hxxp://tria[.]ge | Triage™

Analysis

user interaction
yes
max time kernel
814s
max time network
819s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/08/2026, 13:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://tria.ge
Sample260807-q3phnseq8z

Score

7^/10

discovery execution persistence privilege_escalation ransomware

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
4280	msedge.exe
4280	msedge.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\system32\spool\drivers\color\CalibratedDisplayProfile-0-Temp.icc	dccw.exe
File opened for modification	C:\Windows\system32\LogFiles\WMI\FaceUnlockManually.etl	LogonUI.exe
File opened for modification	C:\Windows\system32\LogFiles\WMI\FaceUnlockManually.etl	LogonUI.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5536_695333853\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5536_986883273\deny_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5536_508282407\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5536_1533568243\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4280_496045892\autofill_bypass_cache_forms.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4280_150277515\Mu\Social	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_1887293000\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping900_602648032\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5536_695333853\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4280_150277515\Mu\Analytics	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4280_150277515\Sigma\Analytics	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4280_1834792010\well_known_domains.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4280_318964749\english_wikipedia.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4280_318964749\test.txt	msedge.exe
File created	C:\Windows\rescache\_merged\1190018277\2260672429.pri	LogonUI.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4280_150277515\Mu\Fingerprinting	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4280_1424124003\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4280_1424124003\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4280_705187330\ct_config.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4280_1834792010\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5536_986883273\deny_etld1_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4280_150277515\Mu\CompatExceptions	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4280_150277515\Mu\Staging	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4280_150277515\Sigma\Content	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4280_705187330\crs.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4280_743394285\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4280_318964749\female_names.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4280_318964749\passwords.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4280_150277515\Mu\Advertising	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4364_1887293000\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5536_508282407\crl-set	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5536_1533568243\arbitration_metadata.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4280_496045892\regex_patterns.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4280_1086206850\safety_tips.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4280_705187330\kp_pinslist.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5536_1376342796\classification.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5536_1376342796\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5536_695333853\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4280_318964749\ranked_dicts	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping900_1946556076\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4280_150277515\Sigma\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4280_318964749\male_names.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping900_602648032\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5536_1376342796\travel-facilitated-booking-bing.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5536_986883273\deny_full_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping900_1946556076\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4280_496045892\v1FieldTypes.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4280_1860674669\domain_actions.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4280_150277515\Mu\Content	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4280_705187330\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5536_1376342796\extraction.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4280_150277515\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4280_150277515\Mu\TransparentAdvertisers	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4280_150277515\Sigma\Advertising	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4280_150277515\Sigma\Cryptomining	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4280_150277515\Sigma\Social	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4280_296016601\Microsoft.CognitiveServices.Speech.core.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4280_1086206850\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4280_150277515\Mu\Entities	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4280_150277515\Sigma\Entities	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping900_1946556076\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4280_496045892\edge_autofill_global_block_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4280_150277515\Mu\Other	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4280_318964749\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
persistence privilege_escalation

Accessibility Features
T1546.008

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3956	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winhlp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winhlp32.exe

System Time Discovery 1 TTPs 7 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6600	msedge.exe
2500	msedge.exe
2448	msedge.exe
5032	msedge.exe
5108	msedge.exe
2080	msedge.exe
2928	msedge.exe

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	LogonUI.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	LogonUI.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	ONENOTE.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ONENOTE.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ONENOTE.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	LogonUI.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	LogonUI.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 27 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	ONENOTE.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	ONENOTE.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	ONENOTE.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile\en-US\0409:00000409 = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\InputMethod\CandidateWindow\CHS\2	LogonUI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\AccessibilityCPL.dll,-83 = "Narrator"	utilman.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Lighting	ctfmon.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile\en-US\CachedLanguageName = "@Winlangdb.dll,-1121"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile\Languages = 65006e002d005500530000000000	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\AppDataLow\Software\Microsoft\IME\15.0\IMEJP\MSIME	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\StigRegKey\Typing\DesktopNearCaretKeyboardEnabled	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\Personalize	utilman.exe
Key created	\REGISTRY\USER\.DEFAULT\Control Panel\Colors	utilman.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Windows\Pen\PLOC\Settings	ctfmon.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\CTF\SORTORDER\LANGUAGE	LogonUI.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\CTF\SORTORDER\ASSEMBLYITEM\0X00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}\00000000	LogonUI.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}\00000000	LogonUI.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}	LogonUI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}\00000000\CLSID = "{00000000-0000-0000-0000-000000000000}"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Input\TIPC	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	utilman.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Keyboard Layout\Preload\1 = "00000409"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\TIP	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile\en-US\0409:00000409 = "1"	LogonUI.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\CTF\SORTORDER\ASSEMBLYITEM\0X00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\TIP	LogonUI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\AccessibilityCPL.dll,-7008 = "Voice Access"	utilman.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}\00000000\KeyboardLayout = "67699721"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IME\15.0\IMETC	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\InputMethod\CandidateWindow\CHS\1	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Lighting	ctfmon.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\Language	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile\ShowCasing = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem	LogonUI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}\00000000\Profile = "{00000000-0000-0000-0000-000000000000}"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	atbroker.exe
Key created	\REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile	LogonUI.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\CTF\SORTORDER\LANGUAGE	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile\ShowShiftLock = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}\00000000	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\TabletTip\1.7	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile\ShowCasing = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile\ShowShiftLock = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\StigRegKey\Typing\DesktopNearCaretKeyboardEnabled	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile	LogonUI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile\en-US\CachedLanguageName = "@Winlangdb.dll,-1121"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\InputMethod\Settings\CHT	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	atbroker.exe
Key created	\REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile\en-US	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}\00000000	LogonUI.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}\00000000	LogonUI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Keyboard Layout\Preload\1 = "00000409"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\CTF\SORTORDER\ASSEMBLYITEM\0X00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IME\15.0\IMETC	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\TabletTip\1.7	LogonUI.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-189034102-168398478-1159367937-1000\{F6CD007A-48B9-4A30-B135-44EEB71865FF}	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2 = 14001f483accbfb42cdb4c42b0297fe99a87c6410000	NOTEPAD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	NOTEPAD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	NOTEPAD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	NOTEPAD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	EXCEL.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings	NOTEPAD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}\Instance\	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	NOTEPAD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Documents"	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	EXCEL.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 020000000100000000000000ffffffff	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	NOTEPAD.EXE
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-189034102-168398478-1159367937-1000\{7C83DB9E-0A0B-415A-AB3D-A867A698C8F3}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Documents"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	NOTEPAD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{24ad3ad4-a569-4530-98e1-ab02f9417aa8}\Instance\	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 010000000200000000000000ffffffff	EXCEL.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Generic"	EXCEL.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	NOTEPAD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}\Instance\	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	NOTEPAD.EXE
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-189034102-168398478-1159367937-1000\{BD634582-71FB-4BF4-B0CE-4DD13C2AB56E}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-189034102-168398478-1159367937-1000\{C5B92021-2AFD-428E-94FE-F363CEF849B1}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-189034102-168398478-1159367937-1000\{30E0090A-D1B8-4EAA-A9A5-A43897A3D52B}	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\NodeSlot = "3"	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\MRUListEx = ffffffff	NOTEPAD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	EXCEL.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	NOTEPAD.EXE
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-189034102-168398478-1159367937-1000\{069D9FEF-C05C-4D9A-A95F-67242B135467}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	EXCEL.EXE

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
2500	NOTEPAD.EXE

Runs net.exe

Suspicious behavior: AddClipboardFormatListener 3 IoCs

pid	Process
4868	ONENOTE.EXE
4868	ONENOTE.EXE
6568	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
4940	utilman.exe
4940	utilman.exe
4940	utilman.exe
4940	utilman.exe
4940	utilman.exe
4940	utilman.exe
4940	utilman.exe
4940	utilman.exe
4364	msedge.exe
4364	msedge.exe
1628	msedge.exe
1628	msedge.exe
5536	msedge.exe
5536	msedge.exe
4508	msedge.exe
4508	msedge.exe
4868	ONENOTE.EXE
4868	ONENOTE.EXE
4280	msedge.exe
4280	msedge.exe
5336	msedge.exe
5336	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
6568	EXCEL.EXE

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 39 IoCs

pid	Process
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
6116	msedge.exe
6116	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe
6332	msedge.exe
6332	msedge.exe
6332	msedge.exe
6332	msedge.exe
6332	msedge.exe
6332	msedge.exe
6332	msedge.exe
4280	msedge.exe
4280	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5472	LogonUI.exe
Token: SeCreatePagefilePrivilege	5472	LogonUI.exe
Token: SeShutdownPrivilege	6104	LogonUI.exe
Token: SeCreatePagefilePrivilege	6104	LogonUI.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
6116	msedge.exe
6116	msedge.exe
6116	msedge.exe
6116	msedge.exe
6116	msedge.exe
6116	msedge.exe
6116	msedge.exe
6116	msedge.exe
6116	msedge.exe
6116	msedge.exe
6116	msedge.exe
6116	msedge.exe
6116	msedge.exe
6116	msedge.exe
6116	msedge.exe
6116	msedge.exe
6116	msedge.exe
6116	msedge.exe
6116	msedge.exe
6116	msedge.exe
6116	msedge.exe
6116	msedge.exe
6116	msedge.exe
6116	msedge.exe
6116	msedge.exe
6116	msedge.exe
6116	msedge.exe
6116	msedge.exe
6116	msedge.exe
6116	msedge.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
6116	msedge.exe
6116	msedge.exe
6116	msedge.exe
6116	msedge.exe
6116	msedge.exe
6116	msedge.exe
6116	msedge.exe
6116	msedge.exe
6116	msedge.exe
6116	msedge.exe
6116	msedge.exe
6116	msedge.exe
6116	msedge.exe
6116	msedge.exe
6116	msedge.exe
6116	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe

Suspicious use of SetWindowsHookEx 56 IoCs

pid	Process
5472	LogonUI.exe
5472	LogonUI.exe
4940	utilman.exe
2660	helppane.exe
2660	helppane.exe
2500	NOTEPAD.EXE
2500	NOTEPAD.EXE
2500	NOTEPAD.EXE
2500	NOTEPAD.EXE
2500	NOTEPAD.EXE
6104	LogonUI.exe
6104	LogonUI.exe
4868	ONENOTE.EXE
4868	ONENOTE.EXE
4868	ONENOTE.EXE
4868	ONENOTE.EXE
4868	ONENOTE.EXE
4868	ONENOTE.EXE
4868	ONENOTE.EXE
4868	ONENOTE.EXE
4868	ONENOTE.EXE
4868	ONENOTE.EXE
4868	ONENOTE.EXE
4868	ONENOTE.EXE
4868	ONENOTE.EXE
4868	ONENOTE.EXE
4868	ONENOTE.EXE
6568	EXCEL.EXE
6568	EXCEL.EXE
6568	EXCEL.EXE
6568	EXCEL.EXE
6568	EXCEL.EXE
6568	EXCEL.EXE
6568	EXCEL.EXE
6568	EXCEL.EXE
6568	EXCEL.EXE
6568	EXCEL.EXE
6568	EXCEL.EXE
6568	EXCEL.EXE
6568	EXCEL.EXE
6568	EXCEL.EXE
6568	EXCEL.EXE
6568	EXCEL.EXE
6568	EXCEL.EXE
6568	EXCEL.EXE
6568	EXCEL.EXE
6568	EXCEL.EXE
6568	EXCEL.EXE
6568	EXCEL.EXE
6568	EXCEL.EXE
6568	EXCEL.EXE
6568	EXCEL.EXE
6568	EXCEL.EXE
6568	EXCEL.EXE
6568	EXCEL.EXE
4628	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4136 wrote to memory of 2944	4136	msedge.exe	89
PID 4136 wrote to memory of 2448	4136	msedge.exe	90
PID 4136 wrote to memory of 3428	4136	msedge.exe	92
PID 4136 wrote to memory of 3428	4136	msedge.exe	92
PID 4136 wrote to memory of 1952	4136	msedge.exe	91
PID 4136 wrote to memory of 1952	4136	msedge.exe	91
PID 4136 wrote to memory of 1952	4136	msedge.exe	91
PID 4136 wrote to memory of 624	4136	msedge.exe	94
PID 4136 wrote to memory of 3968	4136	msedge.exe	95
PID 4136 wrote to memory of 624	4136	msedge.exe	94
PID 4136 wrote to memory of 624	4136	msedge.exe	94
PID 4136 wrote to memory of 3968	4136	msedge.exe	95
PID 4136 wrote to memory of 3968	4136	msedge.exe	95
PID 4136 wrote to memory of 5436	4136	msedge.exe	96
PID 4136 wrote to memory of 2636	4136	msedge.exe	97
PID 4136 wrote to memory of 5436	4136	msedge.exe	96
PID 4136 wrote to memory of 5436	4136	msedge.exe	96
PID 4136 wrote to memory of 2636	4136	msedge.exe	97
PID 4136 wrote to memory of 2636	4136	msedge.exe	97
PID 4136 wrote to memory of 5784	4136	msedge.exe	98
PID 4136 wrote to memory of 5784	4136	msedge.exe	98
PID 4136 wrote to memory of 5784	4136	msedge.exe	98
PID 4136 wrote to memory of 2096	4136	msedge.exe	100
PID 4136 wrote to memory of 5340	4136	msedge.exe	101
PID 4136 wrote to memory of 2096	4136	msedge.exe	100
PID 4136 wrote to memory of 5340	4136	msedge.exe	101
PID 4136 wrote to memory of 3436	4136	msedge.exe	103
PID 4136 wrote to memory of 6116	4136	msedge.exe	106
PID 6116 wrote to memory of 872	6116	msedge.exe	107
PID 6116 wrote to memory of 5032	6116	msedge.exe	109
PID 6116 wrote to memory of 3156	6116	msedge.exe	110
PID 6116 wrote to memory of 3424	6116	msedge.exe	111
PID 6116 wrote to memory of 3156	6116	msedge.exe	110
PID 6116 wrote to memory of 3156	6116	msedge.exe	110
PID 6116 wrote to memory of 3424	6116	msedge.exe	111
PID 6116 wrote to memory of 5940	6116	msedge.exe	113
PID 6116 wrote to memory of 3724	6116	msedge.exe	114
PID 6116 wrote to memory of 3724	6116	msedge.exe	114
PID 6116 wrote to memory of 5600	6116	msedge.exe	115
PID 6116 wrote to memory of 5600	6116	msedge.exe	115
PID 4344 wrote to memory of 2716	4344	cmd.exe	118
PID 2716 wrote to memory of 3624	2716	net.exe	119
PID 6116 wrote to memory of 2340	6116	msedge.exe	125
PID 6116 wrote to memory of 4208	6116	msedge.exe	126
PID 6116 wrote to memory of 5180	6116	msedge.exe	127
PID 6116 wrote to memory of 4304	6116	msedge.exe	132
PID 6116 wrote to memory of 4304	6116	msedge.exe	132
PID 6116 wrote to memory of 6044	6116	msedge.exe	133
PID 6116 wrote to memory of 6044	6116	msedge.exe	133
PID 6116 wrote to memory of 5788	6116	msedge.exe	134
PID 6116 wrote to memory of 5788	6116	msedge.exe	134
PID 6116 wrote to memory of 5744	6116	msedge.exe	135
PID 6116 wrote to memory of 5744	6116	msedge.exe	135
PID 6116 wrote to memory of 4188	6116	msedge.exe	136
PID 6116 wrote to memory of 4188	6116	msedge.exe	136
PID 6116 wrote to memory of 5744	6116	msedge.exe	146
PID 6116 wrote to memory of 2400	6116	msedge.exe	147
PID 6116 wrote to memory of 5744	6116	msedge.exe	146
PID 6116 wrote to memory of 5744	6116	msedge.exe	146
PID 6116 wrote to memory of 2400	6116	msedge.exe	147
PID 6116 wrote to memory of 2400	6116	msedge.exe	147
PID 6116 wrote to memory of 1852	6116	msedge.exe	148
PID 6116 wrote to memory of 1852	6116	msedge.exe	148
PID 6116 wrote to memory of 6044	6116	msedge.exe	149

