7272ee2a5ece89ea602e9cf69b27ec84b6b41a5d23c3c92d36c4b98de8b6aca6

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
12/08/2026, 04:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
df1d0d85-7588-878d-b5a7-9a6484f04474.eml
Size 69KB
Sample260812-e4mvpayelc
SHA256 7272ee2a5ece89ea602e9cf69b27ec84b6b41a5d23c3c92d36c4b98de8b6aca6
MD5 b31b810e51e6574be672ec826d1ff567
SHA1 4e01f7c9e37c8fc7c8ae21e9e11c03347b6cc198
SHA512 49639acc20ea20b9888f1f21f9a9b0b12b01726416a947dc38684c400fff295e9eb1ea85e40c10e0db533a0f0679fa426b2f0296428e5ba23f02dd681ee12833
SSDEEP 1536:G6KBOYjSCiQfPydDcflLh4rZeUCBSBDdl0aV1Pj8NP36fnstPn6g+whhp:rqz47pY6AP
TLSH
T169631A60C680A1A72C7A47D9F5167ECCD2E0CC2E87625568EC3368748C8DCA75E6D3BD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

adware discovery spyware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 7 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4020	msedge.exe
5524	msedge.exe
796	msedge.exe
3272	msedge.exe
572	msedge.exe
4596	msedge.exe
1516	msedge.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	OUTLOOK.EXE

Enumerates system info in registry 2 TTPs 24 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\OUTLOOK.EXE = "10001"	OUTLOOK.EXE

Modifies data under HKEY_USERS 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134309826132930594"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 21 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2409539145-3342400454-2096821238-1000\{9CF0D045-8A99-490C-9B26-278CFF8BDEFD}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2409539145-3342400454-2096821238-1000\{1AFF07D5-3215-4838-A72E-7B7F1D9B1DBB}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2409539145-3342400454-2096821238-1000\{6AF4B899-5181-4045-A9E6-CD25ED568A18}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2409539145-3342400454-2096821238-1000\{7A8CAF8D-42CD-4781-A6E2-D9FAC847F086}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2409539145-3342400454-2096821238-1000\{4D0E2F15-7B03-4571-9E23-D317EC7AE77B}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2409539145-3342400454-2096821238-1000\{B6D7ECFE-BE26-4558-A8B7-F52A8E019430}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2409539145-3342400454-2096821238-1000\{3570265E-758B-4DF1-925F-B5BFDC0770F6}	msedge.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
5192	OUTLOOK.EXE
5192	OUTLOOK.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5192	OUTLOOK.EXE
5192	OUTLOOK.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5192	OUTLOOK.EXE

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 25 IoCs

pid	Process
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe

Suspicious use of FindShellTrayWindow 15 IoCs

pid	Process
5192	OUTLOOK.EXE
5192	OUTLOOK.EXE
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
3924	msedge.exe
3924	msedge.exe
2492	msedge.exe
2492	msedge.exe
1264	msedge.exe
1264	msedge.exe
4740	msedge.exe
4740	msedge.exe
5648	msedge.exe
5648	msedge.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
5192	OUTLOOK.EXE

Suspicious use of SetWindowsHookEx 33 IoCs

pid	Process
5192	OUTLOOK.EXE
5192	OUTLOOK.EXE
5192	OUTLOOK.EXE
5192	OUTLOOK.EXE
5192	OUTLOOK.EXE
5192	OUTLOOK.EXE
5192	OUTLOOK.EXE
5192	OUTLOOK.EXE
5192	OUTLOOK.EXE
5192	OUTLOOK.EXE
5192	OUTLOOK.EXE
5192	OUTLOOK.EXE
5192	OUTLOOK.EXE
5192	OUTLOOK.EXE
5192	OUTLOOK.EXE
5192	OUTLOOK.EXE
5192	OUTLOOK.EXE
5192	OUTLOOK.EXE
5192	OUTLOOK.EXE
5192	OUTLOOK.EXE
5192	OUTLOOK.EXE
5192	OUTLOOK.EXE
5192	OUTLOOK.EXE
5192	OUTLOOK.EXE
5192	OUTLOOK.EXE
5192	OUTLOOK.EXE
5192	OUTLOOK.EXE
5192	OUTLOOK.EXE
5192	OUTLOOK.EXE
5192	OUTLOOK.EXE
5192	OUTLOOK.EXE
5192	OUTLOOK.EXE
5692	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5192 wrote to memory of 2464	5192	OUTLOOK.EXE	81
PID 2464 wrote to memory of 1460	2464	msedge.exe	82
PID 2464 wrote to memory of 976	2464	msedge.exe	83
PID 2464 wrote to memory of 4596	2464	msedge.exe	84
PID 2464 wrote to memory of 976	2464	msedge.exe	83
PID 2464 wrote to memory of 976	2464	msedge.exe	83
PID 2464 wrote to memory of 5388	2464	msedge.exe	86
PID 2464 wrote to memory of 5388	2464	msedge.exe	86
PID 2464 wrote to memory of 5260	2464	msedge.exe	87
PID 2464 wrote to memory of 5260	2464	msedge.exe	87
PID 2464 wrote to memory of 5260	2464	msedge.exe	87
PID 2464 wrote to memory of 5272	2464	msedge.exe	88
PID 2464 wrote to memory of 5272	2464	msedge.exe	88
PID 2464 wrote to memory of 5272	2464	msedge.exe	88
PID 2464 wrote to memory of 5464	2464	msedge.exe	89
PID 2464 wrote to memory of 5416	2464	msedge.exe	90
PID 2464 wrote to memory of 5464	2464	msedge.exe	89
PID 2464 wrote to memory of 5464	2464	msedge.exe	89
PID 2464 wrote to memory of 5408	2464	msedge.exe	91
PID 2464 wrote to memory of 5532	2464	msedge.exe	92
PID 2464 wrote to memory of 5416	2464	msedge.exe	90
PID 2464 wrote to memory of 5416	2464	msedge.exe	90
PID 2464 wrote to memory of 5408	2464	msedge.exe	91
PID 2464 wrote to memory of 5408	2464	msedge.exe	91
PID 2464 wrote to memory of 5532	2464	msedge.exe	92
PID 2464 wrote to memory of 5532	2464	msedge.exe	92
PID 2464 wrote to memory of 5564	2464	msedge.exe	93
PID 2464 wrote to memory of 5564	2464	msedge.exe	93
PID 2464 wrote to memory of 2968	2464	msedge.exe	94
PID 2464 wrote to memory of 2968	2464	msedge.exe	94
PID 2464 wrote to memory of 5716	2464	msedge.exe	96
PID 2464 wrote to memory of 2396	2464	msedge.exe	97
PID 2464 wrote to memory of 5716	2464	msedge.exe	96
PID 2464 wrote to memory of 2396	2464	msedge.exe	97
PID 2464 wrote to memory of 2352	2464	msedge.exe	99
PID 2464 wrote to memory of 5800	2464	msedge.exe	100
PID 5800 wrote to memory of 3816	5800	msedge.exe	101
PID 2464 wrote to memory of 6132	2464	msedge.exe	102
PID 2464 wrote to memory of 6132	2464	msedge.exe	102
PID 2464 wrote to memory of 6132	2464	msedge.exe	102
PID 2464 wrote to memory of 3232	2464	msedge.exe	103
PID 2464 wrote to memory of 3232	2464	msedge.exe	103
PID 2464 wrote to memory of 4052	2464	msedge.exe	104
PID 2464 wrote to memory of 4052	2464	msedge.exe	104
PID 2464 wrote to memory of 5436	2464	msedge.exe	105
PID 2464 wrote to memory of 5436	2464	msedge.exe	105
PID 2464 wrote to memory of 5268	2464	msedge.exe	106
PID 2464 wrote to memory of 5268	2464	msedge.exe	106
PID 2464 wrote to memory of 5740	2464	msedge.exe	107
PID 2464 wrote to memory of 5740	2464	msedge.exe	107
PID 2464 wrote to memory of 5696	2464	msedge.exe	108
PID 2464 wrote to memory of 5696	2464	msedge.exe	108
PID 2464 wrote to memory of 5696	2464	msedge.exe	108
PID 2464 wrote to memory of 5372	2464	msedge.exe	109
PID 2464 wrote to memory of 5292	2464	msedge.exe	110
PID 2464 wrote to memory of 5252	2464	msedge.exe	111
PID 5192 wrote to memory of 3924	5192	OUTLOOK.EXE	112
PID 3924 wrote to memory of 3360	3924	msedge.exe	113
PID 3924 wrote to memory of 1516	3924	msedge.exe	114
PID 3924 wrote to memory of 3364	3924	msedge.exe	115
PID 3924 wrote to memory of 3364	3924	msedge.exe	115
PID 3924 wrote to memory of 3364	3924	msedge.exe	115
PID 3924 wrote to memory of 3572	3924	msedge.exe	116
PID 3924 wrote to memory of 3572	3924	msedge.exe	116

