hxxp://ptoszek[.]pl

Analysis

user interaction
yes
max time kernel
190s
max time network
192s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/08/2026, 18:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://ptoszek.pl
Sample260817-wtak2scg99

Score

6^/10

discovery persistence ransomware

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
56	discord.com
252	discord.com
255	discord.com
55	discord.com

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\LogFiles\WMI\FaceUnlockManually.etl	CredentialUIBroker.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2256	msedge.exe

Checks SCSI registry key(s) 3 TTPs 9 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	CredentialUIBroker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	CredentialUIBroker.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134314639623277561"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3611646547-550105268-947503007-1000\{DF22D893-04F2-4FF8-BC94-42E76E020362}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3611646547-550105268-947503007-1000\{9F80F045-A7D1-4435-911A-B456E87DB9C8}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
6492	taskmgr.exe
6492	taskmgr.exe
6492	taskmgr.exe
6492	taskmgr.exe
6492	taskmgr.exe
6492	taskmgr.exe
6492	taskmgr.exe
6492	taskmgr.exe
6492	taskmgr.exe
6492	taskmgr.exe
6492	taskmgr.exe
6492	taskmgr.exe
6492	taskmgr.exe
6492	taskmgr.exe
6492	taskmgr.exe
6492	taskmgr.exe
6492	taskmgr.exe
6492	taskmgr.exe
6492	taskmgr.exe
6492	taskmgr.exe
6492	taskmgr.exe
6492	taskmgr.exe
6492	taskmgr.exe
6492	taskmgr.exe
6492	taskmgr.exe
6492	taskmgr.exe
6492	taskmgr.exe
6492	taskmgr.exe
6492	taskmgr.exe
6492	taskmgr.exe
6492	taskmgr.exe
6492	taskmgr.exe
6492	taskmgr.exe
6492	taskmgr.exe
6492	taskmgr.exe
6492	taskmgr.exe
6492	taskmgr.exe
6492	taskmgr.exe
6492	taskmgr.exe
6492	taskmgr.exe
6492	taskmgr.exe
6492	taskmgr.exe
6492	taskmgr.exe
6492	taskmgr.exe
6492	taskmgr.exe
6492	taskmgr.exe
6492	taskmgr.exe
6492	taskmgr.exe
6492	taskmgr.exe
6492	taskmgr.exe
6492	taskmgr.exe
6492	taskmgr.exe
6492	taskmgr.exe
6492	taskmgr.exe
6492	taskmgr.exe
6492	taskmgr.exe
6492	taskmgr.exe
6492	taskmgr.exe
6492	taskmgr.exe
6492	taskmgr.exe
6492	taskmgr.exe
6492	taskmgr.exe
6492	taskmgr.exe
6492	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
6492	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: 33	2608	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2608	AUDIODG.EXE
Token: SeDebugPrivilege	6492	taskmgr.exe
Token: SeSystemProfilePrivilege	6492	taskmgr.exe
Token: SeCreateGlobalPrivilege	6492	taskmgr.exe
Token: 33	6492	taskmgr.exe
Token: SeIncBasePriorityPrivilege	6492	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
6492	taskmgr.exe
6492	taskmgr.exe
6492	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
6492	taskmgr.exe
6492	taskmgr.exe
6492	taskmgr.exe
6492	taskmgr.exe
6492	taskmgr.exe
6492	taskmgr.exe
6492	taskmgr.exe
6492	taskmgr.exe
6492	taskmgr.exe
6492	taskmgr.exe
6492	taskmgr.exe
6492	taskmgr.exe
6492	taskmgr.exe
6492	taskmgr.exe
6492	taskmgr.exe
6492	taskmgr.exe
6492	taskmgr.exe
6492	taskmgr.exe
6492	taskmgr.exe
6492	taskmgr.exe
6492	taskmgr.exe
6492	taskmgr.exe
6492	taskmgr.exe
6492	taskmgr.exe
6492	taskmgr.exe
6492	taskmgr.exe
6492	taskmgr.exe
6492	taskmgr.exe
6492	taskmgr.exe
6492	taskmgr.exe
6492	taskmgr.exe
6492	taskmgr.exe
6492	taskmgr.exe
6492	taskmgr.exe
6492	taskmgr.exe
6492	taskmgr.exe
6492	taskmgr.exe
6492	taskmgr.exe
6492	taskmgr.exe
6492	taskmgr.exe
6492	taskmgr.exe
6492	taskmgr.exe
6492	taskmgr.exe
6492	taskmgr.exe
6492	taskmgr.exe
6492	taskmgr.exe
6492	taskmgr.exe
