Overview

overview

7

Static

static

1

URLScan

urlscan

1

https://drive.google...

windows11-ltsc_2024-x64

7

Analysis

  • user interaction
    yes
  • max time kernel
    1799s
  • max time network
    1769s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    11/08/2026, 02:09

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    https://drive.google.com/file/d/1Ar1-rplZICCH6B6jYwN1TLReec5nziOL/view
  • Sample260811-clltkatbja
Score
7/10
discoverypersistenceransomware

Malware Config

Signatures

  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 14 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 51 IoCs
  • Drops file in Windows directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 2 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 11 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Modifies data under HKEY_USERS 12 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 6 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 36 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://drive.google.com/file/d/1Ar1-rplZICCH6B6jYwN1TLReec5nziOL/view
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2984
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2cc,0x7ffa0023c188,0x7ffa0023c194,0x7ffa0023c1a0
      2⤵
        PID:3812
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1696,i,1864257113439051890,8082271301757136284,262144 --field-trial-handle=2288,i,9508042685946385986,5497310063737585018,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:2
        2⤵
          PID:2364
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1896,i,13206126090014667013,3486432394243746975,524288 --field-trial-handle=2288,i,9508042685946385986,5497310063737585018,262144 --variations-seed-version --mojo-platform-channel-handle=3008 /prefetch:11
          2⤵
          • System Time Discovery
          PID:3476
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2376,i,13701350175256503304,2398179220285501799,524288 --field-trial-handle=2288,i,9508042685946385986,5497310063737585018,262144 --variations-seed-version --mojo-platform-channel-handle=3020 /prefetch:13
          2⤵
            PID:5008
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3592,i,12471567529344072430,7320098661956323054,2097152 --field-trial-handle=2288,i,9508042685946385986,5497310063737585018,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
            2⤵
              PID:4112
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3596,i,7120519180460345747,6980050470003003270,2097152 --field-trial-handle=2288,i,9508042685946385986,5497310063737585018,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
              2⤵
                PID:1160
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4300,i,4504422821601325161,6770587793809623881,2097152 --field-trial-handle=2288,i,9508042685946385986,5497310063737585018,262144 --variations-seed-version --mojo-platform-channel-handle=4792 /prefetch:1
                2⤵
                  PID:2880
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4352,i,16575393534201558883,3097370955576266865,2097152 --field-trial-handle=2288,i,9508042685946385986,5497310063737585018,262144 --variations-seed-version --mojo-platform-channel-handle=4952 /prefetch:9
                  2⤵
                    PID:3968
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3784,i,10435783395080660596,14311060226790786829,524288 --field-trial-handle=2288,i,9508042685946385986,5497310063737585018,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:14
                    2⤵
                      PID:5596
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3736,i,8886310441986061248,13765480804877743952,524288 --field-trial-handle=2288,i,9508042685946385986,5497310063737585018,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:14
                      2⤵
                        PID:5604
                      • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,32284299503634773,4876368951885371805,524288 --field-trial-handle=2288,i,9508042685946385986,5497310063737585018,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:14
                        2⤵
                          PID:2140
                        • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,32284299503634773,4876368951885371805,524288 --field-trial-handle=2288,i,9508042685946385986,5497310063737585018,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:14
                          2⤵
                            PID:2316
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6348,i,4190113731552877942,14338134774156304228,2097152 --field-trial-handle=2288,i,9508042685946385986,5497310063737585018,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:1
                            2⤵
                              PID:4000
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6816,i,16843560613046470402,10333890457595407521,2097152 --field-trial-handle=2288,i,9508042685946385986,5497310063737585018,262144 --variations-seed-version --mojo-platform-channel-handle=6868 /prefetch:1
                              2⤵
                                PID:4052
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6748,i,644241646640870329,15644748803612343068,524288 --field-trial-handle=2288,i,9508042685946385986,5497310063737585018,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:14
                                2⤵
                                  PID:5972
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6480,i,12632145000885898814,9033157592188138939,2097152 --field-trial-handle=2288,i,9508042685946385986,5497310063737585018,262144 --variations-seed-version --mojo-platform-channel-handle=6436 /prefetch:1
                                  2⤵
                                    PID:2504
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3628,i,14426571925976518807,1845274331296963866,524288 --field-trial-handle=2288,i,9508042685946385986,5497310063737585018,262144 --variations-seed-version --mojo-platform-channel-handle=808 /prefetch:14
                                    2⤵
                                      PID:5780
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5240,i,8575403152289392682,6702912336018897766,524288 --field-trial-handle=2288,i,9508042685946385986,5497310063737585018,262144 --variations-seed-version --mojo-platform-channel-handle=7436 /prefetch:14
                                      2⤵
                                        PID:1284
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3812,i,13505271184381407832,4761915112160633351,524288 --field-trial-handle=2288,i,9508042685946385986,5497310063737585018,262144 --variations-seed-version --mojo-platform-channel-handle=7476 /prefetch:14
                                        2⤵
                                          PID:3860
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=2940,i,17989339115092043355,13516570120913969677,2097152 --field-trial-handle=2288,i,9508042685946385986,5497310063737585018,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:1
                                          2⤵
                                            PID:5080
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6368,i,4147954493821527107,11993254243201852824,524288 --field-trial-handle=2288,i,9508042685946385986,5497310063737585018,262144 --variations-seed-version --mojo-platform-channel-handle=6740 /prefetch:14
                                            2⤵
                                              PID:4092
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5688,i,8386194362942826145,16983907984954551589,524288 --field-trial-handle=2288,i,9508042685946385986,5497310063737585018,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:14
                                              2⤵
                                                PID:1900
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7048,i,3835704583618877822,10575247310948019610,2097152 --field-trial-handle=2288,i,9508042685946385986,5497310063737585018,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:1
                                                2⤵
                                                  PID:2508
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7244,i,617267478995250303,12214033840878332057,524288 --field-trial-handle=2288,i,9508042685946385986,5497310063737585018,262144 --variations-seed-version --mojo-platform-channel-handle=7264 /prefetch:14
                                                  2⤵
                                                    PID:5700
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5548,i,16190772626776190274,6084145367886661474,262144 --field-trial-handle=2288,i,9508042685946385986,5497310063737585018,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:10
                                                    2⤵
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    PID:2080
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
                                                    2⤵
                                                    • Loads dropped DLL
                                                    • Drops file in Windows directory
                                                    • Enumerates system info in registry
                                                    • Modifies data under HKEY_USERS
                                                    • Modifies registry class
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:6016
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x264,0x268,0x26c,0x25c,0x2bc,0x7ffa0023c188,0x7ffa0023c194,0x7ffa0023c1a0
                                                      3⤵
                                                        PID:2788
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1604,i,5301236807224568007,5907680279594434679,262144 --field-trial-handle=2272,i,8727777241544924158,16660321241967089608,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:2
                                                        3⤵
                                                          PID:5132
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1852,i,7252421341341531323,5613914707627895660,524288 --field-trial-handle=2272,i,8727777241544924158,16660321241967089608,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:11
                                                          3⤵
                                                          • System Time Discovery
                                                          PID:3172
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2488,i,17965555234233511242,9258396589925571533,524288 --field-trial-handle=2272,i,8727777241544924158,16660321241967089608,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:13
                                                          3⤵
                                                            PID:4108
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4108,i,3334247858163534427,1984396677711457605,524288 --field-trial-handle=2272,i,8727777241544924158,16660321241967089608,262144 --variations-seed-version --mojo-platform-channel-handle=4172 /prefetch:14
                                                            3⤵
                                                              PID:5280
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4308,i,13119097319828892964,14670070804587410110,524288 --field-trial-handle=2272,i,8727777241544924158,16660321241967089608,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:14
                                                              3⤵
                                                                PID:5300
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4424,i,1817309915173009311,7448229103820759641,524288 --field-trial-handle=2272,i,8727777241544924158,16660321241967089608,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:14
                                                                3⤵
                                                                  PID:5784
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4424,i,1817309915173009311,7448229103820759641,524288 --field-trial-handle=2272,i,8727777241544924158,16660321241967089608,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:14
                                                                  3⤵
                                                                    PID:4272