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://tria.ge
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2d8,0x7fff24e8c188,0x7fff24e8c194,0x7fff24e8c1a0
  2⤵
  PID:2944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1684,i,4034286819453387089,4014147587108846013,524288 --field-trial-handle=2164,i,5367126966467394828,11170549368041542660,262144 --variations-seed-version --mojo-platform-channel-handle=2208 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1552,i,3640477470362835644,5564423172571546147,262144 --field-trial-handle=2164,i,5367126966467394828,11170549368041542660,262144 --variations-seed-version --mojo-platform-channel-handle=2160 /prefetch:2
  2⤵
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2348,i,17121076298548298523,14623066001015096479,524288 --field-trial-handle=2164,i,5367126966467394828,11170549368041542660,262144 --variations-seed-version --mojo-platform-channel-handle=3032 /prefetch:13
  2⤵
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3628,i,3565214390726930237,12940154284782560079,2097152 --field-trial-handle=2164,i,5367126966467394828,11170549368041542660,262144 --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:1
  2⤵
  PID:624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3648,i,1964790855756613279,11430633118755365846,2097152 --field-trial-handle=2164,i,5367126966467394828,11170549368041542660,262144 --variations-seed-version --mojo-platform-channel-handle=3736 /prefetch:1
  2⤵
  PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4344,i,5594149662686713155,12080541180978912743,2097152 --field-trial-handle=2164,i,5367126966467394828,11170549368041542660,262144 --variations-seed-version --mojo-platform-channel-handle=4424 /prefetch:1
  2⤵
  PID:5436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4384,i,7600756289929646982,5012104024582300765,2097152 --field-trial-handle=2164,i,5367126966467394828,11170549368041542660,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:9
  2⤵
  PID:2636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3880,i,10196946742984199994,14940517693935060260,2097152 --field-trial-handle=2164,i,5367126966467394828,11170549368041542660,262144 --variations-seed-version --mojo-platform-channel-handle=3812 /prefetch:1
  2⤵
  PID:5784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3964,i,8067690232165909283,13928774981797576268,524288 --field-trial-handle=2164,i,5367126966467394828,11170549368041542660,262144 --variations-seed-version --mojo-platform-channel-handle=3952 /prefetch:14
  2⤵
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3948,i,14774369388528773598,4210832842120582449,524288 --field-trial-handle=2164,i,5367126966467394828,11170549368041542660,262144 --variations-seed-version --mojo-platform-channel-handle=3968 /prefetch:14
  2⤵
  PID:5340
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6020,i,15930140084626275878,2936294638223250433,524288 --field-trial-handle=2164,i,5367126966467394828,11170549368041542660,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:14
  2⤵
  PID:2504
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6020,i,15930140084626275878,2936294638223250433,524288 --field-trial-handle=2164,i,5367126966467394828,11170549368041542660,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:14
  2⤵
  PID:3436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:6116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x270,0x7fff24e8c188,0x7fff24e8c194,0x7fff24e8c1a0
    3⤵
    PID:872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2084,i,5137699831617320983,933785472588963588,524288 --field-trial-handle=2636,i,2715815511073145055,4089331167662520390,262144 --variations-seed-version --mojo-platform-channel-handle=2708 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1908,i,4929075206924851227,4237820112938930391,262144 --field-trial-handle=2636,i,2715815511073145055,4089331167662520390,262144 --variations-seed-version --mojo-platform-channel-handle=2644 /prefetch:2
    3⤵
    PID:3156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2432,i,17153450832573581082,9262526089833306288,524288 --field-trial-handle=2636,i,2715815511073145055,4089331167662520390,262144 --variations-seed-version --mojo-platform-channel-handle=2828 /prefetch:13
    3⤵
    PID:3424
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4304,i,13906465373024296152,2367468544997410772,524288 --field-trial-handle=2636,i,2715815511073145055,4089331167662520390,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:14
    3⤵
    PID:6052
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4304,i,13906465373024296152,2367468544997410772,524288 --field-trial-handle=2636,i,2715815511073145055,4089331167662520390,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:14
    3⤵
    PID:5940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4512,i,15893253146330803137,15695636145615454143,524288 --field-trial-handle=2636,i,2715815511073145055,4089331167662520390,262144 --variations-seed-version --mojo-platform-channel-handle=4504 /prefetch:14
    3⤵
    PID:3724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4616,i,10702037424013742118,15021961158314102126,524288 --field-trial-handle=2636,i,2715815511073145055,4089331167662520390,262144 --variations-seed-version --mojo-platform-channel-handle=4640 /prefetch:14
    3⤵
    PID:5600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1372,i,17919514358986612512,10193675590155131067,524288 --field-trial-handle=2636,i,2715815511073145055,4089331167662520390,262144 --variations-seed-version --mojo-platform-channel-handle=1236 /prefetch:14
    3⤵
    PID:2340
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1380,i,17797615347799307627,5403340928348961984,524288 --field-trial-handle=2636,i,2715815511073145055,4089331167662520390,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:14
    3⤵
    PID:4208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1388,i,16128865689575110284,5626926653912591781,524288 --field-trial-handle=2636,i,2715815511073145055,4089331167662520390,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:14
    3⤵
    PID:5180
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5028,i,2796284669813809001,2098492902455592294,524288 --field-trial-handle=2636,i,2715815511073145055,4089331167662520390,262144 --variations-seed-version --mojo-platform-channel-handle=1328 /prefetch:14
    3⤵
    PID:4304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4892,i,3148410550940534788,10836186726046286619,524288 --field-trial-handle=2636,i,2715815511073145055,4089331167662520390,262144 --variations-seed-version --mojo-platform-channel-handle=4956 /prefetch:14
    3⤵
    PID:6044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4984,i,11591675417219128064,9904156239798353740,524288 --field-trial-handle=2636,i,2715815511073145055,4089331167662520390,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:14
    3⤵
    PID:5788
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5044,i,6780219636727860046,3079676017055637392,524288 --field-trial-handle=2636,i,2715815511073145055,4089331167662520390,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:14
    3⤵
    PID:5744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4864,i,15290982329114782669,3528726112491060623,524288 --field-trial-handle=2636,i,2715815511073145055,4089331167662520390,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:14
    3⤵
    PID:4188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=5092,i,15960017668548022284,302069604331073637,2097152 --field-trial-handle=2636,i,2715815511073145055,4089331167662520390,262144 --variations-seed-version --mojo-platform-channel-handle=3416 /prefetch:1
    3⤵
    PID:5744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=4928,i,17958359965450203839,6864655532351008967,2097152 --field-trial-handle=2636,i,2715815511073145055,4089331167662520390,262144 --variations-seed-version --mojo-platform-channel-handle=4924 /prefetch:1
    3⤵
    PID:2400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5556,i,4409244845811447799,8478501180044023185,524288 --field-trial-handle=2636,i,2715815511073145055,4089331167662520390,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:14
    3⤵
    PID:1852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5552,i,7909114792317544486,16492997739230029885,524288 --field-trial-handle=2636,i,2715815511073145055,4089331167662520390,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:14
    3⤵
    PID:6044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of SendNotifyMessage
    PID:4364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x270,0x7fff24e8c188,0x7fff24e8c194,0x7fff24e8c1a0
      4⤵
      PID:4564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1904,i,603624549161572011,3073651106285571868,262144 --field-trial-handle=2480,i,11326336119474584442,3097152449866994755,262144 --variations-seed-version --mojo-platform-channel-handle=2476 /prefetch:2
      4⤵
      PID:2648
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2116,i,13545509301244353060,1421428770296625666,524288 --field-trial-handle=2480,i,11326336119474584442,3097152449866994755,262144 --variations-seed-version --mojo-platform-channel-handle=2616 /prefetch:11
      4⤵
      System Time Discovery
      PID:5108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2640,i,14066745946407329636,17009001139802970467,524288 --field-trial-handle=2480,i,11326336119474584442,3097152449866994755,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:13
      4⤵
      PID:3344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4404,i,17590839658114296028,9223841987476749266,524288 --field-trial-handle=2480,i,11326336119474584442,3097152449866994755,262144 --variations-seed-version --mojo-platform-channel-handle=4420 /prefetch:14
      4⤵
      PID:6076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4404,i,17590839658114296028,9223841987476749266,524288 --field-trial-handle=2480,i,11326336119474584442,3097152449866994755,262144 --variations-seed-version --mojo-platform-channel-handle=4420 /prefetch:14
      4⤵
      PID:5256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4908,i,6450735159903065776,11467609120379954541,2097152 --field-trial-handle=2480,i,11326336119474584442,3097152449866994755,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:1
      4⤵
      PID:3448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5224,i,18234405447534359294,4494311633496578430,524288 --field-trial-handle=2480,i,11326336119474584442,3097152449866994755,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:14
      4⤵
      PID:4728
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5244,i,16653155300536507170,14211022851277737622,524288 --field-trial-handle=2480,i,11326336119474584442,3097152449866994755,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:14
      4⤵
      PID:1676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5656,i,6911571758780045795,16983607772352626421,2097152 --field-trial-handle=2480,i,11326336119474584442,3097152449866994755,262144 --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:1
      4⤵
      PID:2972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4512,i,17599026775275994108,8650901484542666411,524288 --field-trial-handle=2480,i,11326336119474584442,3097152449866994755,262144 --variations-seed-version --mojo-platform-channel-handle=1248 /prefetch:14
      4⤵
      PID:1032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4508,i,13485188776381668830,708707331234301109,524288 --field-trial-handle=2480,i,11326336119474584442,3097152449866994755,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:14
      4⤵
      PID:1140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4516,i,12347948808727183455,8476220541240758464,524288 --field-trial-handle=2480,i,11326336119474584442,3097152449866994755,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:14
      4⤵
      PID:2624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5360,i,9689052899869851917,9268657753884909164,524288 --field-trial-handle=2480,i,11326336119474584442,3097152449866994755,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:14
      4⤵
      PID:4304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5468,i,1004042081142215611,12341986382048204232,262144 --field-trial-handle=2480,i,11326336119474584442,3097152449866994755,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5472,i,5721036864130037488,14052145236496348013,524288 --field-trial-handle=2480,i,11326336119474584442,3097152449866994755,262144 --variations-seed-version --mojo-platform-channel-handle=1256 /prefetch:14
      4⤵
      PID:3800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=3976,i,6462742737426820305,9746491292085666174,2097152 --field-trial-handle=2480,i,11326336119474584442,3097152449866994755,262144 --variations-seed-version --mojo-platform-channel-handle=4520 /prefetch:1
      4⤵
      PID:5704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5512,i,5480243574361878757,63378623511918670,2097152 --field-trial-handle=2480,i,11326336119474584442,3097152449866994755,262144 --variations-seed-version --mojo-platform-channel-handle=1352 /prefetch:1
      4⤵
      PID:5820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6060,i,13697389057342885572,17869309758454176578,524288 --field-trial-handle=2480,i,11326336119474584442,3097152449866994755,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:14
      4⤵
      PID:4684
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
      4⤵
      Drops file in Windows directory
      Enumerates system info in registry
      Modifies registry class
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of SendNotifyMessage
      PID:900
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x270,0x7fff24e8c188,0x7fff24e8c194,0x7fff24e8c1a0
        5⤵
        
        PID:2772
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1884,i,13642091965223992587,8908029446238490599,262144 --field-trial-handle=3128,i,1884715489893110854,14336813165224495326,262144 --variations-seed-version --mojo-platform-channel-handle=3112 /prefetch:2
        5⤵
        
        PID:5048
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2056,i,5795332851951563362,16936956977866916967,524288 --field-trial-handle=3128,i,1884715489893110854,14336813165224495326,262144 --variations-seed-version --mojo-platform-channel-handle=3276 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:2080
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2472,i,11868540685911166595,1704907573289700810,524288 --field-trial-handle=3128,i,1884715489893110854,14336813165224495326,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:13
        5⤵
        
        PID:1520
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4392,i,3595444474397278471,3304396009111586155,524288 --field-trial-handle=3128,i,1884715489893110854,14336813165224495326,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:14
        5⤵
        
        PID:6076
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4392,i,3595444474397278471,3304396009111586155,524288 --field-trial-handle=3128,i,1884715489893110854,14336813165224495326,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:14
        5⤵
        
        PID:2768
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4880,i,1965821693570045566,5086833377523560803,2097152 --field-trial-handle=3128,i,1884715489893110854,14336813165224495326,262144 --variations-seed-version --mojo-platform-channel-handle=4904 /prefetch:1
        5⤵
        
        PID:5540
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,6960048853191686235,12766196789562934909,524288 --field-trial-handle=3128,i,1884715489893110854,14336813165224495326,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:14
        5⤵
        
        PID:5436
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5168,i,17352235034677134189,750225013516251153,524288 --field-trial-handle=3128,i,1884715489893110854,14336813165224495326,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:14
        5⤵
        
        PID:2776
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5576,i,11409035800372399856,15993039803591749593,2097152 --field-trial-handle=3128,i,1884715489893110854,14336813165224495326,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:1
        5⤵
        
        PID:1032
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5892,i,12696432619380679053,10655191737040767201,2097152 --field-trial-handle=3128,i,1884715489893110854,14336813165224495326,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:1
        5⤵
        
        PID:4664
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6780,i,10660039289397266690,6243789883633617547,524288 --field-trial-handle=3128,i,1884715489893110854,14336813165224495326,262144 --variations-seed-version --mojo-platform-channel-handle=6748 /prefetch:14
        5⤵
        
        PID:2904
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1392,i,2034162539904022562,15809664656132333881,524288 --field-trial-handle=3128,i,1884715489893110854,14336813165224495326,262144 --variations-seed-version --mojo-platform-channel-handle=1364 /prefetch:14
        5⤵
        
        PID:5628
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1388,i,10347158535053061328,413858634253187470,524288 --field-trial-handle=3128,i,1884715489893110854,14336813165224495326,262144 --variations-seed-version --mojo-platform-channel-handle=1252 /prefetch:14
        5⤵
        
        PID:4376
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1404,i,14226895219501864917,17088403630140833616,524288 --field-trial-handle=3128,i,1884715489893110854,14336813165224495326,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:14
        5⤵
        
        PID:2760
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=1364,i,11061448347834856119,7625080282680605714,2097152 --field-trial-handle=3128,i,1884715489893110854,14336813165224495326,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:1
        5⤵
        
        PID:2176
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=1216,i,13949601764565514435,11529145722448372156,2097152 --field-trial-handle=3128,i,1884715489893110854,14336813165224495326,262144 --variations-seed-version --mojo-platform-channel-handle=6472 /prefetch:1
        5⤵
        
        PID:2460
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1428,i,15129517331464531933,17761301409256739658,524288 --field-trial-handle=3128,i,1884715489893110854,14336813165224495326,262144 --variations-seed-version --mojo-platform-channel-handle=7120 /prefetch:14
        5⤵
        
        PID:1996
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4252,i,1364417893039947694,8382722844511733546,524288 --field-trial-handle=3128,i,1884715489893110854,14336813165224495326,262144 --variations-seed-version --mojo-platform-channel-handle=7268 /prefetch:14
        5⤵
        
        PID:5124
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7532,i,2777258340055846471,260771925827277280,524288 --field-trial-handle=3128,i,1884715489893110854,14336813165224495326,262144 --variations-seed-version --mojo-platform-channel-handle=7436 /prefetch:14
        5⤵
        
        PID:2692
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5324,i,8324083347044824624,8418472500078971658,524288 --field-trial-handle=3128,i,1884715489893110854,14336813165224495326,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:14
        5⤵
        
        PID:3432
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7256,i,3626735956844938924,3663692459290985079,524288 --field-trial-handle=3128,i,1884715489893110854,14336813165224495326,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:14
        5⤵
        
        PID:860
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
        5⤵
        Drops file in Windows directory
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        
        PID:5536
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2e0,0x7fff24e8c188,0x7fff24e8c194,0x7fff24e8c1a0
        6⤵
        
        PID:3196
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2012,i,6870041502115198017,5619394426279480639,524288 --field-trial-handle=2476,i,11225991300167183659,16222301975161127681,262144 --variations-seed-version --mojo-platform-channel-handle=2504 /prefetch:11
        6⤵
        System Time Discovery
        
        PID:2928
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2624,i,11494420493445083488,15793782100121025467,524288 --field-trial-handle=2476,i,11225991300167183659,16222301975161127681,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:13
        6⤵
        
        PID:2828
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1884,i,2331439169569075138,13998390642348306541,262144 --field-trial-handle=2476,i,11225991300167183659,16222301975161127681,262144 --variations-seed-version --mojo-platform-channel-handle=2472 /prefetch:2
        6⤵
        
        PID:2760
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4372,i,4093980337960431918,8366686266365625871,524288 --field-trial-handle=2476,i,11225991300167183659,16222301975161127681,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:14
        6⤵
        
        PID:1496
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4372,i,4093980337960431918,8366686266365625871,524288 --field-trial-handle=2476,i,11225991300167183659,16222301975161127681,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:14
        6⤵
        
        PID:5732
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4928,i,1814791222806370407,13005053399519657420,2097152 --field-trial-handle=2476,i,11225991300167183659,16222301975161127681,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:1
        6⤵
        
        PID:2976
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5024,i,701036478962506889,4555432359257133333,524288 --field-trial-handle=2476,i,11225991300167183659,16222301975161127681,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:14
        6⤵
        
        PID:6004
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5048,i,12257058442543036586,4824364330158928865,524288 --field-trial-handle=2476,i,11225991300167183659,16222301975161127681,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:14
        6⤵
        
        PID:3976
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5668,i,2175999678648996132,6261298057625925732,2097152 --field-trial-handle=2476,i,11225991300167183659,16222301975161127681,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:1
        6⤵
        
        PID:6080
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1252,i,8660539313234230627,12700172086453102792,524288 --field-trial-handle=2476,i,11225991300167183659,16222301975161127681,262144 --variations-seed-version --mojo-platform-channel-handle=600 /prefetch:14
        6⤵
        
        PID:404
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1216,i,6172245496070125729,7497497965083106665,524288 --field-trial-handle=2476,i,11225991300167183659,16222301975161127681,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:14
        6⤵
        
        PID:2292
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1364,i,712566110552623746,12303033686475866998,524288 --field-trial-handle=2476,i,11225991300167183659,16222301975161127681,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:14
        6⤵
        
        PID:3508
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4324,i,14064305268496595401,17566992293442764258,524288 --field-trial-handle=2476,i,11225991300167183659,16222301975161127681,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:14
        6⤵
        
        PID:5272
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5572,i,10938206193983336108,9113732264397041370,2097152 --field-trial-handle=2476,i,11225991300167183659,16222301975161127681,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:1
        6⤵
        
        PID:3496
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1468,i,2580470776724706555,11634916600082319264,524288 --field-trial-handle=2476,i,11225991300167183659,16222301975161127681,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:14
        6⤵
        
        PID:2452
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5568,i,16952347826688990792,17063006044609384928,524288 --field-trial-handle=2476,i,11225991300167183659,16222301975161127681,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:14
        6⤵
        
        PID:5936
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6684,i,105027707401814748,892254606720999517,524288 --field-trial-handle=2476,i,11225991300167183659,16222301975161127681,262144 --variations-seed-version --mojo-platform-channel-handle=6752 /prefetch:14
        6⤵
        
        PID:5864
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6660,i,9026316821401382914,17163668155950063343,524288 --field-trial-handle=2476,i,11225991300167183659,16222301975161127681,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:14
        6⤵
        
        PID:4384
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6716,i,15342261360434535674,15869917856205093323,2097152 --field-trial-handle=2476,i,11225991300167183659,16222301975161127681,262144 --variations-seed-version --mojo-platform-channel-handle=6660 /prefetch:1
        6⤵
        
        PID:580
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6744,i,14661437345860067664,7057542334522449489,2097152 --field-trial-handle=2476,i,11225991300167183659,16222301975161127681,262144 --variations-seed-version --mojo-platform-channel-handle=6936 /prefetch:1
        6⤵
        
        PID:1800
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6716,i,2670436972885269437,5219778360106943253,524288 --field-trial-handle=2476,i,11225991300167183659,16222301975161127681,262144 --variations-seed-version --mojo-platform-channel-handle=6988 /prefetch:14
        6⤵
        
        PID:4516
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6956,i,16457745876666224452,13530384084946803261,524288 --field-trial-handle=2476,i,11225991300167183659,16222301975161127681,262144 --variations-seed-version --mojo-platform-channel-handle=6992 /prefetch:14
        6⤵
        
        PID:3936
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2944,i,8437882311249101898,1507223151701228707,262144 --field-trial-handle=2476,i,11225991300167183659,16222301975161127681,262144 --variations-seed-version --mojo-platform-channel-handle=6660 /prefetch:10
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4508
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=808,i,14890717807967287553,9621832046924322184,2097152 --field-trial-handle=2476,i,11225991300167183659,16222301975161127681,262144 --variations-seed-version --mojo-platform-channel-handle=7088 /prefetch:1
        6⤵
        
        PID:2456
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=6960,i,12460642546329118377,16054413156578732466,2097152 --field-trial-handle=2476,i,11225991300167183659,16222301975161127681,262144 --variations-seed-version --mojo-platform-channel-handle=7216 /prefetch:1
        6⤵
        
        PID:3316
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=7424,i,12005190630933024838,2372726330687346472,2097152 --field-trial-handle=2476,i,11225991300167183659,16222301975161127681,262144 --variations-seed-version --mojo-platform-channel-handle=7460 /prefetch:1
        6⤵
        
        PID:2860
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=7440,i,2850297215206977921,11891511048964058227,2097152 --field-trial-handle=2476,i,11225991300167183659,16222301975161127681,262144 --variations-seed-version --mojo-platform-channel-handle=7416 /prefetch:1
        6⤵
        
        PID:1364
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=7768,i,16585083031111129887,4501973862964461106,2097152 --field-trial-handle=2476,i,11225991300167183659,16222301975161127681,262144 --variations-seed-version --mojo-platform-channel-handle=7712 /prefetch:1
        6⤵
        
        PID:5560
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=7992,i,4916837272429986909,2966658334344912424,2097152 --field-trial-handle=2476,i,11225991300167183659,16222301975161127681,262144 --variations-seed-version --mojo-platform-channel-handle=7808 /prefetch:1
        6⤵
        
        PID:2900
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8040,i,5692560238023078137,1134067425987350516,524288 --field-trial-handle=2476,i,11225991300167183659,16222301975161127681,262144 --variations-seed-version --mojo-platform-channel-handle=8052 /prefetch:14
        6⤵
        
        PID:4576
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=8080,i,17387391353543159542,11307832641798222968,2097152 --field-trial-handle=2476,i,11225991300167183659,16222301975161127681,262144 --variations-seed-version --mojo-platform-channel-handle=8108 /prefetch:1
        6⤵
        
        PID:1012
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
        6⤵
        Enumerates system info in registry
        Modifies registry class
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        
        PID:6332
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x328,0x7fff24e8c188,0x7fff24e8c194,0x7fff24e8c1a0
        7⤵
        
        PID:6372
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1684,i,16374337238491498498,2920125459980954911,262144 --field-trial-handle=2268,i,7461754013163478150,7768549780277284737,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:2
        7⤵
        
        PID:6608
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1904,i,9668967498367283104,1206865851340979731,524288 --field-trial-handle=2268,i,7461754013163478150,7768549780277284737,262144 --variations-seed-version --mojo-platform-channel-handle=2476 /prefetch:11
        7⤵
        System Time Discovery
        
        PID:6600
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2388,i,7246855834316018719,11067402419881262678,524288 --field-trial-handle=2268,i,7461754013163478150,7768549780277284737,262144 --variations-seed-version --mojo-platform-channel-handle=3080 /prefetch:13
        7⤵
        
        PID:6676
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4368,i,18217849164461895286,8129860623654490901,524288 --field-trial-handle=2268,i,7461754013163478150,7768549780277284737,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:14
        7⤵
        
        PID:7036
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4368,i,18217849164461895286,8129860623654490901,524288 --field-trial-handle=2268,i,7461754013163478150,7768549780277284737,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:14
        7⤵
        
        PID:7048
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4924,i,2060293825530538746,6727854016239854505,2097152 --field-trial-handle=2268,i,7461754013163478150,7768549780277284737,262144 --variations-seed-version --mojo-platform-channel-handle=4948 /prefetch:1
        7⤵
        
        PID:1776
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5200,i,11233948373732897168,504672642172536622,524288 --field-trial-handle=2268,i,7461754013163478150,7768549780277284737,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:14
        7⤵
        
        PID:3724
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5172,i,10202239729641380222,4502144544399362803,524288 --field-trial-handle=2268,i,7461754013163478150,7768549780277284737,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:14
        7⤵
        
        PID:6152
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5644,i,16320499700217025414,2222608517451806301,2097152 --field-trial-handle=2268,i,7461754013163478150,7768549780277284737,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:1
        7⤵
        
        PID:1752
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=6124,i,5403423909886005249,608018817806847860,2097152 --field-trial-handle=2268,i,7461754013163478150,7768549780277284737,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:1
        7⤵
        
        PID:2960
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6860,i,5170522026950317028,13378876829628944931,2097152 --field-trial-handle=2268,i,7461754013163478150,7768549780277284737,262144 --variations-seed-version --mojo-platform-channel-handle=6904 /prefetch:1
        7⤵
        
        PID:3028
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=7000,i,1325080061797434123,6719933502848166601,2097152 --field-trial-handle=2268,i,7461754013163478150,7768549780277284737,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:1
        7⤵
        
        PID:4508
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6260,i,18370331672092768118,9660918527237884397,2097152 --field-trial-handle=2268,i,7461754013163478150,7768549780277284737,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:1
        7⤵
        
        PID:4524
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6952,i,14489723945819682060,2055452885659080660,2097152 --field-trial-handle=2268,i,7461754013163478150,7768549780277284737,262144 --variations-seed-version --mojo-platform-channel-handle=6972 /prefetch:1
        7⤵
        
        PID:5036
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6840,i,13240672551458470315,6206579832950313106,524288 --field-trial-handle=2268,i,7461754013163478150,7768549780277284737,262144 --variations-seed-version --mojo-platform-channel-handle=6808 /prefetch:14
        7⤵
        
        PID:3876
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6352,i,5921337569038686940,4593871746811404183,524288 --field-trial-handle=2268,i,7461754013163478150,7768549780277284737,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:14
        7⤵
        
        PID:4876
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6424,i,3976960756417473023,9940590971650335139,524288 --field-trial-handle=2268,i,7461754013163478150,7768549780277284737,262144 --variations-seed-version --mojo-platform-channel-handle=7028 /prefetch:14
        7⤵
        
        PID:3280
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
        7⤵
        Loads dropped DLL
        Drops file in Windows directory
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        
        PID:4280
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x238,0x31c,0x7fff24e8c188,0x7fff24e8c194,0x7fff24e8c1a0
        8⤵
        