6492	taskmgr.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
6492	taskmgr.exe
6548	CredentialUIBroker.exe
6492	taskmgr.exe
6492	taskmgr.exe
6492	taskmgr.exe
6492	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2296 wrote to memory of 2292	2296	msedge.exe	89
PID 2296 wrote to memory of 4396	2296	msedge.exe	90
PID 2296 wrote to memory of 2256	2296	msedge.exe	91
PID 2296 wrote to memory of 4396	2296	msedge.exe	90
PID 2296 wrote to memory of 4396	2296	msedge.exe	90
PID 2296 wrote to memory of 3016	2296	msedge.exe	92
PID 2296 wrote to memory of 3016	2296	msedge.exe	92
PID 2296 wrote to memory of 2488	2296	msedge.exe	93
PID 2296 wrote to memory of 2488	2296	msedge.exe	93
PID 2296 wrote to memory of 2488	2296	msedge.exe	93
PID 2296 wrote to memory of 4944	2296	msedge.exe	94
PID 2296 wrote to memory of 4944	2296	msedge.exe	94
PID 2296 wrote to memory of 4944	2296	msedge.exe	94
PID 2296 wrote to memory of 244	2296	msedge.exe	96
PID 2296 wrote to memory of 244	2296	msedge.exe	96
PID 2296 wrote to memory of 244	2296	msedge.exe	96
PID 2296 wrote to memory of 252	2296	msedge.exe	97
PID 2296 wrote to memory of 252	2296	msedge.exe	97
PID 2296 wrote to memory of 252	2296	msedge.exe	97
PID 2296 wrote to memory of 3468	2296	msedge.exe	98
PID 2296 wrote to memory of 3468	2296	msedge.exe	98
PID 2296 wrote to memory of 3468	2296	msedge.exe	98
PID 2296 wrote to memory of 4300	2296	msedge.exe	100
PID 2296 wrote to memory of 4300	2296	msedge.exe	100
PID 2296 wrote to memory of 1860	2296	msedge.exe	102
PID 2296 wrote to memory of 2644	2296	msedge.exe	101
PID 2296 wrote to memory of 1860	2296	msedge.exe	102
PID 2296 wrote to memory of 2644	2296	msedge.exe	101
PID 2296 wrote to memory of 4436	2296	msedge.exe	104
PID 2296 wrote to memory of 3172	2296	msedge.exe	108
PID 2296 wrote to memory of 4092	2296	msedge.exe	109
PID 2296 wrote to memory of 3172	2296	msedge.exe	108
PID 2296 wrote to memory of 3172	2296	msedge.exe	108
PID 2296 wrote to memory of 4092	2296	msedge.exe	109
PID 2296 wrote to memory of 1740	2296	msedge.exe	110
PID 2296 wrote to memory of 1740	2296	msedge.exe	110
PID 2296 wrote to memory of 1740	2296	msedge.exe	110
PID 2296 wrote to memory of 3504	2296	msedge.exe	111
PID 2296 wrote to memory of 3504	2296	msedge.exe	111
PID 2296 wrote to memory of 3504	2296	msedge.exe	111
PID 2296 wrote to memory of 2288	2296	msedge.exe	112
PID 2296 wrote to memory of 8	2296	msedge.exe	113
PID 2296 wrote to memory of 1104	2296	msedge.exe	114
PID 2296 wrote to memory of 2288	2296	msedge.exe	112
PID 2296 wrote to memory of 2288	2296	msedge.exe	112
PID 2296 wrote to memory of 8	2296	msedge.exe	113
PID 2296 wrote to memory of 8	2296	msedge.exe	113
PID 2296 wrote to memory of 1104	2296	msedge.exe	114
PID 2296 wrote to memory of 1104	2296	msedge.exe	114
PID 2296 wrote to memory of 5892	2296	msedge.exe	115
PID 2296 wrote to memory of 2484	2296	msedge.exe	116
PID 2296 wrote to memory of 988	2296	msedge.exe	117
PID 2296 wrote to memory of 5892	2296	msedge.exe	115
PID 2296 wrote to memory of 5892	2296	msedge.exe	115
PID 2296 wrote to memory of 2484	2296	msedge.exe	116
PID 2296 wrote to memory of 2484	2296	msedge.exe	116
PID 2296 wrote to memory of 4716	2296	msedge.exe	118
PID 2296 wrote to memory of 6468	2296	msedge.exe	122
PID 2296 wrote to memory of 6476	2296	msedge.exe	123
PID 2296 wrote to memory of 6468	2296	msedge.exe	122
PID 2296 wrote to memory of 6468	2296	msedge.exe	122
PID 2296 wrote to memory of 6500	2296	msedge.exe	125
PID 2296 wrote to memory of 6500	2296	msedge.exe	125
PID 2296 wrote to memory of 6500	2296	msedge.exe	125