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4788,i,15636829564639554940,5530381772476511816,524288 --field-trial-handle=2272,i,8727777241544924158,16660321241967089608,262144 --variations-seed-version --mojo-platform-channel-handle=4792 /prefetch:14
                                                                    3⤵
                                                                      PID:5392
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4912,i,7666905284951835131,7656164398857402071,524288 --field-trial-handle=2272,i,8727777241544924158,16660321241967089608,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:14
                                                                      3⤵
                                                                        PID:2716
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,4613274029253861698,12111830984576307378,524288 --field-trial-handle=2272,i,8727777241544924158,16660321241967089608,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:14
                                                                        3⤵
                                                                          PID:3384
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5212,i,11435066745207900275,1204857862192348621,524288 --field-trial-handle=2272,i,8727777241544924158,16660321241967089608,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:14
                                                                          3⤵
                                                                            PID:2364
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5356,i,15359742587091220003,18405591750235314500,524288 --field-trial-handle=2272,i,8727777241544924158,16660321241967089608,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:14
                                                                            3⤵
                                                                              PID:292
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=600,i,5408495907172406378,17160453179439207528,524288 --field-trial-handle=2272,i,8727777241544924158,16660321241967089608,262144 --variations-seed-version --mojo-platform-channel-handle=4964 /prefetch:14
                                                                              3⤵
                                                                                PID:1572
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4724,i,12630028375172084165,10971227447616400352,524288 --field-trial-handle=2272,i,8727777241544924158,16660321241967089608,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:14
                                                                                3⤵
                                                                                  PID:556
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5208,i,6703270365118826319,1184604451293898920,524288 --field-trial-handle=2272,i,8727777241544924158,16660321241967089608,262144 --variations-seed-version --mojo-platform-channel-handle=4972 /prefetch:14
                                                                                  3⤵
                                                                                    PID:2772
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=816,i,3946603528108509292,56831804183419185,524288 --field-trial-handle=2272,i,8727777241544924158,16660321241967089608,262144 --variations-seed-version --mojo-platform-channel-handle=4712 /prefetch:14
                                                                                    3⤵
                                                                                      PID:4204
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5192,i,16889467277872542253,5976076654054997852,262144 --field-trial-handle=2272,i,8727777241544924158,16660321241967089608,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:10
                                                                                      3⤵
                                                                                        PID:4396
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4440,i,15259894489074614392,184340313420023922,524288 --field-trial-handle=2272,i,8727777241544924158,16660321241967089608,262144 --variations-seed-version --mojo-platform-channel-handle=3308 /prefetch:14
                                                                                        3⤵
                                                                                          PID:1508
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4772,i,9873874847721182572,4620118834912837754,524288 --field-trial-handle=2272,i,8727777241544924158,16660321241967089608,262144 --variations-seed-version --mojo-platform-channel-handle=4568 /prefetch:14
                                                                                          3⤵
                                                                                            PID:4556
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4140,i,16427045439120175201,2195423399165673823,524288 --field-trial-handle=2272,i,8727777241544924158,16660321241967089608,262144 --variations-seed-version --mojo-platform-channel-handle=3928 /prefetch:14
                                                                                            3⤵
                                                                                              PID:3148
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3300,i,10088784419491961393,16594809506243664169,524288 --field-trial-handle=2272,i,8727777241544924158,16660321241967089608,262144 --variations-seed-version --mojo-platform-channel-handle=4716 /prefetch:14
                                                                                              3⤵
                                                                                                PID:1472
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4824,i,3650484128934738393,9012230008035953180,524288 --field-trial-handle=2272,i,8727777241544924158,16660321241967089608,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:14
                                                                                                3⤵
                                                                                                  PID:1820
                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5252,i,10313029188767841598,16982436488711683475,524288 --field-trial-handle=2272,i,8727777241544924158,16660321241967089608,262144 --variations-seed-version --mojo-platform-channel-handle=4564 /prefetch:14
                                                                                                  3⤵
                                                                                                    PID:4480
                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5400,i,3191773329575128154,11162125241968465852,524288 --field-trial-handle=2272,i,8727777241544924158,16660321241967089608,262144 --variations-seed-version --mojo-platform-channel-handle=4792 /prefetch:14
                                                                                                    3⤵
                                                                                                      PID:1492
                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4016,i,12667534960216015721,16193460597114372127,524288 --field-trial-handle=2272,i,8727777241544924158,16660321241967089608,262144 --variations-seed-version --mojo-platform-channel-handle=3764 /prefetch:14
                                                                                                      3⤵
                                                                                                        PID:2080
                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4008,i,2227925386375283508,17593045122989403735,524288 --field-trial-handle=2272,i,8727777241544924158,16660321241967089608,262144 --variations-seed-version --mojo-platform-channel-handle=4016 /prefetch:14
                                                                                                        3⤵
                                                                                                          PID:4660
                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4008,i,9425158430161870629,5562359968880790929,524288 --field-trial-handle=2272,i,8727777241544924158,16660321241967089608,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:14
                                                                                                          3⤵
                                                                                                            PID:3456
                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5212,i,11324086865429874987,1691692500677170240,524288 --field-trial-handle=2272,i,8727777241544924158,16660321241967089608,262144 --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:14
                                                                                                            3⤵
                                                                                                              PID:4496
                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5256,i,17974125133770152313,7064119677857816446,524288 --field-trial-handle=2272,i,8727777241544924158,16660321241967089608,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:14
                                                                                                              3⤵
                                                                                                                PID:5208
                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2644,i,17634943441275335704,17512237363699172481,524288 --field-trial-handle=2272,i,8727777241544924158,16660321241967089608,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:14
                                                                                                                3⤵
                                                                                                                  PID:1080
                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3740,i,7458656308843988511,10325574562572811326,524288 --field-trial-handle=2272,i,8727777241544924158,16660321241967089608,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:14
                                                                                                                  3⤵
                                                                                                                    PID:3828
                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4848,i,12252821671224284798,7439831601725533466,524288 --field-trial-handle=2272,i,8727777241544924158,16660321241967089608,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:14
                                                                                                                    3⤵
                                                                                                                      PID:5632
                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3792,i,18228740920983111206,8656979607858202016,524288 --field-trial-handle=2272,i,8727777241544924158,16660321241967089608,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:14
                                                                                                                      3⤵
                                                                                                                        PID:3544
                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4428,i,10889708756313572453,5290599655073955635,524288 --field-trial-handle=2272,i,8727777241544924158,16660321241967089608,262144 --variations-seed-version --mojo-platform-channel-handle=4176 /prefetch:14
                                                                                                                        3⤵
                                                                                                                          PID:2528
                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3792,i,15916824136273258373,2982791277165425994,524288 --field-trial-handle=2272,i,8727777241544924158,16660321241967089608,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:14
