmHkCrHvPAjrWMMI3UJswogl4j7/hSlW
TLSH
T1F9130231EB70EE59962C903454E7FDA9433B1457D731ACA80E99A1CE6F8103454FACEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000088

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000088
Size 78KB
SHA256 5e1262af39219b4201b041292d09027ec726672545941b7064fd81cf5d82a100
MD5 56b9f98b9e9801b92aad55e00e9bc5c6
SHA1 9b3925944a36609679e4c529269843b7af5eac82
SHA512 23135096a4298f06a5b2657344d96cc9b278c1a90a130926e202f14a68731d3a4d5998c189c27fec64d9f99311ef4fa5c51f0a0c1d5aec8f0136acc52a257023
SSDEEP 1536:LS1Pas7b0//BRMTDXmxFqMNKQbPzedLv48KjD9zkB8OoqdbPJ:KPas7b0//bKIFqMYQnWj2QF
TLSH
T1DE732AF0B6D0B0F84F664DE1A13F4315B2662F52744A98A0E12CDD542F615CBE4BFEA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000096

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000096
Size 1024KB
SHA256 332f861d048fe11c30fa958f44e266a2bdff576a2c34ec54b8327fa58a244ab9
MD5 25a650dd552e4a19064d315634e2106a
SHA1 0b847b4c5b8ea30f949f8646afd2050f4c738970
SHA512 cfb222c795ff0f78c6b8357a1ab8b56bbc3192aeb11d58f98afa52a3fe6f613918b2efe58489d10864fd0ee56ff54b65155d9b9ea85d1f65d6f6401e36489034
SSDEEP 24576:J4GVOTAiaZRbQSoGQyZhjufcOpvh+G39Q0voWaYMFeUUUIh:J4OnLju3p5OOaYlUi
TLSH
T1302533C24A2F7EC50963C746DE352631A855EC822A22D7C7A3B87F21157F52B2FB444B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 45be09ef449bf123a4c3285f0c5b106006c92257720e24cbbfd592f96c17ec29
MD5 5a3484b0f024b5eac8a31e27e11fe3f2
SHA1 f6a57d53d1a12ca96dbe46022c3ec9b46a377bf7
SHA512 6ce26e9c630d3084e4c0c835181de57a2b155dc83f97557979dfda3a64bb14fe118e2db0c13ecee7483da46862bbd1ff7cded34e75c3cddad9756d9f0d4f2a08
TLSH
T110719390F5758886D3A6833DD6E1C6243035A6AB0B8FDD4B0670553DE50FBE353AE518
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 7b8c200a53f024603f9d10deb12d9c63e18eee5e2640fb8edd245b80743cfc3b
MD5 92ed3f4f8b3eedd9a280f2a62c8faddd
SHA1 c67dbc28924822cd05075ee3ab325e164a01bb26
SHA512 071ac570bddc2589e1acc9bafee8eb6c41db3b75fbd4a9e9ca9207dfaf9faebde122a885bbcfde71653cf9ad9b5ac6270b0f7796063ab0154525ec403a864405
TLSH
T13371A3D0F1759886E3A2837DC6E1C624303597AB0B8FDC4B06A0553DE50FBE343AE618
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 57c95165e2052e2732fe88c13fc4c1d079fd89b944b959d9694d16b3e47ba7b8
MD5 15b13a9eb89afdb8b34de07e6fbf3808
SHA1 9bd7ba613ef948874781fcba871b1d6294411b10
SHA512 06ba998a2a1819402157d5ad9080203bb5439ec1b3176e0fae0035cdf54df85e72ae1b5ac1449d69ecff77cac240459f3597cd653c19f8bd033146d6ea047686
TLSH
T15C7181D0F1759896D3A28379C6E1C624303997AB0B9FDD4B0660863DE50FBE343AE618
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe595e33.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe595e33.TMP