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://ptoszek.pl
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x264,0x268,0x234,0x288,0x7ffbcde5c188,0x7ffbcde5c194,0x7ffbcde5c1a0
  2⤵
  PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1556,i,8097799525937060084,4899664523265922730,262144 --field-trial-handle=2580,i,9346774683723729990,7296143587131510674,262144 --variations-seed-version --mojo-platform-channel-handle=2576 /prefetch:2
  2⤵
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1844,i,15968398847841673117,3621422033713504233,524288 --field-trial-handle=2580,i,9346774683723729990,7296143587131510674,262144 --variations-seed-version --mojo-platform-channel-handle=2704 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2280,i,10890909066539439998,8771826337257867702,524288 --field-trial-handle=2580,i,9346774683723729990,7296143587131510674,262144 --variations-seed-version --mojo-platform-channel-handle=3192 /prefetch:13
  2⤵
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3620,i,15758515378268340286,3768335234855101729,2097152 --field-trial-handle=2580,i,9346774683723729990,7296143587131510674,262144 --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:1
  2⤵
  PID:2488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3616,i,17408444825356237044,12713134152082791774,2097152 --field-trial-handle=2580,i,9346774683723729990,7296143587131510674,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:1
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4316,i,10720379151655093746,15954785627773363746,2097152 --field-trial-handle=2580,i,9346774683723729990,7296143587131510674,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:1
  2⤵
  PID:244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4332,i,9177578476231312597,14276905762302246540,2097152 --field-trial-handle=2580,i,9346774683723729990,7296143587131510674,262144 --variations-seed-version --mojo-platform-channel-handle=1660 /prefetch:9
  2⤵
  PID:252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3908,i,2714292159865550180,14582581201267078103,2097152 --field-trial-handle=2580,i,9346774683723729990,7296143587131510674,262144 --variations-seed-version --mojo-platform-channel-handle=3896 /prefetch:1
  2⤵
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5464,i,13280511030820614502,12337772525597303984,524288 --field-trial-handle=2580,i,9346774683723729990,7296143587131510674,262144 --variations-seed-version --mojo-platform-channel-handle=3872 /prefetch:12
  2⤵
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3760,i,17613643724107129107,12440904838135400152,524288 --field-trial-handle=2580,i,9346774683723729990,7296143587131510674,262144 --variations-seed-version --mojo-platform-channel-handle=3772 /prefetch:14
  2⤵
  PID:2644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3480,i,6407396900916566259,12301370949205358256,524288 --field-trial-handle=2580,i,9346774683723729990,7296143587131510674,262144 --variations-seed-version --mojo-platform-channel-handle=3804 /prefetch:14
  2⤵
  PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6236,i,1180257297429681484,7096984701148176979,524288 --field-trial-handle=2580,i,9346774683723729990,7296143587131510674,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:14
  2⤵
  PID:1920
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6236,i,1180257297429681484,7096984701148176979,524288 --field-trial-handle=2580,i,9346774683723729990,7296143587131510674,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:14
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=7188,i,4546403532846364727,3154451314814536073,2097152 --field-trial-handle=2580,i,9346774683723729990,7296143587131510674,262144 --variations-seed-version --mojo-platform-channel-handle=7424 /prefetch:1
  2⤵
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7044,i,15903753249147890183,975018614021738834,524288 --field-trial-handle=2580,i,9346774683723729990,7296143587131510674,262144 --variations-seed-version --mojo-platform-channel-handle=7420 /prefetch:14
  2⤵
  PID:4092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=7208,i,2064562168869404524,11102734668545600752,2097152 --field-trial-handle=2580,i,9346774683723729990,7296143587131510674,262144 --variations-seed-version --mojo-platform-channel-handle=7448 /prefetch:1
  2⤵
  PID:1740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=7476,i,5133092439722635454,15824548807407343438,2097152 --field-trial-handle=2580,i,9346774683723729990,7296143587131510674,262144 --variations-seed-version --mojo-platform-channel-handle=7552 /prefetch:1
  2⤵
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=7312,i,9616686063301026450,13108222727227694952,2097152 --field-trial-handle=2580,i,9346774683723729990,7296143587131510674,262144 --variations-seed-version --mojo-platform-channel-handle=7648 /prefetch:1
  2⤵
  PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7372,i,17585219791874893994,7966565659884651815,2097152 --field-trial-handle=2580,i,9346774683723729990,7296143587131510674,262144 --variations-seed-version --mojo-platform-channel-handle=7592 /prefetch:1
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=7412,i,16302091543269158783,18363803759261627834,2097152 --field-trial-handle=2580,i,9346774683723729990,7296143587131510674,262144 --variations-seed-version --mojo-platform-channel-handle=7572 /prefetch:1
  2⤵