                                                                                                                          3⤵
                                                                                                                            PID:4156
                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4644,i,14485596774199052541,9934012122517608669,524288 --field-trial-handle=2272,i,8727777241544924158,16660321241967089608,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:14
                                                                                                                            3⤵
                                                                                                                              PID:5076
                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4108,i,3758848479102577431,13167199940837290630,524288 --field-trial-handle=2272,i,8727777241544924158,16660321241967089608,262144 --variations-seed-version --mojo-platform-channel-handle=4684 /prefetch:14
                                                                                                                              3⤵
                                                                                                                                PID:5984
                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5176,i,2662496949266393968,14262316776360705476,524288 --field-trial-handle=2272,i,8727777241544924158,16660321241967089608,262144 --variations-seed-version --mojo-platform-channel-handle=4100 /prefetch:14
                                                                                                                                3⤵
                                                                                                                                  PID:5000
                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4428,i,7719874731707909982,16782135875363788774,524288 --field-trial-handle=2272,i,8727777241544924158,16660321241967089608,262144 --variations-seed-version --mojo-platform-channel-handle=4100 /prefetch:14
                                                                                                                                  3⤵
                                                                                                                                    PID:5752
                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4272,i,14292194523058314690,8837130598286865027,524288 --field-trial-handle=2272,i,8727777241544924158,16660321241967089608,262144 --variations-seed-version --mojo-platform-channel-handle=316 /prefetch:14
                                                                                                                                    3⤵
                                                                                                                                      PID:6040
                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                                                  1⤵
                                                                                                                                    PID:4496
                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
                                                                                                                                    1⤵
                                                                                                                                      PID:2384
                                                                                                                                    • C:\Windows\System32\rundll32.exe
                                                                                                                                      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                                                                                      1⤵
                                                                                                                                        PID:2344
                                                                                                                                      • C:\Users\Admin\Downloads\IDIOT.EXE_20260720\VC_redist.x64.exe
                                                                                                                                        "C:\Users\Admin\Downloads\IDIOT.EXE_20260720\VC_redist.x64.exe"
                                                                                                                                        1⤵
                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                        PID:1808
                                                                                                                                        • C:\Windows\Temp\{A762DC18-A832-4082-B6E6-D2D46D9A87A0}\.cr\VC_redist.x64.exe
                                                                                                                                          "C:\Windows\Temp\{A762DC18-A832-4082-B6E6-D2D46D9A87A0}\.cr\VC_redist.x64.exe" -burn.clean.room="C:\Users\Admin\Downloads\IDIOT.EXE_20260720\VC_redist.x64.exe" -burn.filehandle.attached=748 -burn.filehandle.self=752
                                                                                                                                          2⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • Loads dropped DLL
                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                          PID:5848
                                                                                                                                          • C:\Windows\Temp\{0AF7B7C9-0376-495C-BCB8-6465810F2C73}\.be\VC_redist.x64.exe
                                                                                                                                            "C:\Windows\Temp\{0AF7B7C9-0376-495C-BCB8-6465810F2C73}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{4E000B35-E4D1-4EA0-8D5E-05049FCB59E3} {E8C037B7-A6FA-42F7-9E39-E23C884C1933} 5848
                                                                                                                                            3⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Adds Run key to start application
                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                            • Modifies registry class
                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                            PID:3976
                                                                                                                                            • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
                                                                                                                                              "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={0e3bb569-69d6-4c34-bff9-c2f81db5e5f0} -burn.filehandle.self=1048 -burn.embedded BurnPipe.{3986C6F6-DFA3-4463-BA5E-8A4BDB459D1D} {74A8503C-3BED-400E-A720-120558E7B1F9} 3976
                                                                                                                                              4⤵
                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                                              PID:2044
                                                                                                                                              • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
                                                                                                                                                "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=556 -burn.filehandle.self=576 -uninstall -quiet -burn.related.upgrade -burn.ancestors={0e3bb569-69d6-4c34-bff9-c2f81db5e5f0} -burn.filehandle.self=1048 -burn.embedded BurnPipe.{3986C6F6-DFA3-4463-BA5E-8A4BDB459D1D} {74A8503C-3BED-400E-A720-120558E7B1F9} 3976
                                                                                                                                                5⤵
                                                                                                                                                • Loads dropped DLL
                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                                PID:2436
                                                                                                                                                • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
                                                                                                                                                  "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{E65E39ED-ACAB-4DC7-9976-B66FF37FA66E} {B8611428-C222-42F4-AE40-BFEEF90757EE} 2436
                                                                                                                                                  6⤵
                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                  • Modifies registry class
                                                                                                                                                  PID:5760
                                                                                                                                      • C:\Windows\system32\vssvc.exe
                                                                                                                                        C:\Windows\system32\vssvc.exe
                                                                                                                                        1⤵
                                                                                                                                        • Checks SCSI registry key(s)
                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                        PID:4572
                                                                                                                                      • C:\Windows\system32\srtasks.exe
                                                                                                                                        C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
                                                                                                                                        1⤵
                                                                                                                                          PID:3412
                                                                                                                                        • C:\Windows\system32\msiexec.exe
                                                                                                                                          C:\Windows\system32\msiexec.exe /V
                                                                                                                                          1⤵
                                                                                                                                          • Enumerates connected drives
                                                                                                                                          • Drops file in System32 directory
                                                                                                                                          • Drops file in Windows directory
                                                                                                                                          • Modifies data under HKEY_USERS
                                                                                                                                          • Modifies registry class
                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                          PID:3264