Size 3KB
SHA256 2e67db61a7acce2d7b0cdc6e443ee1ca7f96c4404b8a79877b798342fd86162b
MD5 6062965554bfbfd70ae4e2e0afce276d
SHA1 4f24d76370e58a08fa7df5ac5a6b67344ab9dbb1
SHA512 411e11ff0f3c261394fc291edff59c77e0b4744107fe443897a543cdfc46bd37af960082f7882aa4ed4a3aa20dbc56e4bcc65d339011b32b788c2e8fd5712cc4
TLSH
T1EE7192D4F1769896E3A2837DC6E1C62534359BAB0B8FDD4B0660463DE50FBE343AE118
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 5b169fc37ad08ba9d40437c7491e9ce1eedb4510548b26f11760f9abc86b87b6
MD5 1f5a18b8b292d042c521ea2fed9f8c61
SHA1 8ec75e05e1fbf9c7bd7477c8b13849e257e9756e
SHA512 d45f8a108c2f477ede38c88b41961477c928ccabc610c4badc6fdd61e82ebdc192e089d9c332bf44abe8ea41c8e2f93043811733d3d12f0d9b0f5f5a79052123
SSDEEP 96:D/OunRYRQRsRQartrzBuNR4R3BRxRVQiVqRtwCU/LzRSuGj4/3:DWiKmqSartr1CmTzTQi0bLU/LzguGj4v
TLSH
T177817AF6C3E5862ED91196F0AA14AE2BCE1C0514472C3D3989D5BE4BA3E3471E102B6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 59080ccd2d175c882b99fd29bc02586169226aa21227f3de110f869abb0d243e
MD5 caa159d966dddb4fc1acd6c27b0b8976
SHA1 d961c60754b2e3446d8bb9737e6510752d68e104
SHA512 b2278079f8cfc69d97de7264e14f2f1f45cfc9072790f1ff43ee3254dbe0def90ecd33cdd3a137f61bd5378f63cc0a35d007020c6746b5b387531bf7df3cebec
TLSH
T1B1617BF3C3E5861ED95657F09A14AE2BCE1C0524431C397A89D6BF8BA3E3471E10275E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 067298b691543b2db18481edcfca92212d47f1f2ee0ae5731e31563f425a7f95
MD5 385786e012675fc27752faab6ac962c7
SHA1 0882f189e7efb469dbea19632ae0a1073bafe162
SHA512 712cdf467b8003e00fc79ea4f23237db984f93935aa0a753579731e660b581941f75de1cb551d2569accea5f93b0dd2a309df6caa59826a2538c57306ff2705e
SSDEEP 96:DOOugR9R5RLRaartqztuNR4R3iRRRVQiVWBKRtwCU/LzcR5:D9BTr5IartqJCmQjTQi1bLU/Lzc/
TLSH
T167A17BF7C3E5861ED95256F09A14BE2BCE1D0924432C3D2A89D5BF4BA3E3470E111A5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 a2ee551a7c7f5bf1dc28cda37b44ca2121bec664ade8eb4b3490aa4f71979219
MD5 f256d2e4aac447156005d8609bc8f1c3
SHA1 b2b4bacd32ec2d3f7a7ce8fdbfb0ed4d02be9315
SHA512 aaad93afe7343c1b74fcc58b1049610bf20b02ca2b9b33aeee28e5bfaaf0245cd1a8744436c4d65b28f3845e866daf709caf368b37b019109263f9a0905bbf2e
SSDEEP 96:D/OunRYRQRQOktsRyJ4xPgzBuNR4R3BRxRVQiVqRtX1zj4/QwZuGyZYyY/p/xs4q:DWiKmSOktsS4Zg1CmTzTQi0bX1zj44cI
TLSH
T1E5C1CBF683B5866DD91296F0AA14EE2BCE5C0515432C3C2A89D0BE8BD3F3470E152B5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 89c474faf482f23bcd5a3fdc9759bbad64a7014aeaa7222db6a7fd5c006f03da
MD5 7d16a2b806770a3e62f06b92bd8b38c3
SHA1 42753953fe7ed70f2dfe2023e08f4dbd720587b9
SHA512 b8c6f5348dfbc56899450cde356b19cc47b78218a4fcfa911e24c9efdaa6a30f7bec56c47ae0f732a9f46f7969dfbf69676b2b04885e184600ce82d6e883c588