  PID:1104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=7400,i,9619821999581786126,7226375559348940871,2097152 --field-trial-handle=2580,i,9346774683723729990,7296143587131510674,262144 --variations-seed-version --mojo-platform-channel-handle=7576 /prefetch:1
  2⤵
  PID:5892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=7308,i,10751561234771921850,11197787383657542741,2097152 --field-trial-handle=2580,i,9346774683723729990,7296143587131510674,262144 --variations-seed-version --mojo-platform-channel-handle=7644 /prefetch:1
  2⤵
  PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8452,i,347111854225207304,7276995112281085092,524288 --field-trial-handle=2580,i,9346774683723729990,7296143587131510674,262144 --variations-seed-version --mojo-platform-channel-handle=8492 /prefetch:14
  2⤵
  PID:988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8736,i,3090047196386319262,10987925944069396915,524288 --field-trial-handle=2580,i,9346774683723729990,7296143587131510674,262144 --variations-seed-version --mojo-platform-channel-handle=8712 /prefetch:14
  2⤵
  - Modifies registry class
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=4312,i,3154357171559105786,9207921397830765471,2097152 --field-trial-handle=2580,i,9346774683723729990,7296143587131510674,262144 --variations-seed-version --mojo-platform-channel-handle=10076 /prefetch:1
  2⤵
  PID:6468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9464,i,13531497491117628168,3406419311892750840,524288 --field-trial-handle=2580,i,9346774683723729990,7296143587131510674,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:14
  2⤵
  PID:6476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=9616,i,5739072437672751936,4396730816160206271,2097152 --field-trial-handle=2580,i,9346774683723729990,7296143587131510674,262144 --variations-seed-version --mojo-platform-channel-handle=608 /prefetch:1
  2⤵
  PID:6500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=10048,i,12172683731015421999,18348832426894889603,524288 --field-trial-handle=2580,i,9346774683723729990,7296143587131510674,262144 --variations-seed-version --mojo-platform-channel-handle=10140 /prefetch:14
  2⤵
  PID:6516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=10120,i,15919464580524589298,7852301376837032731,524288 --field-trial-handle=2580,i,9346774683723729990,7296143587131510674,262144 --variations-seed-version --mojo-platform-channel-handle=9896 /prefetch:14
  2⤵
  PID:6524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=10096,i,9074129095540382999,6564565945555389651,524288 --field-trial-handle=2580,i,9346774683723729990,7296143587131510674,262144 --variations-seed-version --mojo-platform-channel-handle=10160 /prefetch:14
  2⤵
  PID:6532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4132,i,12802626678668897822,15752183951299137060,524288 --field-trial-handle=2580,i,9346774683723729990,7296143587131510674,262144 --variations-seed-version --mojo-platform-channel-handle=4140 /prefetch:14
  2⤵
  PID:7056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6236,i,14724665535703486047,16506173808462795405,524288 --field-trial-handle=2580,i,9346774683723729990,7296143587131510674,262144 --variations-seed-version --mojo-platform-channel-handle=7832 /prefetch:14
  2⤵
  PID:6940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=6704,i,13100599758913358731,10685702269957541047,2097152 --field-trial-handle=2580,i,9346774683723729990,7296143587131510674,262144 --variations-seed-version --mojo-platform-channel-handle=9280 /prefetch:1
  2⤵
  PID:7136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=printing.mojom.PrintCompositor --lang=en-US --service-sandbox-type=print_compositor --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6348,i,12419360004771792391,3041556646031110864,524288 --field-trial-handle=2580,i,9346774683723729990,7296143587131510674,262144 --variations-seed-version --mojo-platform-channel-handle=9780 /prefetch:14
  2⤵
  PID:1608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=ppapi --lang=en-US --device-scale-factor=1 --ppapi-antialiased-text-enabled=1 --ppapi-subpixel-rendering-setting=1 --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4384,i,3137480347820710297,6124484754120618721,65536 --field-trial-handle=2580,i,9346774683723729990,7296143587131510674,262144 --variations-seed-version --mojo-platform-channel-handle=9888 /prefetch:3
  2⤵
  PID:5832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4560,i,6380730117768404911,6880692579073879526,262144 --field-trial-handle=2580,i,9346774683723729990,7296143587131510674,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:10
  2⤵
  PID:6520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6336,i,17674387591777280017,3135803669202113356,524288 --field-trial-handle=2580,i,9346774683723729990,7296143587131510674,262144 --variations-seed-version --mojo-platform-channel-handle=9464 /prefetch:14
  2⤵
  PID:6604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4560,i,12148679743531264484,13818528441415363962,524288 --field-trial-handle=2580,i,9346774683723729990,7296143587131510674,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:14
  2⤵
  PID:5372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8884,i,10762647613471812797,12145998707882947907,524288 --field-trial-handle=2580,i,9346774683723729990,7296143587131510674,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:14
  2⤵
  PID:6352