C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE
"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\Admin\AppData\Local\Temp\df1d0d85-7588-878d-b5a7-9a6484f04474.eml"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://u40859938.ct.sendgrid.net/ls/click?upn=u001.EqP6qanbc9aRZyIv0zag4lOPEZ16rO-2FzE992qkSw3-2Fqu4eqlDA-2B-2B4UlsJE5qlWZBl-2Fj0tQHAcYz5bqO-2BURDwixtLqJNNeq2szXDC5rM7Ciid9-2BctMb9DjEfsGjUq3z11u00JPcOa2vOIRmwcRnCx1kmBf4dInnPaKvjEHnEH9cZ6Krzc-2BdH9oG8zRksSAeFgIwrQ5a2qqQQQuLEb3wuKnSeJlvT9IcH7i14tXXmkr3cVqUOq9Euq-2FRi8tA9Jp-2BTziS2oBJyv1zug8QU2WQp07Q-3D-3D5LkW_ldvjFfFidCkX1UsNHybJvGoCS3IBl4bPnK8uaMf-2FXBxiGS0eBM0uLy-2FoqE2iZ5IkxWb7gakUot1R39CTYy56Kn8CSMDgKAnWQsImmQ3jV1SDw0g17bltashIxfkOHZ1dvX14DJQlvqyvkwM6fVCBJD93V-2FFrxiU9WYOQQRAcmH5-2BTBWNz7wc1LNnrLRZDObV4qDOj2SYf3ZsxAR-2BlfeFbA-3D-3D
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x2f0,0x7ffced9ac188,0x7ffced9ac194,0x7ffced9ac1a0
    3⤵
    PID:1460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1752,i,2527405353630359623,14802677730821549783,262144 --field-trial-handle=2180,i,7259543897094189668,12896843490296270899,262144 --variations-seed-version --mojo-platform-channel-handle=2176 /prefetch:2
    3⤵
    PID:976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1852,i,16295139308333512804,12443865305918399204,524288 --field-trial-handle=2180,i,7259543897094189668,12896843490296270899,262144 --variations-seed-version --mojo-platform-channel-handle=2420 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2452,i,6596871595949944015,18087334712381847322,524288 --field-trial-handle=2180,i,7259543897094189668,12896843490296270899,262144 --variations-seed-version --mojo-platform-channel-handle=3128 /prefetch:13
    3⤵
    PID:5388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3508,i,7037595575974589008,901442320047952135,2097152 --field-trial-handle=2180,i,7259543897094189668,12896843490296270899,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
    3⤵
    PID:5260
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3512,i,6739921795674083829,16512621190940451232,2097152 --field-trial-handle=2180,i,7259543897094189668,12896843490296270899,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
    3⤵
    PID:5272
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4188,i,18034929969625942040,17571215918553243032,2097152 --field-trial-handle=2180,i,7259543897094189668,12896843490296270899,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:1
    3⤵
    PID:5464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4224,i,16055272775439006155,10384877080930607216,2097152 --field-trial-handle=2180,i,7259543897094189668,12896843490296270899,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:9
    3⤵
    PID:5416
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4212,i,10521081335894997636,4394777274202097537,2097152 --field-trial-handle=2180,i,7259543897094189668,12896843490296270899,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:1
    3⤵
    PID:5408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4236,i,16340218567941246494,15852912961744733619,2097152 --field-trial-handle=2180,i,7259543897094189668,12896843490296270899,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:9
    3⤵
    PID:5532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5400,i,16934238353615823795,2196344039367933838,524288 --field-trial-handle=2180,i,7259543897094189668,12896843490296270899,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:14
    3⤵
    PID:5564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4480,i,7453712264490062901,5201482341263950513,524288 --field-trial-handle=2180,i,7259543897094189668,12896843490296270899,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:14
    3⤵
    PID:2968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5396,i,15347246001842148854,4883077703074250873,524288 --field-trial-handle=2180,i,7259543897094189668,12896843490296270899,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:14
    3⤵
    PID:5716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5424,i,12313506874974652427,7328615511865626996,524288 --field-trial-handle=2180,i,7259543897094189668,12896843490296270899,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:14
    3⤵
    PID:2396
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5964,i,1784434160232083838,451039546861824121,524288 --field-trial-handle=2180,i,7259543897094189668,12896843490296270899,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:14
    3⤵
    PID:4380
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5964,i,1784434160232083838,451039546861824121,524288 --field-trial-handle=2180,i,7259543897094189668,12896843490296270899,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:14
    3⤵
    PID:2352
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6192,i,13735288990125782433,15300395319458410466,524288 --field-trial-handle=2180,i,7259543897094189668,12896843490296270899,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:14
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1140
      4⤵
      PID:3816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6332,i,1622881796484784649,10288387841945819931,2097152 --field-trial-handle=2180,i,7259543897094189668,12896843490296270899,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:1
    3⤵
    PID:6132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6484,i,14476979183696990926,5527151631777923394,524288 --field-trial-handle=2180,i,7259543897094189668,12896843490296270899,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:14
    3⤵
    PID:3232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6116,i,10924631186902495767,10357247360961061156,524288 --field-trial-handle=2180,i,7259543897094189668,12896843490296270899,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:14
    3⤵
    PID:4052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6688,i,718820993037554997,13402376678345600700,524288 --field-trial-handle=2180,i,7259543897094189668,12896843490296270899,262144 --variations-seed-version --mojo-platform-channel-handle=6664 /prefetch:14
    3⤵
    PID:5436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7080,i,6793054885476236008,10716605690040664897,524288 --field-trial-handle=2180,i,7259543897094189668,12896843490296270899,262144 --variations-seed-version --mojo-platform-channel-handle=3932 /prefetch:14
    3⤵
    PID:5268
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6564,i,13354558529844624208,7277539022593002883,524288 --field-trial-handle=2180,i,7259543897094189668,12896843490296270899,262144 --variations-seed-version --mojo-platform-channel-handle=4016 /prefetch:14
    3⤵
    PID:5740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=5112,i,17575593073191977643,12067129763167871974,2097152 --field-trial-handle=2180,i,7259543897094189668,12896843490296270899,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:1
    3⤵
    PID:5696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=728,i,1440680777055854471,4319405335868864285,524288 --field-trial-handle=2180,i,7259543897094189668,12896843490296270899,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:14
    3⤵
    PID:5372
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6052,i,1664355521696678546,16179432170955171836,524288 --field-trial-handle=2180,i,7259543897094189668,12896843490296270899,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:14
    3⤵
    PID:5292
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4372,i,14865381787285140923,5501889689943319415,524288 --field-trial-handle=2180,i,7259543897094189668,12896843490296270899,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:14
    3⤵
    PID:5252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://u40859938.ct.sendgrid.net/ls/click?upn=u001.EqP6qanbc9aRZyIv0zag4lOPEZ16rO-2FzE992qkSw3-2Fqu4eqlDA-2B-2B4UlsJE5qlWZBl-2Fj0tQHAcYz5bqO-2BURDwixtLqJNNeq2szXDC5rM7Ciid9-2BctMb9DjEfsGjUq3z11u00JPcOa2vOIRmwcRnCx1kmBf4dInnPaKvjEHnEH9cZ6Krzc-2BdH9oG8zRksSAeFgIwrQ5a2qqQQQuLEb3wuKnSeJlvT9IcH7i14tXXmkr3cVqUOq9Euq-2FRi8tA9Jp-2BTziS2oBJyv1zug8QU2WQp07Q-3D-3DOKxT_ldvjFfFidCkX1UsNHybJvGoCS3IBl4bPnK8uaMf-2FXBxiGS0eBM0uLy-2FoqE2iZ5IkxWb7gakUot1R39CTYy56KttS6Q37O3AxvAqoFJD565o-2F-2BxW5F6qQNrYliTZeVV9UK6-2BB35UOiwWhaD8lzLnES4XQ0W3ZG-2F8iTLrbbN4MsQvBYn-2FGXsO5s-2FD-2F-2BvUMatp6SaFq4DQV8vP-2Fr4lfPnyHMA-3D-3D
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x2f0,0x7ffced9ac188,0x7ffced9ac194,0x7ffced9ac1a0
    3⤵
    PID:3360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1824,i,2291861541321278006,17928867667604222485,524288 --field-trial-handle=2260,i,7185411060681304931,17630921533131005135,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:11
    3⤵
    - System Time Discovery
    PID:1516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1612,i,11368744662009601062,14259929026071472018,262144 --field-trial-handle=2260,i,7185411060681304931,17630921533131005135,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:2
    3⤵
    PID:3364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2524,i,15311053820356564287,4899323802894008244,524288 --field-trial-handle=2260,i,7185411060681304931,17630921533131005135,262144 --variations-seed-version --mojo-platform-channel-handle=2688 /prefetch:13
    3⤵
    PID:3572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3284,i,10254224980464851488,8710674417289650238,2097152 --field-trial-handle=2260,i,7185411060681304931,17630921533131005135,262144 --variations-seed-version --mojo-platform-channel-handle=3296 /prefetch:1
    3⤵
    PID:1968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3292,i,5794558294262764559,1994344902638911047,2097152 --field-trial-handle=2260,i,7185411060681304931,17630921533131005135,262144 --variations-seed-version --mojo-platform-channel-handle=3328 /prefetch:1
    3⤵
    PID:816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4880,i,14694597843684316864,15344637534938880754,2097152 --field-trial-handle=2260,i,7185411060681304931,17630921533131005135,262144 --variations-seed-version --mojo-platform-channel-handle=4888 /prefetch:1
    3⤵
    PID:5568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3796,i,7234389103155539313,17440678834568614849,524288 --field-trial-handle=2260,i,7185411060681304931,17630921533131005135,262144 --variations-seed-version --mojo-platform-channel-handle=3748 /prefetch:14
    3⤵
    PID:4160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3800,i,16316648839799518484,14172626074161145022,524288 --field-trial-handle=2260,i,7185411060681304931,17630921533131005135,262144 --variations-seed-version --mojo-platform-channel-handle=3412 /prefetch:14
    3⤵
    PID:996
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5736,i,14491123342167151921,16217205109492818975,524288 --field-trial-handle=2260,i,7185411060681304931,17630921533131005135,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:14
    3⤵
    PID:804
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5736,i,14491123342167151921,16217205109492818975,524288 --field-trial-handle=2260,i,7185411060681304931,17630921533131005135,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:14
    3⤵
    PID:2224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
    3⤵
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    PID:2492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x24c,0x7ffced9ac188,0x7ffced9ac194,0x7ffced9ac1a0
      4⤵
      PID:5028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1748,i,12480969238341363593,9394539146052104736,524288 --field-trial-handle=2276,i,12326247281723244118,9718290303768544588,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:11
      4⤵
      System Time Discovery
      PID:4020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1580,i,803413241963232528,7920811942930643926,262144 --field-trial-handle=2276,i,12326247281723244118,9718290303768544588,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:2
      4⤵
      PID:3304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2532,i,13968650252076741071,10559992429471630135,524288 --field-trial-handle=2276,i,12326247281723244118,9718290303768544588,262144 --variations-seed-version --mojo-platform-channel-handle=2700 /prefetch:13
      4⤵
      PID:4932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4556,i,16541173770200219604,16367040892388521608,524288 --field-trial-handle=2276,i,12326247281723244118,9718290303768544588,262144 --variations-seed-version --mojo-platform-channel-handle=4572 /prefetch:14
      4⤵
      PID:3224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4556,i,16541173770200219604,16367040892388521608,524288 --field-trial-handle=2276,i,12326247281723244118,9718290303768544588,262144 --variations-seed-version --mojo-platform-channel-handle=4572 /prefetch:14
      4⤵
      PID:4380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4996,i,1702648657063379417,11392549349570285191,2097152 --field-trial-handle=2276,i,12326247281723244118,9718290303768544588,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:1
      4⤵
      PID:3996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=5024,i,4908161541858904529,9718272150571299654,2097152 --field-trial-handle=2276,i,12326247281723244118,9718290303768544588,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:1
      4⤵
      PID:1480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5296,i,5151180150843068992,4045300244385873591,524288 --field-trial-handle=2276,i,12326247281723244118,9718290303768544588,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:14
      4⤵
      PID:3544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5288,i,13608181394753361000,14667582128277597302,524288 --field-trial-handle=2276,i,12326247281723244118,9718290303768544588,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:14
      4⤵
      PID:4732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5916,i,6807509884350097204,11679200565151158427,2097152 --field-trial-handle=2276,i,12326247281723244118,9718290303768544588,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:1
      4⤵
      PID:2532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=6352,i,7448152516261378167,13236439471423876726,2097152 --field-trial-handle=2276,i,12326247281723244118,9718290303768544588,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:1
      4⤵
      PID:4696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
      4⤵
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      PID:1264
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x250,0x7ffced9ac188,0x7ffced9ac194,0x7ffced9ac1a0
        5⤵
        
        PID:5880
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1760,i,13926081989612788650,8746357973211100209,524288 --field-trial-handle=2220,i,17624853034505620490,10596776648548271419,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:5524
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,15296758897064485212,2830457048201439757,262144 --field-trial-handle=2220,i,17624853034505620490,10596776648548271419,262144 --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:2
        5⤵
        
        PID:5628
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2232,i,11453118032468611986,5516841413265006073,524288 --field-trial-handle=2220,i,17624853034505620490,10596776648548271419,262144 --variations-seed-version --mojo-platform-channel-handle=2792 /prefetch:13
        5⤵
        
        PID:1136
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4480,i,320922919819850503,10993765211830143515,524288 --field-trial-handle=2220,i,17624853034505620490,10596776648548271419,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:14
        5⤵
        
        PID:4380
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4480,i,320922919819850503,10993765211830143515,524288 --field-trial-handle=2220,i,17624853034505620490,10596776648548271419,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:14
        5⤵
        
        PID:1096
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4988,i,17383486217524568233,2967429974297048861,2097152 --field-trial-handle=2220,i,17624853034505620490,10596776648548271419,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:1
        5⤵
        
        PID:4172
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=4992,i,6857740448280772846,14885088642735898859,2097152 --field-trial-handle=2220,i,17624853034505620490,10596776648548271419,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:1
        5⤵
        
        PID:5964
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5520,i,2742142092283090984,15579061474033214915,524288 --field-trial-handle=2220,i,17624853034505620490,10596776648548271419,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:14
        5⤵
        
        PID:1032
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5528,i,13419620673648262660,11996472149142432622,524288 --field-trial-handle=2220,i,17624853034505620490,10596776648548271419,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:14
        5⤵
        
        PID:2208
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5944,i,11873433278787771238,10553538260207986542,2097152 --field-trial-handle=2220,i,17624853034505620490,10596776648548271419,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:1
        5⤵
        
        PID:2576
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6008,i,12978498301024954403,1785461637470853258,524288 --field-trial-handle=2220,i,17624853034505620490,10596776648548271419,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:14
        5⤵
        