TLSH
T170819CB7C3B1C66ED91196F0AA14EE2BCE5C0514472C3D398AD1BE4BA3E3471D142B6B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 1cf915277d1b3f00c42f5a15760752e580a00fddecc958095ab596a7acdc3480
MD5 62869b52ebad461788245f20c77e4ad4
SHA1 c9e4804b232d1a636a081233bc87dd570cdab1e0
SHA512 bc6324bbc9bc27f60fc2a8c10ac0756a7d4d28be96984485339a9bf0e43620b512270a9830a8f623c4bd9e9836d54e5ec33c98394483b24130097e4d1eb02618
SSDEEP 192:sxZeRWyM/jK1Ml8Mkw/fSs1z0Idp6OWHW6+WNrzh/Yw/RV2IgrJ:sxZeAMw/fSs1ztsHb5/I9
TLSH
T19B52E701AA346E77CCCBD209BA45BB53D6F51572A2904E94A9FCDA1C04F6BEC2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 f61d9419c602995fff526f56b550183e769a53dad062d701e0ecd50ac407b1e9
MD5 2e563e53ebbdb4d0d8586fae52a69f40
SHA1 6ded56c57435852adda3eafe13a82e0095f6d488
SHA512 54e3e2d6642dd5501b06efe85535fae95469a3fd026bd65ee76a432f1e159d5065483cd52e259bfe74925e4053cf0684537d7f3243df13ed2d0467d664b4158c
SSDEEP 192:sxZeRWyM/jK1Ml8UQZ9w/fSszH5IdpEnN44HW6+WNrKxFYw7Sj2Ig5kJ:sxZewqbw/fSszHSAHbEFPO
TLSH
T1C652D642AA345E77CCCBD20DB945BB53D6F5057292904E94AAFCDA1C04F6BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 29KB
SHA256 0c97e508a4aa7abdad0d1ac92a01c7de6aedb5c62d9e4b450f85b19f1a76ef8e
MD5 14ef43541cee4ec21c71211b519cf9bb
SHA1 dfb696081854f4a6ca83455e5cc5425356323179
SHA512 3049ee62235872853f26448fd5804605ad5d0095cc175c5c5d9dd3066cf33d09426d320dff58a60ee6dcd4d839d27e37569349d12642c3a0e300d0be399f3c19
SSDEEP 384:sxZ1nFwqbw/fSsz866s8qMpRiYnazAW8pZS15posJWeT+KbDHbWZHAOJuO:stF3bw/f584Mnc7WeT+KnHbiZ
TLSH
T158D20701A524C977DBC35D18A43D7E33D9AC506262C4CEDA5AECCE1C01AD6FDAB07827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 292fdd7c4f52b718d3a3bfe5b7178f0be788239e4bdd290ffc69e53134019923
MD5 11b26da2c6b6beecbb9c09a616f1af34
SHA1 2611bb14a196c073b0b074897deff560532b6b39
SHA512 68f567ae9dea455e605515e43da2c6f000ae1f66093d3451d8f419042bbb09b407e7428b5e60136f480250d6aaf0187c4b10f2cd3f90e293024c763168fe9d70
SSDEEP 192:sxZeRWyM/jK1Ml8Mkw/fSszz/Idp6O44HW6+WNrzh/Yw/RV2Ig5OJ:sxZewMw/fSszzwrHb5/Ik
TLSH
T17B52E701AA346E778CCBD209BA45BB53D6F5057292904E54AAFCDA1C04F6BEC2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 29KB
SHA256 37aeae2fa1d2490473ed6da4cf56fd81e63e9d1385516bc11753012f90b5486e
MD5 e80ba8dc3a23b5803f87bb119883afda
SHA1 633865b387aac629a875d67866bdd051e7607e02
SHA512 75047982f83bedd35c516c5a2790a96d25ea20702cd0f9af195481929206657579d847001a334e722865f8393995a82e5bd09845829c82a735ae92dce3b6b8b9
SSDEEP 384:sxZGnywqbw/fSsz866s8qMpRiYnazAW8pZS15posJWeT+KRWHb1kOb/6O:s4y3bw/f584Mnc7WeT+KcHbXt
TLSH