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1740

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4708

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:1984

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E4 0x00000000000004D4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2608

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:6356

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:6408

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:6492

C:\Windows\System32\CredentialUIBroker.exe
"C:\Windows\System32\CredentialUIBroker.exe" NonAppContainer -Embedding
1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
PID:6548

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:2272

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 88e8496f79fcc56fd2c308aece4d8e5fec17b54e98ec26958f051858ad846bd6
MD5 f26433e8f9e90b2ee64537eeeaad0760
SHA1 199ecf3a7466a1137b042d003c224acdf26a8993
SHA512 916cd02ccbcd6f4e12e2118648e0cc32220abcc4613fbd2712d249414f5376e0c02ce0532c70c49dbed1db795c70d3dd3a688a4f667ee68596992f22f72adb77
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7Y:fwUQC5VwBIiElEd2K57P7Y
TLSH
T1B4B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ee3af991fa1719733ca1e3ac746d5b605f4205e269bf244bd9ae780ceadb9bd8
MD5 a044f6413820c4c3fbd300ee9b379ebc
SHA1 94fc91536a25274f06d3a6e89322dec7fde7912e
SHA512 ced4374c54d7b4ea2b76afe4ca5d8841dfb55d8cb5db96de4ed49e64bd3850a817db5301787c268756641c94c0bf85eb4ee188f04fc891fa2e45ad48284985a5
TLSH
T13AD02BA433044D0CCE40203215B8A210720484209C49031A8D41B01C8C6FD4387171FB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9bb02e5c3df0fe5da83794bd9fdfc835234bd8051ebd671dc536fc72b521c60f
MD5 1518285c968ab72392c86c75a8ac2a2a
SHA1 8fc3874d30c34841870f1b306694e5b4ff0ac295
SHA512 908df4f740c1becb3f92cf0fc9a04e433e63c9c814f694281b9aec9b65eb60564d14d427617215ecd3564122c459cc98464217d15b9dd5cbf115803275a43a97
TLSH
T12DD023B07529EB80CB0D003540245A00322A82323CC7032399917C0CCD7D800D3DBBF7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 22c1d58ffa7df77a7e0440ce3b2c474b1e03f30b60355bbf5dd6392fefb641fd
MD5 b9f45a900b1f64efbf90731f41c6ad44
SHA1 0c28e85e464e328fbbc07373b05113d39f83bdcc
SHA512 132313545c55ea809da0e811d6d5d324ecf5b6cfaefadb3fa4a29df5e6266dfeca7cffa4daf21754b4b37771504d3692189b5660a468784b5eaf80bf92f59ae0
TLSH
T11ED02BA033044C0CCE40203215B9A210720484204849031A8E41F02C8C6FD4387161F7
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 357B
SHA256 e3d96884d684b94b75cf07c8d28621812833ebc9d7a02c4c7981acb9197ca340
MD5 e3b4ac29acd05ad3e068093cb8fade95
SHA1 2aae714153b092a257fafdcc5c0f1bce42b5959b
SHA512 4313af0749aeb0805f4b2c7c5715879388ee9741ba55ee3abb9e694939fe96e9a23a6b7eff768c35c7681daefddd957b8547d4ddd4b3e9478c2577fe3baecb6b
TLSH
T1FCE020E59385EE7C3EC9964790B57318D9107187D64DEA573244F08C1D41D009F5679C
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 158B
SHA256 249358b1eab901f0b034023569e7f01b1f94c9179591789d99d6f279761d6e1c
MD5 e3fe72c0f542fbb29d9eb8933eefb382
SHA1 fce9a5a6bf89b76d58b4c0f0c691531330ab3b3e