        PID:4944
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5024,i,14325943491172469656,12853383798156820574,524288 --field-trial-handle=2220,i,17624853034505620490,10596776648548271419,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:14
        5⤵
        
        PID:3816
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5460,i,17779890072513007705,5330178230157341601,524288 --field-trial-handle=2220,i,17624853034505620490,10596776648548271419,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:14
        5⤵
        
        PID:4880
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
        5⤵
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        
        PID:4740
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f0,0x7ffced9ac188,0x7ffced9ac194,0x7ffced9ac1a0
        6⤵
        
        PID:4832
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1752,i,8947519992033018018,12495894071797624783,524288 --field-trial-handle=2056,i,16190228659976815455,2839389009310406264,262144 --variations-seed-version --mojo-platform-channel-handle=2084 /prefetch:11
        6⤵
        System Time Discovery
        
        PID:796
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1520,i,5299565622179169400,13944964098462558358,262144 --field-trial-handle=2056,i,16190228659976815455,2839389009310406264,262144 --variations-seed-version --mojo-platform-channel-handle=2052 /prefetch:2
        6⤵
        
        PID:3472
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2480,i,13959497554006484988,17493157624625928355,524288 --field-trial-handle=2056,i,16190228659976815455,2839389009310406264,262144 --variations-seed-version --mojo-platform-channel-handle=2576 /prefetch:13
        6⤵
        
        PID:3172
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4452,i,13485800653771715036,4367418194482223788,524288 --field-trial-handle=2056,i,16190228659976815455,2839389009310406264,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:14
        6⤵
        
        PID:908
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4452,i,13485800653771715036,4367418194482223788,524288 --field-trial-handle=2056,i,16190228659976815455,2839389009310406264,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:14
        6⤵
        
        PID:5408
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4940,i,6108738850834762175,5680600627921490836,2097152 --field-trial-handle=2056,i,16190228659976815455,2839389009310406264,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:1
        6⤵
        
        PID:4168
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=4960,i,16241216853818795433,17844701782534484927,2097152 --field-trial-handle=2056,i,16190228659976815455,2839389009310406264,262144 --variations-seed-version --mojo-platform-channel-handle=4992 /prefetch:1
        6⤵
        
        PID:712
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5448,i,7119541489638404852,4059515127572514044,524288 --field-trial-handle=2056,i,16190228659976815455,2839389009310406264,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:14
        6⤵
        
        PID:584
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5484,i,13238314196945633038,9223721362840211907,524288 --field-trial-handle=2056,i,16190228659976815455,2839389009310406264,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:14
        6⤵
        
        PID:5848
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5952,i,3121586822465991275,1776261810910527316,2097152 --field-trial-handle=2056,i,16190228659976815455,2839389009310406264,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:1
        6⤵
        
        PID:5732
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
        6⤵
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        
        PID:5648
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f0,0x7ffced9ac188,0x7ffced9ac194,0x7ffced9ac1a0
        7⤵
        
        PID:1760
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1812,i,15080146219602105193,16700573130988165825,524288 --field-trial-handle=2104,i,8975325787657665863,4148347334732311926,262144 --variations-seed-version --mojo-platform-channel-handle=2132 /prefetch:11
        7⤵
        System Time Discovery
        
        PID:3272
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1616,i,18276127363732399260,9227303497663323159,262144 --field-trial-handle=2104,i,8975325787657665863,4148347334732311926,262144 --variations-seed-version --mojo-platform-channel-handle=2100 /prefetch:2
        7⤵
        
        PID:2096
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2216,i,11305557337643010503,16289117493841533998,524288 --field-trial-handle=2104,i,8975325787657665863,4148347334732311926,262144 --variations-seed-version --mojo-platform-channel-handle=3296 /prefetch:13
        7⤵
        
        PID:4720
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4488,i,3270469099853632729,6721664537358768086,524288 --field-trial-handle=2104,i,8975325787657665863,4148347334732311926,262144 --variations-seed-version --mojo-platform-channel-handle=4504 /prefetch:14
        7⤵
        
        PID:992
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4488,i,3270469099853632729,6721664537358768086,524288 --field-trial-handle=2104,i,8975325787657665863,4148347334732311926,262144 --variations-seed-version --mojo-platform-channel-handle=4504 /prefetch:14
        7⤵
        
        PID:3880
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4948,i,6464972882924966630,4603026277498448484,2097152 --field-trial-handle=2104,i,8975325787657665863,4148347334732311926,262144 --variations-seed-version --mojo-platform-channel-handle=4992 /prefetch:1
        7⤵
        
        PID:2420
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=4952,i,11794079120938080347,8378736073490401358,2097152 --field-trial-handle=2104,i,8975325787657665863,4148347334732311926,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:1
        7⤵
        
        PID:5688
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5480,i,4416660324440889322,15623998931098343874,524288 --field-trial-handle=2104,i,8975325787657665863,4148347334732311926,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:14
        7⤵
        
        PID:1600
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5484,i,16746713690266732478,6435251931508151250,524288 --field-trial-handle=2104,i,8975325787657665863,4148347334732311926,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:14
        7⤵
        
        PID:5660
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5956,i,1770949711322782039,14509088617941682829,2097152 --field-trial-handle=2104,i,8975325787657665863,4148347334732311926,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:1
        7⤵
        
        PID:944
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5984,i,5154749779422865516,2946360766030212121,2097152 --field-trial-handle=2104,i,8975325787657665863,4148347334732311926,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:1
        7⤵
        
        PID:5432
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
        7⤵
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        
        PID:6132
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2e0,0x7ffced9ac188,0x7ffced9ac194,0x7ffced9ac1a0
        8⤵
        
        PID:4540
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1832,i,7348055646119714428,15834751311429014649,524288 --field-trial-handle=2052,i,13712108788164267535,3190142661884785949,262144 --variations-seed-version --mojo-platform-channel-handle=2088 /prefetch:11
        8⤵
        System Time Discovery
        
        PID:572
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1580,i,11274883849613235108,14075021808059170699,262144 --field-trial-handle=2052,i,13712108788164267535,3190142661884785949,262144 --variations-seed-version --mojo-platform-channel-handle=2044 /prefetch:2
        8⤵
        
        PID:3572
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2344,i,6679844455679278560,15560830918152914420,524288 --field-trial-handle=2052,i,13712108788164267535,3190142661884785949,262144 --variations-seed-version --mojo-platform-channel-handle=2872 /prefetch:13
        8⤵
        
        PID:4644
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4408,i,15049860923654896333,15170485372822429818,524288 --field-trial-handle=2052,i,13712108788164267535,3190142661884785949,262144 --variations-seed-version --mojo-platform-channel-handle=4148 /prefetch:14
        8⤵
        
        PID:1176
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4408,i,15049860923654896333,15170485372822429818,524288 --field-trial-handle=2052,i,13712108788164267535,3190142661884785949,262144 --variations-seed-version --mojo-platform-channel-handle=4148 /prefetch:14
        8⤵
        
        PID:4576
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4400,i,5370291933171603133,16655151874507050199,524288 --field-trial-handle=2052,i,13712108788164267535,3190142661884785949,262144 --variations-seed-version --mojo-platform-channel-handle=4104 /prefetch:14
        8⤵
        
        PID:2412
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4512,i,5111759926109160303,17454377029083702532,524288 --field-trial-handle=2052,i,13712108788164267535,3190142661884785949,262144 --variations-seed-version --mojo-platform-channel-handle=4752 /prefetch:14
        8⤵
        
        PID:492
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4464,i,4386231350865829277,10773322320665750108,524288 --field-trial-handle=2052,i,13712108788164267535,3190142661884785949,262144 --variations-seed-version --mojo-platform-channel-handle=4796 /prefetch:14
        8⤵
        
        PID:3168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://u40859938.ct.sendgrid.net/ls/click?upn=u001.EqP6qanbc9aRZyIv0zag4lOPEZ16rO-2FzE992qkSw3-2Fqu4eqlDA-2B-2B4UlsJE5qlWZBl-2Fj0tQHAcYz5bqO-2BURDwixtLqJNNeq2szXDC5rM7Ciid9-2BctMb9DjEfsGjUq3z11u00JPcOa2vOIRmwcRnCx1kmBf4dInnPaKvjEHnEH9cZ6Krzc-2BdH9oG8zRksSAeFgIwrQ5a2qqQQQuLEb3wuKnSeJlvT9IcH7i14tXXmkr3cVqUOq9Euq-2FRi8tA9Jp-2BTziS2oBJyv1zug8QU2WQp07Q-3D-3D5LkW_ldvjFfFidCkX1UsNHybJvGoCS3IBl4bPnK8uaMf-2FXBxiGS0eBM0uLy-2FoqE2iZ5IkxWb7gakUot1R39CTYy56Kn8CSMDgKAnWQsImmQ3jV1SDw0g17bltashIxfkOHZ1dvX14DJQlvqyvkwM6fVCBJD93V-2FFrxiU9WYOQQRAcmH5-2BTBWNz7wc1LNnrLRZDObV4qDOj2SYf3ZsxAR-2BlfeFbA-3D-3D
  2⤵
  PID:5276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://u40859938.ct.sendgrid.net/ls/click?upn=u001.EqP6qanbc9aRZyIv0zag4tiOuhF2TFHixkU-2Fh40J5lTz82KNcirmkWVl56bFG-2BDrbunwU4KJZdfXYioaTWMdaiXH6HRVyNymhqgt0d-2F3oQbBXXntIGQvISRgnTl7uleijFkz7bY-2FQgXgNIyBP8cd1YiOmbSGZXy96CgPLnfPqGJZD52h5lK816Zu5vuloWPP-2BJIvDZt6G41qH8Sck5ipg043sDXmSIlvLQ4dnHJoTTqXnZgaRMfOMSxyO5xIZ04-2BfbQi_ldvjFfFidCkX1UsNHybJvGoCS3IBl4bPnK8uaMf-2FXBxiGS0eBM0uLy-2FoqE2iZ5IkxWb7gakUot1R39CTYy56KuzmNqJUFD5ekLinU7HOFfXR0fB6k3T6g5nYr8DQg1b1p7oNnTXAoXPzkMzIKMkkDcH8sBkkuu0ExcQxxflVFa-2F2U-2FgByGnh9bg8FIvo3ncaHpS0g5kys0WuMrcPXlPphQ-3D-3D
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://u40859938.ct.sendgrid.net/ls/click?upn=u001.EqP6qanbc9aRZyIv0zag4tiOuhF2TFHixkU-2Fh40J5lTz82KNcirmkWVl56bFG-2BDrbunwU4KJZdfXYioaTWMdaiXH6HRVyNymhqgt0d-2F3oQZhQkXxAfqGD-2BsVP4lH0JRSqsOjhSWJCFrPt-2Bp3cKhqAcZStL8WyvXAOXDAbR30VTnRRi6QRIt1o3LK2frTxpWyknV9u96UVSLR68xwaH0vAlOHZHXcA1khLBNvTQseG9nBYSgJOk2-2BUytaKyeTp-2BNUqr7Z_ldvjFfFidCkX1UsNHybJvGoCS3IBl4bPnK8uaMf-2FXBxiGS0eBM0uLy-2FoqE2iZ5IkxWb7gakUot1R39CTYy56KunxuYsPhZJHx9uKXei8YdcYTxTPAd25RcQlgRDSPRfq8NBg-2FbIK4ELQhCTpUTnnrUC9dINZfP6-2FGdEbyvDrc4uya1fCi9c-2B-2F-2BGT79Ea4vV-2B-2B8MNErewqwCPrVLOB-2BnxqQ-3D-3D
  2⤵
  PID:1536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://u40859938.ct.sendgrid.net/ls/click?upn=u001.EqP6qanbc9aRZyIv0zag4tiOuhF2TFHixkU-2Fh40J5lTz82KNcirmkWVl56bFG-2BDrbunwU4KJZdfXYioaTWMdaiXH6HRVyNymhqgt0d-2F3oQZYmhEzv2KLz-2FVSJw7DlqkO-2F6XsojUmEKNbNmfRtYeT8wSGnE5zwctDvQ7yKJkzw6rnko3P8xRnAFySxhyhvmp-2BkDOiQDJvGXkfsxgvxMRPFdjBzCKNOHHGw2FnM9ukZh-2FJtRYZKsdn2kTjztdqifA3E1Jy_ldvjFfFidCkX1UsNHybJvGoCS3IBl4bPnK8uaMf-2FXBxiGS0eBM0uLy-2FoqE2iZ5IkxWb7gakUot1R39CTYy56KrzKiO4Mva86lOcbAuSAxVh9SeBwiEAKGWcCQ7-2BIM7AvIekt9QGtbLKTzIAJOP0xbA1PV06-2BLB385S9czGAqzAQOEq01CSoKKfJOrAKX-2FzEZyphVqc-2B-2F96jhUrEf5zp8EA-3D-3D
  2⤵
  PID:4848