                                                                                                                                        • C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe
                                                                                                                                          "C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe" /burn.runonce
                                                                                                                                          1⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                          PID:4260
                                                                                                                                          • C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe
                                                                                                                                            "C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260811031132.log"
                                                                                                                                            2⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                            PID:788
                                                                                                                                            • C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe
                                                                                                                                              "C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe" -burn.filehandle.attached=560 -burn.filehandle.self=580 /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260811031132.log"
                                                                                                                                              3⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              • Loads dropped DLL
                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                              PID:2588
                                                                                                                                        • C:\Users\Admin\Downloads\IDIOT.EXE_20260720\android_studio\android-studio-quail1-windows.exe
                                                                                                                                          "C:\Users\Admin\Downloads\IDIOT.EXE_20260720\android_studio\android-studio-quail1-windows.exe"
                                                                                                                                          1⤵
                                                                                                                                          • Checks SCSI registry key(s)
                                                                                                                                          • Checks processor information in registry
                                                                                                                                          • Modifies registry class
                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                          PID:1628
                                                                                                                                          • C:\Users\Admin\Downloads\IDIOT.EXE_20260720\android_studio\UnityCrashHandler64.exe
                                                                                                                                            "C:\Users\Admin\Downloads\IDIOT.EXE_20260720\android_studio\UnityCrashHandler64.exe" --attach 1628 2644020039680
                                                                                                                                            2⤵
                                                                                                                                              PID:1188
                                                                                                                                              • C:\Users\Admin\Downloads\IDIOT.EXE_20260720\android_studio\UnityCrashHandler64.exe
                                                                                                                                                "C:\Users\Admin\Downloads\IDIOT.EXE_20260720\android_studio\UnityCrashHandler64.exe" "1628" "2644020039680" "cbmUrl=" "cbmFile="
                                                                                                                                                3⤵
                                                                                                                                                  PID:4984
                                                                                                                                              • C:\Users\Admin\Downloads\IDIOT.EXE_20260720\android_studio\Watchdog.exe
                                                                                                                                                "C:\Users\Admin\Downloads\IDIOT.EXE_20260720\android_studio\Watchdog.exe" 1628 LightweightViewer 61974
                                                                                                                                                2⤵
                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                PID:2536
                                                                                                                                              • C:\Users\Admin\Downloads\IDIOT.EXE_20260720\android_studio\LightweightViewer.exe
                                                                                                                                                "C:\Users\Admin\Downloads\IDIOT.EXE_20260720\android_studio\LightweightViewer.exe" -wallpaper -port 9000 -slots 4
                                                                                                                                                2⤵
                                                                                                                                                • Loads dropped DLL
                                                                                                                                                • Modifies registry class
                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                PID:1756
                                                                                                                                              • C:\Users\Admin\Downloads\IDIOT.EXE_20260720\android_studio\LightweightViewer.exe
                                                                                                                                                "C:\Users\Admin\Downloads\IDIOT.EXE_20260720\android_studio\LightweightViewer.exe" -multi 12 -slave 1 -port 9000 -slots 4
                                                                                                                                                2⤵
                                                                                                                                                • Loads dropped DLL
                                                                                                                                                PID:4972
                                                                                                                                            • C:\Windows\system32\AUDIODG.EXE
                                                                                                                                              C:\Windows\system32\AUDIODG.EXE 0x00000000000004B8 0x00000000000004F4
                                                                                                                                              1⤵
                                                                                                                                                PID:4376
                                                                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                                                                C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
                                                                                                                                                1⤵
                                                                                                                                                  PID:360
                                                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                                                  C:\Windows\system32\svchost.exe -k DevicesFlow -s DevicesFlowUserSvc
                                                                                                                                                  1⤵
                                                                                                                                                    PID:5764
                                                                                                                                                  • C:\Windows\System32\ShellHost.exe
                                                                                                                                                    "C:\Windows\System32\ShellHost.exe"
                                                                                                                                                    1⤵
                                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                                    PID:1264
                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                                                                    1⤵
                                                                                                                                                      PID:1344
                                                                                                                                                    • C:\Windows\system32\svchost.exe
                                                                                                                                                      C:\Windows\system32\svchost.exe -k GPSvcGroup
                                                                                                                                                      1⤵
                                                                                                                                                        PID:4404
                                                                                                                                                      • C:\Windows\System32\SecurityHealthHost.exe
                                                                                                                                                        \\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
                                                                                                                                                        1⤵
                                                                                                                                                          PID:1944
                                                                                                                                                        • C:\Windows\system32\svchost.exe
                                                                                                                                                          C:\Windows\system32\svchost.exe -k GPSvcGroup
                                                                                                                                                          1⤵
                                                                                                                                                            PID:2552