        PID:2560
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2008,i,15412918067609898711,11819358567389478414,524288 --field-trial-handle=2876,i,7280505232148327197,13594192373831194602,262144 --variations-seed-version --mojo-platform-channel-handle=2944 /prefetch:11
        8⤵
        System Time Discovery
        
        PID:2500
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1916,i,13856641507072709249,17350707227591168586,262144 --field-trial-handle=2876,i,7280505232148327197,13594192373831194602,262144 --variations-seed-version --mojo-platform-channel-handle=2836 /prefetch:2
        8⤵
        
        PID:2744
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1312,i,14892591472103439298,9586159031028019216,524288 --field-trial-handle=2876,i,7280505232148327197,13594192373831194602,262144 --variations-seed-version --mojo-platform-channel-handle=2952 /prefetch:13
        8⤵
        
        PID:2896
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4372,i,14357045045073866301,14955720902150545379,524288 --field-trial-handle=2876,i,7280505232148327197,13594192373831194602,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:14
        8⤵
        
        PID:5436
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4372,i,14357045045073866301,14955720902150545379,524288 --field-trial-handle=2876,i,7280505232148327197,13594192373831194602,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:14
        8⤵
        
        PID:5916
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4916,i,15893383649954022884,5497165184443391491,2097152 --field-trial-handle=2876,i,7280505232148327197,13594192373831194602,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:1
        8⤵
        
        PID:4380
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4996,i,7103296827688707946,18333261865541239413,524288 --field-trial-handle=2876,i,7280505232148327197,13594192373831194602,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:14
        8⤵
        
        PID:6732
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5016,i,5683784362843219995,4797595705579960056,524288 --field-trial-handle=2876,i,7280505232148327197,13594192373831194602,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:14
        8⤵
        
        PID:6816
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5688,i,7000033336121947258,4884417716356227518,2097152 --field-trial-handle=2876,i,7280505232148327197,13594192373831194602,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:1
        8⤵
        
        PID:6704
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=604,i,11832378161052934259,17843496142746082396,524288 --field-trial-handle=2876,i,7280505232148327197,13594192373831194602,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:14
        8⤵
        
        PID:3620
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,2745393388022450755,648411677045285753,524288 --field-trial-handle=2876,i,7280505232148327197,13594192373831194602,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:14
        8⤵
        
        PID:3708
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,2373430079239503855,15316049169200613714,524288 --field-trial-handle=2876,i,7280505232148327197,13594192373831194602,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:14
        8⤵
        
        PID:2708
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,8710711260175187978,6241352877427673072,524288 --field-trial-handle=2876,i,7280505232148327197,13594192373831194602,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:14
        8⤵
        
        PID:2972
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1188,i,10875613536699958087,16878621165658101126,524288 --field-trial-handle=2876,i,7280505232148327197,13594192373831194602,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:14
        8⤵
        
        PID:3976
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6028,i,15418874460299573827,13157370664960613592,524288 --field-trial-handle=2876,i,7280505232148327197,13594192373831194602,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:14
        8⤵
        
        PID:7072
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4528,i,9156990420664648715,7194975468547641081,524288 --field-trial-handle=2876,i,7280505232148327197,13594192373831194602,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:14
        8⤵
        
        PID:5628
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4528,i,6749558594777344767,1508769416234988142,262144 --field-trial-handle=2876,i,7280505232148327197,13594192373831194602,262144 --variations-seed-version --mojo-platform-channel-handle=808 /prefetch:10
        8⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5336
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4528,i,10492226277875600535,5823534922110665252,524288 --field-trial-handle=2876,i,7280505232148327197,13594192373831194602,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:14
        8⤵
        
        PID:1316
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4692,i,16486138212591725295,111557573968935904,524288 --field-trial-handle=2876,i,7280505232148327197,13594192373831194602,262144 --variations-seed-version --mojo-platform-channel-handle=4856 /prefetch:14
        8⤵
        
        PID:6724
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1160,i,7813676848597809337,12007116558866027144,524288 --field-trial-handle=2876,i,7280505232148327197,13594192373831194602,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:14
        8⤵
        
        PID:4332
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5536,i,3231228723253699302,6869238995271442089,524288 --field-trial-handle=2876,i,7280505232148327197,13594192373831194602,262144 --variations-seed-version --mojo-platform-channel-handle=4696 /prefetch:14
        8⤵
        
        PID:2860
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5452,i,7619665065568220569,5349087108782885592,524288 --field-trial-handle=2876,i,7280505232148327197,13594192373831194602,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:14
        8⤵
        
        PID:4964
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4056,i,11435049527812409002,16560662518744461691,524288 --field-trial-handle=2876,i,7280505232148327197,13594192373831194602,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:14
        8⤵
        
        PID:3028
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3824,i,13065292407534381678,1541245722728712125,524288 --field-trial-handle=2876,i,7280505232148327197,13594192373831194602,262144 --variations-seed-version --mojo-platform-channel-handle=3852 /prefetch:14
        8⤵
        
        PID:3032
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3388,i,4046798500971336514,18066431184574062501,524288 --field-trial-handle=2876,i,7280505232148327197,13594192373831194602,262144 --variations-seed-version --mojo-platform-channel-handle=4704 /prefetch:14
        8⤵
        
        PID:5788
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3820,i,6675363343078504776,12632768817052544351,524288 --field-trial-handle=2876,i,7280505232148327197,13594192373831194602,262144 --variations-seed-version --mojo-platform-channel-handle=3824 /prefetch:14
        8⤵
        
        PID:6752
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4032,i,12403867900967494753,2233187126006914870,524288 --field-trial-handle=2876,i,7280505232148327197,13594192373831194602,262144 --variations-seed-version --mojo-platform-channel-handle=3840 /prefetch:14
        8⤵
        
        PID:1304

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3940

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6076

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6056

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4344
- C:\Windows\system32\net.exe
  net user admin qwertyadmin
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2716
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user admin qwertyadmin
    3⤵
    PID:3624

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:2840

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0 /state0:0xa39c9855 /state1:0x41c64e6d
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5472

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k CameraMonitor
1⤵
PID:5592

C:\Windows\system32\ctfmon.exe
/QuitInfo:0000000000000240;0000000000000284;
1⤵
- Modifies data under HKEY_USERS
PID:4204

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5360

C:\Windows\system32\utilman.exe
utilman.exe /debug
1⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4940

C:\Windows\system32\sethc.exe
sethc.exe 111
1⤵
PID:1772

C:\Windows\System32\rundll32.exe
rundll32.exe uxtheme.dll,#64 C:\Windows\Resources\Themes\Aero\AeroLite.msstyles?NormalColor?NormalSize
1⤵
PID:5248

C:\Windows\system32\sethc.exe
sethc.exe 11
1⤵
PID:2016

C:\Windows\System32\rundll32.exe
rundll32.exe uxtheme.dll,#64 C:\Windows\Resources\Themes\Aero\Aero.msstyles?NormalColor?NormalSize
1⤵
PID:3624

C:\Windows\system32\atbroker.exe
atbroker.exe
1⤵
PID:2640

C:\Windows\system32\sethc.exe
sethc.exe 11
1⤵
PID:4844

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
PID:3120

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2968

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\CompleteTrace.js"
1⤵
PID:3744

C:\Windows\System32\wscript.exe
"C:\Windows\System32\wscript.exe"
1⤵
PID:3800

C:\Windows\System32\wscript.exe
"C:\Windows\System32\wscript.exe"
1⤵
PID:5324
- C:\Windows\winhlp32.exe
  winhlp32.exe -p
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3032
- C:\Windows\winhlp32.exe
  winhlp32.exe -p
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2516

C:\Windows\system32\dccw.exe
"C:\Windows\system32\dccw.exe"
1⤵
- Drops file in System32 directory
PID:1496

C:\Windows\helppane.exe
C:\Windows\helppane.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument microsoft-edge:https://go.microsoft.com/fwlink/?LinkId=528881
  2⤵
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument microsoft-edge:https://go.microsoft.com/fwlink/?LinkId=528881
  2⤵
  PID:1656

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2108

C:\Windows\system32\notepad.exe
"C:\Windows\system32\notepad.exe"
1⤵
PID:4940

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\ResetBlock.htm
1⤵
PID:5820

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6004

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\free_robuxREAL2026.txt
1⤵
- Modifies registry class
- Opens file in notepad (likely ransom note)
- Suspicious use of SetWindowsHookEx
PID:2500

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\free_robuxREAL2026.bat" "
1⤵
- Executes a command shell one-liner
PID:3956

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\ConfirmRename.xht
1⤵
PID:5348

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6760

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\ConfirmRename.xht
1⤵
PID:3616

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:7096

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\CompleteTrace.js"
1⤵
PID:3600

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0 /state0:0xa3911855 /state1:0x41c64e6d
1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:6104

C:\Windows\system32\atbroker.exe
atbroker.exe
1⤵
- Modifies data under HKEY_USERS
PID:3048
- C:\Windows\System32\Sethc.exe
  "C:\Windows\System32\Sethc.exe" /AccessibilitySoundAgent
  2⤵
  PID:2664

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k CameraMonitor
1⤵
PID:2752

C:\Windows\system32\ctfmon.exe
/QuitInfo:00000000000002A0;00000000000002A4;
1⤵
- Modifies data under HKEY_USERS
PID:6160

C:\Windows\system32\atbroker.exe
atbroker.exe
1⤵
PID:5436

C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
"C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4868

C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:6568

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:4356

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3936855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4628

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k CameraMonitor
1⤵
PID:3400

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Privilege Escalation

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

LockScreen___1280_0720_notdimmed.jpg

Path C:\ProgramData\Microsoft\Windows\SystemData\S-1-5-18\ReadOnly\LockScreen_Z\LockScreen___1280_0720_notdimmed.jpg
Size 65KB
SHA256 cafa53a62bfc0dd5adc2c70881bbaf39d96b741799783d4e63b6f39614d895fa
MD5 fc0ed5b667e95c6cf6a86d26d7a2ca69
SHA1 faab47ab02ad8e14d2836713a92d9438df5d63c1
SHA512 e165f4d4c6c83b714a1351d2cbb65db536d4cbc3c6764c06b3ef11f306374b855b17b8991982f62123c588f5169f1a28f7afdfb2f560afcdea86e123dcd7bb01
SSDEEP 1536:mhgbVFNUbQ0/Cb5RrveTSfDERKXduMVYgTuonWZDLgB6MxixSa:fFNqQ0qrrmTfRiPZ1X4x5
TLSH
T16C6302FBD1F0BDFCCF51B194A04F7E48880A3665EA066A9A7CA10B81259047F953AD1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LockScreen___1920_1200_notdimmed.jpg

Path C:\ProgramData\Microsoft\Windows\SystemData\S-1-5-18\ReadOnly\LockScreen_Z\LockScreen___1920_1200_notdimmed.jpg
Size 125KB
SHA256 d4bd1e6403d158d46d023f36fcb446dac919b1929750db6d1fed144f0d3e2e60
MD5 11e5c4113cdb913d1505c467cdf4efd7
SHA1 e5e5d6cb73cd41826c761b252a6f4ed88f461dd2
SHA512 23350f8c8332a910e2f5263826118cf187530ed9b6afc85a5478ac9aeff807900cbfcbc896dd8b9c549a88f2ff9305793c12988e5e13c9057598aa79cfa90dc0
SSDEEP 3072:zxQ4aNHUe+H5vGdw1wljsAPgyWQ4OCnuv+4Bs7036v:FQ4aWehGwljdZWduvdBsA36v
TLSH
T177C3025B8D2AD69B7C458E3A3F078C376DC0A64CBE2032FC59A61F667DB4366BD05240
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 d5e01f572f200ae0d9d64d79018ae3bde45ebb286bc5bf50a62989856dced547
MD5 01f48c1fbe8ccf941841ff8734c129a3
SHA1 577248a196b207fe2e3a1315a5d217cfc6b0f71f
SHA512 baec84017a6e59e94e80c73714d4fec85916d9266f02b870d61660cfe34dc3a7ac847221ae594e9534f37e2b4b9db895127fbc895e83d5a7a319308fab679fa3
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7f:fwUQC5VwBIiElEd2K57P7f
TLSH
T15BB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 64f10e410401c0ae61080e549d26b173d7a00de71705c91117a82e82c7eeed45
MD5 c1450dceb50c109d33f080a6b05d26c9
SHA1 7a6b4e11c79f135d9b3c3c0bc19204bfb733eb0f
SHA512 f6ab5346052d6260a12c335056476d219c614101c033f93fa44266a96f15bfa0cc17d2eb84dd1549dc045885eb1774792fb2e778d59281d27353de29512d5845
TLSH
T185D097B0BC2462F0C00D0030102022001A3201726BAA474A2061E80ECA70000F2EEEAD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 15e53da0a6edd72befc27fa8f2867c5f34d057de58ba73269ff129c1cbea2f12
MD5 13512ed2caa6ada72120aefd0181bdd4
SHA1 456582cca24a972f9c057df59e7047c6e507e0d5
SHA512 359b118bd6f0d4e172b497cfe163bcba8bcdfd1495ba8ef612bbce3b3b42d662fbc5278aaaab0c495973b13cdd0cec990e22b7b8d2db59173cc4b3943bd1dc98
TLSH
T121D0A7B0BA049670C10E41316451B3111BB3617425AF8F626065E54ED9A4008F2EE559
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 27c433d609298c3bb0423fa097858fdf295eda1f09119b72f89d79759bfe2224
MD5 366b218190a88ad13fa2ebbc4893a1b7
SHA1 39b6dcc595894addd1678d8fa028da22382666e9
SHA512 df3a7b845eefb04f4bbfdc9290d1ab24a210e5e2d481f2c8296e02c414dd7eac74c78155b4d5533a1922a31ec24cec1a22d6a608ec7fa228b1d2f744c600959a
TLSH
T1E7D0A7B0BA049670C10E41316451B3112BB3517425AF8A6260A1E55ED9A5004F2EE559
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a068a68341be5a3bcc683f10740af3cbb1b03e960b78ac080c418cbff6fb534b
MD5 ed43aae07dd6f267e42dfca7a9ec5cc5
SHA1 c4bc7ec76d0e20a8fa9ebbdf46a6b0d3fd30d8de
SHA512 d3281a5e382f8bda2876753072800ab635d9efcfa12868a767387af0cd8858894c4a9a51507ff496a0329081e40e43915c5a61f2b74968ae229e4a58405e45f5
TLSH
T124D0A7B0BA049770C10E41316451B3111AB3517475AF8A626061F54ED9A4004F2EE55D
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7add6572365d752d8c3a090b9a256c43e3c5ff716f29ed7aa3c53dc57a08ba60
MD5 0da70f521ac5aee3489abf6e3eb4e375
SHA1 0f3cd9919820116ecc86bab93f4712c08485dc56
SHA512 a9cddd04863b2ac842fe4f91265c19a41d8b7442be8f07a91747705beca52c1e1d563e3c46cf68e1b73606695624f13ca69a8246653c2535d0684ced42c37d33
TLSH
T182D09BD479045D78C4C1353231A673155A616435DA5C46481051F3AACD65141667F5AD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ccc29428521d4b8c78c698b4a08b907513b76794120c6d48eac8b61dcfbc9309
MD5 e6c0bb131e822c5f5c3bb7d343139848
SHA1 3ddb3fc81eb8fb3e40c83218ad086f180a48ecbb
SHA512 9df2af3c78552a4a01319fd8b7594883999ed5e381c27e7c2336258578c65173b2a4c0d117c3fe0e7caa5c787d6f58b47e941ebb01b8d6636fe1fbf4d1a41ee3
TLSH
T133D0A7B0BA04A670C11E41316451B3111AB3557425AF8A626061E54ED9A5004F2EE559
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7bdee780f1a74d7c863729d278deacac4a38ef783f5ba3f059fd4ca90347368f
MD5 1aaa3c8aa31ed280a1195db5251ca8a7
SHA1 e380ce776d85b8e9963d82b117fe09b5124d5ca7
SHA512 5d3df5528b0580608187b9c6d730467349e89463564263bc45f5b57a04fd607211f579311c3c481089c17d199f7d92b7e075c95b10b288bd6d275223c723ab2d
TLSH
T145D0A7B0BA049770C10E41316451B3111AB3517425AF8A666061E54EE9A4014F2EE559
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ffe13798c5910685872d371e84c30baa9eefaaa5db1419603eb30d473d7b2e37
MD5 03c111f9396889c77f6d9883c5df333f
SHA1 be65300843096dba92c5695fd35e2dffcbb7eb0a
SHA512 a77dfe3b48fcb72648f1adfafbf0d0fcd4d88690dcf41609a03e1d6b645d1336b6e322931b2205673283b920d20ed0225c6aa320a83a2d3a410771f18d120c19
TLSH
T1B1D09BD079145D78C4C1353231A773155A516435865C46481151F3BACD65141667E59D
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 220c5958154f71601f01ac22726996f99abf9ac10e37ee91a6a216c34e32d226
MD5 fb63a1121aa2c8edb14fa96ac945a3f4
SHA1 587e39303048bfd223c9bb85637ae2bab02bfd79
SHA512 00111e6bac66008d6276ac702f2375c0d099cf196737712f690f6e6c5f89a884cca49a1267a8caadd992ba470d003ae6e4c1c3626d5fa3ec8834a58d88a4511e
TLSH
T1E3D0A7B0BA049670C11E41316451B3111AB3517425AF8A626061E54ED9A4004F3EE599
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 83f1d2e2c93291e38fedd7b56de8d5a3e0aac05413f1b235a0181056ac94a63f
MD5 fd6520d196d46dd32cfadca8953aa19a
SHA1 4402109a77ca03e1ce0a580e334c95397f6297da
SHA512 30c85d60424e557df6844222c345240d41bd00bcdd3f63af075dc748c91b2d68779ee48f26b358b0fa7853427c4650231befeb2b9e3df58f9924b5e0b172e22b
TLSH
T188E0268406CAC2FEA740648B61AC730C82C0372BDBC8EA0F9704C4C57682864A286BB1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 b3073d7f86433d25967ecbcb72fda69464cd502495464d777257d3b36aef443f
MD5 d318b13c523ce98cbc6f6c338ddf0961
SHA1 cbc2c366dcc34cea576ba294aa0879fe03f6ba4a
SHA512 99b7282f75b434ea00d1a250055a04270595e83da1ba32f27d8dcd25c8e13f4f32e379e2abb0431c6366c47a720f5ac674db0e32a31b7e24a0e28e626b17474c
TLSH
T11EE0208406C9C69DD700784751AC634C92C0362B96C4EA0F6700DCC57902C94F3C59B8
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 d8e928d0e9fc7dd8bb58040081fcd3b7397e9135d600432b32a4aea2711f52e2
MD5 04eb3819c0a10ff641dd6930825ce184
SHA1 481e4c4952631ea6e0f20d453f33859f776a4e1b
SHA512 50842f07a074990be99087c8a109f1d0501480aa0ef98594c61004186f6f74f085f717374be1157d2a5b1267e83e51622dfcbb1b083231bfacb64cd1ae049ada
TLSH
T166E0268406CBD7BEB700644B6268A34CD2E0364BDBC8BA1E1700C8C77607850A3F3AA6
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 a385da10726571d3c59dcee5cda4984c08d3ef6ec68d0a0c0cbfa3f9035da340
MD5 0c1be0879acaba5abfcab9fd708970cb
SHA1 bf060bd9594441b338af6041d19b07937ae03a3c
SHA512 e72573651d9a91944da3be3e08febebe6e11efccce13955fb6bf156f2a6f59c821b2106025e117dc3cd01c4620e4fab977833225f5778f11b515905a8e3c3fdc
TLSH
T1E3E061F5DE21FC3708FD171C10840A59E74543571B614D8F3A3C615C8FB063A0145CAD
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 ea14897e54383064b89ad112ce18a5794f0a2eb7ea806d70145e3c7da816bc41
MD5 74df9ce8a8096f4853fc7c2eedcedc1d
SHA1 363c8d958ae44862c50a038a7044f315d30d4a55
SHA512 69ef9ff5bce4da02ed0c0380f4ad1ae59f583c020813fc8bc57ae2a6d90278842f6a66fd7aef46217dd4bb88f64c927c7d8e9688c57d3433a526a6991b61e91c
SSDEEP 384:JKpkKKSTM+TaT7TVT/TZTrTxThTwT3Gm2Z9IuJIfoB:JKpkRyGm2Z9bI
TLSH
T133133D3D9A9A6E4BC2E7D13D099FDB760337C680C1C1859722F83B525956326AF0FA0C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 3a30dac85e6d42a7fee121293ec0dc5aaa02aeb224970266e19025b619159f27
MD5 7ae8381eb566df4267cb95c48fcb33ea
SHA1 36ffaa9d30637ec3aa1da7e816e94812078035b1
SHA512 2573cf8d9609bcd942120c832fd7067aac225885298e7429c84b5a915033996925b40df2b2a6e332c5aa9be82b7d6896d7737ce3061ed015ff2b66b651a7cf9a
SSDEEP 1536:K3VL/75L/8MARZl6t5xBHK3rI6sSBFkZ:KlL/dL/z+oOfQ
TLSH
T1844441FB5951A40ACBA852F5D2133E3EC17B454D7CD2E8E9E1784CC22829F31B6BCA45
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 2e6f6eb0a564d06e8e4bd4db9b2f2d1bbedaf7d5796c455ef16737e18efe93d2
MD5 6d96a601044b311e1c580b6a3e64e509
SHA1 1f327b7d3dea47d5b472d2255975fe32af2463a6
SHA512 e2a2bc6530bd6fe5d28cd246266e36aeff16954a4f6bf1f2b9889561af420d2cacee26472a6ec0859f4c9e2125bf7b6095933c811d15d1608bfb968240729777
SSDEEP 3072:Sv9G+HN4Zck+H3MNy060oHdDktXiKBSl:SQ8uZckkMERPKB
TLSH
T108255DDECB681D82CF67DA70B4D0D8177E712083FA89E0C36941C4A957C2BC576E92AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 695055eecea4346327003a910573ef04f9eec4550299821100b7c0e99c1a6d55
MD5 056ed102e612a74032307cd1e070f2ae
SHA1 9d8b18cb5662ae4533abec0d133b3218236bcca0
SHA512 d0a568a18a16e8a1a71e6189624b4b28549f757d330894592a37269e767441eb52fc051ddcb9d007ea87781b8ce8b3bacc4792ee9c7308e060959e269063ee2f
SSDEEP 12288:00HvyTN59U+jUj4U9MUPYIdjajQ2R7FHfRq8olK4Qbafl3PG5Gu2j36oLKd45FBq:vHquupeVgowKllx8RFPzJk7hZ22V0
TLSH
T1F4167DEDC97858C3CD639A30B4F0E9877C7413C3F995C1D68898C584026BBC5BFAA669
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a3
Size 53KB
SHA256 75fa16e8fe16ffe235efb62632d99055e4374da7389f9d59ac86086756afdd1b
MD5 3d5eba3fa0a6b8745047cdb70ce68063
SHA1 fbcdaaa654abf0f3d0a3741020cb52ccd46ecaa3
SHA512 f03093f48b8f961c5d65b4c37ed283214ccb7f69efbf255d3d4cca8408a65f5270841887af811cdbba8c4387324b2c95d1a65528f70baff171bf3e98ff1df510
SSDEEP 768:ZoF4sYKVBnWjJUoCZQ6dSTvCXnBlF4XVGcK49LFjiPKHv2bkLa6vQib0i:ZPKVBboQQ6djnbFtcb9LhiPKHwwoCl
TLSH
T11C33F10F962CEA2F955E6ABA8275DBF6C5C87F115CAB230E3703644C7A77DE045208E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a5