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4940

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1768

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4504

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4760

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2512

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:5692

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6068

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5500

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3176

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 4KB
SHA256 0300e9ddb527990e8b59d06e9ccf3ec2bd92d3bbd0ef4fba69d6336e4195e82d
MD5 5f036f91e86e30f749961506951d51eb
SHA1 acb87b59117c6e2db86f98c4c8bac52eade97cd4
SHA512 341f250cf3764207b5328a12b31016c0750daddcd16722b4bcef502bcbef7ef379abb601649ee6c3fdf121f3d3cd6890c8a80e5dae3169fe56ef82af20631944
SSDEEP 96:Dbonzjs6o1BXl7EV4/sClywa3UHimRkISatmQFjm:Dbsns6KXxUrClywawinLatvFjm
TLSH
T100A19E44A75AEB61C331EBB6829B7B51033B6D20178468FAEFDAA1E1695B44C143C3C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 342B
SHA256 051a1f8a4315455944b3a35245c580584fcccaba8479e2c414a27f7751575c87
MD5 990f0697209cfcf85e918f29561985b2
SHA1 eb523ded3e1838ef95fe4a58eb92afa8d3f37c03
SHA512 d0f18f6138baac19cb4b74bc4f9a6e9f6eb236c991a323b30ed27b762e178b5eaad9acd563bf578f738e51a3bdaff0142f31915c9863f1c49d6db8e512775fbc
TLSH
T188E05E116FEC0204F5770A3DA8736549997BB77BAA41CBDD0275008D1C25FA2DD7271D
MD5 SHA1 SHA512 TLSH

Submit Download

2cc1016b-0961-46f8-871d-11606dd6700a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\2cc1016b-0961-46f8-871d-11606dd6700a.tmp
Size 26KB
SHA256 4a6eef48222690dcd9be80050bb6f700c92631c11481afa1e524cb41296d2b12
MD5 ec69c53a97c67c0cad78fe3b4a8e5023
SHA1 93eec907ef847fdeb37a4ece240b2907ec945e86
SHA512 6aa2c26f76bb4abc5b8f27254f30bac9d3e17388a45bd7ed70627cff0e12032240cfc4b94985fd50b75ea4d3d2c44edb97d1acd67279ba5c060b78153d10b72b
SSDEEP 384:nlZcIh8NOCyhozUSyDgUu8YwWrEGoofUghJVFE48GryKJiMsRnlYwBT:dhfxBCf4UfXhJVFE48GryVhn2oT
TLSH
T117C26B7D9C646C7F85BEBB09A68E29238D74513BD6B41E18E7E85B0DC032888F302D35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3013465-2205-4897-8234-6028834236f3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\d3013465-2205-4897-8234-6028834236f3.tmp
Size 105KB
SHA256 e1a61cf8ec8c094e45bb4e86f9cbc36aca297f52fa265914107ac060ac244abc
MD5 c1020ffefc90bc7c0d9059a02e960b8c
SHA1 1d726953f428dd465cfd01b654ce3b7a765b61f3
SHA512 40f698ce62221a6afae2bf5f1e4294e14a453f86424880e8dae96a6e7ce6df357b45fb00ecbe3363502bc48237cb8b523b7dd97f505ce64513f4fb4e2993ecd5
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7c:fwUQC5VwBIiElEd2K57P7c
TLSH
T1A9B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 1024KB
SHA256 1c02e2feba3b2af3c045d1ed01f8a67e0923f7e357b32c434e567eef6aac4138
MD5 f05b0294ae4949feed0706bc80fa6418
SHA1 346bb7d2d99251c193652ad4ae7ef2964565b98d
SHA512 348366e162f3a037e74d0e9ff422ba7ca3e14c2b170f50bab2a4b88b29a572028e56965c332bc63cbe89de1a3467c215893ecf3cac514d786ec7ea30c08bcc05
SSDEEP 12:bHiUXhV0xosfxCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:blRqxosfxWMk8xVZ4YWI30otWn
TLSH
T139257D85B34494FFC8C35A7189BD17903774F6DE5F42835B6A377A0E2E671D44B48220
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0fdfc88d33e5873eb883dc0725b47ca88ec9b88b87213d6bb552b1f5dcedc9f6
MD5 1bd38a0ec85b29854c32787087b839d1
SHA1 7f41f3bf19fa9e6d4c8555833785ce0f7e7cec56
SHA512 d9efc0b6ae1cb228ec213dbfc07a2d0a9da0ceab5f7d78dd76e21a058943830895076c0f6a471037ea59a156451fb86ff1cbb4280faca47d2b9aa6e4f4b5977f
TLSH
T123D0A7B5F5564152C9450031E8D16F403372443038EF9E9293EA68089594090A3DB169
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7eceafaa55fd41ffad6debb85312fcf3e910a176de4f2b4e50ec7f43b16cc3fb
MD5 608e256950a45dca015f38a2cff556a9
SHA1 a8e0b5c88e6f4983b403ab3c41493e4ea37c663e
SHA512 43babef92589894a59db5542b56ae78892dee13dec29381332c3f727772f88f5d7b723963e0c364a4001b5f3dd467e14b7506f13236cca5c0fb8053cce0d0a37
TLSH
T161D0A7B5F5464252C9450031E8D16F40337244303CEF9E9293EA68089594090A3DB169
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 772adacdbfed5a63b90ffe5dcbf0debf486323c2f1dea65b11c0d0f4c17598fb
MD5 838327e0cb1874376a84b1312a60c251
SHA1 60fdd2c097d30805ec384264d1881ea3a74471ec
SHA512 045400ec54df11f8b55a9deb1f63aa67ea29e0a7e85fd3049bd28b67a6c4150e8763277737b4e6faf08e838f96980464606207a60c6f1b25dc7a2f5aba79f4a5
TLSH
T1A0D0A7B5F5464152C9450031E8D16F503372443038EF9E9293EA58089594090A3DB1A9
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 41db081cbeed1d542dab8556e481014819dd9621cc8f471a1ab30fb5a9b2d612
MD5 7cb606e3f62ce7cab80b20bbe05ea398
SHA1 2fc2b2680ab414be518435760dcd1694b524c278
SHA512 41bf499b86b77a7005c8d6f8c1735b114f5d0944e113a8629de616c231986071280eae7237f46891ee6cda15ba07e8dcf667b6e524e8ac53217cce08c3dd6dce
TLSH
T1D4D0A7B5F5464162C9450031E8D16F403372443038EF9E9293EA58089994094A3DB269
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e3c932e879f8a7071362a654b47cd73c05f90d7fe66be785d811b84b86743e1b
MD5 8c92d931ed33c3d779a020ae7e111fb4
SHA1 de123f6d92bf24747affe820aaa8be3785388fae
SHA512 5be895d6a61eacf4f3117293636fb4890abbe186ddcbfbb3c8d3aa0fd1aa59519bbdd86e552732d2ded27aae5be1ffb0d6d9f6ccaac824d1b13ed03a12a438dc
TLSH
T13BD08032BB9D6452E7455230D893DF10276644A12C978B42E325C84CD5B90D493C3282
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5f896b32f2101e33ea31c20ee10de2ca1fe3d38397dee0f734c2de97e82aa83c
MD5 3f0c2ea5d5e016237938554be47814cc
SHA1 17b2788be3d9fc27602369ad5da4e572ece8a228
SHA512 31e0843ae0a960017b5324cd6011fc4d6fd8a68d94ba22e9abdc7c3491d5fa5b631c5765707361d33529f72e0713e1ffe945a52c72ba399151e1565d8dda55f8
TLSH
T1CED02370F96555F1D5180034C8A06E007765457239FF47C253715C0CD9B40C0D3D7AD5
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0b5dc1bf65a27f8ea20844919d7db192caf7a54fd791434a1304a7df2e9b496f
MD5 5de7bfd3f869f48e7255b6bdc532c4bc
SHA1 c26027eb70bc9887bf69c2b22be60226b685dbae
SHA512 0e6af8c455f57dc816a2c01366f46a0d069e8f41cccb1f7565e2afd873b71ffd5f135649fb4bf44d1a15a9efd68dc59696dc74a971b3483ec9d87a4323b2b4f2
TLSH
T112D08032FB5D6052E7455230D893DF10276644A12C974B41E325C84CD5B80D493C3282
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9a7c058810f302adc953d9c719b78dbb7092713af5fdb16b753e2703f68ddd70
MD5 605d73ac51ae04b94e0e5ba065cff7f2
SHA1 26dde968db25c14eadfebe1ef83580cf6d184868
SHA512 4b6f483ef440e3181a93ac59fb03f2cf083ba8a53954b9e4789389904f62ee9f82068ff756543cd2155282b4e26ec86c44b3f35b6419ab720c777ad4b2b9f5d1
TLSH
T10AD0A7B5F5464152C9450031E8D16F403372443038EF9E9293EA5808A594090A3DB169
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 aada0f5d476a7976903c87a31672e111aa80ac9f7291509a4a5422ed7ab2b959
MD5 c98def1172bd7178d6dda2415ff28acb
SHA1 7915f492a0683f9ba1ca45c34085abd548faaf99
SHA512 a4f161cd331cd0ac809e8d40fa89f8c421f56f5a3cb81205854a4b6da90cc80aacb15604c6a7505fc65368e4616ae5837aec1115b5da8ad96000d38bd1356d08
TLSH
T136D0A7B5F9468152C9450031E8D16F403372447438EF9E9293EA58089594090A3DB169
MD5 SHA1 SHA512 TLSH