T135D21805A524C9779BC35D1CA43D7E33DAEC40626285CEDA5AECCE1C01AD6FDAB07827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 dc4ae9b03f807aad1f35c841c63f1929f54606df1a0fa26a9c4c2825ac45da06
MD5 37f51ccb2d139f390d26d32aa1db718b
SHA1 7bf09a823b4abd5fa570c2168967a9b8b635b496
SHA512 c0eed11c679e14c3cf425eea05751da4eff6a7d7054facc8082a221c778588e7b418755a375b48979d3420748f22e6b22fc00ff7b75f96f696747a77e0ea2751
SSDEEP 768:aj4jeXmWvmKxE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhPLlrZ+dJroh7Ka3s:aj4jeXmWvmKxEu1jacPLZQdiLs
TLSH
T10DE20A3B240CCF7E4F844E5CED26AE872ED802CB6A584D5047FA494C03C76EB512B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\06cdf1d3-b695-4c71-9713-e0c03943cb59\index-dir\the-real-index
Size 1KB
SHA256 e62aa5582aeba9936c265b7888df5b020e5c95167d899ae461acc52416b8f71b
MD5 bb29c5bbcb33ea3b10bbff7a108a0c18
SHA1 2ebf2330ad2bc1cbf264c286a014ba6ecb83fbe2
SHA512 9f25af31a68994eb8a2a92a6a3caf6ac05399b9d6621f258c045fc7e34b93bafe65e1ac763afae41b5c3d789026a6624102dc0a02738adbb34d45a173d2e4f81
TLSH
T18131514A8D908E5BE85445B615B379BC32B089CC4A20E253582C2235BE2236A179B1EC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5d6ca7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\06cdf1d3-b695-4c71-9713-e0c03943cb59\index-dir\the-real-index~RFe5d6ca7.TMP
Size 1KB
SHA256 839eea8f19c8bc805df8a9bac40e5d72a36fd5f9e44f70d19af87c465bcf09c1
MD5 9dd0502983aa37e81f0141f61fe473d2
SHA1 c3e0c11535549cfa50f4eb11ee83c7f3a3721cda
SHA512 2af8ce60e2d8354292b1dd601ac7be3d0b6cca4746e1edb0a29912b15424543ee444ccade20bdb52b8afa18df9dc572d7fedbc4ee8ab9fa793c64b9c6572d25b
TLSH
T19331664A8A908E1BF884507709A7A8B87335D9404315B783987C6239BD35BBE1F5F0D9
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 a5a2ded19080c552d251bbf4427a01532ab2376f90004de732efe8cad1765ed7
MD5 9f4468e8295d2077ce2ae2f2c35f6102
SHA1 f42322b9846471c96830bc6e9b8c8d7f9a74a3be
SHA512 c1c1cfccf267dc7683ae14140ec8707a6d12f4532fff18059875a572d8ec88923f4cc22f8d586e1e78ee1cda65250b194e4563e6ba908ddd7d482bca26c838ca
TLSH
T177E0D8FA2DD72E20AC7F47E628B245B44156B469C555AC8E2416A2E751A02682016C61
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 da1fb4fb393c5e195f52539038a4dd91bcf0e7ae6095670d9239c0cecd1f5b48
MD5 8d678411017d9f3579fd784bf5b12945
SHA1 1140d9d0dea0250b55c9769c112e2a2306d5afd3
SHA512 9d97ed2f2286da6f95a83821e1bef4013f36aeabe5a95e1a92a9dd9a987c3455e43b258bd2ae09cca0a42e4ec3d3628e8d750c619d61890e1b947a6524f16084
SSDEEP 96:KkHC7ntll+n1AldH+KFLdB+pfHoxXfm3uKQ4XEQKJGyiz:zHC7ntll81A3HHLdBwfHoxXfVDDq
TLSH
T10391514672BF42023C7EA90C9295CB675742B5733118A42B7BEC41A64E67E280EFDCDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.usage