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a5
Size 204KB
SHA256 66dd446966b08ef2cb2b9cf5018858dc365ecbcd48f67b91510bf9c9d045e324
MD5 ce4c1c4ee2898701b82fb0004d3c76fd
SHA1 82f490879e72581d2cb178f4c30b9cec2a1ae715
SHA512 3a49c69674f1e28b46606f45d92005c6098a73450c2971a3bad7a2ac73324385960e542ed9a192d877e5c965fba1fef9bb39ce1c51759dcfb9d9913a840728f2
SSDEEP 6144:7id9hxTMDduK6dKulF1p7F78xYP2r1AbHq+GLYn4hFb:IhxOduKYFXB8xW0Mq+Ob
TLSH
T167142390067E33A4B9A8821C70936A471C59A8EFC5F716549FC8CB23FCCE6E14AD95C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 27b1992fcb52e4a20d8ce38004ea579143a90d9e62f5ded8f3d4f4eeb0ebda3e
MD5 31bbb3457819c39c7092cb9bbe08f447
SHA1 778e38448beb84ce86ba92ec07fe688a5e0736a8
SHA512 470b5c35fa3d8c148195304caf255964faaaa2749f65b63cfbe61467bf473659a2c67ba14ddedd7a47c94437245f3566741f5e8a69a3a5f1d908113c9bbb184f
TLSH
T1B1819A4A83E93DDEDF6297B305E17D16B373E0169807AF1A45749FBA0B033859347222
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 ecb4817f0ae72d7c55e9a47ebee8e4d1cc5226e41677384becc0dbb71596ae82
MD5 fdea7f34ab6610d0dd8e53d83fba5e9d
SHA1 5f7e2821fa682a9164052c8c140697f3945af7e9
SHA512 a4ead79230147bfbab41698db6e530f927563bc835f3d285bd5e7c27c5a2bd1143b520ac8296f67e2046f94ff2f3777cbb2907f13aaf35061cd6ba0ce052be10
TLSH
T16D411A1D83BC3DCFE7A19BB111E9625A3373E05A6D076F488684E77C8B053577123221
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 af98eed2732b0b3672bd162de8d49aa7a258e08396462453ae441a7159aeedc1
MD5 47684a5a721cdf20f3ada1435a3110c9
SHA1 5dbf15ac8ad36ce145c2bac9fce7305242aa8ef8
SHA512 a6dd3c287ec279636041fa300b0ad3ab9254083614760b056fb248ccce6dabc5e5f8ff63113fd1e240928ed97643cd64185c9543b304fe3c3cae59ded1633bdb
SSDEEP 96:v8TpastyYTCBJ8vqOzwJ/jLkSHPajLa9i1O3tEtSpW+:0QGBTCo3zErLPai9NtPU+
TLSH
T149D1E70587A87C8EDF577A7A86DDB85E3677E286CB034F0787109F785A127C1A702112
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 e9378f41571363dfda554cca76d9e8ff3ef278120f0f73e37fd1b45f7a634dc0
MD5 f32c9f37c795d121b567c96d53aef033
SHA1 4ec47b75ea6b3cd446ed0f0a9a98bf243a2a2b58
SHA512 dcd11f724caebb1d2eff039f1adce79059ef3d70e616e6e983abadc41c2ae564a25c74084a81356ce52c38c5a298d78cabc2c8cedee8e1eb22e6704a28ef323c
SSDEEP 96:LxEutYp7BWM9l8JcGCLOldx8DXeJf9wnRVfOsLzqDLax5aa8v1138EtSM+8D:21NlHdiWuFwD2LLaea8T8PAD
TLSH
T1A1F13D0987643C8AFF676A3AC6FD785D36B3F586DB438F074650AE341A1B391A702425
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 71c018367f0cbf52a3d7d3a39ba06aae36534211e7a16092f73df21d02941e16
MD5 e2e354a8f5a9267055225c44c8fd4a2a
SHA1 1331c29449317a8656e8b3ca20293988deccb294
SHA512 2eb7521637d4dabb77c82367d36b63905e00e021b5effae667f27c078a62ab929517bd803b3225e0d8e5845b38c8609e97f672195558c5ce7e7da3fb52ce3aea
SSDEEP 96:KtazVe6duvRevwUIVO9Dxfpq23FwjVfnnh+HNJ06Lf0lbBkrV0zp52/Ma0:NzmvoNIEdb/YKvqBe0zsb0
TLSH
T1A3F14E0987603C89FF676E3686FC786C32B3F592AB038F064754BE745E1B3916742925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 d4f9bf7c17d8d9bc1af0b95f4347f19c16646f7642d4b5b599d78001c97f11d9
MD5 f732f9e444b2de98cf069feab0874da9
SHA1 c1f59435314762670bd06081490aa09f99f249ce
SHA512 da189fa786d11c63a7a6086f157e3b10daebb584aa234855c343037084f0b69a444fe7bbe8709155c1de523515514241e739205d4078115dc2fc1400b579ce46
SSDEEP 96:Vr9yLdatnlCrVOvASDLeJ9CMZMJcPAxJ7Ha59q9wt:Z9x5lCrE4iyurxh6j/t
TLSH
T1E6D1FA0987A47C8DEF677E7A46DCB84D32B7E1869B039F0A47209F785A137C27752112
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 656577a400bf0fbd0c9d0a034de731c0f844bc3f815fca99bdbb40512ada4960
MD5 8489f15fde0d8cd76e3dbb10de1357de
SHA1 85a35158948fa3e97da713c9800355f7ab0efcb1
SHA512 c60e2c7ae679c028efd9fada0ed3570693b0efe02ee0ff18e6fd296a1f6ef3696585d2b66d20618bd920a5efe0613d34c22aa156a17bc685684c91c83690f487
SSDEEP 96:V3/mRc10e3ww4UB+dYcsigI2xhz6ijWIGhXXJnw6X0ajawtWra8nL08Ogfo:Vm0hcsimxh0JnZXAvO8Yhgfo
TLSH
T13EF14E8987607C89FF276A3686FC789C32F3F586EB038F060750AE745E1B7916742825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 db9b80d01149fceb0a9f657b350c4ea6ea7d718026bb889ecfedaf86c87cb678
MD5 42d215ef763fd98557da5433cca61250
SHA1 bd0bf8fd1c09a8df8ca09a66feb2f045d19a9e47
SHA512 68560fa60238db0717696ea55909689372c149b64ed7f3716ac7dbee05720633cd90276c6b606871587a451e975230a930ee3347ef5a26a56fd857ed5306471d
TLSH
T12451539D83B83CCEDBA1977352D5BA4A3273D05AAC135F4B45B4AF7A5B073926303211
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 b3edf8e28e996c03d37ffd08e2a4da7f9e4ce53a79c05a65aa6d6c81c433a775
MD5 10b1f1eeb25a1b94da1674de92e23e28
SHA1 aab9ad14b8bd644acd9e8631439840c50fbca70d
SHA512 55a43c62bd3cf73e153600a7c8606ae3ee1b7879f47af484cf8c1c4e99b5777ae6f1d5b008a03a1fd5ed927f8183fece079f1149e89064f27b558333b49ea22c
SSDEEP 96:cxETp7pWM9ZgJmGCLOlhUweJRbwPVfLLzXxQas5aj8v1T3wEtSM58w:thlZ5dic3hwtVQahj89wPxw
TLSH
T1BDE12E0687A53C8DFF576A3AC2ED785D3AB7F196CB038F0746549F340A1B391A742425
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 1962e3affad8a2cafb611fc4ea52fccc86d6b004478d2a6487204f5d46f6b648
MD5 a6e4e105442d38e5dfd4dd02573d1908
SHA1 db0ee742b062b12a2976105a60115b7c13a7c5c0
SHA512 e3fbb3a7f1d2b3185ee3a31f09d3ecbadb29b7d3b8b4890b8f72c2d8e85442e1787625d9f1abd2546390f3689ed8857ad10d51c6bd81c33333422d161a14c663
SSDEEP 96:BDk7WsAktOiqAWVTawcOTjyaOmS2C3KjNKxSzUd:BDk7hY0uPJ3SgNK0zUd
TLSH
T14691B94A87E83DCEDF7297B345E57D21B233E01698036B1B49749FBA5B032D69307222
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 346B
SHA256 170ebfe09af7772d399eacb11ec2f8892021b3081d80e8c1091a33e81768f467
MD5 73118708e0f31196e2d7cf76cf928c64
SHA1 17c55cefc865e1ec7d49ad5908d49a0cd63e3e89
SHA512 0a52b66f4a9beb4729ae7c3e8b1d46189ee66fe251d879c8553c32da30468eea24c9c21dfeef87709aab0951b977040bbf92f2367f5faa6bab0c20599e66f19f
TLSH
T10CE0D8A494C7C1DE9A1434D35124EB28C2C43443EA86EF032704CCC07F03452B375A96
MD5 SHA1 SHA512 TLSH

Submit Download

EdgeHubAppUsageSQLite.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db
Size 32KB
SHA256 0d72cbe82a96bd101394b7bd8b321686e6fe741881c365b03a6e3a5124783c68
MD5 8eb7e5af07baa302d55e026867af27cc
SHA1 c3bf79c975d43eba1c8c2e190fc833968f206da2
SHA512 64bb32e343714c9168edc6c9a91071b840479950ea00191cd4e5b4220d605e71dfab4045cafec993ea15367c9bb6b201dd21d7420b8e85ffd3b348982f1fb0ad
SSDEEP 24:TLJHDDNzWjJ0npnyX7yNUs9vb7OkIbzXagfjrx9W5LFfFtIkNVqYpN:TtD4jJ/0UC+lf5nrWxFfFOkVTpN
TLSH
T10DE2E08C3B12F511C4ED733DA0D2C6E05EBC683C4A9DB5B152386DB68D63662F49E20A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 342B
SHA256 39dfdec86949f152a1471442545245ac5f3372b56428a6f61dffac0a3ec159e7
MD5 829a3c6987490c82e6ba954662c1d61b
SHA1 3799630075c4e24b21e810bb5896dd5ecb96c9b5
SHA512 0fe38650c2f79854b11bb4f6564fa45639e74cf8e644f7913c55cc92ee0ebe58c20307360aa83432e6521c046c39ccf2d2e1098695cae563817d0f4af593e30a
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 322B
SHA256 c843d46665c48ecf9fa6724b405fa7e59518ae44a4ac1ab0be76850a3fd5a55a
MD5 d0894cd00e44860ca67c249e8a8e44b7
SHA1 7b7e856c10ba6a894dab7f9ddf80f1b299e636dd
SHA512 f6fa0e7fe13dc8f6a1cdf17d21431419f5f94141ca29799a24554615e1acd1ec94960a11219b2edd17b7a584188977cf3939cf6b5f40189fe355b0b1aebc895e
TLSH
T119E0865445CFD56DA4186893C368671CCBD13447AACDFB421B09CC807613A66A39AAE0
MD5 SHA1 SHA512 TLSH