Submit Download

2ddaddf4-40b0-42d7-a44c-791af78039e1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2ddaddf4-40b0-42d7-a44c-791af78039e1.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 c8a4194eeba1da0da4935365e8fcb819f3356e9cac7b299b2c4893c0228d56f3
MD5 1a6c8a9fec2fadb396fc182240058423
SHA1 0e39e8a4e9f794c345014b624ec28b8404ef122b
SHA512 68294f6b3bf6a43c5ef397564fc30be5fb845b0f6f7812890119c6f3cef353d999415080b8a58a08dce36c975a90bc3d5337d87b472fa76d1eb513d6279f5614
SSDEEP 96:r/wdM1MKerggrcbVwTozSLJgXsVXkpuv5fMYwP:zMKerNobGoL6e8XwP
TLSH
T1B1A1605961521A63EF12B2F0A7C04A093871AE7F80771ED656EC6CFE019EBD5C7D2207
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 e04786530e2c3fc6f4b78d45d83cc24359064f0c0327d7beaafde40576eee272
MD5 74c3f467d4fd161f59ba28b4ac70f578
SHA1 de0791714e8430f174fa4ba107b984389ba84270
SHA512 0dcd936cf1ea9fbfc4b581e309469e8568b65119febd608ce67ad9967d47bf2831aac3b1105ee39f161996935c606335e013a30beac5802d0d78668406fe5428
TLSH
T1A971D652024263E3EB5122F0ABC0920A3572C17F45271E5A22FCADFF008E3EAD7D6117
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 da3117b655827a1f2a99921dcd96e131312596e37e273dd394559dd1631d18ae
MD5 78e69d64de5eb57de91aa0f7659ede12
SHA1 e804aacfc7d282d7ed874e5f3e221f7f567a630d
SHA512 5d7bd5dc532934027f03da9a70cea4a12c3abad75f825020c54b6cbed31abfbf0755c6ce5146eb8a627991b8ff4fe968eb28a01c7df4b901207bad512f4ddab4
SSDEEP 48:JTilTlf01p6WV53cdvQuBLUQIPjlMToglhQWRhbxWcrfpF9/8Vf8u4PU613:JTETlfS1V5kPRGjlSlhQyhb9j9/8sMK3
TLSH
T13F91C35162912AA3DF5032F0A7C05A0A35718A7F84671FDB12ECADFE104E3D5C7D620B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 8f5908705a5b421d130ead599e1b46f97625bf7cd5d1681528a1d30401369866
MD5 6bb2603fbffd5924b9275c835e003552
SHA1 ed20d438d0e5782b837b5e1de45e2ca0bb7ac460
SHA512 a1ffb35fbb1e951d17c40238f015839b2f41fc50bb0452565101d60275ec8539312d4ff3bd52ddf3358b89a7651a36c03af5becc3b988852e7ddfc5aad1dde49
SSDEEP 96:2szwL240W1ot/pGPxsaKXANEAqBfXGSmR:M20onGZsaGAqwR
TLSH
T1DA91D35162912AA3DF5032F0A7C04A0A35718A7F84671FD712ECADFE044E3D5D7D620B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 dbbcb50404f546944d140380c0d8642a5c408f1be2c7c6919746452a2bc06577
MD5 3c2a6acc2610f81aad7035760d388213
SHA1 e56f35e494ca0bc9a416b5416c96e680cbeb2c7c
SHA512 bd7e6c832e6a418b902961b9a4b1eda217e30acd628334b0ffe56f370dbd359ad44f5455f999651fa8f777a528cf938b6cf05c0348ee23e0304cf2267bc73969
SSDEEP 96:D8yiFDiwAiit/GB9aSYO4C8xZ9q2I1RxlApqstl:wyikwycG5ZxPzEAD
TLSH
T192A14C1961521A63EF62B2F0A7C04A093171AE3F80771ED615EC6DFE008EBD5C7D220B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 0e87b911812dd4279f8b5509a5424c849edcfda2d6de78f824bab980157173bb
MD5 791b15685f0ef9973f44c475a4157d63
SHA1 4671cdde4a733ab286a941a3fdd622f614a20197
SHA512 5b54fe28d5ef5f957888ea8cf1aac66987791ce5a48ae2b0e301089b3be7ea85b492e1f0312130bb7f701e558f1e434f4fc56a601dcbd1dfd2a4ad0e782b021f
SSDEEP 96:gzt9NzdPT1VXoIlogkwEgBbNT/p4xOG8wXi77:U9NzpFkwEEbEIGK3
TLSH
T159B16159A1621A63EF52A2F0A7C046093471AE7F80771E8655EC6DFE054EBE6C3C2607
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 446054c146bfdbe14522eab49a40f8feadc0979cf305f57c9ee72d4b9e036ec6
MD5 7844cd777243bbfcecb231dbafbd293f
SHA1 bbf4ff457036462163dd8ac5564045c66ceeb4ce
SHA512 4f5b76c280c66e6e481334e6e043408a57970a59ce2535363b599e15ee2b51fdb5db417b5221d1047a038c0e0cef5fcef3062bfee55d7cb265d75a2b8edb2c52
SSDEEP 96:mobnOpbFs/mstOE9lbLtYqHGn7k151f3Spvqa:dnOpbK4WlvSqHcqa
TLSH
T15DB18319A1621A63EF52A1F0A7C046093470AE3F80370F8655EC6CFE014EBE6C3C2607
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58d31a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58d31a.TMP
Size 3KB
SHA256 1cc9de248c9e5b27932b771602be8688f9ca359762a327c4912065efbf001158
MD5 f92d69a2099e9f5343cf942d26b175b1
SHA1 2f849a0b9badde0df841e5c72f143b3e8be213cf
SHA512 3ed5dc525105e4994d9c66c166eec742721412121e1cd239c89559fc517b2601606a22166b3dccc2d313d11ef88bd4e47b414f051bafc4498b36a3a8c874e17b
TLSH
T12D719516424266E3EB5122F0ABC0520E3972C17F85271E5A22FC9DFF114E7E5D7D611B
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 b431c0a114099788a9481f556c969332db24533ec3e7175f298b575926c27dcd
MD5 a09f43da9320c275080fc071b13ad5a6
SHA1 d099418d0ad8c8a0c32b270130bc3f0c165435d5
SHA512 4235cbd5ce6ffaa65a8bb57bef49415af43761d817b387b40ad571dac2e358ecc897d9ff8da323958bf04e68a2fdc368a895d3046a26da991e5f4272a50dd857
SSDEEP 3:MsEllllkEthXllkl2zEklyn7//:/M/xT02znynz/
TLSH
T1BA4404047FC01405D50035304413D3511371F4745515574334510C135DC55400C00100
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 912B
SHA256 5b8b95bcfc5166dae664a63a04cce2c7181632bb2aa16ee3eceb52dbc24ab359
MD5 31f2fda68069960fc373111b3b077fe8
SHA1 261eee6c07a38136aecdf18edd8561fe6e770935
SHA512 9ba0c6d6e5bc149a052565c05fd051088a61e04012f246975055fb716b43b519f150543f1b20df171407eb43bbed922668b3d0e510348abb0f2bd93ef6ea3ab9
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 319B
SHA256 3d012c54dcbea315e9f3893405e24fbdb91e39b119b263aba57936e29855af34
MD5 fd8e3e783d7feb56e42d2dc142cae51a
SHA1 fa069c9c56d4e4c19833d901b1e8d0badafd61f2
SHA512 ba7e21e25528d6e09393fcad97ef213ab222a5f4603331c2a03322734e2ae23814fb821baaad7ad03f8df2cc6497a5e63185124884fdd3de538eb17f3098e818
TLSH
T1ADE0205409C8C11BDA68E5D3527C570883E1F643B3C47D01278DCC446287D7273C75C4
MD5 SHA1 SHA512 TLSH

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.108.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

computed_hashes.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_1\_metadata\computed_hashes.json
Size 429B
SHA256 b829b0df7e3f2391bfba70090eb4ce2ba6a978ccd665eebf1073849bdd4b8fb9
MD5 5d1d9020ccefd76ca661902e0c229087
SHA1 dcf2aa4a1c626ec7ffd9abd284d29b269d78fcb6
SHA512 5f6e72720e64a7ac19f191f0179992745d5136d41dcdc13c5c3c2e35a71eb227570bd47c7b376658ef670b75929abeebd8ef470d1e24b595a11d320ec1479e3c
TLSH
T10AE055170A1A50B79BB8DB90EE525CA2E8A0A6B1C50438D63E608234B68A11F738347D
MD5 SHA1 SHA512 TLSH

Submit Download

verified_contents.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_1\_metadata\verified_contents.json
Size 1KB
SHA256 d23b2ba94ba22bbb681e6362ae5870acd8a3280fa9e7241b86a9e12982968947
MD5 738e757b92939b24cdbbd0efc2601315
SHA1 77058cbafa625aafbea867052136c11ad3332143
SHA512 dca3e12dd5a9f1802db6d11b009fce2b787e79b9f730094367c9f26d1d87af1ea072ff5b10888648fb1231dd83475cf45594bb0c9915b655ee363a3127a5ffc2
TLSH
T12B317466C8683D56267A63348E2D0602EB57C2BB0050640EB5AC558D4F7115FE242FAF
MD5 SHA1 SHA512 TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_1\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 28KB
SHA256 cb6e1eb0e8f98cc006d343cfd392f9c20ca6203b645bce3cabeec2cd56d87b67
MD5 abc60ee615e0ecdcbc273a7c13923173
SHA1 a7a8f965cc513c0213cf7db40f76ad2977a8ba9a
SHA512 2a7a78bf830e837697bb0a2e0fde7e96df001e2887da549d7c654ba025a581520acd9406bfef6700f56b473d1bbc7dfb8944dd6ce6229ac61403c501242d8f26
SSDEEP 96:BBCx7ieyDAm8zekqQQgh7WqyUoWgh7WvyUo:3a70Am8V4gMUngxU
TLSH
T195D22A1756763813EFC60C7A03691524C977E92C6FF1CCACAC0B88706FB4C956073AA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 204KB
SHA256 74f0c4c6feddc738ee86c1148a5f47641e00482c4739aa4c2433f9c677fd7290
MD5 15eb8073243b9ce4c76d15688fe130e3
SHA1 4f5f7360d30476cd04e0d7ae531b432f4c634465
SHA512 9ca2d180692a063af1783a77f1e7d31005d18c0cdade9211d384d66154aeb71d57d3a3d1ef7c4e7c2f65d3020e5a2991d8cceed08a83cd6d3c5c11492e048414
SSDEEP 192:IAjA0+G83uxXBBK31GkSJ/C9mo7qGEJH7DNspUy:IAca83uFBBQ1GkS88o7qT7DNspUy
TLSH
T14214651F4F343712CDBD417668E744A29C6DF03F8B52A5DA686118B4CFE2B52A01C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 334B
SHA256 bd214b832f951f07776e1c11753d4f6bbeafd2a2db7e882169c9dea5f08d28ed
MD5 41a13af34dd6b7ef4c071e7e4b861854
SHA1 81e1ad02d0e1563538e21428a439043397e3a155
SHA512 51144027ffa8afce898adaa52ee3c933f91faef8235408ecdaa0296f9c8430b2a35b1c4668858b6150abeabf496fa1966e66e15e90d3ea863f84feb2c5407c77
TLSH
T15DE0D87049DEC5199B556257A22C6708D3B23647E7C8BF016B45DC84B10E415A2C21C5
MD5 SHA1 SHA512 TLSH

