f1b11db92f90a20bfea5355e28bfccf1fba0a74985d72a1e65aeb455f23a2114

Analysis

user interaction
yes
max time kernel
898s
max time network
876s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/08/2026, 22:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a1.txt
Size 56B
Sample260828-197b6sen2t
SHA256 f1b11db92f90a20bfea5355e28bfccf1fba0a74985d72a1e65aeb455f23a2114
MD5 75f8c016b38499a79afb24db8314ecfb
SHA1 b29d50ab7628fe727fe2ec870add679c918edff6
SHA512 786d8297d883763db31b653e480da073a491799c56b7e6ad71e346500cfa998cab0a40af642505a309d659238409d801caa0451ab0d8345030ec1fa4a6d3fb0d
TLSH
T18F90025BC52B905D9B65418845052757F62BC418CA99D0F8F110804550122516055E15
MD5 SHA1 SHA512 TLSH

Score

7^/10

discovery persistence ransomware

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
4544	msedge.exe

Probable phishing domain 1 TTPs 1 IoCs

Phishing

T1566

description	flow	ioc	stream
HTTP URL	36	https://sourceforge.net/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=a326ba3d6c6bcd11	1

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4544_742436986\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4544_742436986\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4544_1833841556\travel-facilitated-booking-bing.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4544_641884485\crl-set	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4544_742436986\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4544_742436986\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4544_742436986\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4544_742436986\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4544_1883277039\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4544_645207723\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4544_2064406865\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4544_1883277039\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4544_742436986\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4544_742436986\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4544_742436986\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4544_742436986\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4544_645207723\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4544_742436986\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4544_742436986\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4544_742436986\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4544_1883277039\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4544_1833841556\automation.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4544_742436986\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4544_742436986\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4544_742436986\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4544_1581266844\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4544_742436986\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4544_742436986\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4544_742436986\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4544_742436986\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4544_1075368510\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4544_742436986\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4544_742436986\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4544_742436986\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4544_1075368510\safety_tips.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4544_127815608\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4544_742436986\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4544_742436986\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4544_1833841556\extraction.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4544_271388131\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4544_1508314735\regex_patterns.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4544_742436986\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4544_2020902862\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4544_742436986\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4544_645207723\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4544_742436986\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4544_742436986\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4544_742436986\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4544_742436986\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4544_742436986\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4544_1508314735\v1FieldTypes.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4544_742436986\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4544_742436986\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4544_742436986\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4544_742436986\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4544_742436986\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4544_742436986\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4544_311733449\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4544_742436986\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4544_742436986\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4544_742436986\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4544_742436986\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4544_742436986\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4544_742436986\_locales\am\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4544	msedge.exe
1824	msedge.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134324294834755232"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{23F1CF52-6ECE-42DA-82B1-54DE52A723AC}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
4452	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1228	msedge.exe
1228	msedge.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
808	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe

Suspicious use of FindShellTrayWindow 12 IoCs

pid	Process
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4544 wrote to memory of 2976	4544	msedge.exe	90
PID 4544 wrote to memory of 1824	4544	msedge.exe	91
PID 4544 wrote to memory of 5472	4544	msedge.exe	92
PID 4544 wrote to memory of 5472	4544	msedge.exe	92
PID 4544 wrote to memory of 5472	4544	msedge.exe	92
PID 4544 wrote to memory of 4116	4544	msedge.exe	93
PID 4544 wrote to memory of 4116	4544	msedge.exe	93
PID 4544 wrote to memory of 4604	4544	msedge.exe	95
PID 4544 wrote to memory of 4604	4544	msedge.exe	95
PID 4544 wrote to memory of 4604	4544	msedge.exe	95
PID 4544 wrote to memory of 4080	4544	msedge.exe	96
PID 4544 wrote to memory of 4080	4544	msedge.exe	96
PID 4544 wrote to memory of 4080	4544	msedge.exe	96
PID 4544 wrote to memory of 6044	4544	msedge.exe	98
PID 4544 wrote to memory of 204	4544	msedge.exe	97
PID 4544 wrote to memory of 6044	4544	msedge.exe	98
PID 4544 wrote to memory of 6044	4544	msedge.exe	98
PID 4544 wrote to memory of 204	4544	msedge.exe	97
PID 4544 wrote to memory of 204	4544	msedge.exe	97
PID 4544 wrote to memory of 2748	4544	msedge.exe	99
PID 4544 wrote to memory of 2748	4544	msedge.exe	99
PID 4544 wrote to memory of 2748	4544	msedge.exe	99
PID 4544 wrote to memory of 5976	4544	msedge.exe	100
PID 4544 wrote to memory of 5976	4544	msedge.exe	100
PID 4544 wrote to memory of 108	4544	msedge.exe	102
PID 4544 wrote to memory of 108	4544	msedge.exe	102
PID 4544 wrote to memory of 108	4544	msedge.exe	102
PID 4544 wrote to memory of 2892	4544	msedge.exe	103
PID 4544 wrote to memory of 2892	4544	msedge.exe	103
PID 4544 wrote to memory of 2892	4544	msedge.exe	103
PID 4544 wrote to memory of 1436	4544	msedge.exe	104
PID 4544 wrote to memory of 2132	4544	msedge.exe	105
PID 4544 wrote to memory of 1436	4544	msedge.exe	104
PID 4544 wrote to memory of 2132	4544	msedge.exe	105
PID 4544 wrote to memory of 2348	4544	msedge.exe	107
PID 4544 wrote to memory of 3052	4544	msedge.exe	108
PID 4544 wrote to memory of 3052	4544	msedge.exe	108
PID 4544 wrote to memory of 1380	4544	msedge.exe	111
PID 4544 wrote to memory of 1380	4544	msedge.exe	111
PID 4544 wrote to memory of 4596	4544	msedge.exe	113
PID 4544 wrote to memory of 5240	4544	msedge.exe	112
PID 4544 wrote to memory of 4596	4544	msedge.exe	113
PID 4544 wrote to memory of 5240	4544	msedge.exe	112
PID 4544 wrote to memory of 3096	4544	msedge.exe	115
PID 4544 wrote to memory of 3096	4544	msedge.exe	115
PID 4544 wrote to memory of 3096	4544	msedge.exe	115
PID 4544 wrote to memory of 4084	4544	msedge.exe	116
PID 4544 wrote to memory of 4084	4544	msedge.exe	116
PID 4544 wrote to memory of 4084	4544	msedge.exe	116
PID 4544 wrote to memory of 2568	4544	msedge.exe	117
PID 4544 wrote to memory of 2568	4544	msedge.exe	117
PID 4544 wrote to memory of 2568	4544	msedge.exe	117
PID 4544 wrote to memory of 5012	4544	msedge.exe	118
PID 4544 wrote to memory of 5012	4544	msedge.exe	118
PID 4544 wrote to memory of 1256	4544	msedge.exe	119
PID 4544 wrote to memory of 3180	4544	msedge.exe	120
PID 4544 wrote to memory of 3612	4544	msedge.exe	121
PID 4544 wrote to memory of 5260	4544	msedge.exe	122
PID 4544 wrote to memory of 4944	4544	msedge.exe	123
PID 4544 wrote to memory of 4944	4544	msedge.exe	123
PID 4544 wrote to memory of 4472	4544	msedge.exe	127
PID 4544 wrote to memory of 4472	4544	msedge.exe	127
PID 4544 wrote to memory of 2800	4544	msedge.exe	128
PID 4544 wrote to memory of 2800	4544	msedge.exe	128

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\a1.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:4452