Submit Download

ExtensionActivityEdge

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ExtensionActivityEdge
Size 32KB
SHA256 475f12864892aa7b74be2630191c6d8f0223c403e99ba88c526ed36a19ab91bd
MD5 eec0746e532e1aa3315a9bcbaaec4a2e
SHA1 b3092a8c10c8f3ae716f6e3bc8beec6eccc0e4d4
SHA512 dbb680492930aaf08078604ab14d0d1e63853a735d0a896644c8eb4d4ed380aa94f0cc9f573a04a7abc1c06fa1ad335a082b07b9242e5b463f1c06605f0a2bbf
SSDEEP 24:TLlWK3iOvwxwwweePKmJIOAdQBVA/kjo/TJZwJ9OV3WOT/uReQQ:TWm+/9ZW943WOT/
TLSH
T156E24B2A5E7C7121CD667136AC2194665CB910DA977336F23EE000796F8228BC535CEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 20KB
SHA256 1a640bfc0182c3a9445991adf3e664ccc1afbf09e9b7dc458e1b32451790076f
MD5 456bf8a7b08c862fbe05f96461a07025
SHA1 d3f5941e6b4846e2d38aa5398ad9c663535a623c
SHA512 f750f0fad16fc3dfd8faa9d470fe8acf006433f0f724db7c45da8bfd22e6c62d6a18bef4261e249555a38567e941b5b7999b46502b201f5788dcd033ff2878b8
SSDEEP 24:LLBQJY90+mhh0GY/l1rWR1PmCx9fZjsBp6UwcECjzJ3xDcNgdFXH1CIcT+11q0d3:uzBmw6QU1PzfyYFXHBAs1q0dFkWQFUZ
TLSH
T11592A4576E78B403EB820D3B223E487ACD7FD01C5FB2DD95749544224CBC882A0359AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 224KB
SHA256 352e30a5d41fc9be5b6920ede49049decb0067c15af2fb5253caab087934300e
MD5 54b739260dbd7cf0e3da3c1dc11c9ce3
SHA1 614a6224493545f328ad765adc419c08c3a7056d
SHA512 b29db06bd47bea7f658a66e42c1bfb7c9226092d1088d40191a6279ab915a157eba019c5032a2fd9b13387cc58c9aee37ccaf4653dd2b067a2464971612d34f0
SSDEEP 96:+bdHtejzH+bF+UIYysX0fxQp97oEHt/DfLjLqL/srbbEOVpZf24JkMfXSFR+CFqD:+bSH+bF+UI3iWGVoWN3qL/4VVV63
TLSH
T17B24104E5F252722CDBD813668E744A35C7DF03FCB5366DA686114B4CEE2652A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\000003.log
Size 26KB
SHA256 5d62269fb0575f981ac19a03acf057e9a70dd51e5ce5714f2281cbcecc501d78
MD5 8c17fe9008609a3c50ebf3b5bd217fb7
SHA1 312f1df527a92745dcac9f6e2a4999ca81f141e3
SHA512 224fa889fe159ffb136d3949e98c1d513ab06df9c8c43ed1823730a5644f46fa43eb429577a20d3622a4ed9a97f481c99d34a6b5f5ab6631a2e5c4fd33b30e32
SSDEEP 768:JuCMvAPJyaeao4uSE/Fx7XakMeMA0izpl9s:8AHEdx79l9s
TLSH
T182C2796275F9061AF2BB9FBAE8B15B954C7ABE462C00D84D5860624D4C72F40CD73B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\LOG
Size 383B
SHA256 570401b75b0db3d7052d4caa30db0ea98d55d1363403b92211206a58de53621b
MD5 c4216c8187a0633cac9b114630fdfcb3
SHA1 f6bd103f8f49dc59f6330943e8900c881e2dc64e
SHA512 8cc0ba3a18aa37e876cffb9513fff9712235b39f8728c9a7c68e47b13180f4604032225e22532e8c6722bbef0c2b1122c5157b4791fa4cd5c00c8506521418ee
TLSH
T101E022BC56CEC21FA254A0970168BF4CD2E3BA4B9BC8EE851F0CC8C1B942A50B16D560
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 146B
SHA256 58d13df616d3d466e1d3a5e0bc14ea456c8317c98577c92e6ba39fa5754f5e7a
MD5 f5c81ba61ea9b4795d251d67eb459a2c
SHA1 f98a562e0de299459ce21d5343d4b5546e77fd57
SHA512 b8d982b955379a8893bc46a5fbee2e2c15803cd4d781e824bbbabb35b96f7b7926969e8f11300332a84f7ec189a1dc43e78d59fba58d66d4b5462aec6d43591e
TLSH
T18EC048AFAA25A0AAA70405F524317C4DEA2E90ACAA889696E54436030AA9438290A805
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 334B
SHA256 7c3698afd4517db36a0a5d40b9644f394e90bc3d1f320b39616198d035386b83
MD5 05a8da85b78456682d17c9d18f14c1d7
SHA1 a3dea90d24c21d63863fd3e68e7d8399e59293a4
SHA512 5480be3f66c89504b66a5f428630b3b58348433ee75c66bfa68695009ae13f2eb06a9586a922f8a36584f55372b80a3c243037cfec2c8041879ca33efbc67e42
TLSH
T177E026A444CFD5AEA608204B92287B0CC7F0381BEA88BF871B05DC40FA0F844A3C76D2
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 24KB
SHA256 502f25048c93bb1e84e9db192947ca734bdffdafb964dab150f6f3ebf4b57d87
MD5 7c5514af771e5ecaaa507063a186ee56
SHA1 0e56a590c8cc180334c4a6546501461f05a804bf
SHA512 34a8e3218333c150afba1652f0cf2badbe73d13c5d3299fa11be8f6c1337d0f341d4573f2ce44fdb1abf1bc58486c1571cc1e5baf3cda8df4b2b6e3d5156c16f
SSDEEP 48:Txk/LopFMaty423w/a9NUuTjAw7oHwKdzm4:qDeMatha9RAzzRv
TLSH
T1BFB2234D1F346221C0F04F76EDE085A72F3C111DC3732A859E5464F2DD926ABF6065AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 3a53cd764ced5eac84e447998036094e178213c0524992209ff9083b5363a4d1
MD5 d01264dfe14a7d655881affb06f4ef7b
SHA1 1a0c4115a78ebbe6c6cf84221eb32adadf30c2dd
SHA512 336b849261e13baf260cbfa1cdca5a864dc614f0cea3789612e2b02b7e7b6769d7a8e79a765d6bd96bd068cffcaf53d86a7958fc0dd8195fbc54db8bd16b08a9
SSDEEP 96:D9O0dqVSjhIzBXJ2IiPkndiP0BcwBGOq/jHzk:DQ0dqVSjhI1XkIiPkndiIck7q/jTk
TLSH
T19291DBF7C3F4866DCA0195F0AA14AF2BCE1D0456436C3D5A89E4AF1BA7F24B1E041A4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 d4aa91388c2d4aa772de653b567c7d7dedf081f1ed5e343cfeb97c3eac8ef035
MD5 b5fb8abaeef76c8dafcddbb15cce3d59
SHA1 2c12e294f2788f99f070bc322fb69ece48f1b0c9
SHA512 a52082361945bbcafb896f7c1e16a0337b947ddca9423b2c8b84fc42fc3c08299808f024e9ce71f84e92abc5b5683cedb447addf67dd91785096d36d21c679ea
TLSH
T18751FEF3C7E4866DCA0156F0AB147E2BCE1D0959432C3D5A89E4AF1BA7E34B1E141A4F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 53d025b2d34ab4408021b5ad4827f0734a325c74e8f8d1fb3443e4530bd804bc
MD5 00d60cbd41ff7bed3a397e0ec39586c5
SHA1 5f4085da638cb4cf00e4c82aebdda1b8f23a52b7
SHA512 3542cf3e9390826e3e6697cecc241959e06aea1f76303de7964e0c569099a7e4c05939e08699fd61aa44015d4c017ca91cc1e8d6895e2f07f88b4f48b528e2f0
TLSH
T17B51FEF3C7E4866DCA0156F0AB147E2BCE1D0959432C3D5A89E4AF1BA7E3471E141A4F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 4ccc385e1df1f8f2633a133449e405874b178d6ad284ee755778483d1e4a81b0
MD5 afe7449e1e51551591c2513c4f58d601
SHA1 6a4fe3d173f432a4c1233780f8852dcdb770ec23
SHA512 266bfddad9daca486e9483b0477109ccd9ff290275ef7a5062923a56c5edcc9c036e4536a06c0d78b0d2569187e90810ee326bfebf74d3c6ce5f7d7891f80c7b
SSDEEP 96:D9O0dy3E4VSjhIzBXJ2IiPbdi4GP0BGO5HzPcuttwKKRx:DQ0dy3E4VSjhI1XkIiPbdi4GI75TPcuY
TLSH
T182C10EF3C3E5822DCA0195F0AA147F2BCE1D0556436C3D5A89E4AF0BA7F2471E142B8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 21KB
SHA256 5d3f1d7c2964cfeb772bac72026a9d9aef5c2eb7111d8369f231204102be92ac
MD5 4b7de1d666818ca0f4cfbbcc3ccff2bf
SHA1 7ffe8f46719c49a17dc47e63c2d7541453fea516
SHA512 341c9c9c0822b7006b0db96b087026c99792257c60be39d428c0aff1163046e5b1b451bb6db7d87e5c2e70a3652e7597a72acf40459ac8c02db4c63c9dfe823b
SSDEEP 384:DWHt1+z8MueiVKkKAKnKEKaK6eKPKpK3KcKAJKcKpRVS51XP4aaiE5eUL+qb0441:ZRVKxH+iUa5A05p9olpMC0WsJcFVrop6
TLSH
T125A2CCF7C3E8862ED91156F49A142E1FCE6C1969432C386686D0BE0B93E2872F24575F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 4dc781b3629c2b59e26d34679c18c57ffe94ef5d57d19248bc56d7942c58085b
MD5 9350cb8aa110cc22958c94279a9c481f
SHA1 90796f5f148e45061360f6a16b42a57279b69f32
SHA512 bf358233b4a85534601f4eed9f3aa35bcf55d8b55b18fc3cf0acc5679e04691db2961c08d364183297136573f1de3fc5deb4c4364fe81dc9664e7fdf9063154f
SSDEEP 192:DWHdy3E8z8MGVSjhn1XPIiPbdiE5eUL+qb040bcZ75GttcGXmv8Ay4ux:DWHdy3E8z8MGVS51XP1PbdiE5eUL+qbI
TLSH
T1ED02ABF7C3E5822ECA1195F09A18AF1FCE1C0556436C3D5A89D4AE1BA3F2471E142B9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 18KB
SHA256 1cde26599787bead6f0cd680b814d79d72124f4e4d90c083abcabd21bac6071f
MD5 9c9a59efed69cec5966b75f5c7e853da
SHA1 b50fb620505dbfc3a5dc4ac59af87637b8a3caca
SHA512 c3605d7f9f9c90a1fc63bd6d8b92350c1634d499a44265b4af190808a842fe59193aacb4c59b7db82139f00af6fab13cef8bbf00898c612eb43d51e3e0ed217a
SSDEEP 384:DWHt1dBX6zv1K1KLK1KeKsKoeKoKSKAKTKMJKgKGJ8VS51XP4aaiE5eUL+qb040C:Q424jJYtvVuM01GITXpMC0WsJPrDro06
TLSH
T15792BAF783F4862ED91196F49A446E1FCF681865032C387A8AD07E1B93E3872F24575B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 21KB
SHA256 5d64513c8c2aac2a5e7fe7e6b9d363fa0c8e76e2dad0cf9f7f22c6a4b07964eb
MD5 fdb7c7f4a65b7cab8a6d58bcb46d112a
SHA1 e42737652b50e45c999ac533699d8a52d8667dac
SHA512 3da29b49e2b924022f6de258602ab3aecff415dc9fbcaa7405b9ce090ca94fd667a08a229f4bdf1f4494cb3d11035bc09f55ab949344202efdfcb42f654deb8e
SSDEEP 384:DWHt1z8MueiVKkKAKnKEKaK6eKPKpK3KcKAJKcKpJ3VS51XP4aaiE5eUL+qb044b:cRVKxH+iUa5A05p9ulpMC0WsJcFVropQ
TLSH
T1F6A2CCF7C3E8862ED91156F49A142E1FCE6C1969432C3C6686D0BE0B93E2872F24575F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL
Size 36KB
SHA256 84b03eb8e9885b3e28d5e6140856d26f27c2cda7e0838984c67aee4c68d455e7
MD5 d61655626f8e6e8602f5bb1d0bff17a6
SHA1 e77813b61d940e8fb61e89babe7ed2148ded3da0
SHA512 4764b08f1b70657d007bf36f6ba68027f6783a14f12f87f1f94bb43a75f2e37850a50da0ac1ca46a2e4aefa00ea0a9ce78fff998468c2c4d68c980ee34633b3e
SSDEEP 48:TKIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSBkl8:eIEumQv8m1ccnvS6hvsGcf6CnFGAL+4g
TLSH
T16EF2CBFA07276206C99484B0E4009F8EAF1A010B47B6B6DC76D447E3F7A21E2B57875A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 a7b80ce571aa08f535f3383365f5dff33f4c4a934190ea902181c3617ae90a5b
MD5 67fec138834f5e68d22c13fbc7f36ce4
SHA1 d69be990e094ccf8d5966ebf26554a0806c90b91
SHA512 da8e44fc2dda523b84321d54290354ef108df5a09ab578093e59e5a449da2ddbe07b3cd1ae7f7df39b570587de6f28c807d2fd011d0a62a14d287020b09de67f
TLSH
T16CD022A3E20130B5A56D7E92A46EAC8EC32751280A83AEE426E05C9C063A8BC051F041
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 4d7c5f20e760c1ee138b47e5743ae913e4b08cb063ebb132fef906706ae8196a
MD5 e23168b0c1c36a6d252bddcddb77c813
SHA1 4f75e7404285a42eee2aea68ef61f36542b79268
SHA512 fa56409e9f41a3c53fe9f8ea939e8dc5f2ac2e4e25756bc6534d2f8df4f47bcfdf8048a18ae7cca4c37874f8f6c05db029adeb8bb1a87c9b11602811b159ab78
TLSH
T1BAD02353E1027075657C3D815465AC8FC36701140683DED435D4949C177545C451B541
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 690B
SHA256 d75e1c86b7326fdd0ae683d6332b86f7c00766b8ecc61b0a43c01f43e04fc73a
MD5 fd2c4e5efc83473a6f90f5bab82184c7
SHA1 d444ca0cb7dbf231d8681903b451682f4fa9857a
SHA512 73f18a01a29a7dfa14597451912a6437f78e86e9667fe9fa2f45918ec5f4bf80d2b0b683c371fc0ec5b9d33a9b3ca78af8ba059376ec50791f4ea63b76425b2c
TLSH
T131017BE3C6BEA467102C497A0F44780529B6AC3552C09CF5EB75A23CB0C59F74B4A01A
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 2KB
SHA256 4a127dc0a7ed9090067427e33f0b54d48fb91173299f2852d804948eaaf27a5f
MD5 d051e042686ad8b974371409da9dffa1
SHA1 94c8efe663b7330852d3be0095df9f25eefa3067
SHA512 9e3b1e44d2b4cc4f51d0465b0eb3f36d6752f5c3bd6c9ea8049288e4c19e6f97a791de375a44324cc0c521e289978dbef71abc97b7c1b11cc2f341c9afaf7702
TLSH
T1155190E7C17FB47B102948AF1F097C0A5DB7983643C169F4EBAA922CF0C55F38A16066
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 019babcc9c5a6b84f39371ec7a86224e421641e49c59c622bcb8ef98f45aa043
MD5 4f2d16da7a82e0311e024d9c09c25633
SHA1 1138d5a59b78333b21f0cc9974ab5ef48a738c14
SHA512 d00b415fbaf985eaaf43d9e076052c85ebbbb1ce6f3a67894c48aa441f160713a04c33b4378627a9f9d9c277e75e00f8ee63d5b6e24567f84daf5dc04da553c1
TLSH
T1BFF059A3CA7EA4B710284D7A1E48740529B69C3522D05CF5EFB1E32CB1C1AF7870A029
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 b8299b928660ab51cd2eae938cc83d4c0cf768166705e0b778380391cdf581b2
MD5 0e385be54f7f172467d75e6718f12144
SHA1 173aa3034c829f1cf05a418d8fc57949e0823933
SHA512 9957fba05073cc26d8e35a203f6612895236fe9f80747304933593884b30988380af8a1a9f936e399856318c78f8a963bb6ce3b42d4e33e5db8b0cf223970776
TLSH
T15F315DE7C67EA87B10290C7F1F09780A2DF6A83943D068F4EBA6922CF0D55F74656066
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 5KB
SHA256 4a8b074dbbf1ef109769c056d69cd03da26015d90c707dacaf4e8e892407716a
MD5 9c6d53a0530d1516f6d9373be8e05e46
SHA1 58e64fd50f5f788ba99e4bf8054f7ac7634578bc
SHA512 e2905ce5aa2f9624412fff9cc918f4697dbed469849088dcd73fe1a1e8b58d145c59564a2eea3e8ce295947ef7d8bd7b4dd4865b0401d5bd7d7f5c442bf818e4
SSDEEP 96:SUyUsUyqAUsUQYUAieUJUweUrFUgUTUHeU34UvUJUEKUtUwwBUTUUenU9jUBUULh:SUyUsUyqAUsUxUoUJU/UrFUgUTUHeU3B
TLSH
T14CB18EA7C27FA8BB102D5D7B0E05B80629B6AC3E42C169F5DF96C12CB1C9DF34657062
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 5KB
SHA256 d1235c20d4ebd1ff6753c5bc4a429afff74a8a4934c54163589e4627ba177dac
MD5 508b71e9ca1e434960b3876b4a74032e
SHA1 9cce09b7aacf222cf2f485e1fbfc72569e999c6f
SHA512 01ed75b34191782294eabc7dd3bb816c3304b3b3993897e00469a8cc646d13893da9d95fddded84dc31f093582b1e08aab3f5dcd61521987843906500f888438
SSDEEP 96:SUyUsUyqAUsUlUEieUJUweUrFUgUTUHeU34UvUJUEKUtUPiBUYUUenU9jUBUULUQ:SUyUsUyqAUsUlUUUJU/UrFUgUTUHeU3d
TLSH
T101B18FE7C27FA8BB1029596B0E54B80A29B7AC3E02C155F5DF96813DB0C5DF74657022
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 21KB
SHA256 51850bd619b3b09aad9acb809fa9123dc0c65e226cc0474b452f4baa2ad16dc9
MD5 1668913c842f1a449983c8480728a0e2
SHA1 0c8c3aec99580daaa73922d8494b8f70347029f9
SHA512 bfc0af896d6a1e36819c8e15f95fd76cee3a989f760ecbbe48518f990b56ddce32c22882e13981c895a21a2e274dd91c339756b263a276d33b12d53a8bff96df
SSDEEP 384:sxRTncp4Oq/fZsmWvcM8UqWGNg/5GRefFZs91w:sfc5q/fZYcM85WN/5jFZmw
TLSH
T165A20956E4305DBB9DE7D218F906BB63D6BC542396805E94A6FC9D0C00E7BED2203C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 0352a4dac45028a3e62ac255c8c201f1254e9170a1e981016ba9ab96fb5d5f10
MD5 c60c1289e074ba023e3dc6297b2650ca
SHA1 33fc0de030401a4c678f66baba7af82d25d69f8d
SHA512 d06cabafce6bda9a6311c57be3bbb8b834ad312dc2d5eade6b15567458793d3e8fd5e5f7ef205d737cc49c7adccdc96c4d69645b402098e7e38b09e010d1b879
SSDEEP 192:sxR1xRYyM/jK1Ml8vbq/fZszWpVcZp8bNv4zoA8psn/g6+WNc2uY/YJ7iZ/GTIg3:sxRDS2q/fZszWvcX8vBC/53/7Z83
TLSH
T1D862D715A52499BBCCDBD20DFA557F63D6F85433A2901E44AAFC9A1C00E7AED2213C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 a80cd79e703e6ec109e1c335e2b2f80a9a9facc12942a7fa406125ac79ac50bd
MD5 28eb91da252ec95bc579041618e78808
SHA1 c4dbbc45e622993407cc52c24f5bcf94487452dc
SHA512 259898c599163c407ec5ee15a3179b7978171cccb72d1e9e9f38c2291f0d1b5876d2b610b32560e92f17b45640a2cc70ded6fa364d9d6c1906d1c134d629881c
SSDEEP 192:sxR1GRYyM/jK1Ml8vbq/fZsnWpVBZp8bNv4zoA8psn/g6+WNc2uY/YJ7iZGgTIgs:sxRIS2q/fZsnWvBX8vBC/53/7ZDs
TLSH
T12A62E815A524A97BCCDBD20DFA557F63D6F85433A2901E44AAFC9A0C00E7AED2213C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 38e8d89e1bdedb63aee9793dbe8e9e360110b410a48c2e1c0f4cd2c275fb8e65
MD5 15f9311fa65d14088ac748be09c665d2
SHA1 33ab3c818d2521d27d9cfbd60b74148d9fa3c92b
SHA512 7361a7cccc954b5c3a73b91b3dd98c2be8dffa6f4676dd9cdc8ada005728b60ada263ba37892e7bb8cb8e12c3661c019a2d468ea10755e723a437e757c962fad
SSDEEP 384:sxRD0Cq/fZsYWvcM8Uq3dW/5+xef/Zq91w:svDq/fDYcM85Y/5f/Z8w
TLSH
T14A92E956E43459BB8DE7D218F945BB67D2F8542396905E84A6FCDE0C00E7BEC6103C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 26KB
SHA256 2f1d6b194f19df6ad31a5a4bf5897e792437b26f68697838abadf1f658288fcb
MD5 3a8d62f2457c54d75b03bf506617985d
SHA1 735aac5615b154d5b55acafda19409b2bb47d5ad
SHA512 830b0590f86ab83983d3036daf90f12977069d51fe0cf394fb22e36ab75606968cd89efa9aa74bf836c615f0ddba9f50ee01c238dc3f8a70604ec4c32526bf4c
SSDEEP 384:sxRTna+Qm4q/fZsFWvcM8UMJOwd/5BKRwWfrZVB+4Xg0/48:sfaPm4q/feYcM8tJX/5BerZOuJ3
TLSH
T13EC2F956A42089B7CDE7D518FD367F66D7E854238D814E88AAFCC91C00EB6FD2612C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 31KB
SHA256 088fd6dae951e2ec7ec0af3381e747bf3c37b43430cfbb692eda098ce63f38f7
MD5 3c6ab7342d031246d35402c2cff6ac4f
SHA1 2b4bbca6956d9061cc56f19f80527c8f1a865a47
SHA512 c922de760aac228b1f3709d83f706cf620bc76550d41a8de2a98e4d5abaa7ba5df6f2e56364ee1ff6137b5f4f065f83d6598bc21c4090ca1031c493ad0885188
SSDEEP 768:sfpYm4q/fuYcM8BTr/2Ca0RFLW5ShZsuJ3:8Ym4bYcM8lCn55SAuJ3
TLSH
T1E3E2C7D3B02049BB89EAD425F835BF7AD6A444238E904ED9AAECCD1C10DB6FD7901C57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 26KB
SHA256 f335de312543b73e239f14c88fd64bca90593addd31ca75f70fffe5b447ff6c7
MD5 3d9afe788d5dc5d6bcf8a29ffcb605ac
SHA1 4db0e4f3d55ece636d4bf0577e345b81a05140e4
SHA512 aabe41bbaa0881a963ef5d3b7e56bdbe30aaaae314ff3bb91a242a894f05aef83d17e2caa6242bc791983e11749a1c2da02a4a6b2e43f35eb7f0190e4960940e
SSDEEP 384:sxRTnL+B2m4q/fZsFWvcM8UxJOwp/5BKRVMfVZVB+4Xje48:sfLVm4q/feYcM8YJv/5BPVZOuK3
TLSH
T10BC2F856A02089B78DE7D518FD367F66D7E854238D814E98AAFCC91C00EF6FD2612C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 b7ec6886e4b34a52c2b007f38a2dbcfe806038d12368c4c249c6977ec24deca0
MD5 39b63751f20ff68eea72c1ea68a931a3
SHA1 bd9137802ed38a7752e41f7d6fafbbddbcabd224
SHA512 1ec204f301f87f52a86a7a3dc995d6f90c0d8fca42427522795c7a1922d09d6fd527aef3591b703cea72a9fbce995977b7209a50ec9270dbcbbed965bdcc431b
SSDEEP 192:sxR1xRYyM/jK1hl8DSq/fZszWpVcZe8bNvq+bp97oA8pJOzn/g6+WNIblZfdAxuw:sxRDb1q/fZszWvcU8vBEwL/59x/yZOR
TLSH
T1E282F746A5245D7BCCE7D209FA567B63D6FC546392901E44AAFCCA0C00E7BEC2213C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 3574c5ed368c97439f6050510cfa0ef3805773411de4e6baec26a73f6d392b84
MD5 0b97769fe0f4d1fcf9806e34b0f3a586
SHA1 28d4aee3f66123edb756d0f8e0ee6b9ede137728
SHA512 9ef3665363c381ee3ba130c1fb7a1e83a3be04c96eb28d9a64f997068e9ece3216ca818fdb017ff63671904906d74e804ac8441b0c2400a6cbf1945793445da3
SSDEEP 384:sxRD0Jq/fZsYWvcM8Uq3dW/5bxefnZJ91w:svIq/fDYcM85Y/5enZBw
TLSH
T13992E856E43459BB8DE7D218F946BB67D2F8542396905E84A6FCDE0C00E7BEC6103C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 31KB
SHA256 ff56c6e6a4aa745d53973fa5fda790fbf886a3debc7f4fc41371be736aceb180
MD5 3d530fad1c180e5648a37c9797d67423
SHA1 07af8f7b25602b9d3aa526785897a17e9e51a379
SHA512 72f26b4865885257ca268edd14cb87b1e5db219d0f43fa302467f379caf4f6ab06dd78c1d6a4b71e674dfeb67829ed26192e76f8e4d5ae98fcb016eb688df5d6
SSDEEP 768:sfYUm4q/fuYcM8Bym/5Ca0RFLW5ShZsuJ3:FUm4bYcM8Ewn55SAuJ3
TLSH
T1D3E2C7D3B02049BB89EAD425F835BF7AD6A444238E904ED9AAECCD1C10DB6FD7501C57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 64ccde308f164b5e4a141e6196375680e9a6cd87dd9f5984214657a97acfd6b9
MD5 b40e4a3308b70b913faf84170e3454c3
SHA1 6478c7648d7940c4541c90ae58b0fa4a26fd4fae
SHA512 f46d3a7a01812a696708fdd149cba4deb53b92bbd99c06d0908f03261f9c3ac15b75fe42d375251e6ac05e7cae02615db77c7b1663799da4362d7b60368f2e8e
SSDEEP 192:sxR1xRYyM/jK1hl8vDOq/fZszWpVcZe8bNv40oA8pJOzn/g6+WNclZfdAxuY/YJd:sxRDbMOq/fZszWvcU8v6wL/5zx//ZGR
TLSH
T18C72E855A5249DBBCDE7D209FA557F63D6F8547392901E44AAFC8A0C00E7AED2203C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 20KB
SHA256 71a37e234d05e5f0fe4c874dafb376b2cd0685b8128cf5b02187e7da6ef979bf
MD5 ab91cf8df64493cdebb0ba09c7fef8f2
SHA1 d408f299735b9f1a5e5b0edce214b92cc2778249
SHA512 edb995e23d2dddc4321e50eb7afb8a70e77dc038853945a9dca727b6f6328f658eb2ece46920fd902c2efb0061ec3ee38d57538b2023ad08209691024dc1e620
SSDEEP 384:sxRDp4Oq/fZsmWvcM8Uq9IJg/5GRefFZs91w:sv5q/fZYcM859j/5jFZmw
TLSH
T16892F846E4345DBB8DE7D218F946BB63D6F8542396805E84A6FCDD1C00E7AEC6103C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 31KB
SHA256 4392bb821965347ba97c63a9beb03d0a88566510e06583921c51f0b740f4192e
MD5 04c331ba22f26e4345500293fca1ae92
SHA1 a20ae9694c1c2ffd9c6d816040c49bec9a0049c3
SHA512 b43898df5c8a74bc74e44aeac7cc3c9405f6be7ff67f6fd884d676ce11ef5ae01b4ca4cc12cf06258c1e012f03b01bccb1d9e20bc012dcc7d51ddeb263d6c8f1
SSDEEP 768:sfbYm4q/fuYcM8BTr/2Ca0RFLW5ShZ6uJ3:eYm4bYcM8lCn55SOuJ3
TLSH
T183E2C7D3B02049BB89EAD425F835BF7AD6A444238E904ED9AAECCD1C10DB6FD7501C57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 21KB
SHA256 22f811a2d2621c43729d218ab793a70dd049c11f389771036e294f22135332de
MD5 5b67509a9eddceed0e22042691f9842f
SHA1 8346ea412d7db6f0877a0050fdc34174833b2b85
SHA512 cc1c95b369f70264e8cd3ddf1dfe07c3c0047b28ecd4e6376d3f0f90493aff5123d30448820437cc79f4dea774757d4668002c101475ea4a7a413b8a3c20a43f
SSDEEP 384:sxRTnXp1m1q/fZsmWvcM8UqWGON/5DRUef3ZsBHh:sfXfm1q/fZYcM85W5/5p3Zk
TLSH
T176A20956F4345DBB8DE7D118F902BB67D6B8502396805E94A6FC9D0C00EBBED6203C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 3e7271cfe91e1656e444f9f00cc924a8fa7cb128a4c6b91875b4a82ff46dcdf4
MD5 39487fe7238d4a23b9121a4cd6d09221
SHA1 80d25a6ec814ec4c9b340bb2c4c38d4d20cec90c
SHA512 3e68b54c7fc132d8c855c75a2dced2dde235106a27535e33aab26e558ffc4089ebedd3dd79e2b574902f0b71401d56c79c561cc21aa79553efe6aa975ac2fc61
SSDEEP 768:dhRACxWgg+fAJ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVL13fjroPchB:dhRACxWgg+fAJu1jaulfQ0hB
TLSH
T163C20C3F240CCB7E4F844E9DEC29AED76DD802CB96988D5447EA894C03C67EB511A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\04cc1ce5-6ba0-4a73-bdde-56d8ba7dc184\index-dir\the-real-index
Size 72B
SHA256 f4ba6ba0f3e464b5bb8498b775d7def501d89122e65ab6e5711db4d9dcfae310
MD5 15a51134383c778e623710acd37366cb
SHA1 1dbd00ce77b9b5b2ee611b89cc4ec9386fa21648
SHA512 be1b6360ce906939419ed982da0531653b4d72f1ede262c48b41f9a0fda37dd4aa932148e22b37715909b76c0737c4fbfddee27a0e971f99e2060b59b95fe03b
TLSH
T111A002108271921BE25707BC604F15C42650C96441017616D3F1A1BC8C63941A3860D1
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\04cc1ce5-6ba0-4a73-bdde-56d8ba7dc184\index-dir\the-real-index
Size 96B
SHA256 8bfe0737968d24b1610bb1ed72d10de0f61859c74ede2b3d3e429e13954bb811
MD5 30ed277e33e111af52f7cf362040505b
SHA1 99ffd3eff0b517311e349dc849220954a25915f0
SHA512 8c857c94ee9f7dd1c84af2e94ae95c0c62c202176d7161763dfa9fa8bf38e98a6101a9056e4cc7d9deb165cf9934273d97dc5840270a5d43fc855b78e9a77c96
TLSH
T162B0223C00808F8FC0200BF0288C2B80F22ECCCAA2032008C280B220CC203A0230F8C8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\04cc1ce5-6ba0-4a73-bdde-56d8ba7dc184\index-dir\the-real-index
Size 96B
SHA256 2b630e957bbdfd1def42a50a4bd7a0f3500d1e8b40826c3d2aba06157d5c9b6d
MD5 289c4dd917aa6ce0275b3637824980bc
SHA1 3b382b9c6ad74bc4e0425e10777db807cf909712
SHA512 977364380dbdd76eb039646cabc8338955bb0d9edf103324334576d37bc3ebd1ce7831c80e551df5087d3b1d3a6e2e9a557ac499003cdebcf12849faa70c6d36
TLSH
T11AB022ACF2300F8BEA000BF8208F3BC03220CC2C2B030000AEC8F230C820B08B30E000
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\04cc1ce5-6ba0-4a73-bdde-56d8ba7dc184\index-dir\the-real-index
Size 96B
SHA256 aed045018a2fcfd2c96d2b558f165564eaaa4d51e093fadbc5c481691f14d37e
MD5 38171dc5625c40f42155928a0752985b
SHA1 583b80558050dff5f8535d0776b21b7fab8fe7e4
SHA512 aff434020fa15f6e3447fb114ec79418f3207e411e14d847d1eb2c73227fdf81de39b7edead2c089a34b9a8df823bf5743e10ca24558dc436b0258bf427bc32b
TLSH
T126B0222C80808F03C20003F8020C3BC03A00CC0C330200228CBEF280CC2020ABB8BC88
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\04cc1ce5-6ba0-4a73-bdde-56d8ba7dc184\index-dir\the-real-index
Size 72B
SHA256 697ad0fa748941f578755c848903f11285518bc0530ec5a648398e2f7f9b1619
MD5 6db1e2d45aadda5730f08d923196e29a
SHA1 41a3d6c54ed9f911a45fd2e6fb942e3547e05d0a
SHA512 32e3252e9954676a0001534e825e927647207bc535fc6251e50ba1c613ea70e3e6719c0cdef79a092209b924bd06ad438105b081e2434b5974c5b3c5ce699073
TLSH
T135A0023941D1674FC09517B051457E80A35CC85431021642C09151649D6094CA30F8C9
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5d84c3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\04cc1ce5-6ba0-4a73-bdde-56d8ba7dc184\index-dir\the-real-index~RFe5d84c3.TMP
Size 48B
SHA256 3e08a28a200e5845380124eb1e023af916553152da3068507ca15d87a6da568c
MD5 8b85c4e3d26deb7f7a12aa7b60822c82
SHA1 c349dfac9a51fc984d9803627e48ceeac45b8837
SHA512 a63e97f41fa9a137db2bd130c2157e159e5275c27ad0ff5e329ce30c3e3f29b7ba0c51b06019b8c084b16a236927f877ef7e6a1fd9838d62b9b63ab165bc1511
MD5 SHA1 SHA512