Submit Download

57036480-c1a5-4523-a342-7665c0c512cb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\57036480-c1a5-4523-a342-7665c0c512cb.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 1ad5c045faa02f5e23b29228be45077b40c309ec3cfb92845e103d06e03b450e
MD5 196e75bff305c841fd2107d52947e856
SHA1 5cf1e2b14879388b05368045b27514f6a5d59107
SHA512 ca0b7b3215881c1c627f1917e63ac9f5a1f4b374ab070eeb28d7b1f1de14cd675dab4eeef8938d6a954720569faa5c422b3151954bb49c628693b6796b9f3033
TLSH
T11151AAF3C3E8C56DCD0156F0AA14AE2BCE2D0925432C3D5AC8E4AE5B93F2471E24168F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 29abde31f6514ca7364d0ad6330b8907891c1496c7dd26784b4a4d6e52a7c5de
MD5 4e4ae967e654957a27c1686ebae06399
SHA1 734974b689cd0cfae39aeb9b962a15421e644744
SHA512 1c5aebd5bf6180328d5032c04b2f06617cadcad6052f91e4eea297c69cb79c272768a286ae2c24cebb73a8defc39ace6d1851b98753184e9da1644bc72efc0ff
SSDEEP 96:DKObA+zili9MGc+Iqn0n1qauSpGP0BwEZfNK2mtBS42pcb2NC:D5bA+Gli9MGHIqn01qaHGITfNK2mtBbx
TLSH
T1B9C1CBF7C3E8866DCE0255F5AA24AE1BCF1D0924436C3D5AC8D8AE1B97F2471E24164F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 ef328fb66e569e4da06a22cbf0fd3b6bc8c758e51262f219bda1a60b852e4ae2
MD5 af7dcf01db0603634512b0ba935b5f65
SHA1 063ec26011ba2df47cdd23827ae1aed0ed71c5dc
SHA512 71077572a1b96f18b0fe5788de3ee4f47ec02c8050fc3f52b820d9526d8aa53564e83aaeb2242d22ca492f5eb4501b0d6e69a025c79a2fde30843a82d17b39f5
SSDEEP 48:YALlN0OgylPpKsYRstzEsufoKs2gmg/cJzsnczsOGcEsQC7P0BngsDqbsTZsBsyR:DKObA+zili9MGcEGP0BnbqHF0qauBwQ
TLSH
T11F819CF7C3E8866DCE0255F0AA146E2BCE2D0564436C3D5AC8D8EE5B97F2471E24158F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 7291561b014bc60563e5fac1be372f1f7982c94cf07175601951808995452c1a
MD5 d0f0fa3e7ed10d1c2414223e55bdf5af
SHA1 68420a0f39c6d257fa74f9cd389cbdf9cd956155
SHA512 a3c960863975d0890a2d56506fe457b401c559d0f2223c7095dcc6bdf2528be281eb6e7e4adc864601dcb7d88b6726e88fb551f00a9b8ccb37f8a4e719249006
SSDEEP 48:YALlN0OgylPpKsYRstzEsufoKs2gmg/cJzsnczsOGcBP0BwEsTZsBsDqbsy0n1qc:DKObA+zili9MGcBP0Bw+Iqn0n1qau+x
TLSH
T17381ACF7C3E4866DCA0255F0AA146E2BCE2D0564436C3D5AC8D8AE5B97F2471E24158F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 e155dea7df6cbdad8cd06a50292fead534a27b3318fbd1452e2efb6ed88655de
MD5 e54a28f368ce21c8a3491c8b37182847
SHA1 ddae329f4ba36365ffaf64b437e054833753ba84
SHA512 6e13364cc1d79770183f21f4fbb9e0b2b6ddf317a6093ad74e5eb1a11abbe0c64810d5542b4d0b7a02d338bc4d9ff8d7985d17f9fad72588be99eb8db3f8e86b
TLSH
T18C51BAF3C3E8856ECD0156F0AA14AE2BDE1D0925432C3D5AC8E4EE5B93F2471E24168F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 2663483726c4608d18a40e4ea628687d05f54b621d7fb9f3bc7217a3f2872586
MD5 b9fbe8136d3bf04970a0251bc4615dc3
SHA1 e598233a041890eb3bef4e271f2bcd4520a57b18
SHA512 657c64aea3ed0edf5a1fb3ae9a926634308f2fbd8c90c28275a64724dbeff19b659ec3b11bfae4bae9927cc2ecceef3290f5692b1cadbc5350e106e361fa3507
TLSH
T15451ABF7C3E8856ECD0156F0AA14AE2BDE1D0925432C3D5AC8E4EE5B93F2471E24169F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 6428037984d0e5b75cc70b6720a4645df3c130f5e72eee9f27f0d53396e74343
MD5 8bb4c66075b5381bb9724889609146fd
SHA1 6373b8c3b913e1d3b70da2d108f82d633b761a71
SHA512 cd73155b6666f1986e739348e3bf007bc68bbbd0fcc920a38e81e3a27019d37414234c83262df88168342f7f2b5f11a041762e65cbb7f0d29436266c3092f4ca
TLSH
T1333168A784BEA87B603C2C6F0E48780619FEA83540525CF8DFA7806CB0E05F71B16427
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 690B
SHA256 98dce2d8f491cdc3c272046f1d3e62331a0e3ef74554df8b79cde326cbda5b44
MD5 631e0e4437888ea4f501147c9d69356d
SHA1 066b72b6b1169c50318babde115010be81c8a4cd
SHA512 6a34914894f36f90a94e6beaef70eb99af078cd1eb010f3eada60e0120547c78df0708d6198a60a559ae2c62b4a4ed38bea5f10f32ee5655a338c37dc5898f45
TLSH
T1A1012BAB80FEA8B72038693F1D59B80256BEA432505258E4DBA681ACA0D41F75A1542A
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 9b47c0084253f81cb27c65ef13e96c27b871dfce0aacc185fec58a953c5e43c5
MD5 a649d955fa1b628c3f00bd8b7c3458d9
SHA1 c21abfb440634b5852fb54a1d917d7edc1a20008
SHA512 d2e3b9c220d20325bfd27e870f2a9877257909bfc2ca29c0374bbe24f6d3706ea309d07995278d1532b488e664e94fa84ee0bfbae46bf22b80d590125ceabb36
TLSH
T159315AA799BEE87B603C286F0E587C0619FEA83541525CF8DF66817CB0E45F71B1242B
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 2KB
SHA256 ce80faeb5c4824fb22118e4eb313a8c9d4348f8a9097b9c4a701be8684bd05b6
MD5 8dee1f780bf7036f5ca851a42834165b
SHA1 f5c25b8619b640746aaab9236fbe3483add7bc17
SHA512 241005a36bc70eb8fd0bb2a9141a748a73c2129cc9b1449e5020498dd6363587630b75a658bfad62e4b9da645f310046d11edb1c2f0a98142937ddb49a17ac20
TLSH
T1AA51A0A795BFA87B503C186F1E05780629FEA83501529DFCCF66916CB0E45FB1B12427
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 690B
SHA256 863404dd80d1a236cbee2c3059b5892b215c2f1b761dc0e4c55fec5ed40dbd58
MD5 9d1dd9b52bf82151941e6d5e52f0bcb2
SHA1 02622ee425447ea2cd9ede03f4f2e7c0202b45cb
SHA512 b39fcda620d995d7a6045b556fa68755682c0233cd3fe7c4ed547610911f52974e001a3cbfc5ae83fa58581ec7b0aa7b4cbfd7f800b359862727dc4a0ab248a0
TLSH
T168012BAB80FFB8B72038693F0D58780255BEA436505258B4DBA681ACA0D01F75A05426
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 9f483a2031c4e381fe7d1f447b767c667f33817943a26061aa98b82d9419e8f6
MD5 8e010338a9c6e0ff7c51b9946fdf23f9
SHA1 369cfb3d759e9e25ca1cdc7eb5be943016bb84cc
SHA512 577cb6a4cd75ade7953899c0d7c8d1bad9f0b45421361c036b9283cff136548b115c5baade6a55189654a50efea6a87fe28c6a354da3517a49d30bb9de33fbcd
SSDEEP 192:sxZaRjyM/jK1Ml8MNK/fcs36U6X9z2IdpYq/W6+WNxSs/Y0o1wkVIg4J:sxZax1K/fcs36U6tj/bZ/5Ic
TLSH
T1BA52F815AA34A977CCDBD209F915BF53D6F5556292800E44AAFCDA1C04F6BED2203C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 dcb29f66cb396ff53a787e380e774b15ceab07f3ed877348f2a6d001d85ab978
MD5 f69f61297ccf30d23222aa56e6db8588
SHA1 6d89dad184bf5d6eede0bb654b9f509fe253dbd3
SHA512 0b099b27cc12db81b3a5e10e5d45ef20fcfd361e98f393d75cb06480c3cc7b8671238ed55752f4d5a498d7745af34315a088f77239c2b1eb237c97a48963b4bb
SSDEEP 192:sxZaRjyM/jK1Ml8mcK/fcsaWpVE6z6X9zdIdpYue/W6+WNpJHcjXY0gKLozIgbmJ:sxZaxcK/fcsaWvE6z6Iy/bYX52u
TLSH
T1F962E716AA349977CCEBD208FA15BF53D6F8542291910E44AAFCDE1C01E6BED2203C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 b85023da550a8fd2c3531de83fcc36943d2df35840a2d8ba718f9da03a879cc0
MD5 7158c9b6ad0108ba016210fc432d92a5
SHA1 d2e5305184da82e45fb4d816543bd2228447993e
SHA512 632bd22ccefda6ca9ec8bb954496133cf350f85bce4e3227de52ff98433bfa4f6841bdc6087847cda34812e2b19e45ce894c8aaa2f8fb4a9ff67874a87916d21
SSDEEP 192:sxZaRjyM/jK1nl8BcK/fcsFWpVo6zmM9z/2MLzodpYQVI/W6+WNbhLdpbjQeWu/w:sxZa4fK/fcsFWvo6zm8IE/bVBeG/58/7
TLSH
T18082F915A5349D7B8CEBD219FA557B63D6F8542391804E44AAFCDE1C01E6BED2203C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 0b797bd6191a55ab7620c6ab766ec01cfad5c5c166166f15ed07ff6731d29de1
MD5 09808bf7467ddb726d53a4e7f59b457d
SHA1 05c280e9810a665fb34f0a1777a4e892f81c7a53
SHA512 23a9bfa1e6aa5e813e5b0d4e84e730f599f24573567820154473ea39e8bb069653d544b466ba964f7b0d109794ba22ba8f45ad7e5b6c222cdbeef719b8290ff7
SSDEEP 384:sxZa1YK/fcsMpUWvo6zm8hJ/bVBb0f52/7:sS2K/f8iYoLg/bVBe54
TLSH
T12F82F915A5349D7B8CEBD219FA457B63D6F8542391814E44AAFC9E1C01E7BED2203C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 b561215d02700a37343067aff13719d4b9a65f4729908afecaa6a35ed886edb6
MD5 c595c0d75fd145ddae1e2504bf52914d
SHA1 28f710a995ecd93f0ce20a0ea5c70f4bb1e0d119
SHA512 82d3a346ec34aa4b6d7bafacb574396ead2ae55429c7b6994935fc9393984884967db700871c481687406c526551c24eb0de7d88ada14d006b866d053043a23f
SSDEEP 192:sxZaRjyM/jK1Wl8ccK/fcs9WpVo6zmX9z/2MMzodpYQv/W6+WNbhLdgjQ9Y0g91r:sxZa3qK/fcs9Wvo6zmFHl/bVBD95Bu
TLSH
T11E72E715AA24997BCCDBD219FA557F63D6F8542391814E44AAFCDE1C01E2BED2203C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 fca6d50be00a09638fd6e72f4b4b760433dca29dc37967936aeb2814d769d507
MD5 99b8c2faa04761c2569ff55cda47c0ec
SHA1 2e7b9ff80cfe99769977eac7c04b849fdf756357
SHA512 196a9fddd05c49cbff75e0a34c71b20c8cddc62c6d0572984f9bfd37df6a2afd7af90e3cd4bf210ef8a373536f80ecbb0dc263011f28e2ce0b347bb3ffe627c9
SSDEEP 192:sxZaRjyM/jK1hl8acK/fcsFWpVo6zmX9z/2MozodpYEe/W6+WNpwJipdY0gg08zu:sxZaGwK/fcsFWvo6zmFDA/b9d51u
TLSH
T18B72E715AA24997BCCDBD219FA457B63D6F8542391814E44AAFCDE1C01E6BED2203C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 81d23ba7dc7a34e6ca7d2b7322d5c02655fc2c2f7ea726700c094cd80241416e
MD5 a5c099ce52d1fc27d1835795c1b3a3ab
SHA1 0d4d53c30cbf40c87755370b4765702c3a9de4c3
SHA512 ba459fac98ff5e60bea9729a0e2cf6d64f4c813bf003c6e7e8d7d206e5a2f00b86630e523fcee91c27500cb4bd12c92d5bc086610b245920f2886a2873af201f
SSDEEP 192:sxZaRjyM/jK1Wl8acK/fcs9WpVo6zmX9z/2MzzodpYQe/W6+WNpwJjQ9Y0gi8NVu:sxZa3wK/fcs9Wvo6zmFwk/bF95Gu
TLSH
T15072E715AA34997BCCDBD208FA457B53D6F8542291814E44AAFCDE1C01E6BED2203C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 7e74beb7db763a85a8f211ea2ce428f07747e852dd072ed22b5aca6cb9e810d7
MD5 a44839338243f3486bd0ce91188d9913
SHA1 2797cd4650726f169b9858f2e2ce93c7bfba7be8
SHA512 06ab723f9f76df1a71a98598cb19f0ce9fd672c646b19011595907e5807977bdcd0cd7ebb62cf08878b79ad91dbe9bbfed237c8b86ab9138eaaa0c3e816e45d6
SSDEEP 384:sxZaSMK/fcs0Wvo6zm8iq/b5mRByyj0feao/7:sSFK/fkYoLg/b5mRByzeaK
TLSH
T1D4920816A5745DBB8CEBD119FA55BB63D6F8542381804E44AAFC9D1C01E7BED2203C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 1bc04c9dcf510b72a670c14a2f7dc50cfdfc4a451d3de1b2e35ec35b661df4a9
MD5 62cc2fb83454e6fb30eed9690d2ab217
SHA1 84dc4df11dbfc1176eb3ef6d727f529f1ce8b6ac
SHA512 7e547adf66b008e69d1f7007494429b0b9e14aa8c6e44a8df8f43a7a6e9ebee213bebc593c90876fa158c4cbbf747979808c59fff568706ccbacbcd05d5dd8bb
SSDEEP 768:+y/c0s8Ww24j7pLuLf/fWRm/JQg18F1+UoAYDCx9Tuqh0VfUC9xbog/OV3Ip6OL0:+y/c0s8Ww24VEf/fWRm/JQg1u1jaKIpu
TLSH
T18F030B3B2C0CCB7E4F844E9CED26BE9A6DE8018B6698895447FA444C03C76EB551B4DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 d222aedcc021649e1e4cb2499ca6f24558d28bde9a27049a709b335515072861
MD5 354edfc11bdd4582ef99564026c53630
SHA1 0fe876003a091f4e07cb3e036d6b821813573076
SHA512 6825c4fe1efc1557288f6667367505bbb0b8974078fc49493fa66e94ac71c7dce2b4eb2f998962b720217894d6371e5e8cdcdfda7de68dc85af053ac14831115
SSDEEP 768:+ypcws8Iw2ij7pLuLf1fWRm/JQM18F1+UoAYDCx9Tuqh0VfUC9xbog/OV3IpEOL4:+ypcws8Iw2iVEf1fWRm/JQM1u1jaKIps
TLSH
T117F21B3B2C4CCB7E4F800D9DED266E9A6DE8028BA6988D5447FE444C03C7AEF55164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 a27fe24e8ef1a61f05c77d40c14935f5251421733a7487e71064194579f29e13
MD5 2212383713cc68b949cc04f901e10ef0
SHA1 d96fd0513c60bd2073e076660b635057c94337f8
SHA512 a4ba2cbaaf0207d8190e76a4396fa204a0f2ff687ef0afd65fc1659ca1d049d501aeafd103056610eba36133d58e4d92ab6246d0a722c7a6d5cca6e22ac23b31
TLSH
T1ABE0DFA009C8D1FBB97B628312AA830983A5B547F3CCBE063F89CE44614AD86B1D3180
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG
Size 319B
SHA256 8d5b4193c16e30c347157b7a5d319e6a64844ed512cc8db8288f9fc9134f6745
MD5 99467e7deaaa0fee8f0b64038d551ef2
SHA1 87cdaf8a2a1ea93722d0cd63e232a2096413e390
SHA512 03651b648ee5ad6b79e433793ba7fe810ae9798c06ef66f6170846e53230e15e7a98fe489aa9230b2797df5f09feb162fcd1f57c28ebcbf3d8099c40f7ef5d76
TLSH
T127E0267408CAC12DAA60AAA72238970C93F37583F3CCBD022750D888720DA0AB3C7195
MD5 SHA1 SHA512 TLSH