SHA512 f71315278d44c74df19833e56e16d62705ddd45cc9bbabd13be55f51927a3d7464736846a1c4bcda6770c5b8c0720e1defbfbddb5206de648079efb1a9250340
TLSH
T17EC080D9BD4D845FD385187E5716F00007906511942796171650FDC032419A01E29220
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00004a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00004a
Size 1024KB
SHA256 d89033106b6ae3d9e826f32eac92bd841e746b79456fc22e5f689c99418d0537
MD5 d197649c73526935efc119fe8ec163f8
SHA1 a30894d83231d77a9c663b5f450ed34db212fc12
SHA512 c02892254a76f4ca86bcfd87c261da6696b62961bbfab87d3ccff67c5319a34d71e22e3760a690f5ede37493af1b367659d0739ea721dc2e7402f560d22efd1f
SSDEEP 24576:60lemPA6qA9+FfvAw8wUDuUNIgYTk/VdAze3jLkgNyb:6Ke/JE+F3UaUNZY6YaL+b
TLSH
T1AF25330565FA34E0D1323EFC25A89A5860709AA06B6C0773EFF1AFA7D9AD35D7101E70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 3f9b72f7528f98ea43e13e0eeb8665bf36b92a0d6ab4dd7d44e69fa1b34028d5
MD5 dcf57d7f085791b268b143ee41a56167
SHA1 a99fa5dfa8733afddb3c2bf94d74fa309f4aa4dd
SHA512 ab8e7e5ae3a09c519332798a482445112531c460067efc3602623366a52ae53c4ce9b49ed4ed6c5492d55e5c28ecf17378649106b531bb0f4cf983969e686725
TLSH
T1E541FC6823E40BF1D7A049B128E17D4A32F4C46D360B2EAC312C9EF85AD2F9403D5D93
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 11KB
SHA256 35e11d7dd62ec7d2a3ce02067a3361dc8ae7a8aa75e6ae736ae710bcd77fae0f
MD5 ddb2d75089949ed94f916a805bfba2b3
SHA1 b5e5e37829e4fa9f0092e4edb6868377fb91915c
SHA512 e306935fce4225a29f38aa5a1b193d42ef2b42aadadd4dcf607bf82f9014481705160c21626d149ac665f2005e39ac5925a6a860ecf3389ce8667779cbd8a80e
SSDEEP 192:DoIEp7eF2s9jyMaVaio2/uE5H2eE6Wj7zNrVtVpYImVlIbXG+6oEXEsHL9fYXqnQ:DoIEp7eF2s9jyMaVaio2/uE5H2eE6Wjt
TLSH
T1423299FBC7E4863D8A0156F5AB146E2BCE5845648B6C3979C9D4FE0763E2821F20274F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 12KB
SHA256 3472c57d6e4e66642670027c850da94462e92fac1ed9f6d31e89b750fb222fda
MD5 06e1de39e623c1af044e62987f801e22
SHA1 6f81978e0d7910fdfcdce3f5f895cfaafa42d31a
SHA512 1b305a6acaa319a96999643e6f4ad270b581046bf78a1c7a403cc4030b16056f0c9ec608c6fc6322162a7611a8bbb6147794760b76731d6934420bf60fc2f539
SSDEEP 384:DoIEp7eF2s9jyQ1oxaVaio29E5H2eE6Wj7zNrVjpYImVlkXG+6oEXEsHL9fYanQ1:9
TLSH
T1065288FBC7E4863D8A0156F5AB147E2BCE5844648B6C3979C9D4FE0763E2861F20274E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 266dfe3e50fbc43867dad8b2ee99bc77fe64dac0ce3210df6295cd48d463448b
MD5 705e1f7dff683101128f7ec4cb9a1329
SHA1 5605ab56c1d09d90fa9b6c4c2183a346d984ed7d
SHA512 23437073f3a1c124ae40b667930a3ad14d2b3ad21f45ed6c717cb657b39e962495ae2f6bb0ed793ae9057ae81dc675cde2c7f95ab7c92fb6d936071072e35412
SSDEEP 192:sxRZRE9yM/jK1Ml8wY4/fBs/uopq1zJKzoD8pqu/g6+WNMP8VYGgbVHH+GVIgD8Z:sxRZux+4/fBsGo4t2J/5vVcHvE
TLSH
T17F62D715A634A977DCDBD209FA517B63D6F95533A2901E44AAFCDA0C00E6BED2203C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 7499a6662085f63cf80bc0b75bd726b8b43778614f8c95d92685e19469e41593
MD5 ca9ec10b57324bd8e2abfca1e7c16fd6
SHA1 7aff649599f9e0c2926c99a894159fae2a48882d
SHA512 0ce6188218c211c43274fa6fd51165686c73d9d0427b13d6a2c1a2d38130142d1027fe3fa64a96a71d9e253de207121135285da077c6ae752c7300ed12394a9a