                                                                                                                                                          Network

                                                                                                                                                                MITRE ATT&CK Enterprise v16

                                                                                                                                                                Replay Monitor

                                                                                                                                                                Loading Replay Monitor...

                                                                                                                                                                Downloads

                                                                                                                                                                e5b95d9.rbs
                                                                                                                                                                • Path C:\Config.Msi\e5b95d9.rbs
                                                                                                                                                                • Size 19KB
                                                                                                                                                                • SHA256 8d9398a7c85a34eb333808a1cb8652add57957e80570e3f2e2fe39963d28ffda
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                e5b95e5.rbs
                                                                                                                                                                • Path C:\Config.Msi\e5b95e5.rbs
                                                                                                                                                                • Size 19KB
                                                                                                                                                                • SHA256 f3e4e166d8813c033dab0de70fbef2f282b7c343c921820770b22842d9ff5bfd
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                e5b95ec.rbs
                                                                                                                                                                • Path C:\Config.Msi\e5b95ec.rbs
                                                                                                                                                                • Size 21KB
                                                                                                                                                                • SHA256 4b405570433ae2cbc281e4799a5a2beb3f5be463b04dc072372ff57cd7bfbf85
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                e5b95fb.rbs
                                                                                                                                                                • Path C:\Config.Msi\e5b95fb.rbs
                                                                                                                                                                • Size 21KB
                                                                                                                                                                • SHA256 38fb442c7faed220a4212cab5a30b6d1859c173f4271baf2feca0d6f5b4bfa7b
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                state.rsm
                                                                                                                                                                • Path C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\state.rsm
                                                                                                                                                                • Size 952B
                                                                                                                                                                • SHA256 6a0aa557e9f77bf54d8153b5d0b87568121980067457b0f647d04872b44c7e1e
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                c
                                                                                                                                                                • Path C:\Users\Admin\AppData\LocalLow\madmad\android-studio-quail1-windows\Unity\cf8e8b35-d2e3-477b-a8b2-5100b3976fcb\Analytics\ArchivedEvents\178641433900002.b9b3b2b0\c
                                                                                                                                                                • Size 1B
                                                                                                                                                                • SHA256 d4735e3a265e16eee03f59718b9b5d03019c07d8b6c51f90da3a666eec13ab35
                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                Submit Download

                                                                                                                                                                s
                                                                                                                                                                • Path C:\Users\Admin\AppData\LocalLow\madmad\android-studio-quail1-windows\Unity\cf8e8b35-d2e3-477b-a8b2-5100b3976fcb\Analytics\ArchivedEvents\178641450300003.b9b3b2b0\s
                                                                                                                                                                • Size 462B
                                                                                                                                                                • SHA256 48efae46415d72ab776d0e78b45c50ea47cab8d49dfe10e1d4a21964106e557f
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                settings.dat
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                • Size 280B
                                                                                                                                                                • SHA256 7f7f7efafb9f87082470af84df3b906033b9d533fb7a188458a4e181362f2170
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                settings.dat
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                • Size 280B
                                                                                                                                                                • SHA256 5e34bc4625bf22507150f49d8c28444bda8222ea36c2a7d431bbdaae5c134a9d
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                settings.dat
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                • Size 280B
                                                                                                                                                                • SHA256 68e33ac4aa2e456ecadc75bb30e4f5fa8ad522042b96390251c948e0c4192090
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                settings.dat
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                • Size 280B
                                                                                                                                                                • SHA256 9afc2bdbfb9972f868cc29c5854332c41d900b0f4aa2298f96310f5ed7136c16
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                30a18f4f-1492-406b-bbf5-cbc4823673f3.tmp
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\30a18f4f-1492-406b-bbf5-cbc4823673f3.tmp
                                                                                                                                                                • Size 414B
                                                                                                                                                                • SHA256 ebe897f738d947a77537ee1c3f49cbec186ab3be9b08b9f6796ee2537ed5a327
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                783fca10-7bf3-4d41-8f7e-617741ddc86d.tmp
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\783fca10-7bf3-4d41-8f7e-617741ddc86d.tmp
                                                                                                                                                                • Size 6B
                                                                                                                                                                • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                Submit Download