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\FileSystem\t\.usage
Size 24B
SHA256 c7d8233319fb8b5137d3d30bab5b4fba5ffddfddcd1413dea3173a8fc7bc58ec
MD5 2aa4e8256c1d438a6b454e6f092574f7
SHA1 2b54a19605efaf72aeb7443df91dc93be404b389
SHA512 59ada4ef83225bfcf95d7b70a1aaac4300c282b694823e08a0130fdbe4202b0b5d635d5b25212622695e288343475f2ee42c09a2c0d46c7b8540c474c696dc59
MD5 SHA1 SHA512

Submit Download

00000000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\FileSystem\t\00\00000000
Size 1B
SHA256 6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d
MD5 93b885adfe0da089cdf634904fd59f71
SHA1 5ba93c9db0cff93f52b521d7420e43f6eda2784f
SHA512 b8244d028981d693af7b456af8efa4cad63d282e19ff14942c246e50d9351d22704a802a71c3580b6370de4ceb293c324a8423342557d4e5c38438f0e36910ee
MD5 SHA1 SHA512

Submit Download

5a4800c2-6475-435b-b945-fd11cc48363e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\5a4800c2-6475-435b-b945-fd11cc48363e.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 291ba83335e997888df89c619ee2041471abd50629429cf54949573931275e35
MD5 e996f8852a99a41afaf4aa65a7228741
SHA1 5acb4058cdfbaa599af5633bc4cadb7f6475fcda
SHA512 a579fd0caf51ac1f62e4476e26a157d0b75aa033d3c948fc0ec9461f746e173620871db81ab0b58c50b3047dfd85eacd4985bcda6625e54d068594af64c0149c
SSDEEP 384:BZcIhsNVNGKoEz4mf++BO1/cGFoKLtuMAo4gh9ChpHZUx:JhzKG2TBO1/c4oKLtrAo4KChpHZUx
TLSH
T1C2929E315834AC371CE7A685F8872A138FF89127D6C82F949AECAB1D04DD69C230AD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 db96220f220ab7027726bd7089af5ada8dc41f80641f3baa6d8d7610a75ad73e
MD5 67587326a68cb0cd9e9bd2d39750dd2b
SHA1 6580bc4482bdb7a4ed610eab9e412ddaef3b853e
SHA512 a09d03ed6b280f6442f263fb94336079e4bfda01ace83ba8f26b9e0d3c257cb703eed8689025cff37fe58929839fa5a04b98bdbf1f2f90bd5dfb52eed2b4856f
SSDEEP 768:KF4yIwg4KGSTBO1/cVoKLtrAo4KChpHZUx:lykpTwE+CAo4P2x
TLSH
T143D24BF248D7883AE8AE5743F77E2D138EBCC123B5846A90B7985A1CCC951BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 2491fb55581af83aab673a3b6eb05c107ca668f7e20f99c14d46023f293da2e4
MD5 7d7c856ba3058d50a4035a962403b225
SHA1 35a98b98094470c356b97d31ebcf1e3161e5b5f3
SHA512 77b7540d015e49e25130f87a2b121fa02bf39b01606018c66383a0638bf7792a6c0e9a27044607ed89a8aea9e1ac35e2812e8ac736213cd53d46b563ba22e887
SSDEEP 768:KFHlIwg4KTSTBO1/cPoKLtrAo4KChpHZUx:clkOTwEgCAo4P2x
TLSH
T10CD24BF248D7883AE8AE5747F77E2D128EBCC123B5846A90B79C5A1CCC951BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 0dbe605645027cb24d1e458e5c1c342254bdd4e1c944d3331b7b67977c47df24
MD5 43efb6d5e7160f9b2b9fb7d354c1f86e
SHA1 2f729b8b329de73646e5d1278c296b2cf4b721f3
SHA512 31a8b031a77c2fd729dfd554cc21a9b662830122ebaf5bd64363783d4cab0963bb7d3bc69126336903582e4bb7f39d8f0f2e9186d6f9479ba1b823e7193bff67
SSDEEP 768:KFQx+wgdKdnmTBO1/cuoKLtrAo4KChpHZUx:nxlcTwE5CAo4P2x
TLSH
T1E7C23BF248D3883AD9AE5747F77E2E138EBCC123B5846A90B7985A1CCC951BFD305811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 7b0d72fb86fb55fa38d34f2b3d518f4efdb28b210c69f350c6adff84bf0f0111
MD5 2255f12fed77bf81a89c4bdd91eb27c7
SHA1 1dc81a3b5415049be748ebad05eee597e5d1a2dc
SHA512 431eedf5a8cc97be9a1008effe5852569fae64270ec3d1f692143cf7c3cdc63486fdaea4895a02bef8475cc7180519d49f9d6d0b0f7fb38770787d82041f9101
SSDEEP 768:KFXlXwgNK0STBO1/cPoKLtrAo4KChpHZUx:aliHTwEgCAo4P2x
TLSH
T11FD24CF248D7983AD8AE5743F77E2E128EBCC163B5846A90B79C5A1CCC951BFD306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 6a4a8115de033404d9e4d64aca60e7971439e5e010b07b81244ce57c4506405a