SSDEEP 192:sxRZRE9yM/jK1Ml8w/4/fBs/uDpq1zJKzoD8pqu/g6+WNMvY9YGo82HH+GVIgD8z:sxRZuxh4/fBsGD4t2J/5R9zeHve
TLSH
T1DF62B615A6349977DCDBE209FA417B63D6F95532A1901E44AAFCCA0C00E6BED2203C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 4b1e2a0364960deadbe4317f89329c9c89371cec23c41c9375049f263159b884
MD5 29ac711c26e78de99763ca137f584d18
SHA1 16cb72a5ea59360ceeffb6ace6bfe6bc52d6765e
SHA512 01f1654cb0ed6196331a1749602fb2ab25573b8f32050b4422cba236ec7a8ac8bdc27ee75a07a3f81cfbe7e220bf6a53312cc958cff0716cb839042e0a48a51d
SSDEEP 192:sxR4RE9yM/jK1Ml8wb4/fBs1uopq1zhKzoD8pqN/g6+WNMHt/YGobVHH+GVIgIJ:sxR4uxl4/fBsQo4V2i/52/0Hvs
TLSH
T19462D715A6389977DCDBE209FA517F63D6F95533A1901E04AAFCDA0C00E6AED6203C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 61a912e361b82eef367d6ddcab5f2c8cb6370a17316c25a05adf2e45b55a3517
MD5 b5b054f7e09c28089dae1e66ca816f85
SHA1 16607719a759c270749f622c7cc6ae477a7a96b0
SHA512 194c1007345963f2b7908e9d0e5109d80abb1af69844c77432110a5b32e2028893c13aa208aec1080acb7629d96d449c15b12e10a8aaf4d4741df0f0ea8ac3a6
SSDEEP 384:sxRZuxqM4/fBsGD4t2JhVR/5CgQ9dMgHve:s9uYM4/fNDdhVR/5CgId/H2
TLSH
T18572E615A5249977DCDBE20DFA917F63D6F94532A2901E04AAFCCA0C00E6AED6203C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 964641c8724f0642d51256a9067f76aaba3d811c2b358d1d36834e64ab7ce9a2
MD5 18107b3717ab67a6a9a263104d772ae7
SHA1 f19e6f85ace527260c27f290484d15132cf5c517
SHA512 ae368d10dbaea48f798949c9be9a150cecbd883d6382a94d7f0c6fe9277f84e37e725731092adc8300ca9b36b2bd2573de485ad8cf8194721eaf25913627b1ee
SSDEEP 768:UtiiWNWgv7fgJ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPpN09roYll:UtiiWNWgv7fgJu1jaCf02ol
TLSH
T141C2FC3B640CC77E4F844E6DEC29BED76DD801CB5B984D9447EA890C03C77EB921A49A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 d96c63404a5762137b8f06cac8a6fc84fd5c226d75c79427838e238830abfd24
MD5 20cb12fe7190d6e30a3001626860163e
SHA1 adcc89e9bb5ffea8dedc4ceba7acd05d85897fa6
SHA512 11a393bc6dcf26f0f7baf815d254d18ab26d361fff037271f42760da079f0922690b3815fc75f60ec7335e0e7c09bb7b3c3fc387b34f73b5499f351b57bd3aec
SSDEEP 96:KRm7KmgIIOW4tVgGOK47g0OcOGlkdqjXNn7vWj4mgfvK4+gBvcldQzLkHLURlTpb:Cm7KmgIIJ4tWGm7g09OGlkdqjXNn7Ojc
TLSH
T1DF913545753A12403CBDFA1981B8991F92C1B4637159A46B7FA821B61F3BE038DFE8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 88c4ef3f8fe2c27ff1b403c84b0af6de6bb754198984b1ff85684a87b41cd610
MD5 30a8572e6aef4fd713c90448683801fc
SHA1 00919a35b307989eb46635d62a7f0abe7afe43ef
SHA512 baec9a5587571efefc4ebc4813d34389493286413ed2da0cd8ab286d4ddf2916b737b1a93d233ba78921b36605ef19fb9d593d01cfccf7913cee202939d00565
SSDEEP 768:Krv+4UNbdE3bnelYycgBf7Hucys6BRvi82oP4/z6himo69x:Kbsbi3Ng83imOz6ImoOx
TLSH
T1ED03AF31F4689D73ECEB8298B0477A537FF4522385C81990E9DE5B0D169BAAD530BC23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 2b642c7a028ac45a3f9e89ff1726d4fff3f8fdec9b0515788a09884cc0669a25
MD5 bd57b05bffb4c5ecd43f087277f522a8
SHA1 fa5676952c8eda918ea8ef8b1fad904771cc35f0