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument microsoft-edge:?url=https%3A%2F%2Fsourceforge.net%2Fprojects%2Fsilverbullet-1-4-1-pro%2F&timestamp=1787955877726&source=WindowsSearchBox&medium=MSBLink
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Time Discovery
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ff9028ac188,0x7ff9028ac194,0x7ff9028ac1a0
  2⤵
  PID:2976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2156,i,191899169368087057,14916629667811744758,524288 --field-trial-handle=2600,i,6324258015915593788,17150259786305088525,262144 --variations-seed-version --mojo-platform-channel-handle=2628 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1872,i,1660205938713749683,15477515601357570490,262144 --field-trial-handle=2600,i,6324258015915593788,17150259786305088525,262144 --variations-seed-version --mojo-platform-channel-handle=2596 /prefetch:2
  2⤵
  PID:5472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2664,i,12577967546164557816,11077406451442284357,524288 --field-trial-handle=2600,i,6324258015915593788,17150259786305088525,262144 --variations-seed-version --mojo-platform-channel-handle=2892 /prefetch:13
  2⤵
  PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3588,i,5566687729584001055,11071454757814933424,2097152 --field-trial-handle=2600,i,6324258015915593788,17150259786305088525,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:1
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3596,i,3320872588345849327,10089855984638904428,2097152 --field-trial-handle=2600,i,6324258015915593788,17150259786305088525,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:1
  2⤵
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4316,i,7414483693526341368,7423041173627440523,2097152 --field-trial-handle=2600,i,6324258015915593788,17150259786305088525,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:9
  2⤵
  PID:204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4304,i,13594760946531525422,7421851883838319072,2097152 --field-trial-handle=2600,i,6324258015915593788,17150259786305088525,262144 --variations-seed-version --mojo-platform-channel-handle=4420 /prefetch:1
  2⤵
  PID:6044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3932,i,18216715077630012964,2978398069604892520,2097152 --field-trial-handle=2600,i,6324258015915593788,17150259786305088525,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:1
  2⤵
  PID:2748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5408,i,10233374116706215775,17198994222896333984,524288 --field-trial-handle=2600,i,6324258015915593788,17150259786305088525,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:14
  2⤵
  PID:5976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3888,i,2650186916966108166,12406440039353793432,2097152 --field-trial-handle=2600,i,6324258015915593788,17150259786305088525,262144 --variations-seed-version --mojo-platform-channel-handle=3800 /prefetch:1
  2⤵
  PID:108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=4048,i,14672868274144431643,13631150875673649601,2097152 --field-trial-handle=2600,i,6324258015915593788,17150259786305088525,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:1
  2⤵
  PID:2892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5836,i,15167154572046904593,17627920698723484448,524288 --field-trial-handle=2600,i,6324258015915593788,17150259786305088525,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:14
  2⤵
  PID:1436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,8407031762117069530,2449951526164432900,524288 --field-trial-handle=2600,i,6324258015915593788,17150259786305088525,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:14
  2⤵
  PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6476,i,2802516867416330056,15170605047230722862,524288 --field-trial-handle=2600,i,6324258015915593788,17150259786305088525,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:14
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6476,i,2802516867416330056,15170605047230722862,524288 --field-trial-handle=2600,i,6324258015915593788,17150259786305088525,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:14
  2⤵
  PID:2348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6760,i,13636844079587842946,7316369525875868656,524288 --field-trial-handle=2600,i,6324258015915593788,17150259786305088525,262144 --variations-seed-version --mojo-platform-channel-handle=6720 /prefetch:14
  2⤵
  PID:3052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6648,i,6551889675562930929,8212162564684899365,524288 --field-trial-handle=2600,i,6324258015915593788,17150259786305088525,262144 --variations-seed-version --mojo-platform-channel-handle=6720 /prefetch:14
  2⤵
  PID:1380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6756,i,5028675356364332257,7816091770022103459,524288 --field-trial-handle=2600,i,6324258015915593788,17150259786305088525,262144 --variations-seed-version --mojo-platform-channel-handle=6948 /prefetch:14
  2⤵
  PID:5240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6960,i,2180758405220140061,13877004474567797396,524288 --field-trial-handle=2600,i,6324258015915593788,17150259786305088525,262144 --variations-seed-version --mojo-platform-channel-handle=6908 /prefetch:14
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=5064,i,17755537227698124170,5660802946589120220,2097152 --field-trial-handle=2600,i,6324258015915593788,17150259786305088525,262144 --variations-seed-version --mojo-platform-channel-handle=7080 /prefetch:1
  2⤵
  PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=4292,i,11701022915989013611,11754693898055026402,2097152 --field-trial-handle=2600,i,6324258015915593788,17150259786305088525,262144 --variations-seed-version --mojo-platform-channel-handle=6940 /prefetch:1
  2⤵
  PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7356,i,12209023315991432486,7106416117809632549,2097152 --field-trial-handle=2600,i,6324258015915593788,17150259786305088525,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:1
  2⤵
  PID:2568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4416,i,15131313343797281553,8298248327077846522,524288 --field-trial-handle=2600,i,6324258015915593788,17150259786305088525,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:14
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7076,i,3980791335560267331,17319554005969801817,524288 --field-trial-handle=2600,i,6324258015915593788,17150259786305088525,262144 --variations-seed-version --mojo-platform-channel-handle=4044 /prefetch:14
  2⤵