MD5 a6462f4b7eb73a07e5f1a007ab8f52c1
SHA1 df6b9247dc7f21341f643e3670559158623cb389
SHA512 30f424ae395d289bae73437206611cc20a54eded54ac5923f1e141fd469320c70325745be4feebff8a9d46d47a5257535e1efb5847d94bb52f6155401ed9f892
SSDEEP 768:KFW9Iwg4KTSTBO1/cPoKLtrAo4KChpHZUx:n9kOTwEgCAo4P2x
TLSH
T1C7D23BF248D7883AE8AE5747B77E2D128EBCC123B5846A90B7985A1CCC951BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 1fae2a87ebf2969b337fdc852bd9d656d412926eb55ab34a2b7619f4c7b7b6fa
MD5 06f7a0c8280d11bd287d524d659b4634
SHA1 d517a489bda0ad6a1fa6fd168d2cfd52fb641a64
SHA512 9f262d32d6bbd035d904755bb7f663fa6fd6628f9629588287ab78fb6470b87b7d31404831f20be3a582c6150b26330218580042f75511f7e8aba8106c407929
SSDEEP 192:EONI6hZ0QmiUyoGpc/+jVEBO1Tm65wOZogfrU6:EONI6oypu++BOU29DU6
TLSH
T1DC02D935686C6C778EE2AE49F48727235FE8212BE9956F84D6EC1B1D04C775C2307836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b337ee2421624c2acffad52945cf571839133842da2d5b36b4df1a11942eeb58
MD5 478cd8761f28a59e87b8d28d60997d7c
SHA1 30aaabbe8b782d0b1364cd85001c4087b5e5c3f9
SHA512 0013ccdac274b8bc65e88bc39d55c1d636e3e74e23e6cfbc59f2cebf3cc45770d1c5f73487638e1e00bda849cd6ff49038c238ca34d23e446813ed5f01abaeab
SSDEEP 192:uONY6hZ7QmiUyIGyc/+jVEBO1Tm6//E95cOqfqLU6:uONY6xkyu++BO1/cI9oU6
TLSH
T144121B326868AC7B1ED2A984F48736534EE45227DE897FC5D6DC2B1C04DF79C230B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 3aae68bd442ea2c46633ca3cb609d81bc532fdd8782363ce0400b1947b79bce2
MD5 70f8cd8c79258e854a0d4cc4792b768a
SHA1 6025234cb8d563c5c48f60a49bc56382c02ea2dc
SHA512 85aca0e25ca1d9e5f0782ddbf136ae708f734eecb70cfde24a09234edc17f33956c15b363ec695612926555c6d6582987937afbc14faa9db34e1de3750f1e2bb
SSDEEP 384:cZcIhsNVAGKoEzen2f++BO1/cGFoKLtuMAo4gh9ChpHZUx:KhmKknmTBO1/c4oKLtrAo4KChpHZUx
TLSH
T18C929F3158346C372CE7A685F9873A138FF49127D6C86F949AECAB1D04DD69C230AD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 0fd2c87551d33d1230a39c6b30e5d90e26e872fb3706bff8a9b3a9f227900a93
MD5 d97606c55e5aa7b0784eb7ff08744064
SHA1 30a69e2867202e31a387571d8f2264102a8d0b41
SHA512 b6125920a5737d92bbfce68838062b3d7d701bcf2511f8659020131f869963028b34000e5336b6613ede553186849131c6d8f4599827d0c9e553274b518df1e2
TLSH
T147E00913930120AAE064033400A36B206BE3D1240272030B8B2042796C637412E50B88
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 85dd44dc48668b84881daf9f9fca218c780e526cdb98d3d60e3f82f7b55b253b
MD5 f7979b481a8df80f810429b8d88a4021
SHA1 891e4cc96f6c8d711621092a4a5b490d88666ce1
SHA512 2699e3595d2878d839aa7ec8de7d9ed66407a471c661cec764102a1860509c71fbe7b8439a88917e5ee7db7a4dfe2a090912d716ffab240dc23bfa6eb92032b1
TLSH
T1B7E0EA13C30219EAD028033441D707217FB3E07013A7130B5E2056383C23B657F24A44
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 0d14d8bf4136fc4405dd65a953c1142043787d2685a2151887f23d04e8c8bebc
MD5 4faec24c10b6efb51a40a00f77c2fa3d
SHA1 feb7bcfc34de7e266d3e764ed2bdbfcfb04543f4
SHA512 7ad3d7a38a1190f412c3c6294cbead6a2fb0ddc5da14ab1e38b814c769b96da896a4b1ec247b376b26336159f03751ecfc76b63789b60f9583371f33dbba34b6
TLSH
T173E00213530120DFE038033400835F204FD3D1340272030A8F3041681C337013E107C4
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 317b4f567265613e44a816ffc0ed09ba239113ed52d7cbca86f2736b0ed974ab
MD5 a1f1451c6bc6baff5e0774604283660e
SHA1 f6a65693e4e4342fa80228f6b861da9da0f3c7da
SHA512 46d578f6ee1e0849962d86130a40fb51b5e86ea5396cfec9e4c5d33e751597dbfec7b99782e45f6b7fdf4a7a9e363d1878876e9c872561fdd385b83b8855860e