SHA512 c86220937a874f08a0d8219e5eeab6c8737456992417e590a11d1802cf98f500da383a1054f27f5b83fcd065a80bb95185c2d3fad3eefa0c4cb30ffd3653702a
SSDEEP 768:PP3W+MlYycgBK7Hucys6BRvi82oP4/z6himo69Pi9P4+:PP3tgR3imOz6ImoOPq
TLSH
T161136CF0A4D79972DC9E9387A37D2E026EBCD213B5881940B7D99A0DCD9753FC306822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 97476b1f5774578ef1a2f8edde33d86cb0cdc8aa6fa47d11fb4f74552a49fd75
MD5 51067624b1fa553569236daf8c517d3a
SHA1 c4ec01353cf67be9cdc7c7fec6da641c1d1e08a6
SHA512 387f8964abb6adaf305435e0a79061be6d13e81d33928ea9149e3e5ba6b5a67562cd3079576017edf81a1f55f8b5113aef2329d41f4d087cebee0b44af910d19
SSDEEP 768:2x3WmMlYycgBf7Hucys6BRvi82oP4/z6himo69Pi9P4+:2x39g83imOz6ImoOPq
TLSH
T1E9F2BF31A8549D73ECEBD2D9A0463642BFF05323D5C82994E5EDDB0D16D7A6E030BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 6766a04686ddb280da554116b69e89b9f8d62ad7aa3b9e8b3732384e55c97df9
MD5 4275180002a397ffce2a0298f37b0dab
SHA1 bd5427d1a15e9335e6e7916144d38d694a20215a
SHA512 592daa180ba40be9a0caf03a8c49543c2493d22e63154e488b93f69e25c33077f04095b39fd68cb7519f1edbf4df16f67a60fafdca72d5d293f5faa632b2f9fa
SSDEEP 768:xGrv+4UNbdS39zvlYyc47Hucys6BRvi82oP4/z6himo+62bwn+h:xGbsbw39cd3imOz6Imod0w+
TLSH
T14803CF35E4548973ECEBC2C8B04A7A537FF4522385C91AC0E6DE6B0E029B95E530BC63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 23e7f0bd4992af1c199921dd65a6a0b00fb1defcae2f4accf228bb760921d305
MD5 045fbe9dd7c2639874fb4b562b68315a
SHA1 25a74393fcd32845ca2db334266dcc049101abda
SHA512 f9eac605a72c1ac0937dba4e54f7f9e8e5c85c13afe24a8486f2c191c7d19568edb0b396cc1bb130a5c350558e8ca8a800979da4c0e6694c5bee4096746e2a66
SSDEEP 768:Grv+4UNbdS36wlYycgBG7Hucys6BRvi82oP4/z6himof92bwn+h:Gbsbw3mgh3imOz6ImoV0w+
TLSH
T15D03BF32E4189D73ECEB8288B04A7A537FF4536385C91A90E5DE5B4E069B95E530BC23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 cba50431cafa0be40c7a83e4d5147691c9c01e94db7fcc0a1a82f8886a832fdb
MD5 27b17b99e3c897d36db5a042cc1f44d6
SHA1 78c70f12d2fea70fdac3c3ce5776474538a2dca3
SHA512 e34b63abf2c58d21a080b730f28a36d2e63df2066a3974368959b256eb231ee5e465f36b4ed782f5e3f2ae51d84e4a72ff5c3c9f828538758e1c3364e6649939
SSDEEP 768:OP3bmMlYycgBf7Hucys6BRvi82oP4/z6himo69Pi9P4+:OP3Og83imOz6ImoOPq
TLSH
T1A7F2BF31A8649D73ECEBD2D9A4463642BFF05323D5C82994E5DDDB0D16D7A6E030BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6579276d-f997-48e3-b2f4-37d0e39610bf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\6579276d-f997-48e3-b2f4-37d0e39610bf.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

memory/6492-298-0x00000232F3950000-0x00000232F3951000-memory.dmp

Download

memory/6492-297-0x00000232F3950000-0x00000232F3951000-memory.dmp

Download

memory/6492-304-0x00000232F3950000-0x00000232F3951000-memory.dmp

Download

memory/6492-303-0x00000232F3950000-0x00000232F3951000-memory.dmp

Download

memory/6492-302-0x00000232F3950000-0x00000232F3951000-memory.dmp

Download

memory/6492-306-0x00000232F3950000-0x00000232F3951000-memory.dmp

Download

memory/6492-305-0x00000232F3950000-0x00000232F3951000-memory.dmp

Download

memory/6492-307-0x00000232F3950000-0x00000232F3951000-memory.dmp

Download