  PID:1256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7060,i,12699242640710097995,13955403674018202353,524288 --field-trial-handle=2600,i,6324258015915593788,17150259786305088525,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:14
  2⤵
  PID:3180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4076,i,6493335334793245016,4896012975478327818,524288 --field-trial-handle=2600,i,6324258015915593788,17150259786305088525,262144 --variations-seed-version --mojo-platform-channel-handle=4900 /prefetch:14
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4312,i,14450093367646604676,13634514478618581878,524288 --field-trial-handle=2600,i,6324258015915593788,17150259786305088525,262144 --variations-seed-version --mojo-platform-channel-handle=6916 /prefetch:14
  2⤵
  PID:5260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7504,i,7219344723017858384,7422378634837758078,524288 --field-trial-handle=2600,i,6324258015915593788,17150259786305088525,262144 --variations-seed-version --mojo-platform-channel-handle=7632 /prefetch:14
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4416,i,12611193598808642903,7492838620773378108,524288 --field-trial-handle=2600,i,6324258015915593788,17150259786305088525,262144 --variations-seed-version --mojo-platform-channel-handle=6592 /prefetch:14
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6252,i,1701340140919449267,4511126568687038711,524288 --field-trial-handle=2600,i,6324258015915593788,17150259786305088525,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:14
  2⤵
  PID:2800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7624,i,7308734153796280284,7689810309733380249,524288 --field-trial-handle=2600,i,6324258015915593788,17150259786305088525,262144 --variations-seed-version --mojo-platform-channel-handle=7444 /prefetch:14
  2⤵
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6616,i,17687962777933908636,14726611377328688075,262144 --field-trial-handle=2600,i,6324258015915593788,17150259786305088525,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6156,i,10481864149929535913,1906171064638370831,524288 --field-trial-handle=2600,i,6324258015915593788,17150259786305088525,262144 --variations-seed-version --mojo-platform-channel-handle=4804 /prefetch:14
  2⤵
  PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3560,i,6216554716470232762,7741290901417479627,524288 --field-trial-handle=2600,i,6324258015915593788,17150259786305088525,262144 --variations-seed-version --mojo-platform-channel-handle=7036 /prefetch:14
  2⤵
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4876,i,4899699136083368285,18353817751520985462,524288 --field-trial-handle=2600,i,6324258015915593788,17150259786305088525,262144 --variations-seed-version --mojo-platform-channel-handle=7540 /prefetch:14
  2⤵
  PID:5356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4920,i,9387074737000162973,15104663971857517484,524288 --field-trial-handle=2600,i,6324258015915593788,17150259786305088525,262144 --variations-seed-version --mojo-platform-channel-handle=1472 /prefetch:14
  2⤵
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1232,i,8750037464822351394,2417996483933470918,524288 --field-trial-handle=2600,i,6324258015915593788,17150259786305088525,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:14
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4952,i,5796489571169780135,17310769567224801918,524288 --field-trial-handle=2600,i,6324258015915593788,17150259786305088525,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:14
  2⤵
  PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1416,i,6629134623802932904,11429560417002516803,524288 --field-trial-handle=2600,i,6324258015915593788,17150259786305088525,262144 --variations-seed-version --mojo-platform-channel-handle=6592 /prefetch:14
  2⤵
  PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3444,i,14412833932870914344,9990112344051022992,524288 --field-trial-handle=2600,i,6324258015915593788,17150259786305088525,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:14
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6060,i,1326975274590896081,5530233838362545682,524288 --field-trial-handle=2600,i,6324258015915593788,17150259786305088525,262144 --variations-seed-version --mojo-platform-channel-handle=7260 /prefetch:14
  2⤵
  PID:5744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6316,i,8270780177978839431,17172151785456638083,524288 --field-trial-handle=2600,i,6324258015915593788,17150259786305088525,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:14
  2⤵
  PID:3888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6392,i,11100310919109227622,10686105716274197912,524288 --field-trial-handle=2600,i,6324258015915593788,17150259786305088525,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:14
  2⤵
  PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1464,i,16382572628975948279,15498225852266009365,524288 --field-trial-handle=2600,i,6324258015915593788,17150259786305088525,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:14
  2⤵
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6060,i,7259518342000525856,3419459468865437963,524288 --field-trial-handle=2600,i,6324258015915593788,17150259786305088525,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:14
  2⤵
  PID:4012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7592,i,2383995942968204909,15099435043622868322,524288 --field-trial-handle=2600,i,6324258015915593788,17150259786305088525,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:14
  2⤵
  PID:5316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7592,i,13455118585235331508,4597944022330608146,524288 --field-trial-handle=2600,i,6324258015915593788,17150259786305088525,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:14
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3176,i,4600335051918128188,11996858206463424855,524288 --field-trial-handle=2600,i,6324258015915593788,17150259786305088525,262144 --variations-seed-version --mojo-platform-channel-handle=6592 /prefetch:14
  2⤵
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5948,i,10746146109793535153,10166977840563464011,524288 --field-trial-handle=2600,i,6324258015915593788,17150259786305088525,262144 --variations-seed-version --mojo-platform-channel-handle=7608 /prefetch:14
  2⤵
  PID:1736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7456,i,14247063016035960507,107697282626428680,524288 --field-trial-handle=2600,i,6324258015915593788,17150259786305088525,262144 --variations-seed-version --mojo-platform-channel-handle=7036 /prefetch:14
  2⤵
  PID:2732