Submit Download

Tabs_13430982643157724

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13430982643157724
Size 4KB
SHA256 d87f368dd8cb290773c0632cf3b2d90204174fe75d85b596a61a3254d3755925
MD5 3ef563a8958d8d4ee56c4207320a1614
SHA1 afc5a89bd81c0cba0b49501789bc9afa56bc64f2
SHA512 c07213ff07bd7b9d4d192de14ac0f6bef6635fd98e7ae21eba3dda5c94c99fe096fbc8256db33c323d0660232907385fa2a0c5d717be2d4623f4360785f1542c
SSDEEP 48:3PbMdWmVStEL0j8FH4uontqeEmW4YEslBlA8O/jRMErPlm8Ep82k/lAtx:3PJhtEOUHGtqeylc8uik21tx
TLSH
T111911F125AF4193FF6BF4DB8C5EA11B0A832B94236E0CE0E805084250953F82EF71FDA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 172B
SHA256 981f09d92d4faaa98bf8b8098f6422530d1d9ec9b76e353e851d1f0b45174148
MD5 1d483744eba5b5c54e87df4eb6239ac8
SHA1 9f5a8faa49a2b4b738b62c30a74adf37cba8504d
SHA512 ee282ec7fe3dd5c1d1d0ef56f7697c4beb7035d78b8bea925fb9139d3f978d313be40a359ec06347a2326c0b10ab41bcd8ee47bcc969e54f3b0be57a11a26728
TLSH
T1D4C08C917750610CECCE2A3206896B546370F407002D8C0B440C9F554C282A46E938C6
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 bd2c3a2e05ec72d963c263c35f747c106b9ff1f6a0fc3eb228020546e6883bf3
MD5 8d774e0a32fceb353b466af162b0b5f1
SHA1 390873b255adc3ad3f45da295de1595876bcf504
SHA512 4a108eeabff508012de2c106b8ce88d0ce20bd0976aa2c2e47497c8ebb5039f14ecaa0dd15a18b88d15cefad8ab84a1c54a88efc11937c241dee000e15d68187
TLSH
T16EE0D8B019CAC6ABB69B6287A229E30D81B3B557F7E8BD113F4CDA44620E54172C3141
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 8e20283df386ab237ededa2a6e3d81d7022481ad8df73e479755f518257f49aa
MD5 c0194afa6dab1003779a5decd89b223b
SHA1 63b7e6f00df4759e729b785462af887745240faa
SHA512 18602df5709a7e6efd0b46905d50487c0fbecde2470a82ac03b9b34dbfeb49290f29e1de406d9bbbf73a188c0e14cebecfa3cebc56ff932e427f3d346694fc05
TLSH
T132E020F049C4C67BAD91A1A35268D70CC2F2B94BB3C9BF056B4C9844B10562172E7280
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 9cd27a634d543b0979bf8c1865abf7b85d506e2fc1a3a5eb54e45f43eefec21b
MD5 c98e994f6dd389e0376e1b0fe173e50e
SHA1 f13df9f114186bebc9147dc4cedd9ccf94144bae
SHA512 342a7b4e7a35529bba21871a43de235fdb1ef2a876f69564708fa4db92ceb4bbddc92571a7be7ad4087267118b02631f6e95e11625a6eaf897707cb9c1f01df8
SSDEEP 96:KMa4K/rEAKdCGeNmKeMQjONJjd9xIp4sGRxKe4Go:WMjBFjONJjd9yp4NRP4Go
TLSH
T142912C9330BA02413C7E690C97F5AF6A4645B2633434A52B7FE841721E67E216EFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

be91bafd-0c37-4dd0-8bc1-c8905657261e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\be91bafd-0c37-4dd0-8bc1-c8905657261e.tmp
Size 414B
SHA256 44c1f98090058b9e59d77e439a3fea7da15dd1636ed0381e29dcb8003718fc7b
MD5 f8c054973c244e0a2974a0da046da279
SHA1 ca5a3b36971686754a9365343af89a6d6d514f57
SHA512 e9985bfaf9bef4d7aa4ddbf501cae0d552b4777b0f8dbefcbb21a57349af2aacfb19953fbb6824dc8f084af104d571b4623e085bb595d46c323dc05757a45e00
TLSH
T1A7E02BEDD821AC370DFE172C64004789E64013572A90959F363C451DDFB01371683C1C
MD5 SHA1 SHA512 TLSH