TLSH
T17BE00113D30120AFE438033401E35B303FF3D13002B3030B8B20103A3C627912F20A84
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 31a128bc725406f6c2f03008f845c998b65385337920eae447cda6b811d647b5
MD5 31924a7cd6423d95831f0d5b29836860
SHA1 8a9ed2748a1c03c4f97a8d2b614ad2072081fba4
SHA512 59afacdb3c5f601e9387e7a59e47f8dc2e18840d7dea4c7c0c43d244f1c1dfe1bba150313678dbe6bf0f3dc0678ca4f444bd19d8b6edbabb80a2a65faab64b84
TLSH
T1E0E00917D30160EBE068033410A7AB206FF3D12402B2030B8B20527A6C637412E60B88
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 9c435cb84739ba16f20db644eaa4330b6653cc4d625cb1c1017897c12ab10589
MD5 f8d5a843358c300c364edac6b3b6a5d4
SHA1 f6213d85482aa314d34c89c0a712e2050b99c0d0
SHA512 c75c9a509c7a80faa1d58143adb1b45379109fe3b0d5e410a2b29f274b2c912686d1ff6d421d3c2745a612d99ae793169995d037248200beb428540131e7b3a9
TLSH
T19CE00417D34160ABE068033411E7AB206FF3D17403B6034B8F20617A6C637422E60A88
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 4c633af64ea49571f4ecfdf6c218192e9041218ecb5e93e7fcde65198d3575e1
MD5 642fb486e7d42d2f335af21711de9faa
SHA1 f557799c88cd134c5d9591274ef3ceeb8a2d0a1d
SHA512 8436dcb19ead34b7fd7bd884059d6885fb1a5407023b087ed5187fd290f16c909661fd9ddf069ec4e32b798a6dd07696de59d80fccf91d9e6a952c31604eb451
TLSH
T170E00427D34161AEE479433411E7AB206FF3E17506B6074B8F20617A7C637622F61A88
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 5273a8e3bd14a993f30e9fd96369463f4dcce835b7f7d73366a8ef3f82d1f356
MD5 13057ef3209f1a08cb0bd1b5e19476f5
SHA1 accde860730f9db4aa08bacc15d88414cffa6f34
SHA512 e6841defc260b7277802f0d4ea96dd80d705ee7b5269eec81c1784d1710bee528637f0509a50b86ab344952927aeba937206782e0d9fc432fc10806f3e86e053
TLSH
T1F3E0EA13C30229AAD428033441D70B207FB3E06013A7030B4A1055783C227657F20E48
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 324f9b43073e5d082c4dcd7223f2b9efbef7bd0254fc1b699a66f36a80282065
MD5 d4b2178e0fb97b920f61e56388041226
SHA1 40786790e5ed194ed360595d455ba1e8f16d441d
SHA512 ee2d8be7089d7d1890384b80a456dbf2f70805ff44249958b06f3d63b19f226c6f84c96efda609aed1630e7a012247a7ace740236f4b552eb3f5b635beec460b
TLSH
T19DE00113C30120AAD028033000E35B203FF3D0300263030B4F2010393C237512E20A84
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 40d4af454236037773b416a8bce5ba697f0a2e65364c4c05b884567889002ad6
MD5 6e3974dcdb37081492e6dba607fb65c2
SHA1 77bb6e895e357608ff514198f39fe68eeed4a227
SHA512 d3660880259791c966b40181d2f3926f03d9bd7a94069d5ba2124d5afdd89ccee3d98504dd80735e7a1d834960fd8a77ae7dc6c81aad060875e19080aa09be36
TLSH
T1ABE00113D30229AAE438033802E35B307FF3E12002B3030B8B20103A3C627A23F20A84
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 1e950d547e09ab340ee667857f02520625a973babce1785f1ca5519da84cc8af
MD5 bac2d1e99ad25f648f0c61b1c21a957e
SHA1 4d1366678aa8c09123a5e6fc789dec8706dd2e80
SHA512 65ee07ef28a6fa46cb438aa41c5f09862d2e53a416a23c1a1db9b141886449d03c826e8f4c2ea4ba45532cf31358a948d3430a47ec4d8f0050371c05b827d9fb
TLSH
T18CE00213C30229AAD438033441E74B207FB3E07002A7030B4F1055383C227657F20E44
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe592205.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe592205.TMP
Size 392B
SHA256 4477d00389e48eb16e20eae8998fa9a048808e66a3835886f29e97663e439e42
MD5 c32bd9444389fdec90050f8ccb712167
SHA1 1150f2f4aed3badebc3355b3f7d4d3abd8cc6fd0
SHA512 1f6c844a5afc0671d72da6322cc04134ae0990e7d9bcf6ba1f2205d734b0e768b0d4fe341208a4e3c85278f723c970d1769dc124fd8332c10609025e7fbb6cce
MD5 SHA1 SHA512