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5640

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4248

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5092

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:1376

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Phishing

T1566

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
MD5 b99f03c5cfe71b03836f8b5fcf09425b
SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
TLSH
T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
SHA1 5228b0b132542be004ea1bb32f3748964d065af5
SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
TLSH
T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 2e76dc0a92be611fbad2a5836ebfee3e20d0726617e77185b337ba9c67efc3cf
MD5 8d1c76acc7093b94248094e5324c4945
SHA1 56f1a8770938184c0ed5a8d9730f18c9d4fdda7a
SHA512 97d83bc8619063bd91ad2b4bae0f3abce68e330703285cc76de48fd81b1de7470856f1c0f52151a1868961020133c7837a04aacabb17d326dabc17a2f91527b3
TLSH
T1DAE0268535C8C36EB603645B9169870CDAC1360B92CBE99B17088484B793944B697AF4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 e0762dd07e2d4f8fc46431cfba258785a742738fc0904f7cd6e6e577d02ee2ec
MD5 d6795a34f1c7cbe7d2694624b7aa6458
SHA1 5972c256ba994d03ba89c2e330c4ea4c5ac8b731
SHA512 36486f0c1df21d74f473cbbf812e93f41f624a80305085152c2b00d3b34ba35312b732584f49c49836a366992ef15c2a1fce614ab51e3634f6ffbb73b015d396
TLSH
T13DE07D9534CAC3AEBA10E4C75178474CE6C0364BD2CAE9DB370488C5B891050F3D3EB0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 0f56faf6a0335670e1c377d664c52f9ce5b1695c0d373111e52a741191ec9034
MD5 64b17ac7b73cb844147b8fa9631e400e
SHA1 ca467c3f86f5e99d5aeccc1ea877f596ec61a241
SHA512 4503997ecbaee63a41eb7fe1f888f9d994bf2eda0f29b8e32555e8fcc5edf795ea01d9541e0346f0a69cf5a1d83fab39ee580646a26784879d0980e4b245f386
TLSH
T159E0268514C9C36EBA02A447526C830CD3C0360BD3CBEAAB2F00C4847792880E786AE8
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 deaba14f667e4780d019c796e2f9fa7a2945998150172bf32ce803f1a8c2209d
MD5 e37c18e490f049f6c8d8313d210082a0
SHA1 5ea8c3dc06653bec0393995c97fc9f289196ba46
SHA512 5da203883edca04b79d1b4f87b7d664f292df6ac62cfa1cc4eee92fb90f39851b8636b3cdad0a61840e2df5ea4b9db9c6cac7813bbfcadf1494c81a76fce170e
TLSH
T176E0209924D9C39D7A146447516C530C91C0360BD6C5E9D7570494C87C5118063C1A70
MD5 SHA1 SHA512 TLSH