Submit Download

load_statistics.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db
Size 132KB
SHA256 d1f1b5856a87ddef55654eaec9c953b429ab62ff965844b4431acdb060865e85
MD5 06656d471035dcd2f2ee87aae085cf69
SHA1 b61d41b527f092a75bff4e83b7bb5bf43ed78084
SHA512 85bf340658cd501ee165400d32ac1306fb32c9ad2cc29b8bb1fa9ed018a94609e9e7648ebc412960eeeda169d026aa293fc71e09314fd3d90847c742fbe537f7
SSDEEP 1536:jVSznpQ14erhx8jUmyk43SRv0m/ggIRj7w0kJ:v14du0/
TLSH
T159D311F76C0992A6CDCD95B8D41BEE4480730661C624D9E9AA3C08C37B79A03BE755CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 12KB
SHA256 87c9c73aba596324ca7b046c12a0ea2691fbb4a87e67ee00a8d829aec5dc799a
MD5 1afc40cbda3bdfb9f514684ee92e40b8
SHA1 c33af70f12764bf513d3289580cdaeb55bd5a391
SHA512 ddaa36e2c672cf5edc3ce4996599ec486d69a2258079bd9879b1b15579e3103082437c8c0b90e5f9dbb34b4659d4ee60a9bffa21ac00e04e333ff90937029532
SSDEEP 384:lQXIIImbGMIMuB8/Ds2R2sNkC3NijOHNijO:lQhg2RNkC3NijOHNijO
TLSH
T1E04296AE1A162F7BC19E9FBA3252C1444AD888824571612D31915C6FCEF3F9B87C12F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 319B
SHA256 151b6b3504ffdf909c2a1624db55817cf8bff905aa78ea9afbbae19cc14b31cf
MD5 8cd1c29760ea1632dd6989d21c581545
SHA1 75286b2b20527ff29dbe4232960cf2dfa148d135
SHA512 4a3258b420999f728cbe33760d68c24c8765b9c3714a90e907c0496a30e28626665fc1a27ab2da8c311b5f9d923751916330a73c2008cb53b6fa60ad4fb3657b
TLSH
T14EE02624AED8C1AFF96561C72238430882A2BA43FBC8BD062F58C948A10D541B7EB585
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 b16d6697b40a6a97603091a948996c578ac625b93b12ba0a5add52b12f713ead
MD5 6ddc2d8f7a050be22e55d21099f1ff5f
SHA1 38181aa8a57054ccceaedd3596c12db882a66adc
SHA512 258691d60ca53b31bf7a9aa6ad07c4fc3606a5f8960c6e51e45be85443f94262e354606bde17bc7b876ad279a642be3a4b6a9057b2b7325d646efa6df4ff5955
TLSH
T1112128A5F334C188D149877A643EAB191738D4028FF8ED0F157924647E77F010D4B2E6
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 337B
SHA256 4a6f3d21a59ad79a104c2d855ca1902c2b394a89ea46774ab5e520c93712691a
MD5 6881d3bc47cf2f503606056d016230cf
SHA1 c934cb9ec096a20e316f784e0dc89a4f38ed6810
SHA512 1f1014b4b5bc6f75d6ae57b6a1791c63d94f0d51fc52d9c2f3b13c6304076301e7f95ae5ddb67405e50724f2e5df5431d22008c4fd89274143ade42057c170de
TLSH
T1BEE020646DD4C19FE56161C32178934C82A27943FBC4BE012F54CD48510958277E7141
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 94992bd985ff49beee17891474bc98be33babc43f570b8545b19b26ecb8985dd
MD5 2f6726dd6634e548bd77dc4c5637a3ba
SHA1 5714503f71a68ca89d6338d1c845e1c0cb8ba41a
SHA512 63a45a2f9a7b960445862b3fba98c326da108a262d16e484e3908c317d3c87d6710edd2012d9dd365c19958af7809f90ffeb57a54cbf2dca8f3eb9a9c0014766
SSDEEP 3:MsEllllkEthXllkl2zEklKMfK/l/:/M/xT02znKMfKt/
TLSH
T1014404047FC10405C50410304031C37003F0D4501531574374510C137DC55400C441C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser
Size 120B
SHA256 9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4
MD5 a397e5983d4a1619e36143b4d804b870
SHA1 aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4
SHA512 4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816
TLSH
T1E0B012203BF9062CF3F74D00AA73AA3428BFF4080A14811D505102080C33E19C478FA3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 8917b6b5d1ae65c3de1af12a1853251d6f68e80459531ac48391c6babef4f5bd
MD5 255abd3bc94bdd17e6fad3ec8f846c44
SHA1 7e5a6a3780f14fe3975fc200640a2aac502ed904
SHA512 a88688ae1099af326d182f3ec74f807115211e5b845821a29eedb74b3d371c7f1e8d9c12d9f97a571cea5b90781896b02a7e1e892b8bc39d60e9f30baee9d548
SSDEEP 384:nfZcIC8NEyyhozUS1ugUu8YwWr8XovdthJVFE48Gry4MsRnlYwBQJx/7IzJ:3CFPBCfgK7hJVFE48Gry4hn2oz
TLSH
T17CC27C7D9C646C7F48AEB709A78E29235CB4513BD6B81E18E3E85B0DA135858F303D64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 40f8e3b37de8d6358fcbe6f8eb0795fa642f066264fd8d1234346507556406c4
MD5 637dada540b4c65dc5542660eccc54da
SHA1 f88e345e2e99f636b59859d99420e7e96d96c1f2
SHA512 0de1183c213ba6a8bc932bbef984f0a6f10c4038734e09979ab9fb28ea3d9e27821ede608bdf34ad03926e6eac0e6dcaf0747b0d467f5492b537eb08d5e3c199
SSDEEP 192:XGNG6jCQmiUynIif4SufoPxzYw1oYSnZFLwU6:XGNG6qoZfju8YwW9ZxwU6
TLSH
T10B02C835AC68B87B9EA36E55F98B37139FA4212BD9952F44DAF81F0C00E754C2346836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 a56333f12d9af92b437333b16f62038560eade543734a45f6634d492daa39dc7
MD5 2d0209510c61f8c5f2463824b02a1d08
SHA1 350262a40543203ceb670724650e29c21af4703b
SHA512 83893e4f9a1c8eb94c6e010b725c55d62940cb61b7fecba00c3399b914c2216484ee1fd5bc9d0f30b1998517016a8efd3289546754d77a9b9e8d613b296bfdbb
SSDEEP 384:n2ZcIh8NbNyhozUSywgUu8YwWrEZHMsRnlYwBT:kht2BCf4ZHhn2oT
TLSH
T137929E719C78AC33ADFBA142F58A36539EB464779DC52F08F5F8AB1D00A65981307C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 bd8d8c64a59c42fd61d0a596d1cd21656e14ea01acf096d64ddedfa1c273ddfc
MD5 e84991a6c3dad0250b763d92d232a36a
SHA1 135e77a511ec07ec78f824dbbaee60d4b5f53953
SHA512 76365c558432783b9aed109d87a1e4675b95ba06e4588c0ad560ba32e077f55dd41e9494e636dda4aba8d53fef5f549154c328b6543e48e7b4bcaf885aaf44e4
SSDEEP 384:nLZcII8NVIyhozUSmSgUu8YwWrUG5uSRYClmX9RktXVMsRnlYwBQJx/7IzJ:TIy8BCfAG5zzK92lhn2oz
TLSH
T1BCC26B7C9C246C7F88BEBB0AB24D29235DA8023BD9B55D18E3F85B0ED035498F342C65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 3a2f80662f643ff7fcbfb919438a35fbe829f1f0dcfb5d72ac33f386edecb2b2
MD5 2138732d11c290457b81c83bdd73acbb
SHA1 0ad6d55deb2f7340c89e5c946cfdb1fe85dcdb21
SHA512 300b5117035f7e5fcb540e3e0db8c50fc14459c7d5abf0657c4fa9bfa7c26aadaf71f4615e20b8a051b8d56603ea8a9ae911c043a2550405246990c59d833c9d
SSDEEP 192:wGNm6jNQmiUyXiA4SufoPxzYw1orYOMZIqJLU6:wGNm6HZAju8YwWryZHU6
TLSH
T1BC121970A86CFC375DA7A555F58B36639F642137DD866F44E6F82F1C00EB688230B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 158571fa8ee5b972034d7a4305c28b7600b959d41e40253c2a6ad827dc6df2ef
MD5 692af021438f855b43c5554c505a5d36
SHA1 a7de72c82ff5de58df4ef5addb800db00e8be86c
SHA512 d95204d8a0d6a561e45b1bf41a78b23bbe512d1167412626a114a88eb1dd354c30956940f3fa81e0960bb977433928d14b54a3f43e9f75c1c204694fff1087b1
SSDEEP 384:nLZcIw38N6yyhozUSb3HgUu8YwWraQGMsRnlYwBQJx/7IzJ:Tw3rwBCfmQGhn2oz
TLSH
T1FEA28D716C78ACB39CF7A146F69A3A13AEF46037DAC52F04F1F8AB1E10955991307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 09e962d2a31787fd8e229055e579cdf74397b27bdf05b330b9de0974372386f1
MD5 a9bd62fb35bc76f692533e63c36748a9
SHA1 facc000824c0ae017fae3a1e47e98f234c5980ae
SHA512 8760676cfdd8861d7223da32a84fae38e55dff5d068f34ea05e6e6ef928a6ad2751c2969eed332436244aa6361d2b4e2aa44a9cff02d5fba4167f8849b0250d3
SSDEEP 384:nLZcI28NtayhozUSjkgUu8YwWr3poMsRnlYwBQJx/7IzJ:T2cjBCf7yhn2oz
TLSH
T1F0A28D716C786CB39DF79542F69A3A13AFF4503B9AC52E04E5F8AB1E00865991307C36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 0757374aa31a318ef3b5786d3ad010821b8ac6714b802635f580d4f18ca02a21
MD5 1cadcc835b779e3e195b690732e78dbf
SHA1 e9070bb91f79fac820c913ba25eecec41a925cff
SHA512 20cb60a8d3755a66735672a3e63b496b80bba7e15409d5eac93dc33353233ec1d1acf43e2963dfe84e07399303721e33fade99b89c7df388275186d74230dbe9
SSDEEP 384:nsZcIw38NtayhozUSKogUu8YwWr3Uuv8wlmt0UDXBVFyd8GAGinMsRnlYwBQJx/m:6w3cuBCf7UpwdUDXBVFy8GAFhn2oz
TLSH
T193C26C7C9C646C7F88FEBB09A74D29236DB4113BC9B55D18E7E85B0E9032889F302875
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 35e090cdd7edb8d79fc0d86fc3345bf8cf1387c88a8fd1dcb8c96de3c3ec202e
MD5 853ed1a40ade1d56e2a7f257286ebcea
SHA1 14dedaafce0e114593082056dec9551a91292f2f
SHA512 84b62bc0b541ba03c3539ebc6bbb269102a5df9259415d1c44acfc29e660962b39c57bf159376001f14c15d73c62b5a1529f41e33fa821477ef8fd106bf1f386
SSDEEP 384:nCZcI48NsIyhozUS0JgUu8YwWrTTobd6lmX9RktGapMsRnlYwBQJx/7IzJ:w4ntBCfvCcK925hn2oz
TLSH
T167C26B7C9C246C7F88BEBB4AB24D29235DA8023BD9B55D18E3F85B0ED075858F342C65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 b70e2b0987b3ad3e8c07d040676c00461a8349c78766944ed9e3d9aca92da97b
MD5 6ec89fc700b94ea02aa448db1d954d0a
SHA1 ea300e82610349d1089443dc632c597c9ecd7b63
SHA512 68f96d94536b9416c31f8a13b5d211a3b51aa95a4406d8eb4eb74417825da9997b5f7e36f7fdb6cf4ccde0f119011d166dd3e1871feb1e4cc5b1f3b4c34ef7d4
SSDEEP 384:nxZcIc8N6yyhozUSb3ZqgUu8YwWraQoy3tlmX9Rkt1IMsRnlYwBQJx/7IzJ:ZcrRBCfmg9K92qhn2oz
TLSH
T19DC26B7C9C646C7F88BEBB0AB64D29235DA8023BD9B55D18E3F85B0ED035458F342C65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 86d92c1d8880dad74f2555f51687a75538f1703367bfa5f402865abdf55a6b8c
MD5 4eedec4576354bea3b6ee52c02bc2aa4
SHA1 2d688ac2ad456b07d24e8e0ba041f10c527dba4c
SHA512 8668a704f4f3805f60a4d85d72120c5d5b9d36b08f61f05faca66a2e64d0643034eafb3e1d0f431073f8aa3efee09dc0f95dfd97a1f1db8daf21723ad126c9a2
SSDEEP 3:MsEllllkEthXllkl2zEklzv//:/M/xT02znL/
TLSH
T10D4404047FD00407C50415305051C3500370D4504D11574374510C135CDD5440C00500
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 85B
SHA256 b26da4f8c7e283aa74386da0229d66af14a37986b8ca828e054fc932f68dd557
MD5 bc6142469cd7dadf107be9ad87ea4753
SHA1 72a9aa05003fab742b0e4dc4c5d9eda6b9f7565c
SHA512 47d1a67a16f5dc6d50556c5296e65918f0a2fcad0e8cee5795b100fe8cd89eaf5e1fd67691e8a57af3677883a5d8f104723b1901d11845b286474c8ac56f6182
TLSH
T1F2A0120384738407E4144051C45C1341287C84570119C0012068931304240CB039643A
MD5 SHA1 SHA512 TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

8f696772-c8ec-4a4b-b78a-cde73b194f23.tmp

Path C:\Users\Admin\AppData\Local\Temp\8f696772-c8ec-4a4b-b78a-cde73b194f23.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bc0c5337-ed03-45f1-903f-9d188bbab7c7.tmp

Path C:\Users\Admin\AppData\Local\Temp\bc0c5337-ed03-45f1-903f-9d188bbab7c7.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2464_1805286012\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fd1a1f78-6882-47ad-a426-5f7bc06e2076.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2464_1953935518\fd1a1f78-6882-47ad-a426-5f7bc06e2076.tmp
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5192-0-0x00007FFCD8B10000-0x00007FFCD8B20000-memory.dmp

Download

memory/5192-11-0x00007FFCD61B0000-0x00007FFCD61C0000-memory.dmp

Download

memory/5192-12-0x00007FFCD61B0000-0x00007FFCD61C0000-memory.dmp

Download

memory/5192-9-0x00007FFD18A80000-0x00007FFD18C89000-memory.dmp

Download

memory/5192-10-0x00007FFD18A80000-0x00007FFD18C89000-memory.dmp

Download

memory/5192-7-0x00007FFD18A80000-0x00007FFD18C89000-memory.dmp

Download

memory/5192-8-0x00007FFD18A80000-0x00007FFD18C89000-memory.dmp

Download

memory/5192-6-0x00007FFCD8B10000-0x00007FFCD8B20000-memory.dmp

Download

memory/5192-5-0x00007FFCD8B10000-0x00007FFCD8B20000-memory.dmp

Download

memory/5192-4-0x00007FFD18A80000-0x00007FFD18C89000-memory.dmp

Download

memory/5192-59-0x00007FFD18A80000-0x00007FFD18C89000-memory.dmp

Download

memory/5192-1-0x00007FFCD8B10000-0x00007FFCD8B20000-memory.dmp

Download

memory/5192-3-0x00007FFD18B24000-0x00007FFD18B25000-memory.dmp

Download

memory/5192-2-0x00007FFCD8B10000-0x00007FFCD8B20000-memory.dmp

Download