Submit Download

3a6e4249-89f4-408b-885f-252f12c86572.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3a6e4249-89f4-408b-885f-252f12c86572.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 744193a32466bb7c6b2414c8e829c5f11b01f5eb2da0fd8e7f6c7d40823496b4
MD5 e1838f030414de7bb8a2fcc7a5178b35
SHA1 3cc921d93e67421ba201865bd811b802cc4bcd87
SHA512 8b67f7393299e4a282a2b378639a75597803f120f9614be050a2b812f4c47596514fb5e838320297b73f8b795493ddcc5bb2249dc5d5bad6fecfc2947df9831e
TLSH
T1EC412A48A6E91148B3B76E56ABF7986E447FB8733E0BD45D00010E4F0B26B44C862B37
MD5 SHA1 SHA512 TLSH

Submit Download

echocini pc.zip

Path C:\Users\Admin\Downloads\echocini pc.zip
Size 393KB
SHA256 b8bd94122b0fe23cdbebef7f80fe5bdcc54994f810573ad454378fba3725dd90
MD5 171c8893afe4a66e4e2b1a88598500e7
SHA1 ade1d974b4fa8550fd1ad9adf808f2d70c329594
SHA512 79a2df82e9924762f9107f01780a99bb3a1a7a48306c2a38383c15efb3aa208d64cd8ca63dee17458e2e6bafb16d7116d10ad466efd1fef9dcfa03577162d832
SSDEEP 12288:YxCsVbdzneD0SctWVVcgHdt6MIG3VoO7c:YNJj2MtuVdt6Slo3
TLSH
T1378423CBC33FE429C1FFC4BC68F45626993154E6CAC86E05ACE2D63A069516D27247E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2840-435-0x0000022EFEE30000-0x0000022EFEE31000-memory.dmp

Download

memory/2840-419-0x0000022EFE190000-0x0000022EFE1A0000-memory.dmp

Download

memory/2840-423-0x0000022EFEA60000-0x0000022EFEA70000-memory.dmp

Download

memory/2840-430-0x0000022EFED20000-0x0000022EFED21000-memory.dmp

Download

memory/2840-432-0x0000022EFEDA0000-0x0000022EFEDA1000-memory.dmp

Download

memory/2840-434-0x0000022EFEDA0000-0x0000022EFEDA1000-memory.dmp

Download

memory/2840-438-0x0000022EFEE40000-0x0000022EFEE41000-memory.dmp

Download

memory/2840-436-0x0000022EFEE30000-0x0000022EFEE31000-memory.dmp

Download

memory/2840-437-0x0000022EFEE40000-0x0000022EFEE41000-memory.dmp

Download