Submit Download

f_00006a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006a
Size 21KB
SHA256 2634df0d79333ea639d7079f566163bb700a57783d3a8f09061c6b11a8a78bcb
MD5 16fee8edf1a69e98d81813f19fffa56e
SHA1 9aada423702d320e5dd580c831a3de3da06129c1
SHA512 0ed3ea486c66383aa308222a5552b5837ec0527e9716d837d5f5cfade007790d7f0e7f622ba41c535cfea7f510d85675da400d84863e60577af238e918913714
SSDEEP 384:80VKnq7QTS0TNdGqzD1+x9FpWtSdJrZJSk49KqdIaKLIfMuMJdPPYp:Kq7ATNYqn1+nWtS3VJmKqdKAMJdPPYp
TLSH
T1BDA2E128696925E7C4FC8E8852D6602A2D415C39E8F3AF9FFD40977C0743B284C1B2E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006b
Size 22KB
SHA256 40c97e11264cb1ac171847f410e85599e7ba7647e6dfe8d9d7f2c4b26d6ebb8f
MD5 6a9512d6b7d560ec8d28637f1f0ec189
SHA1 b0eb2fc3cc520974f84c177ebba34cd683646878
SHA512 a541189a3eb0ce250f32a5f01c92c100233922b9fe853e936c60b75e97c010929840aca21b204fe7ae3b4cadf380ab4f2134e9554328ba7ef7e105879546aeab
SSDEEP 384:H5OXeQD+vKTt/Ph2RWJFm8D8uX/ZfR7uCqCvoo99QKcvdnjaIfiHdLCU5SClv9L:H5cD+2tHhvJjIwBJaCqYrkhjfiH/5XlJ
TLSH
T120A2E1437C6FDE68803B92753156C173E412B239119633A3E303B76A95B850DFA59ABC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006c
Size 24KB
SHA256 a3cf4861c7d0c966f0ed6564f6aad6b28cbd3421a9ca4f60e2246848d249f196
MD5 344ee6eaad74df6b72dec90b1b888aab
SHA1 490e2d92c7f8f3934c14e6c467d8409194bb2c9a
SHA512 2a9a9162d610376512a8fae2cf9eb7e5146cc44c8ebde7a12e9a3985da1718c62ae517c25b00de7c0269efab61b4850a0becfbf04382a25730dbe9cf59825a62
SSDEEP 768:RMxowxdaCb0WaY4P8keYUej86bykBRWIsna:RM1r0NY4P80j86bHtqa
TLSH
T1EEB2E0EEEE552E4CE2F059B4962B734B8A46F022191F947832E7844E8F494C24EDE477
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006d
Size 24KB
SHA256 f254eb93b015455a3c89aaf970631bc989fe2bd387f79e871b514992359651aa
MD5 5366c57b20a86f1956780da5e26aac90
SHA1 927dca34817d3c42d9647a846854dad3cbcdb533
SHA512 15d7127970436f2510344600f3acecc19c39a05f8e82c8a7950095386382b2e2da55883a5a9faa97b84452e67315b9ac1693b6592274c8c1c35c813dfeb543a2
SSDEEP 768:ZfRLYs8uBykIQZ6yXBeQOS9JUmBgKYTbgVec:vsbmrDXwEfUmBgKYTc4c
TLSH
T18DB2D004F02ACA26E53655B371E82BD54CB6C4CAABA9935C113520AF3ED3F48C991673
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006e
Size 77KB
SHA256 d32bc23cbd5760feebcea7ca86888b06c4e67b73bbe9eb25fc36540ff38ce5c8
MD5 f500c3c19ad3497a32f184964a3d0160
SHA1 8eab498e4fe0bd82ccf557087f4bfa68ad64f950
SHA512 5873c486364771ba9aed6aa0d7966fc1264ada0c3f2adac24e2d685d3da15f3de778d8125752eb35ffb196bb0e5bf6b16f6d6e57c2d6dd6a17943ba573f6bdfe
SSDEEP 1536:NP2s592NDeBSjmYxJkOBwNsWbPfKFcwIK1wKsmDyNlCJOua:N9592ND5XxJN2OTIKi0DMVF
TLSH
T1C5730236D72D1AB8AD6296D8A9EA8B7D2E507E04132E5F1341DF97F0E3483FC2745224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006f
Size 41KB
SHA256 88d34dc5e985be79e7f7136861dde103e257d158f4067f3bfcccf19d55b53dc9
MD5 a87106a9b847a12a7ddbcbc689390668
SHA1 4366d1f05666943c083a1cbf6a14b75511f57e30
SHA512 887851f59ad5d79feb5cb12bfa8a3d0bceff59b1a8fe1f060d3702f4bff9bb227a0a49df61c46033c26593a9f0046c00e97cddb3ea3c2cfb4539293b9954fa9c
SSDEEP 768:uiPeGCTU2LKdTjKEBZSYMg77P6KzNaCYlPnsEalFMgsDOQ9GcUfH7g/rw/:XUQSWZSYMg77P6oNiZPgvzcUf0/r8
TLSH
T1A7130268169C9C411DF324A4F63C09834C8E8DEF11AE986D89C13F9686F42AD3FF6702
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 fd4bdb1ac5bfc8ab67616069c99671576c2865dc2eb9a163baa87a33418a763a
MD5 0c57c427a972f22efd3e72c3038377cf
SHA1 93a29c312b12b4a4eed871a8ca1b582ede4839c4
SHA512 8c28cf55fafc58eae66f7e829c667931a329dee7469d24320c44259806da0602984564d1149e0702c44fc0c5ae892f8ce79ee16daf2b018a224ae948c46135ef
TLSH
T1A651930F2B2589D3E771957260E6076932F9A669DBC3AE10C8001E32EA06F3181EBC57
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 9055f728f8a83d6ab4244bfbadce34dca70e666b5f4fb542a6bdc9a7070eba81
MD5 0864748e7dd121b11501fb08bb44651f
SHA1 bd4c9960d63601ba1cc9056521c80a65b8160999
SHA512 d0199606ab376ceb388f539ab1e7b6b87d2eff448e2b892d4431359f6d2012e78cfd3e31bd96a8cfd5229522a28fba4b2f88030962fb56c7e65f3fdf47ab2e12
TLSH
T1D271DC0F3B9A88D3E730567114E607E932F5E666CBC79E10C8481E36EA06F7681DB857
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 df35ceb4e60f16d56ec267ecbd53e9ed4b4d2ed68087c7b8ab7e05db49fef89f
MD5 087875ee74eed1eabc4b4980ef84b804
SHA1 3ab522a0b80a707e91297df9664e7ef5a33eb436
SHA512 d7153edb4172a4f3e22244211a0fef101329a25f1e1f6ce2eaccc6a49bd089da9e188cf082ae3a1f0bcd4f1ac1c32ff8ba13a823ec5906cbcf5ca1467cd3ee70
SSDEEP 96:DfOc/cZcNc1VaFkzCac/WTcqc4wBcvwcYcqcZQcH:D2mcOYVaFkWacWTfpkiwZNT6
TLSH
T148A1BBF3C3E8C66D89615AF1AA142F1BDE5C0914422C3D6AC9E6FE4F63E3071E141A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 707ac468a258151cdae7920398dcb0c48c7269fae9d558d4d6071dfd0c073c06