Submit Download

4f2277ea2139c475_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\af3eb168-6633-40da-bc82-624429f91a56\4f2277ea2139c475_0
Size 62KB
SHA256 de442c2d0270f5c907d8af193f3b6d868b2bee75ff5377bb64574c8c9510e69e
MD5 dfce3805eb55a2e28223db5caaa1a1bf
SHA1 3099110b05be071fd92ddb4bf325704e2bcd14c1
SHA512 da4b7252b07387dd405b8f130d937d50d60dec9972d5481a9406e3572e6a1c5d75dd524e47880835b32ad4295c71eeeff98f250d1c38b36caea1215d12083a32
SSDEEP 1536:cuk3fvs4JfCS+ksYyiApR+M0Dpbarcjf5K7Zc4N5HPwqpzG4/A:cu8c48bC6Rx0DNDs1/A
TLSH
T1815329A6B2626135C7AD21D5A49A7F00F11B17561844C9ECF0AC66913F08ECB67B3BFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\af3eb168-6633-40da-bc82-624429f91a56\index-dir\the-real-index
Size 72B
SHA256 a10101aa05137a821365274ba6f9fcaf65dc6d38e18726d060507994379b7fcf
MD5 ce5753f5ebc9aa6e8a96212c86357e6e
SHA1 60fe1f4a1d5fc1eaec69726b1657596e63a5b9e6
SHA512 97d6c368cc8f679a1b725cc2327a542cd2c0774cd2cde90f6a6d46504cc03fdd16894bb3ce214fababd5c990f136e59a498dbdabbaecb097d3fd29d55e9dbe1a
TLSH
T1CAA002E1257A1981E14106F0514709923314DE1D5963C345D2A004A6CC65D986B03197
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\af3eb168-6633-40da-bc82-624429f91a56\index-dir\the-real-index
Size 72B
SHA256 9ea02161f8ebba56171f1bd785ebecea30495fb82519966fff7643af7cd4b9f4
MD5 c083d2fbee9e5443d4b5fdb088e38833
SHA1 73c315d498f7dcff37b3001bfc3bb65e954c2ba1
SHA512 ad9a563c75f26a331fd97778c3a295b46107839611f35f9d6a6b74b2bf4899eed4135c6e15082cd72baa752fdd119c163d1c1d4001b1c250ec5b032cbb7de68b
TLSH
T1F7A002E401764846F00346B4554342506314DC251223C34F42A046A5DCD3D5D6A02154
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\af3eb168-6633-40da-bc82-624429f91a56\index-dir\the-real-index
Size 72B
SHA256 ef44a1377cfd8df2b445059edcad853d5e1dfaca8fa4107d8e69f144643b4ad2
MD5 322b4fc065b59029dea8c8cfdf09a507
SHA1 b2a8a1e70e56c92687c47fe6abadf4aaacc58abc
SHA512 7e57338d0825950cf293f190ca46bf95e742318df4bb11aaad6da445dc2285fbb0f678ad851bba99b168212207b0cc584fd9a52c7ef31c280910fcaac762d965
TLSH
T154A002E047760983E0124AB1D64201606314DC2A6223D31752945955D856D58E6154D4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\af3eb168-6633-40da-bc82-624429f91a56\index-dir\the-real-index
Size 72B
SHA256 11993ed837f153b1a99a3361128d8abcfb8ee8f78590386887fc9843a8c1d6cc
MD5 808bf4df014e95ed831a0b32cd31dbb8
SHA1 06480bd069cdb74e608833957aa3f282d5a15275
SHA512 f31f53416bb70a96f1b707b0dd9f4fde113ce3008f3ca83308fa13578ee9d73e579ad8838fe07221dfa876eb86a80e72cda3d94f9c200788409e1e314282a850
TLSH
T171A002F1117F1941E0810570D14601911308DE59A522C70662B005A5D956CAD6B02555
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\af3eb168-6633-40da-bc82-624429f91a56\index-dir\the-real-index
Size 72B
SHA256 646b06374f329f17bce5fa305ecc0f548b3c4365e8c2df95e8ceae1c60dab80a
MD5 1b5e8d1695e409357c44c2f70ba8ef30
SHA1 2d13fafdcd44bb9809a22d52d4369b5d087b4a37
SHA512 86031836513b4714b811014954e579c3784699b416f3f17b906d161837ecc7d8a328ef457785a5edfcbb0261e45e8cd48f953e5d745d2abd52a2ca08f999a9b3
TLSH
T183A0026001685142C012CEB06143225477147C6932075706D2D015579A5655C97010F8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe60d47b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\af3eb168-6633-40da-bc82-624429f91a56\index-dir\the-real-index~RFe60d47b.TMP
Size 72B
SHA256 548c3c66cdd106362962b128f38b9934195801ae6948ede5f7f8709b8c753d8e
MD5 cce1eed68e3528a3fa8a19749f927d8a
SHA1 619e83e853883660c8c8ace497f648fd442a54f9
SHA512 3307ca0172bfdcdd0942a5ab3b087ff6898f115a46b2f5102f23a317d0f418dc18e7ffb468df1c3e3bb3d292abeaa61ec11bacab700fa02afe896cd5a059522e
TLSH
T144A00274465C458AC041CD74751222942324AC256443434A459008558E5956887010E1
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\dbc21efe-494b-4aef-aecf-6b4521d42992\index-dir\the-real-index
Size 3KB
SHA256 213f687784d924e9e611cc6d8d9b59066b73a01f0348abd0e599a3d7f0948e04
MD5 7279b119d9d1d780b503c8218715ef11
SHA1 9406d4aadfacfadc1e4d7181936f86c0135128ae
SHA512 c7e681952e6b01a82f4f0caf656eab5ea7952c089e7ea7b652df9b0a569619474a91781c5924d7c406e44ed017a8debf8c8da6e7c755f6ffb1818da5768e32a8
TLSH
T1F551FA4D8D475E26DD9C24F31CFA1942733534FE52898F0B569CE9347CC33291D69028
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\dbc21efe-494b-4aef-aecf-6b4521d42992\index-dir\the-real-index
Size 120B
SHA256 67e8637a43eec01e9be6835c125e85b0d964f1240802f6fdfd651a8349bf161c
MD5 8e4c92bd97311ed0ee2e32407a9399cf
SHA1 569e00b3d08ace4f9fe6dbe6a1721fcf41ebd812
SHA512 2e793cd5a2d846112817df91f9e5039b0078f2a56ecf1dd7856de6fbe125fac9a00bb2e81b383a7a374081af0911dd9bf7a0189920458611f35e1341a43f656e
TLSH
T105B012005D480E55CE07053117772178273B06DC1E11071310DC601694910ED8007544
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a6236.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\dbc21efe-494b-4aef-aecf-6b4521d42992\index-dir\the-real-index~RFe5a6236.TMP
Size 120B
SHA256 7f767c32d53921c4d3312272e686ac7cc4edd217de6b43305ec35f5e067af108
MD5 1c9190b6f4f037f978c539e325bbb035
SHA1 5946773b3bac17c973e2698b9e9f783d33dbbca4
SHA512 59d4a93b74bb63939942a65caacf87ef6de308721df7945a2ded7bac35009b2b5cc90ee31d449a51a330a062f77515d1517f8a0098eb8a1baad0b82bcc59f37b
TLSH
T1D3B0121101840E60CC0A017015178228332B1C140434430320D9146B88610C44446504
MD5 SHA1 SHA512 TLSH

Submit Download

623cd082b6202da0_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\fc78bb28-bf64-4f27-a287-71b933260204\623cd082b6202da0_0
Size 62KB
SHA256 29664947f75f2263531b93694dd79d99e3da5b0d46120c0df780fb0e6faf0130
MD5 47da329a9587c7168bc382cc0ed685c1
SHA1 826175f1678fed657808336c701d95ab868ec3bd
SHA512 ec38fad85d30cd0da03a536914a39f00993e0967ec495e72c873cb5b829efae7d6a5878b6aba05df0a0472d3a46ada176fc68c622eb9b1c16e2ee27bbc341f27
SSDEEP 1536:qk5fTM4JfCS+ksYyiApR+M0Dpbarcj/1qb58Yf5HPwqpzGn/a:qO448bC6Rx0DNDSy/a
TLSH
T13D5329A7B2626035C7AD21D5A49A7F00F12B17561804C9ECF0BD66953F18E8B53B3BBC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\fc78bb28-bf64-4f27-a287-71b933260204\index-dir\the-real-index
Size 72B
SHA256 9cac907e83639f7e413883a38890b55fc3d6176a9be594c706ab0cd20e3c10c1
MD5 7671cbae7abaddbc29bf0735e038846f
SHA1 7c772eb203ab8fe8ce6c7a91c2f395e610567951
SHA512 ebf010f8a512a64798a3b3c27148d7cb91c170ee4e043012d20421d311e34a94715d14497a61ef1567944e0bc9c6fce5e81b01383379b6f12e3ed22e78f10640
TLSH
T1BCA0029183952862C4079BB025D221817310CC100303521542911144CE5455453514EC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\fc78bb28-bf64-4f27-a287-71b933260204\index-dir\the-real-index
Size 72B
SHA256 2c4b544fc09f54a430df858f483f5ba92ad0fd3a230cc7161920ed9fc488cd8f
MD5 3287726a786baa1fb7d4ea93388bee99
SHA1 c528681e6bc5bc0b412a94c28a0669dfca5f5abb
SHA512 9cfbf31e7ee92b6f654320a8721cabb96652dce155689ae17b157a8ffa867fb4cfbaf8750ed717453d645bc377485500141c5f4863eac9e3ce42bfc51f2e466c
TLSH
T191A002D053E3C816F41713B82AEA0651E211D8102363961943A11944CD54D44E24140C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\fc78bb28-bf64-4f27-a287-71b933260204\index-dir\the-real-index
Size 72B
SHA256 7edfdc66f58313103918547d5fe8f69f6606f02e974cc71102e7ff3387f80d58
MD5 959f44febca2e94e253aebd487614fc6
SHA1 976b61a35327eb7f9657035d3ab3e16c3ff03637
SHA512 4e8cb038f60ce59aa8e34ff26a9153c433c8554a5a4305436f4b217feed6a017c8f881bc02769ccc9bdb50845aeb64fa821ed780cd4bb0e3a0a11e5f10de065f
TLSH
T11AA002D043E74C42E41793B17AD712417754C8291327921943910544CD50F51624140C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5da1e0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\fc78bb28-bf64-4f27-a287-71b933260204\index-dir\the-real-index~RFe5da1e0.TMP
Size 72B
SHA256 06fe516c1cdf8669c41f9d316ebebb2f29ee4ca2c237b9cea1589acefba0e677
MD5 e91772cbb2b9947c7cb283bf5f14e05c
SHA1 9ebf5667ca04613608f81238131a1e9b42e64d72
SHA512 56a17117c59a06f74142f5c8dbfa097e9a44daea7dd4c1743d42bdce4e0a66d88bfd014dd842b8e2b9e7836b2281fb7a22de78e778339b26434c3e7a953a5187
TLSH
T196A002505380740EC42255F329D6027127058CD4120523664992008CCCD47428B4101D
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 476B
SHA256 914b35a4264d0194728ebf2314db6f5b3077cc181a33c89c47972962b05810e0
MD5 bfec3aefd1043050bdf3cf6067a935ed
SHA1 d723ad08b55e5350d6fa6abc29228ab4d56bbe2b
SHA512 5d165e5db4585168a98936d8ad1d6a4e75891ab3997f74ef3eb174917ee3af5643c82f6af0459525a0332a6030c2ebeae23354965f589d53556417af292658c7
TLSH
T137F027B66FF72800B86EE3E1207150B40542B844D868ED5F205AB2E7E4B6314284DC22
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 476B
SHA256 81dd5afdc26e1083185399afda79c0ea688730aedc376ed788d09adfcb831eff
MD5 a5e995ae8e0511c9bf6693de34fc947b
SHA1 b6a08a85cd106074826fd5c1e9afda2acd50f408
SHA512 118dddb31f5dcdf4cee3bec045064614e98a01db1bc38d774f76e68e02b09a7a12965f20aa583b3c5b113c0ef73045b0e2a31433fe3ddb132c722c94e26634ae
TLSH
T19EF027B66FF72800F86EE3E1207140B40542B844D878EC4E205AB2E7E4F6314284DC22
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 476B
SHA256 e554e266919a2addc47fe07cc5f18c28f859f6bbb3e6ad34311422120197d36d
MD5 63399eb074740c672722b789353279b6
SHA1 fbb2bf8217f91885b5231c0fed012ebd095b3679
SHA512 f56c90cf4fe0b530586d4565e22cc2affd3508e022519acc1dffb7c1b7b2f0c651ed37e6160768f75baa26c24ca614b9a070ff1e98a75cfea710dff53b1594b4
TLSH
T125F027B66FF72400F86EE3E5207140F40542F844D868ED4E205AB3EBE4F6314284DC22
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 370B
SHA256 77560948db58ee77f09bf1ca919360150e1331285b516cbb1db0b3ae8a81da31
MD5 83c2a72bfdc1e7829c3b4f002f97a71f
SHA1 3c3df61b769eba649f5dba6a342fc1ff4fac4f48
SHA512 5fb88e813a2ec9a4d14fbc9406ffd463b45c7f12b2696e4186092eb95de08018dd615b7ce8602c21804d5c4af884c31faef40fbabc91aa070bd41d70b9e302e4
TLSH
T1CFE0D8FA7EE62410B87F97E5207144F84542F854D859EC0E206AA6D7E4E53542C05D22
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 481B
SHA256 332c28ef85e053642e5029c52dcdde93ab66b839e69e69772b55802e0b0552cd
MD5 1c140a99fec6edbbd58838dee18de0f9
SHA1 8c77421e4450cd574ecad2318c32949cb2644de3
SHA512 8a1bfa6c4dbdd918fee8300cdcfe27e56a6a2a15f5fbbddb55686ddd0a18108ca5f5dba58d122f69e21cc6bf1401eccc4521d273ec683129f6c16e042ab1bbd3
TLSH
T137F027F66FF72800B86AA3E2207140F40545BC44D865ED4E205AB2E7E4F6314280DC32
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 4eaf1e28b29c8767c8cc391cd7c9834f598c2d984cf3516ef5add8c22d8ffdfb
MD5 e31954fe5ed3835b3c1bc513032c28c9
SHA1 2d1ddfe3df8f8484bf1786deb9565f75d0fafba3
SHA512 e64ff8104ab49792246d71d068a3e97b4d0ba5c6993f99bd6ec193b6fcd1e7132f6cbed8b3da4f8a39f871cfbecc1dc201597bd1f1ec21e03edcb72e79f076d4
TLSH
T1FBE0D8FA7AE72410B87FA7E5207144B44542F854D859EC0E206AA2D7E4E53502C05D21
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 476B
SHA256 78acc4da1a5b2e70cbc0348536c4af1c06a89a6a5b22841ac276f9c517b69f05
MD5 d05e300cf05969fa0070f8d9c812075d
SHA1 a944533aea6a8593894bd27d2345358f1ce2fde7
SHA512 e0f42ba01f894df6b006dd98ce3bdd868fa6a3eaa8cd84c7f44f5c39c42713b1dcef5c057660e3173f67724983528414219d8189f161d9999672b8a0bb6acf42
TLSH
T105F027B66FF72401B86EE3E2207140F40542B844D868ED4E205AB3E7E4B6314284DC22
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 476B
SHA256 d2a345f1b9774cf8c2a6610207e3f1b8e39672e4874e44bb5ae422b704e19034
MD5 75e9f281a6956dedc0ba128bf497e968
SHA1 c2bc3426856b53bcbd8ac57444fd068b9628d2c0
SHA512 56467ba0168877b24ad66179118b7abcace63d7855f3f57f3d324ce461275f08e8f06c26838d78fde3d48703623b537f0d37f25bb852eb36f4da5fae2b2bf9a4
TLSH
T148F027B66FF72400B86EE3E5207140B40542B844D868ED5E205AB3EBE4B6314284DC22
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 17a7ee4993635df206eeed00b8eae107707170939efe05417c3f1ef06aaaec25
MD5 20eeddc1fee8f250b14cad94e1d9675c
SHA1 41cc29458ed8854ac4b0c3d70486873fb5e8c3f6
SHA512 e31621fda67ebeb9233b66228af7063f824f94efca20da657877cd284b209cbf48528ec23263bdecd688e5ecee7aaa288345e0496e1f28c27669cc6bed37084a
TLSH
T102E07D1045CED1BD6116608F0225E70CC3E4B417EBCCBF422F40C8407683A15F39B590
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 325372a5e41f6be6bc59ef28f5fd62718dd41c9659a1bef54b885e3892f6e576
MD5 3b78d3f4427491992b6a1b5235951965
SHA1 7e5caa6b939b40e5be69c3c8786b190348b4e9fe
SHA512 128577a8087eaf5ab640666ba4f713b36a62eead064ba8e5fb9add83014510cb211cf33f38f87355da0e1cf27d751e52fa4abdc721e824f6c8d393e2e8596abc
TLSH
T1C2A00271C98AE989C05002B5217101D46210DE9DA5052362C0BF039BDEB1240C2CD000
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5acf48.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5acf48.TMP
Size 48B
SHA256 8325f00875e4e077139cfd9bc1821621b5c3f0fde20e9a94f15be1d51b477dba
MD5 fa0cbed12c20f0b9385222b363973bba
SHA1 15185069e9cd48a0aaf22783662b8f49366c6e09
SHA512 348256102c293dbc3428643fae67ea52df13e98e5819068a9a3dce5a4f44890214fb64582ebdc8973759ad7d13254568fc72b51e6cdb4f41a77a0b3f70b477ae
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 3c798e12f773255153b14bc965a140f2b38bdf44d1f392806cec60aff9358447
MD5 a4d9bf7227f0146a986b1119179a6439
SHA1 9856baff8b9d54240ec16afc978d386d1ea3cf31
SHA512 df8d9a5718e11d825c9b0be69072e4a4d12cb83a9a46f31d356710bb82e15695936cb39f1c6319da0acb1a0a2c7a2cbafce0b0aff35212beabdea270c8087984
TLSH
T16FB012057700DB1EC6960C300E6447C05230E41530005E538C8CCFA14C085B8BF1B8C4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 e62799e2e58d664f68b7478c9ae5184c1a3c6c543cb85f9283d6ca559342567a
MD5 239fffc783d1095250996812507fbcad
SHA1 957d233a06f0e519ac71f323b6a6e0c9cf146d9b
SHA512 c2923a2cfa0089eb82b85d90d590a8be277d743d73b23c3ad26737d340e9fcbb0298f23f92e47344f2d2645dbdeb76f530df2e5ebf0fbe41ff9e546861b8d02a
TLSH
T1E1E0D86015CED7EE614A20C75224F30CC1E27407EAD8EB523B08D581A3076957747D60
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 f0e09a02b81d1b6b3161f124c57b5b193f4c2fb2677228a7c3ee632eb22cfc4d
MD5 287295bbdf6a9a823811c52b751b362f
SHA1 365922c151d7f1629935ed1c00eb9e9a13d19048
SHA512 5ce67657d9c07ee1b8d972f3b6d0fb0fd4c082fcba918fa56a2ec60fa507ace59140e6cafc523c83ed1e5a06be29dd36fcf093b6e688506491c93c57452a2f69
TLSH
T1D4E0867445CED67D548570874264BB1CC6F07847ABC9BBC65B0C8840A603955F3AADD0
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 1dd4ac0caceeb9a7fb7ce31d4bb25eccd6fe534b11993cca189e49760e765b8d
MD5 7b39a0fbf76d7e4758f6ccdde7b317e3
SHA1 a9caec64ed226ab5b766dda20faa84ade88de2e3
SHA512 566cd15440a40c512c065ff1464079beb466266dbf41ea0a9fbba064875c05f9dc46637d30103ff5f88317b37a035e434a502d1e88b720a1c26d6c6c4aa007fb
SSDEEP 96:KRm7KmgIIOW4tVgGOK47g0OcOGlkWPHXAlhXVFJWx+EgpJK4AgnJcPnmZwQgKtCq:Cm7KmgIIJ4tWGm7g09OGlkWPHXAlhXVj
TLSH
T18A915314347E42507D7EB90C95B98C2E868274A33219E52F7BBA41A50F67E1B4DFCCC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 9d90f5546d2864e9d6da52f09c7ebb7d678f2e4169f97b3b1945623fc5f51bd8
MD5 de648473dc724d7aa26ebbbfa6901718
SHA1 a24d54aa53701be47967e6cb965ff3120db967ff
SHA512 973b7801009e51e28310a4bf98ecbc96ab417586b5d68738b5a8e832df4005e723f792ec725f1e5994fc72a0017e8405e16db3ece8f3639a3b1950fc23934bfb
SSDEEP 192:Cm7KmgIIJ4tWGm7g09OGlkWPHXAlhXVFkx+VpjAgnWPnmZJvBndg:oBepnO
TLSH
T1EBD14814317E42547D7F790C91798C2AC68270A7321AE52FBBBA01A51F67E1A4EFCCC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 d3813816fd73584384b4635c653effc1e18fc01c0d979ff60e0f03a18e53e5a0
MD5 6153260031565ee2c9421c2d82da14c1
SHA1 84e05cabe002a36b1adc32a7bb56d39d28d31790
SHA512 b49592a4dca31693882a7e4db78bdfd01a2db9578713639f5293a260f1a58468b363948cbcb4ad8cdcf6070b8553cd6bf653788472c907226c05dde3a16cb88f
SSDEEP 384:DNrRZyCSDnxTICZMEhIKyll7svbFKfk7:xFZJSDni3yI1l7svbF9
TLSH
T18E44850A7B747001EDE6D9725CB080771E3C716E8F22A6916DA254694DB3853A33D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebAssistDatabase

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebAssistDatabase
Size 14KB
SHA256 6054ab42431efd6614e92d191c8782ea223f05b3c8247310157db08994bb2eb3
MD5 c74d74040d456c626b6febdf8255af23
SHA1 304c011529e5d074c6e7d99f546e8b3c18e208ae
SHA512 87469a933136193281d81a8b0f2d0f63d5c393301302006b4979b69ea32c695c9044ed1767a06028a7305993cabaded2cd54360e922e9009b13796a2a37f042c
SSDEEP 24:LLTGxhK3thdkSI5QjUsEGcGBXp22iSBgcB01zbL3MSGt:DEK3tjkSI5IUltGhp22iSBgcB013zW
TLSH
T13F520E9FFF742222CDE943319AC002D37E6BA13D8FC1DB2294E510111EF8951A31E58E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default_cloud_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
Size 13KB
SHA256 f9e4da319fe1f5a7d497c452421f4648a24ec7588f309ebea0f0cd61a6251eef
MD5 256c40bace492c4e28451ce149d2f9ac
SHA1 b48b0eaf986b9efc91d5c8dd394dccb6d82e2adc
SHA512 33b38d1ced015798722180fc8c8ce6daedb18cd5d0e4b3db27d6176c13cf3ccb1bd79f2e68ca390d6eb43ac508c29067e8f1a3ee9f0167cabe37ebbddf6b0ec0
SSDEEP 384:l7BJeojewj9mg1IZyvASoIL5QJwTcoEnE0YU/VwTcoEnE0GU58:l7BJeojewjcg1IZyvASos5FEnE0YREnA
TLSH
T12452007AD2211C7719B8636858BC4692F524137F8281C81F78BC656C8F7FA79A089FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 488B
SHA256 60422b55670d7ee9b4fcb3eeff57618a528432fa70535b024dcf75ea8f0598c6
MD5 e3fe98a787fcaabd78ab4b36ea8b45e4
SHA1 02d24360fdd5bb182ae9e46b536adbd7b3df5008
SHA512 0fa4642846fc539850af563ccc5de5c93e6c4c3b5f5b14f14b401226fea9fbc8a78cfe1379e419d7de05d6e549b37c1c681a9d1346fab4f84ba5aaa8527d5913
TLSH
T1C5F089C013BD60D87E8E9A44D1192903D4C43D6A174ED8B5731F45988B8981E5F2ED72
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 12KB
SHA256 2e732570229796a1acd0925da61feb54721122a9fb4512afdca29525055b79fd
MD5 915793ee9eba873d03f0a553b26b87df
SHA1 fc0f6149789c723ea6f03420dcb39796bc4b292c
SHA512 5b94c1aad9e88b8295d2ccfcda5cbcbcc33b558637325314fa2761c238376d181ae83399508829152007f05be11843109d91ee162230d3afc3da4ea87d57dc4e
SSDEEP 192:UVQHIIImbWMIMQRYcYqfyOOFAs0l8B8ssvmSId18:0QHIIImbWMIMyBLO2semsF
TLSH
T19142836A27061B73D49E5B76137396449BD848820072226D32532C1F8EFBFDBC2D52F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 319B
SHA256 19cb4190f22a1fdc1507c76f40b458880d71b2ed415d6971a895fc331ca165b7
MD5 2eec884dfe4e589c06074aa2c4504e0e
SHA1 c0525a4d960709664848bf4849553c72b23b110d
SHA512 efae800a10113761fb9149dea23f11a33184cc150e4e3681245792300c0c280273fbfc7d0693d82390d462408d06ebcb8390a7fd3a61bbae2c0f130f4e8bf88d
TLSH
T17DE02610ECCEC1AEE455208B11E49708C2E0380BEE88EBC61F01C444AA07501F38A6D1
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 045c824f7f1369764f8ee5f5dde0f508b9837e25cf91efc72f490fe6725be1a1
MD5 7d5887451a40065b3c3dfcb82f4916e2
SHA1 2777bc60f636dbafdbab8a58480ae906815487c0
SHA512 9473c6248f518bc41d50b265ac027869008d783879bbda12ff6c70a15a1c39f9dd100b062156ef143fb883575a3f13699b3aba9b6ca4f0ad81891b2d6e0814a4
TLSH
T16F21D655F330C109E15D827DA47E9B391738D8528FB8ED0F84BA20346E72B040E4B6E9
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 337B
SHA256 6c45acb8c7c6b9fac4ea3fa7c66dc4fd2dbea6f2aa79435c850ae3867b53cb84
MD5 42672255a28bfdd815e5ce8ddab5dcb6
SHA1 730a3d1fe14537de508dd77238db00c4edec51e8
SHA512 05baf51fc7c3300033902c1e35d0aa2fd45e5b615b391fb793aca9af19304ba518dc7932132537a00a42db9fbd2900dc771dc746a9ca6e74cc7b8d88fb83f717
TLSH
T1A2E02610ECCEC1EF905120870165A748C2E13803EE88EF821F00CC44AE07642F3AE691
MD5 SHA1 SHA512 TLSH