                                                                                                                                                                LOG.old
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
                                                                                                                                                                • Size 331B
                                                                                                                                                                • SHA256 9e2e3dc182610586297cdb505412542c06f46b4051b5d4ce615cd1cb9735c696
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                LOG.old
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
                                                                                                                                                                • Size 334B
                                                                                                                                                                • SHA256 cf86227a0097caf17f2d97f2569c9a67ad972c52a3dd3c0deca5f4368a58e7c3
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                the-real-index
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                • Size 3KB
                                                                                                                                                                • SHA256 d739186def2cfd36c87b0abcd3ba087ca5eb87c8e5c505db060c134c655ec64f
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                the-real-index~RFe5a7c46.TMP
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a7c46.TMP
                                                                                                                                                                • Size 3KB
                                                                                                                                                                • SHA256 86176eb3cbffb0fb7231f5203ff42fa796a47ffa59ab2bf371424e6bd20dabd1
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                data_1
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
                                                                                                                                                                • Size 264KB
                                                                                                                                                                • SHA256 10ea01b64cb3ececee34c64b6532e0785ba902539f14491cdd66b7969932b685
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                SiteList-Enterprise.json
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                                                                                                                • Size 2B
                                                                                                                                                                • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                Submit Download

                                                                                                                                                                Edge Profile.ico
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                                                                                                                                • Size 70KB
                                                                                                                                                                • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                History
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
                                                                                                                                                                • Size 224KB
                                                                                                                                                                • SHA256 8b138fb57052b3dc7e8237cb2de48a675ba9a4ffe6a2aaefff95e60d2b8d3084
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                Network Persistent State
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                                                                • Size 7KB
                                                                                                                                                                • SHA256 0a5d09fcb0ee90d8b6b3c9c422ce7a1d05a33c8a52c1028bb002630db09ebce6
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                Network Persistent State
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                                                                • Size 7KB
                                                                                                                                                                • SHA256 e4af9a08ac7cc5a6009820587b8634caa6c81fc6a1142ae812c37b6f1354e6aa
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                SCT Auditing Pending Reports
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                                                                                                • Size 2B
                                                                                                                                                                • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                Submit Download

                                                                                                                                                                Sdch Dictionaries
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
                                                                                                                                                                • Size 40B
                                                                                                                                                                • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                Submit Download

                                                                                                                                                                Preferences
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                • Size 13KB
                                                                                                                                                                • SHA256 709e7b6b36e2949621a509f64a6e415168e4a83930024784a2e9b1b41dc83da4
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                Preferences
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                • Size 12KB
                                                                                                                                                                • SHA256 37de1e60cc5b340cba6ee2f3602f1da2b3127d68de14f761f977c5ae4c7cb786
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                Preferences
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                • Size 12KB
                                                                                                                                                                • SHA256 fc72905662c7eb0ab5bde076ccccb1877c1a38a41ceb129210dbc11d9716a09c
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                Preferences
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                • Size 13KB
                                                                                                                                                                • SHA256 9368bd7b2da8e66c1280a0170c47260cde4f823afd9a80cb9ca0bcd40ed61072
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                Preferences
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                • Size 12KB
                                                                                                                                                                • SHA256 a00b389de37bc09cf55d13faba379529990041e1783b760d82c199bec6882f39
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                Preferences
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                • Size 13KB
                                                                                                                                                                • SHA256 4af27f7a8935da88368d89648746a53d423407bb3a16b0c904807b20656298b7
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                Preferences
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                • Size 11KB
                                                                                                                                                                • SHA256 3d5ba583bc0fa884bfcfd2ebc76e792fed91c0dee33421ebfd76cdc0672b664f
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                Secure Preferences
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                                                                                                                • Size 23KB
                                                                                                                                                                • SHA256 d043fcaa13cc8bf4d47a01cb4559f349c2a9341ea5a422c6608972c21635c5fd
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                LOG
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
                                                                                                                                                                • Size 326B
                                                                                                                                                                • SHA256 dd9e552b1cf6ac7a9e8e12a208b8b0308ecf93c7da7579ad096f1449f8a4a25d
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                sync_diagnostic.log
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                                                                                                                • Size 4KB
                                                                                                                                                                • SHA256 264d3bc6ced5045524cbde2a0c757c78ae47988331e52a98aa0caf4b066d3533
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                CURRENT
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
                                                                                                                                                                • Size 16B
                                                                                                                                                                • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                Submit Download

                                                                                                                                                                MANIFEST-000001
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
                                                                                                                                                                • Size 41B
                                                                                                                                                                • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                Submit Download

                                                                                                                                                                OperationConfig
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
                                                                                                                                                                • Size 22KB
                                                                                                                                                                • SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                OperationConfig~RFe5ad42a.TMP
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5ad42a.TMP
                                                                                                                                                                • Size 3KB
                                                                                                                                                                • SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                Last Version
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
                                                                                                                                                                • Size 14B
                                                                                                                                                                • SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                Submit Download