MD5 4b578a1f0e253c3d4f9faa13b4aae85f
SHA1 286d1a929de28cc48bf8cc3100d1fbc225d33006
SHA512 fcfb26a3afc289d341de68398abe40f05a6dff2d642125072d2385669b1073b404533e14310a376c9a61ac096ab2d55e81d85aef825210c8b45a5e1ceb861f5a
SSDEEP 96:D/OcUcacPc6UVaFTzCacDicqc4cvucYcqcZBcgwqGj4/3:DWtnMDUVaFTWaUifpiuZNe3TGj4v
TLSH
T12991BDF783F4C66E896156F0AA146F1BDE5C0514431C39BA89E1FE4BA3E3071E141A9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 70ed7f2168fa3d9c6485de46d7ea936463d866dcefe56503ab571392a561d579
MD5 fee7d4ce4455ab3c141e6c29fba8a944
SHA1 046b086380cf1f966df3f7d79715bcfd2da7915c
SHA512 8049d66ae87c87ac52a504bb8c9a51bce70c56cbd6b6de1d43914ca5cc876e482ba582a1d7226edbb58583add4659abff719997b7e0e9c0befc2a77c3242338c
SSDEEP 192:sxRORWYC2/fqsxKMZBGUzoA8p5ZCR/g6+WNjZcF//zZpoMmrCY+GzIgDybjdJ:sxROm2/fqsxKyBG1+/5s/Fwa
TLSH
T19242B6266D689D3B9CC7D21DFA55BF53D2F95032A1E12E48EAFC861C04E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 c61065a881ff531621a2da1fba71bc35fd9f207dd14097207f71944f0cbc5b2a
MD5 30ed9d33fff50e649f6191bdcd0e9974
SHA1 3b4dd74aa7db822d8bdbefd2e2c63182091b2fa2
SHA512 bac4701f614ab580d8edee1f742a8c5423fe14332233daa30f663a24285ce998903033e6738dfbf9cd105ec7e453e315341979cb4909c7f4082ea9875bd2cf6c
SSDEEP 192:sxRORWYT2/fqsxxMZBGUzoA8p5ZCR/g6+WNjZcF//zZpoMKzCY+GzIgDybjdJ:sxROX2/fqsxxyBG1+/5s/Xwa
TLSH
T1A542B62669689D3B9CC7E21DFA55BF53D2F95032A1D11E48E6FC861C04E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 44382db64c75fd5f7dd8e0f177599fd2ad0bdb3637c69af480fa9010a35fd0b6
MD5 b48f4ac2fe50e7c27b61e4fe05700c8a
SHA1 9d3d9c299528bad938cf8d70959059fde1624954
SHA512 fddeaecf3d6834dd3432cbcba2162fe398e0731d24bb6f91f72aaa8af4c0526e4b391cd3823ac524dd7204bfb48b90654559f507d2c68a6c93fca265b3ec19cd
SSDEEP 192:sxRRRWYC2/fqsrKMZBGqzoA8p5ZCn/g6+WNjZcF//zZpoMmrCY+GzIgVbjdJ:sxRRm2/fqsrKyBGno/5s/Fw1
TLSH
T13542B7266D68993B4CC7D21DFA65BF53D2F95032A1D11E48FAFC861C04E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 26KB
SHA256 e87210cf1d4b28805a1a785e814946c906792df473c43ae11d00e2b4f5882de0
MD5 15a5ab01c97fdce0f6db5832538a8a65
SHA1 76486bfe7240823255b65df8bfc879afeeef2467
SHA512 578f18dcb9bad7dd56129fa989d264a46c67c6040812e82892ac71dafedf9b819b46d4f9ce018d3f24dc938800ee43b7d1963f08bba9902b114ca469a8060270
SSDEEP 384:sxROX2/fqsxe66s8qMpRiYnazAW8pZS15posJWeT+hyBGy4/5s/XkQ:sSX2/f/e4Mnc7WeT+h6Gb/5OXP
TLSH
T17CC20815A824C83B9EC39D18A93D7E33DAEC505222C5DEDE56ECCA1C019E1FDAB0B457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 92253eeb051a6f01678352455e74f855669484b3b141bbba1661b9c710ac3c84
MD5 6683b37c1379ead8fa0d31dcb9d06882
SHA1 3b3a407b8ce2469f0e6a9c7063c05a76f2a718f9
SHA512 f7a9bcb93b91acec45eac9a17c0c98e09f3a656c97b17820eaf4d49b96da4bb0024a9d128950acf1e2d6292cf5481bee4772fc64029055e0d599b651d34581a4
SSDEEP 768:j26H9h7pLuLz6RWgs2fw28F1+UoAYDCx9Tuqh0VfUC9xbog/OV45BVuwiro9pew0:j26H9XEz6RWgs2fw2u1jaX5B4w5zepR
TLSH
T11FD2DB7B640DCABE4F800ADDDC297E9F6D6802CB9698CD8447FD941C03C6BEA511A4DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\7bc06df3-5a99-4bf7-b23e-54b8f06fb0d4\index-dir\the-real-index
Size 288B
SHA256 7547b6ed5ba0591002566166f5a633541d79feb5538b00bd0e51728def8cb357
MD5 9a84881492a7a07b90d3c14bdcc1f2bd
SHA1 cea25e2700966e7a3e576aa5800ad340bc0f33c5
SHA512 c074d79d749792e450146c2ba8dc9a07dd84bfde0487c929962ce6ec6f04681707d8c3fc5582f61bf51bca7327fe3be4c71a0e8309769e517e625550187ed50c
TLSH
T17AD0A78A9DA2550AD6127C790A736466333703FD25166E2600FC043E5655A788947105
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe60641d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\7bc06df3-5a99-4bf7-b23e-54b8f06fb0d4\index-dir\the-real-index~RFe60641d.TMP
Size 288B
SHA256 55389a43b50bd1de34b348be3677cc44787abc1078bb6dcf15a7340743af0c51
MD5 c369f2ce419258c6134e04504094e1d8
SHA1 91365d32d5ee17421a3e38ee54fcf3802921dfa4
SHA512 f2907abab6c63beee543d0f775b7a182e6096760367b9db1787ce8b4b6a65c562830dafd25da23a9a43f65883f5c47be13b6c6d79c227e2d0195bbcba4291864
TLSH
T18DD023DF4591A962D617153914436515333708342416AE2511FD047F49717AC9D81106
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 c2a75f1b9b49a3c2a8524427ce00e3d1bda03d5d4570a8d3bb394a2d61934873
MD5 c65d1eb8f71519526f923791b1a8f575
SHA1 5ab5523e55df1ea4f5c2ea4a2e5c1bc4320383bc
SHA512 9f52d3811c74cee636b8bda7f0680a8f27ff39cc616462063608c0a5081e0d493b01f00bace3c8cefeb179952843a5725b008adbbdf2b8bfa213bebaefa7a95b
TLSH
T1ECE0D8B32EDB6814ECBF97F5247198A50142F964D80AACCF251E93C250B1251795FC25
MD5 SHA1 SHA512 TLSH