Submit Download

e5ce2eef-d824-4e82-9dea-b52966455b22.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\e5ce2eef-d824-4e82-9dea-b52966455b22.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 2155e3b49638b9a9b2856c52d0234f6b32c5c6ca43d448cf17f919f6c8b0bca5
MD5 f814d9b5df5a8c0d4c11ef667d661763
SHA1 fc6e9f6d49dc7f6485d3cf692dc87a77f6a33a51
SHA512 4017674ffa5016cde03f983e98d8efb3bfd44b23f7c4f7ba5e9fd2f9b411115ad03ecd365e709d920558f57bb3b74a81f6cdad1d3bc3f22a87a192c467213c26
SSDEEP 3:MsEllllkEthXllkl2zEflUrhRa/:/M/xT02z5rH
TLSH
T152440404FFC0140DC54110304151C7D01370D4100731574374D144335CC7D400F1C000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 96bd5827da2ae4db926891387a651ba436acdcd160659b2412ea2cf6979de004
MD5 41fec80ac86f2edb51360af50079589d
SHA1 5c26344d817200625fec217a0620ceaef659a64d
SHA512 0d13b10c4e8acfadc21f8585fd82ecaf4f9c807a7627b3e82b2c56b54d5e42d6cc20ad40331ece5a6d058def59a10ba83c279c8925089c84be2ea4b5d89dcac5
SSDEEP 3:MsEllllkEthXllkl2zEfl+3M/:/M/xT02zp
TLSH
T14A4404457FC0041DCD0010304051C3501370D4140557775334D554335DCFD400D40010
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser
Size 120B
SHA256 9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4
MD5 a397e5983d4a1619e36143b4d804b870
SHA1 aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4
SHA512 4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816
TLSH
T1E0B012203BF9062CF3F74D00AA73AA3428BFF4080A14811D505102080C33E19C478FA3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 61KB
SHA256 3fe1ccea44148c467280e0140c4659224f6f4a6b4ec10003e18b441402330d80
MD5 87c6cc2814fd8fa2f335b1e4c1186a7f
SHA1 fbbd6e41f00f82b7584380304fb28e527313da55
SHA512 23ac1db204d311c19be2cc7427cb5a9be20030944c153136febf0caaba093b68c1f8c866d24207b086ca4b1e06cf9888690aa14d2fecef02321a1eda50527d34
SSDEEP 768:PFX8Awg16cNOblvk0kggiwZjwXpGFa/jd99R7OCAENcT0lBd5bb4jGsntu:V8bvaiwZkXpdjd1qENo0r3M6gU
TLSH
T12A5317F99CD2987AC4AEAB4B577D2D1699BCC073F0A84594F3C41B0DCC620AFE706815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 6a4311492cd535146723868a2e078c03d5a33af22371e29da2cb4a105a6bdaef
MD5 cba22f3f6be7d461d225fc38a9630369
SHA1 315261dca4cf20ce19f9ee61fc9397eb8936fbb4
SHA512 1aca6c51467355b6912dd53701b88d80234542afa0b6faa1d4a7360162447a07903fa2a7c7252d7874bf97e35098956299225beaaaf21c4decf8131f3282a1b6
SSDEEP 384:nXZcI18N4lTgsPD00lbKzKzfY16YSO5QPlLJQXmIkdP9IimIMWEfMbc+V5vnD9TZ:f1ZnWm089NHXmTWTbc+VtD9TXIntu
TLSH
T1DC03BEB8DCA58A3F9CFEB784620E76166DA84133D1E81598C7EC270D817759CE70782B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 428bc8aeed14809cc04284a109b7ac875eee6ac8e90a8089ebc5d99ca7f39cfc
MD5 ab050a6c2f0569b6388b7a2a4321d8fb
SHA1 e5b16a44b84c3c68abb2de7513e57343e45c9f6d
SHA512 7e251b836a01ddfaaaf919f0638c2386782b0ca6bfcaa6e541e4bca0e06de0d0c87c0d1e7758947fd33a51f5076e7cce44c9b34d65c7f8fa4f9bf6b7af72f2c8
SSDEEP 384:kZcIr38NgQ2sq6OobbKzRfY9bYSObwlYQPlLJQXmIkdP9IimIMWEfMbc+HKTJydu:Cr3iH5WiJmWzNHXmTWTbc+HUKb2mtnR8
TLSH
T1DF13AEBC9CA58D3F58EEBB48214E6A256DA80133D5F81598E7D9270DD13744CFB0782A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 67KB
SHA256 22a82249cde9375984ffed2ef08954d4f22f3a974b4d8a1300553aba234630ec
MD5 21c7d211d68e48006d5498790edf40d2
SHA1 24cdc4e7e226b1817ee3385183d27be3ffca61dd
SHA512 ab78f9ac666631bcf3ea7a45498fbd0ff277c88bb283ef7972d20eecdf7f27c781f38f05137dc60ac92bf8dd9b44b06bee2b1d44fe41791782dc1b3522819157
SSDEEP 768:SF417wg92HGNHXmTWTbc+GK8POh/NRHrnTlcrdiXO5SVF30VUvgM8rodOvtD9TXr:X1DeWn1wPyrTlBv31vgMjdOllXiU
TLSH
T100638BF59CD3953AE8AD6787533E6D0269BCC163B1A81484FBD81E0CDC665BFC302816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 914ed0c4ae99c9915c5f9549973d6b73e86246c4eed1a2c9d39d0ea41ae12949
MD5 2a01ffeaacbf412fadf39233f02e159c
SHA1 8274e763ea0d722f4ef26dcc0e495421de03990c
SHA512 b33c546ab3c2962650c61dcc3d1eb59b5b87693190791a4e962b966e614cb55eb285a40c6ac6881277956f144dcd59296c412f0fc3707154fc222987135ef5b5
SSDEEP 768:krv+4UNbdj3iHSWiJmWcNHXmTWTbc+HUtn5X:kbsbF3cpWUeWn10B5X
TLSH
T16513D0B09CB9DE37ADF2D688740B76477FB801B385C41698D9DD2B8D019B49D1B0B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 7e2468787aae852e5058e2d76f450725f71c7a142df30b56e65bce001b0cd718
MD5 0770b82cf752d46059dec2b164216bea
SHA1 ff5e4e3525121a02b4febef7fb3a02d08d17ff5a
SHA512 58365f24be21c4e4a60b00702d3fc5499487009b6c5aeb3fa42db72743d4d30ba505d90d938fe3d775c3b92fb893bb331f51c037542bc04175f366c054a3d203
SSDEEP 384:nJZcIr38NSl2sq6OotbKzRfY9bYSObwl1QPlLJQXmIkdP9IimIMWEfMbc+0ubI5R:Br3xHbWiJmWSNHXmTWTbc+0ubtntu
TLSH
T155F2BFB09CB59E77ADF6DE88650B7B16AFE8017382C82588CAED6B0D018715C070782B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 6efdce52670e5040bc180bee630ab8d8d8b6cfe28b9e3d0cb07ddd302c20e8e5
MD5 58af0a47dedacfd8497861bfaa171cac
SHA1 c5d932627a11400471f23f55d785f4d32f1626ca
SHA512 d6a5ea40dc9a83f78b61cb275a1500c090db9dcc7155e01e8c230e61b78f35c6ce731543a9f70831d0ff4cce20d718ce018c20ac2e709f2a01f90f035da93a85
SSDEEP 768:JFV6iwggf51Rblvk0kggiw4phrXL53cN9TD1ntu:d6Xvaiw4hTL5MbDpU
TLSH
T1B61317F498D3897AD8AEA787533D2E1699FCC163B1985598F7C81E0CCC660BFE306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 3abe25f7d637888bf18564248d035dec8754c76672c1a4880370dec92b9ae0e3
MD5 17a812138555ea691ef582fa3906bbd9
SHA1 48b899d1ffd2b2f9ac4e919c345289b1412b3bbd
SHA512 61d32866e92be19fe8f26e3483083c19980036cd4aa47e63af703142fdbfbf2f5276695f9aab3deb07df2f1f7e8634a0912e52935055cc0e8d631a4085c3fbc0
SSDEEP 384:noZcIr38NSQ2sq6OotbKzRfY9bYSObwl1QPlLJQXmIkdP9IimIMWEfMbc+0ubI5R:Wr38HbWiJmWSNHXmTWTbc+0ubtntu
TLSH
T1D4F2BFB09CB59E77ADF6DE88650B7B06AFE8017392D825C8CAED6B0D018755D070782B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 48KB
SHA256 80519c3c488da5b37c26c9954b1792d58eb0a2382dca42b7aaf28749a98a703d
MD5 cefe374bf728c169b213ffc7639a30b8
SHA1 5d9513485428e4aeb90c2c90e6b6816c7094e577
SHA512 014a2bd098bfa3bb4f16077852ee7cb3640628609dd12646406fff33720401b0878f71d77e977f5594b982442a8a60f669c17dd2253c132b45f75909fe5ac1a6
SSDEEP 768:oFk0lwg4h51Sblvk0kggiw4phrXL5bF7bb4jGrntu:R05vaiw4hTL5pXM6rU
TLSH
T1E623A1F88CD3997AD89EA747536D2E1599BCC173F1A88598F7840B0CCC624BFE706815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 53KB
SHA256 7c86fad5481807acc717ad97e5f9d9ec7a155fa79db8e306c2da15a23c21dbd0
MD5 bbd30c7f9abbeb255ece54384e2e242f
SHA1 b739ed8598fb29a1831134a7a447c92531c848f9
SHA512 788324141eb7c80c9de86c7a62b986299d7e3891f3b85c1ad834ef7bffb5108fac35629ef4de56fd2d21a67d7a6c94229a9051d06b34107774b80f4b2bf6094c
SSDEEP 768:PFH8pwg1FcVOblvk0kggiwZjwXpGFa/jd99R7OCAENcT0lkontu:B8/vaiwZkXpdjd1qENo0qcU
TLSH
T19D3348F598D39976E8AE8B87A73E2E069EFCC097B1881594B7D41C0DCD820BFD706815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 1b0b341fba2ecd1ae7fb57b10fcadbad0353a24aefb84892b7576b50d0d7fc9e
MD5 a8efa534a330e6ee7ea1a7c46433e0c3
SHA1 ee644c0612c71862cfb0aff955191b1301605204
SHA512 354eb5c07d46ce6d14b9a113871b66a7c9819a5bc35950994b01b31c88c954f2f15b344ca912d5844e0d894486bd5162d4ffa9cda9514783ccfb266ee3a6c152
SSDEEP 768:oFHaywg4Pc6rblvk0kggiw4phrXL5bvp9T/nntu:Iahvaiw4hTL5Df/nU
TLSH
T1EA13F6F898D3893AD8AEA787533D2E1699BCC163F1985594F7D81E0CCC660BFE306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 a72b29e2f711e15fc7e08bd15115f445567ced5d99e264de71efedd0e3e3d3fd
MD5 3bfcbe57b3fc141cf25c1f859946c8b0
SHA1 b952afd406c082b62ad4b7c7b17c7e73c8235d37
SHA512 ba1f05e99922f46e4da0652df7762fc3a2f8b317666b0c02a7245fba7ccc63537ce8290646444d304e4d5d8e93edf52800e1991b541427a47c0b75cb94145ced
SSDEEP 768:c1LHmWiJmWPNHXmTWTbc+06T2bb4jG/tntu:c1rpWZeWn1BoM6/BU
TLSH
T1B5139EBC9CA59D3F4DEEB748264E66256DA80133C5F80598E7D9570DE13344CFB0782A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 d9b78f27040e85b6bcfa5bacbb6e17139a2de3a3c916ef3b03ccda30fc5fe4c0
MD5 c6bea5cbe11189e11075715ba0c0dfb2
SHA1 8b7afc2c6a578402ead1554cf70e65d523d56914
SHA512 673a60efde42fbbb69b85310c9775147d66b55e3d27dcc9f4c63514f4a2f4a8a1ff07474105ff2df020b1e57e1149969184383dda9a0f8fd9189828d45c0c7ff
SSDEEP 768:arv+4UNbdM3hk0iJkNHXmTWTbc+/4ueVH1SvyZ:absb+3BTeWn1wuEH1dZ
TLSH
T11503CF719CA98F37ADF69688754BBA473EB8117389C40A88C8D96F4D428748D070BD3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 3cc85439153a4cd39125e4c5be0d641c0166fff05844cc5fd75404b60af0392b
MD5 88dbe1c013823ad4ca1c68a5ea8b98fe
SHA1 922e36f5cc47e4606c2887610aacbfd00de75af4
SHA512 0ec9a34b16cabf9bf10f9a28593c5a0ee584f2ce604c65a82e8196cb9b713567af2f75dd4db1545a936f29bea742f9ab388435efd5c114c21519f4cf6d5c09f7
SSDEEP 768:oFXaywg1gcaYe3Eyblvk0kggiwKBK9T/nntu:aatvaiw0q/nU
TLSH
T14203F6F998D3893AD8AEA783633E6D1699BCC163F1945594F7D81E0CCC620BFE306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 89KB
SHA256 d9cc2a2b010c8822c29efa68aac5a2e591ac64b143c6cdc5d2e91de9a1f69f9b
MD5 065a7a2cc35a837ca4f31de5fd2e0d28
SHA1 703fce5b194410e75d4d9f6de72a5424da430bfe
SHA512 e6d8202db7de4d72edc6f724c2bc8b44bcaf4cc2199f7d3a735060a2dbefcb0328e680e665d513363d43b83bf5431e589f7d83e7e1db314c5a9be81484ec7811
SSDEEP 1536:oQEvaiw4hTL5dkfWfZX49yaU+KWu1xo0/EM6FU:oQ5iN19eyaUU0/E/e
TLSH
T12E937BF898E3593AD89EA747537D1D1A99BCC233F5A88584F7C90A0DCD624BFE306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 be7d702ed8555d5459608b70c5720c28d7400c0658c40a6c3c6a3ef0471b3c58
MD5 a735fee8d699fbe9b10c3c8fbae1a1f7
SHA1 6c3288c62c10987fedcb6ed93aaa99b21c0f734c
SHA512 e4625108115101d827e6ebbe0a6e1f6a8b13eb5f6b972c8e1bae5de3ab187a0c3b445c53db823e0d755c97ec0298fd26f713af9ce1fb013bf8940633bf3d2bab
SSDEEP 384:nXiFPZcI18Nz8TUNTUlIllTgsPD0nBbPlfpcpb75vkx2kpKg1Vywb59TL9TXf5UE:SFH1Qwg9gPcpblvk0kggiwbjn9TXSntu
TLSH
T18403C4F998D3893AD8AEA783633D2D1599BCC163F1A85594F7D81E0CCC620BFE306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 25208af76460b47fc5f1416574210b75390173d2863435babef1c79ff2234152
MD5 2bae6fa7100962223afe0fce4e56e82f
SHA1 d3d3ef6a866fe3e41a2978b4a3993e2b13d3d231
SHA512 ec8a81fd49024d03bd2813819c182eeb25e9b2ec984ec5aa65ebfd78367bc4e287e439ce8b337187166580548dcdc9bad4f7aaf4c3b0416ee7c60f71e526e010
SSDEEP 768:SF31QwgO+cScfblvk0kggiwbH+bb4jGwntu:I11RvaiwLMM6EU
TLSH
T1FB13B1F998D3887AD8AEA787537D2E1699BCC173F1A84594F7C40A0CDC620BFE706815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 f7af24f95e1ea86390ef1ff808835e874885c28e94aeaade99d918a336896898
MD5 acf6423a67f0f4d8809ca580fcf95e10
SHA1 e2f57b6c45b214301cb771bf2722d547ce7e9516
SHA512 9ab8409cd2042f891c61be7bae019d6e6ca1dcd893f0a11bd2592323097c40eafecaeab1216695d990da669708092c6464e253f4539150a805cb173d114e68fc
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 e12b5069f876787257ee815d300013a17cb8bb685f9802a51285be86f4bab9bd
MD5 24bc77f9e565fd93ab4ac92393a1ef79
SHA1 4535d68578a591badbae4aeb3301e0f2fef32802
SHA512 dca2aefa7d9ee3e407b36cf320f1f0e4bd6bcd22f67b43e8184bde260fad50b9a78a24b5261867cb552ef07784c9c23257fd78b553cbda27261f88f60f0e6c76
TLSH
T159E00147A30000D9C07C0330209B1E345ED3802109B1039A4E20524C9C633143F60ED0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 61ab0655a3f1c7989084e956d1f31ade506a2cc330d994365132c886d4b42df6
MD5 7b9dddf19fa4896ffcba439871de6150
SHA1 e270ba1e376c41ce4b0e0fb1506531881bcc31b4
SHA512 6a29dd8fae8d1ed12855707e85bf00d131365b53856fb3f545ebcf2065811ded6745ec986bdf5722c3bfcecaf3af0f99573dcb9e3d056181affb0ce544b94382
TLSH
T14AE0094BA70001AEC07C0330209B1F342ED3803249F1029A4F30524CAD673147F60FD0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 c008e0903f8dedb27f9a8c7b147a0a5f78662d0ab3782be55406dc2eb841a94e
MD5 0d4402bd8b5843d1b1f42cb927b1ba19
SHA1 38228c442fd0527fea13944ae425c6b117c91c6f
SHA512 a5f523ba152418db08286d7327945709c2000d4c5659296daf5ce1afa3acb50bff4367241e2d1321ac6170399fabeefd033d9f04ce9cd28cb0a38820262e7dd5
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 a4c0d9c3853e8b6d0652b99b7d8e9f3e78d31a02263ff9eb0bf31c476121c25d
MD5 5f50da41d46c093d21171ad244da478b
SHA1 582e639927f32671a59967175f787c1b099eae82
SHA512 ca9c8cf475f9579621bebc0a75a3e3883725938c5ee59b315437e750be1e38674d1e639d925776ca0cddf0d413fbd9922f2f118eb660e2e909f8e0e24da1dfee
TLSH
T12FE0094BA30000D9C07C0330209B1F345ED3802149B1029A4F30524CAC673147F60ED0
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 889aed2dc507a07518f83eedd883c422417567a00d6ef02bf9c2a9e41a7e0bbf
MD5 c355cba6733235d8bc67278a664fd5be
SHA1 c28bdad4c20c6edf6f1fd98b9a3f229cfe58240c
SHA512 5a1f7e2aec7854636e45ad806b97cd29bee04d3c134de86ff7b2fada9f6fb51b51efe61e0662b1dc563940f2fd2b3a58c8e0995e400a878fd3ddf6e493c460a5
SSDEEP 3:MsEllllkEthXllkl2zEflPK:/M/xT02ze
TLSH
T17744041C7FC1040DC50010304051C3501374D4100511F75334D1C533DCC7D400F04040
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 85B
SHA256 b26da4f8c7e283aa74386da0229d66af14a37986b8ca828e054fc932f68dd557
MD5 bc6142469cd7dadf107be9ad87ea4753
SHA1 72a9aa05003fab742b0e4dc4c5d9eda6b9f7565c
SHA512 47d1a67a16f5dc6d50556c5296e65918f0a2fcad0e8cee5795b100fe8cd89eaf5e1fd67691e8a57af3677883a5d8f104723b1901d11845b286474c8ac56f6182
TLSH
T1F2A0120384738407E4144051C45C1341287C84570119C0012068931304240CB039643A
MD5 SHA1 SHA512 TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 fc4e8154ab1ac82bfff9cab8bd31ef7fb638b18ff1ca437b2eabd1bf638eae5e
MD5 7cce520fd7518180a8c2ab5064f32c74
SHA1 9b4e4fd0c7c80e89ebaa47c2f2dcf8bcf5e86bb1
SHA512 624e2459bde8653e7aa441c3429fc0f462248cbc0cab6badd7a86a49e59bcbee5d8ad8e75879f4ed37474f769acafe87f6184822e3b05faa5191fd6823075223
TLSH
T10A3141E04C3C0EC4C5FD0EAFB48B39FC85D89722F59530382CA8E928567961E354482F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 852B
SHA256 515443f0f141608a52a6e3882676f62a664c3ca29404afcc74b7adc7dfa29b3e
MD5 efd9e57e68a2ad57a9b11ab540d51471
SHA1 bda8485174d1ae42f4f82c8db46ac49a4b550e2f
SHA512 ad453dbc360ca435338f858b12bfc8129dee9c389d99b132be2639b5a533fa6d06187ae1fcbe9052e4dfdefcaf548061470cd7fe51680d2ebe6d08cfb46f8ffe
TLSH
T1B20112905C7E1AC5D6BE0FAFA08726ED00C8A622F098347818CDE968557901D3511C6E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 6876b473774f2c313102ff50a0516cfd5816b45e46bc9d3e50864f02df7e6ea1
MD5 3de1f2bae90957a24bf1ff0276379516
SHA1 080ef961d01f1d68c38d41c6a52ebf004374ff1e
SHA512 40b54762dc5002c450ec3515739d78c50c45ff6164e0399c69d97f3ba791b645784c506e5ac4383b809e3d36c490835719bdf3c038a6d726f9faf8fd76fd7a79
TLSH
T12C214490587D0EC1C6BE0E9FF48729FC40EC9721F498303828DCE868557921D3550C6F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 26fe8b3a7ca9b3b027a3913190a8cd38a7ce4ce7f943f0a5e911379cf927a932
MD5 930ddcc66b403c380ee16211425dc0c5
SHA1 0e25123e86a5d46341b8ffbea0365c78878b8531
SHA512 5177ef2c51ceb67d7113504c28d8f0822578fd05ee21f1c38279387f6ad739c70a44deca91a9006323ffe3aaf774f4873e4bc2a4c53a5d48d58314ebc73ea562
TLSH
T149312FE05C3D0EC1C9BE0EAFB49B39FC84ECD722F59430382898E958563961E354086F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 a433042ef1bdf8df395914e801b1c8b1f3106e770851c1a78490451ed2543ab3
MD5 36bbbc6da51af1d1837615fac6b65def
SHA1 935a3c799d75e77f1c00c5c6fde23e9f6a34d9a9
SHA512 93062d01ae5f2fe8eddee8f781b7e50219884c2bc2d67141af2c7b685ede1f0904e71ad48fd910643b56f31340538ca09ff91d5d682b2b2947f81c9938149397
TLSH
T17C3121E04C7C1AC1C5FD0EAFB49B39FC85D89722F594303828A8EA18567960E354482F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 e18479fc58076412369373d407ef80d5ae2cbaab56d85910f597669fd2811f7e
MD5 6d0f33ce242f67a94d2e4107cef680b5
SHA1 67854178c65088b10e773b15155e13fae1b184cb
SHA512 a5916bc05cb67ef28d2090d7ca4affbbe14ecbf0510f09b4aac5ec2f6cee2f0c10ddd13947a162199cf658fc160b736b463a457cb4ed348e0d766aa15892c3aa
TLSH
T11C411EE0487C1AC1D5FD0EAFB49B38FC81E8D732F564303828A9EA585A7960E354082F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 55447136a6ddbbab4bf7782d7e5358d5eacff4fed2b2f91c9910df314e3cf37e
MD5 d32f9c95a83be1d7f7c44a0211c58583
SHA1 11402c90274446767c17b772d8f1a146908ba778
SHA512 c94088bdf638ad5415bffbc3706b94a7d961be19518711f1d302adcdc91321bca5ce36fec64052f5530301684982326f080ef7a713767e5e8c0ad30bc3b713e4
TLSH
T1DD410EE04C7D5AC1D5BD0E6EB89B38FC81E89726F46434382898EA58567960E354482F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 732B
SHA256 b2f109735e4b1d65f2a46dcd2c9023b30afba01f00db2bf270fb576373ba481d
MD5 9acde2044c0350a6d1714520a83f994e
SHA1 3a35baa9806b94405ab6e9c5cd9ac6a50424f35c
SHA512 a9d73fbfdf39601d15b35a70d1d93d411f8d15b29849f0c539f094a09fb1fddcc4c8b1373068f8ed071fa73b8b20d40144e13e627c246b31310711967ea8b74e
TLSH
T1E201C091587D5AC5CABD0FAFE08726EC04D86526B09934B818CDE468A57941E3451C6E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 a5706b3bc43ca9ea3fb93b38a7913645426dc8279222b860bc17ba09c6a3b34c
MD5 b385697dae4fac85fe52d39763a3b06c
SHA1 e9a8967210dc74dd4fdef26aecaa36f094f803aa
SHA512 7038a9d0c4a9f55735d361aca7ce9812541cb3cacc7c5817835c0f0284d5ae27cc47b59de41d8ef47c8e0138d3c4540e1b8a304df8b4b01be598cdcde6a1eea3
TLSH
T16721F0E0587D0EC1C5BE0EAFB45729FC80ECD622F59834382899E958567951E354086F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 18b119e0d6c47cd986a87ca355c329e66cbcf0e309d48f51bdd2466ed492d442
MD5 a5c914d9f5f3aa20d69855257a2cf9b7
SHA1 d42a9b1c01b5bc69b22edecafd03985498af9605
SHA512 06ffda9c1ee6fa27528f62e1089cbbd44af1c044815f466720fdaea5059ec4a41db2f49e760a703ce30177eeb769e05003b9c56581b70bf37c9b7f7b339beda8
TLSH
T1D93110E05C7C0EC5C9FE0EAFB48B39FC85D89722F5A430382899E968567965E354086F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 5fe53db792bfe8d4ceeff30591e634478826fc137134a16787cb9e0e52a2b483
MD5 347dd6a5cf7c4397e7f0e6eb7f6a8776
SHA1 8bb9fd76c5fe39446cc09eab1d869b87068c1273
SHA512 815f606bd2d2ea7038f58062866f070c4f88cbdfa46d8aac78ca65e0e423ca05d366e1a0d37f2faaffa4ed017cbc7e50295dc57662d870d85087fb76aaead000
TLSH
T19A413FE04C7C5AC1D5BD0E6EB49B38FC81ECD722F564347C28A8DA585A7A64E354483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 972B
SHA256 bbc38f16adafad460c7b17c4c819cdf2368ab70baf645e3615f510da09bd1e39
MD5 4be4ad6828b3a89b777098014b692d0b
SHA1 338f83c0039a3f8e0fd5accad50b7adf1cb8c40e
SHA512 fb747905dce856a37c4d4763a891fc339e0b4fa698a123514ded0a6695bee5670697633f4388dd696e143b545f4289480d70c1dd576e2f82f02528682740ed9a
TLSH
T115111091187E0EC5C6BE0FAFE4833AFD40D8A622F498307818C8E928563951E3511CAF
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

0c11a6c8-35b8-4f0a-b924-256ec31fd51b.tmp

Path C:\Users\Admin\AppData\Local\Temp\0c11a6c8-35b8-4f0a-b924-256ec31fd51b.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

cv_debug.log

Path C:\Users\Admin\AppData\Local\Temp\cv_debug.log
Size 1KB
SHA256 6e04c0f363712977ec89ce13b6f5289d1c3e969333bbdd98b657b4af4e13a88b
MD5 e1022848bb64265dcf1ff240e4b93651
SHA1 639f2a15c3688549e9846326f009b43ec1de7a8d
SHA512 6bf58f181f94470d0d5f0d60b33fddf0fbbcd2c41c00abe4494cd3e9e8bbd1049607f6e8378e14751471ec3eb3216f10bb8b2604e5c0497d2af0315948071ea5
TLSH
T19E2148E13936737F53D787D490224CC96960F986036B666CDA1B5470FE1CDA0635E3C6
MD5 SHA1 SHA512 TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6116_1645509436\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.dat

Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
Size 413B
SHA256 dd075aae5019b794d46383563441c57b05b2faab1807e05e7160a78e11763b9e
MD5 9446bd2224818c9bbb03be3c34ed6b30
SHA1 9aa4ba5460e2fedcd4ea101521c177598b7ceb88
SHA512 ee8328e097e5b43c4b0ef67068586035e70dbf48f92c5cdfd012717a4678bd1e7b7d5c8695f1a1e4375ebb6c17769f56fbba972e318e720ba140958f0d11005f
TLSH
T138E0E56BB765E7F2EBFCC0EA38768CE19BF20C8CE669512218EC1CCA0C545039097408
MD5 SHA1 SHA512 TLSH

Submit Download

b8ab77100df80ab2.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
Size 3KB
SHA256 44658c94f61cbda58ea473d52e0d7af8666acc9a21e4a673c3c80ebef875aa67
MD5 629d20b2a986ef2fd17fd621c57c4900
SHA1 71787fed8b39b27960a3ffd29e77f3c31283c235
SHA512 fd5e46050b43c4cdc6b1c04d02073b3768d3e70b5e9daa26c4d3a190b0ea5d4495e6154d57845025ddbc39549153ebbb3681d6f868651f2a256acd0bf5d27c2d
TLSH
T1B751FE024E9B0F6BD1714273253EABA6FB30FC4A53589A0DA6C4953F2D34480C95DA3B
MD5 SHA1 SHA512 TLSH

Submit Download

tr&sh.xlsx

Path C:\Users\Admin\Desktop\tr&sh.xlsx
Size 8KB
SHA256 ba41f565c5c446c92891eada6b6576c8d42eb3d505e4f414883dee06ab6839ef
MD5 6b5c6e8e8eedf7acea6035da89b63b2c
SHA1 cd071eeb8e710e32e8b305ccedcd8c54d396478f
SHA512 08168ab71ebec283811fd8f0ff79f020a7acf0a38138dc35c4d2cb09615ce4cf5217d0a0ebb1e1106839aa56aa9e27065e66ff11969ae7047514a33a02f8d364
SSDEEP 192:wc8mV52TsZfb3UVDdEaaFUlbVvevUqzd9uMSeLaoF:wc3X283wyLUlM9zdygaoF
TLSH
T199026B5EF4659929C372843E805E42E0BB4D91425B867A4A7820F86F168128B67DF2EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CalibratedDisplayProfile-0-Temp.icc

Path C:\Windows\System32\spool\drivers\color\CalibratedDisplayProfile-0-Temp.icc
Size 9KB
SHA256 926721666e99ce022d070dfe9df5edd64b8ea89e73ff152d7baa1eb8c6f625b5
MD5 caf96c67f869f633b6d7e543d669d5a0
SHA1 4dfe74ac5a93c717f24cc7d9b4faf385a2525c51
SHA512 ccc72b2a4dbb39113018a037d38e34ed7b33e8598fdbf2177bc4cc42390e2ea3f35d47c3ad32f3723c04052d271551832e41dd1d43a858fdc325e985a8cf115d
SSDEEP 96:kmlnQD2OffOffOfJ82plCx7umVnVWlfrLhm+/ODbjmICpMV26rV9VyniDVVFX/CI:kSnlV0pm3l7fy0PZ
TLSH
T171225B0357FE1214F5F3AB3A6AF624619F76BC215D28C8AD10B1190DC8E2E52AD11FB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Staging

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4280_150277515\Mu\Staging
Size 36B
SHA256 411a706def2e70f96a507208bf80bceb93e950c4c2d671cd1ddb4134ce54b2a9
MD5 0163de1b14421d4eee3757ff76fd81e4
SHA1 96c75c4fe1e3f33a367f45293bd1bd8bff1c06f4
SHA512 80114d59db8f3654dd6821589e5ad03daa923a35610a372756a8865b3e769621e32ef2aed92c2494de2b9fc06d9796b12f1e3bb75873ed794e8c9ae8a0d5e965
MD5 SHA1 SHA512

Submit Download

LICENSE

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5536_695333853\LICENSE
Size 1KB
SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
MD5 ee002cb9e51bb8dfa89640a406a1090a
SHA1 49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2
SHA512 d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c
TLSH
T17D31535723840B9306DA2B4566AEBDC4B0DDC02D7F27AE05186EF394537B52ED8B3443
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4868-4286-0x00007FFF074C0000-0x00007FFF074D0000-memory.dmp

Download

memory/4868-4288-0x00007FFF04D40000-0x00007FFF04D50000-memory.dmp

Download

memory/4868-4287-0x00007FFF04D40000-0x00007FFF04D50000-memory.dmp

Download

memory/4868-4282-0x00007FFF074C0000-0x00007FFF074D0000-memory.dmp

Download

memory/4868-4405-0x00007FFF074C0000-0x00007FFF074D0000-memory.dmp

Download

memory/4868-4283-0x00007FFF074C0000-0x00007FFF074D0000-memory.dmp

Download

memory/4868-4402-0x00007FFF074C0000-0x00007FFF074D0000-memory.dmp

Download

memory/4868-4285-0x00007FFF074C0000-0x00007FFF074D0000-memory.dmp

Download

memory/4868-4404-0x00007FFF074C0000-0x00007FFF074D0000-memory.dmp

Download

memory/4868-4284-0x00007FFF074C0000-0x00007FFF074D0000-memory.dmp

Download

memory/4868-4403-0x00007FFF074C0000-0x00007FFF074D0000-memory.dmp

Download

memory/6568-4420-0x00007FFF04D40000-0x00007FFF04D50000-memory.dmp

Download

memory/6568-4419-0x00007FFF04D40000-0x00007FFF04D50000-memory.dmp

Download