                                                                                                                                                                Local State
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                • Size 41KB
                                                                                                                                                                • SHA256 df9ffa25381c6b5c6d2f8a84ce317a9eca2ff571acfb794ac98aaacd8498d8f1
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                Local State
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                • Size 45KB
                                                                                                                                                                • SHA256 26f67d1c76b8a9498be98f4efd1ee15f67f908055a3be2383d8ca64d35b17f7e
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                Local State
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                • Size 35KB
                                                                                                                                                                • SHA256 8b8057b79cdb74710ed13a1f9f413384188f689ef3bfcabc8f4462afece3d5a5
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                Local State
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                • Size 42KB
                                                                                                                                                                • SHA256 0696ef24867ca54f722aa19e3e04458372c2467b6bb80007f378309e78b052b1
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                Local State
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                • Size 42KB
                                                                                                                                                                • SHA256 711cfbc68afdd633a965a9f4bc95d5a755bc5b6ab58e6c5354e372e21835aef0
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                Local State
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                • Size 43KB
                                                                                                                                                                • SHA256 261cfcb2782a1f8b79c4be3a06de4617a70a2c8238457b6ebaef5851663a236a
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                Local State
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                • Size 42KB
                                                                                                                                                                • SHA256 4818395eea2cc68629436ab7092bbdc5d83de6d3ff4ef845cbcc99ed0817fdaf
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                Local State
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                • Size 38KB
                                                                                                                                                                • SHA256 9786b3d2dd96ab5f07cb840f205388ca748adba4818a0c44460e9a0e1f59d9b2
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                Local State
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                • Size 39KB
                                                                                                                                                                • SHA256 e00cc0c2528edde8ad1d4d09e8037681eeb3e6065a384d98142d09e9a57935e3
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                Local State
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                • Size 47KB
                                                                                                                                                                • SHA256 2fdc3abfa1a37203353b2c3c49ebcdc047d17dd1a5f17cc6449f6b493398a153
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                Local State
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                • Size 35KB
                                                                                                                                                                • SHA256 a5871392acf8bc0d150e1c3a6595672d0b4c4ad812c58aead230df33515c75ce
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                data_1
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
                                                                                                                                                                • Size 264KB
                                                                                                                                                                • SHA256 c9de57e12302832c94e57d22e77eab35daf8504ed44550edc8c06c1cd1b26014
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                Variations
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
                                                                                                                                                                • Size 86B
                                                                                                                                                                • SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                6e8a82b5-469a-4d24-97d0-42789d4979a4.tmp
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\6e8a82b5-469a-4d24-97d0-42789d4979a4.tmp
                                                                                                                                                                • Size 372B
                                                                                                                                                                • SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                metadata.json
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                • Size 132B
                                                                                                                                                                • SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                metadata.json
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                • Size 1KB
                                                                                                                                                                • SHA256 68dd4a6a0b1711003690c2995fd0b77ba3c9ae6c27dd853ff492b52bd7701bc5
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                metadata.json
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                • Size 1KB
                                                                                                                                                                • SHA256 0dcbd641392011e3042d4affe27de6b54e3bfe1fed2f238c1326586e38dbfb80
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                metadata.json
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                • Size 252B
                                                                                                                                                                • SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                metadata.json
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                • Size 492B
                                                                                                                                                                • SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                metadata.json
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                • Size 1KB
                                                                                                                                                                • SHA256 805060eed10d347c6a09a36669a1efe4d08182f1d7531c7c7b9db9386e0ae677
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                metadata.json
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                • Size 612B
                                                                                                                                                                • SHA256 918167fab0fb4435546513252415c1a2e44b6e8e60caf6f31d07587ba0a71ab0
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                metadata.json
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                • Size 1KB
                                                                                                                                                                • SHA256 c9dba99f57460d707c2f92d0662cff713c728cc6ba354c91f18265597a7e07df
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                metadata.json
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                • Size 1KB
                                                                                                                                                                • SHA256 e88fe0139bb3e9894b393fde1b8dbf2be3af661f4ada6e00ec73028b710845d4
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                metadata.json
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                • Size 2KB
                                                                                                                                                                • SHA256 fb65b7b5795c16e508084cdc4c6dc9c00ef5be6b74cea2443b02e118053ef45c
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                metadata.json
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                • Size 852B
                                                                                                                                                                • SHA256 cc631188ae4a22c0621e596be3d4335218373ee3aafe98bb7b213069a0dc3b70
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                metadata.json
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                • Size 972B
                                                                                                                                                                • SHA256 4d2b47e594a4d5d9d0c079c2ff5fac0e47e26ffad46c371ad51e472b3dcd0669
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                metadata.json
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                • Size 2KB
                                                                                                                                                                • SHA256 f9353c278cbd5f4c56664792125e4971eca5c38a2fa69aefc668e453ad54679e
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                metadata.json
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                • Size 732B
                                                                                                                                                                • SHA256 cf5e5467ab3de71fcb419acbbb754c3effd5e787864ffa7c767f24ff9bbe5ae3
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                metadata.json
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                • Size 2KB
                                                                                                                                                                • SHA256 75368897572ebcf6bfcd99ec815069d4f375617603e3eecf3ef83196708aa2a2
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                metadata.json
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                • Size 1KB
                                                                                                                                                                • SHA256 0e2427c94f170f6dda5a9a85ddaaa0dc0088899c19efbb73c05e3598cb541423
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                metadata.json
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                • Size 1KB
                                                                                                                                                                • SHA256 eacf1adcab56ea7707951a59a1d5415c83ac02e038089cf23fd24d14c5a52cf2
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                metadata.json
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                • Size 1KB
                                                                                                                                                                • SHA256 824de99fb2d26a9652ce4d147d41b5f42d8eb58933629e98754b359ef813de81
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                2cff0a27-dc25-4bc2-a8f5-d7b26a6f5a82.tmp
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\2cff0a27-dc25-4bc2-a8f5-d7b26a6f5a82.tmp
                                                                                                                                                                • Size 13B
                                                                                                                                                                • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                Submit Download

                                                                                                                                                                12301a18-993b-4888-8a4d-18510883d0ce.tmp
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\12301a18-993b-4888-8a4d-18510883d0ce.tmp
                                                                                                                                                                • Size 1B
                                                                                                                                                                • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                Submit Download

                                                                                                                                                                dd_vcredist_amd64_20260811031132_000_vcRuntimeMinimum_x64.log
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260811031132_000_vcRuntimeMinimum_x64.log
                                                                                                                                                                • Size 2KB
                                                                                                                                                                • SHA256 83b560b3f2ae1812b6adfbf24a5e8aa972c2c1501c7e88f451e01c183d3e0323
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                dd_vcredist_amd64_20260811031132_001_vcRuntimeAdditional_x64.log
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260811031132_001_vcRuntimeAdditional_x64.log
                                                                                                                                                                • Size 2KB
                                                                                                                                                                • SHA256 080b63ed19683212ab6e04d0abf9f8aec09e0b0f7a5c14d9052676a98c7bc0b7
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                content_new.js
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6016_1073252725\CRX_INSTALL\content_new.js
                                                                                                                                                                • Size 10KB
                                                                                                                                                                • SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                MSVCP140.dll
                                                                                                                                                                • Path C:\Windows\SYSTEM32\MSVCP140.dll
                                                                                                                                                                • Size 628KB
                                                                                                                                                                • SHA256 7c26614e1d733892c2deac7e245ce115504b1d80592dd0a01b08e3e5a55f89ca
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                VCRUNTIME140.dll
                                                                                                                                                                • Path C:\Windows\SYSTEM32\VCRUNTIME140.dll
                                                                                                                                                                • Size 174KB
                                                                                                                                                                • SHA256 d1f4225df2cd877dbf130d5668a021dce3f94118455ff5ec952061c30afc9ce7
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                VCRUNTIME140_1.dll
                                                                                                                                                                • Path C:\Windows\SYSTEM32\VCRUNTIME140_1.dll
                                                                                                                                                                • Size 48KB
                                                                                                                                                                • SHA256 a7146c08f89fe5b04541ab507cdb59ff7b44534d4ba3c668a426c6450a03434e
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                Staging
                                                                                                                                                                • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6016_1465039807\Mu\Staging
                                                                                                                                                                • Size 36B
                                                                                                                                                                • SHA256 411a706def2e70f96a507208bf80bceb93e950c4c2d671cd1ddb4134ce54b2a9
                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                Submit Download

                                                                                                                                                                LICENSE
                                                                                                                                                                • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6016_1578372088\LICENSE
                                                                                                                                                                • Size 1KB
                                                                                                                                                                • SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                logo.png
                                                                                                                                                                • Path C:\Windows\Temp\{0AF7B7C9-0376-495C-BCB8-6465810F2C73}\.ba\logo.png
                                                                                                                                                                • Size 1KB
                                                                                                                                                                • SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                wixstdba.dll
                                                                                                                                                                • Path C:\Windows\Temp\{0AF7B7C9-0376-495C-BCB8-6465810F2C73}\.ba\wixstdba.dll
                                                                                                                                                                • Size 215KB
                                                                                                                                                                • SHA256 e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                cab2C04DDC374BD96EB5C8EB8208F2C7C92
                                                                                                                                                                • Path C:\Windows\Temp\{0AF7B7C9-0376-495C-BCB8-6465810F2C73}\cab2C04DDC374BD96EB5C8EB8208F2C7C92
                                                                                                                                                                • Size 5.4MB
                                                                                                                                                                • SHA256 19c0cdc59ae89d0491c025a966f6d40515adc2449af40f2c6c6f52e2f293ad1c
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                cab5046A8AB272BF37297BB7928664C9503
                                                                                                                                                                • Path C:\Windows\Temp\{0AF7B7C9-0376-495C-BCB8-6465810F2C73}\cab5046A8AB272BF37297BB7928664C9503
                                                                                                                                                                • Size 1.0MB
                                                                                                                                                                • SHA256 6e8ee73933678c55973e83366e48e948b394c7a36743a36b7224c95de979b13f
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                vcRuntimeAdditional_x64
                                                                                                                                                                • Path C:\Windows\Temp\{0AF7B7C9-0376-495C-BCB8-6465810F2C73}\vcRuntimeAdditional_x64
                                                                                                                                                                • Size 208KB
                                                                                                                                                                • SHA256 476427800c1c958dc4e71d9a0f2f3983b2608da70835db9ee5f3b8ac387e9617
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                vcRuntimeMinimum_x64
                                                                                                                                                                • Path C:\Windows\Temp\{0AF7B7C9-0376-495C-BCB8-6465810F2C73}\vcRuntimeMinimum_x64
                                                                                                                                                                • Size 208KB
                                                                                                                                                                • SHA256 bab5d0257e6a18a4a008e683442e3077b38172dd61af3cb1c588b46724a714e2
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                VC_redist.x64.exe
                                                                                                                                                                • Path C:\Windows\Temp\{A762DC18-A832-4082-B6E6-D2D46D9A87A0}\.cr\VC_redist.x64.exe
                                                                                                                                                                • Size 615KB
                                                                                                                                                                • SHA256 dbcc159853d8b83c1df0a0a698127ab98e926af1b6dee86e96f541dc94b34948
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                wixstdba.dll
                                                                                                                                                                • Path C:\Windows\Temp\{F83E293E-857A-488C-A0DF-D13B61E368A0}\.ba\wixstdba.dll
                                                                                                                                                                • Size 191KB
                                                                                                                                                                • SHA256 a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                memory/1628-578-0x000002689FB60000-0x000002689FB61000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/1628-577-0x000002689FB60000-0x000002689FB61000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/1628-579-0x000002689FB60000-0x000002689FB61000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/1628-580-0x000002689FB60000-0x000002689FB61000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/1628-581-0x000002689FB60000-0x000002689FB61000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/1628-576-0x000002689FB60000-0x000002689FB61000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/1628-572-0x000002689FB60000-0x000002689FB61000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/1628-570-0x000002689FB60000-0x000002689FB61000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/2044-567-0x0000000000380000-0x00000000003F7000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/2436-566-0x0000000000380000-0x00000000003F7000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/2536-592-0x0000000000260000-0x0000000000268000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/5760-564-0x0000000000380000-0x00000000003F7000-memory.dmp
                                                                                                                                                                Download