Submit Download

ac8f7501-6160-4d76-ad6b-ac1b36df2d36.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ac8f7501-6160-4d76-ad6b-ac1b36df2d36.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

domain_actions.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Domain Actions\3.0.0.20\domain_actions.dll
Size 82KB
SHA256 e5c9378b540360fb4ab0b16bf40ed18bd99cf4a8a5a6923f4f240d373fb441cb
MD5 aeb538c29f46cf0e19827ce47594488b
SHA1 db32b33a5811c303b1e37e1ab956df20ba44b355
SHA512 38488a42e5c532442a65fd4edab683f1f63eea71bae3ba2f801693647f633af9d836171dc751b342dc2e0e7784266eb9a40f677c0d3c9f651e7374f1af707852
SSDEEP 1536:NocewxXknaFpdgxBf8paY3JQzQik428fKagFVbydki806yav7Sz:NZvx3bgrfrPza428fIe76yaDS
TLSH
T1F783F1C0DA6C0117EE6B4D75D17959CA6BB9D6B50BA0B3EB2372845A0E02FC5EF36700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

48533511-eaf1-463e-88df-9a5796f07933.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\48533511-eaf1-463e-88df-9a5796f07933.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 a6801ab0687146f174ad9292ad45053ddb7a35be054c41f2fc4d206b3e1f7c79
MD5 334c062e962828f23d47215ce3bc25d7
SHA1 96fae5d3185140bb7c094d7fff50c4975e0da76c
SHA512 4019e4892906f3a88c487dc9d79a87411bbb35c7e2fc936e91c64b7ca2f23c53b034bc3529d885bfbc30ef1f9c69b5215e2e2b59d2002c74cf66047c17494ea6
SSDEEP 768:hQ3WhL8/TBOW1r+BONXyer1IRCzni9gVyLTRi:hQ3WYWSIqnri9i
TLSH
T1BEF2AF31A5E69E334CE5E386F6477783AEF81063D4C44A40E9E96F0E059765E270F81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 8cb2c622d519b588fb2a08123c4b854d0679b1f9590af633089ce01a4ac0cea7
MD5 4f3ce1b833d1ccab26cde17d1e15e3a2
SHA1 16c23fdd7aefa71e54e79ac079e79a8930de9785
SHA512 601748543c966caeadb2b31351faebafa2c2a9173059c190bba92eb66f53b3b54643ba268d42167cf2c1b842631d24d7c03973f32af90b749e68ced4b63fd217
SSDEEP 768:qFQs3Qwgbh0vVsOW1r+qONXyer1IRCzni9gVyLTRi:Rs30IcSIqnri9i
TLSH
T1A71329F194D78A37D8AD9383A33D6E429EBCD063B4884580BBD55E0DCC965BFD30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 c19da9dce83ff1deaef675ac64eff0d50abe80b4c94f2616ac2356c91d501bc7
MD5 e075088c1813ae9d10bec8cfea5b01ab
SHA1 5af45e3b63d66febe73cd65ea0ec543f0ac60c2a
SHA512 018c01a99a2b36ad77e133ede9ffe618c2acbd6d1d48b3fdabef0d7388dbbd051366c9bb97d3a2406e1b0b75700d7e1a4b8afcfd6e8342da275df0344abecc9f
SSDEEP 768:hrv+4UNbdz3X7/TBOW1PONXyer1IRCzniBaeVH1SK7:hbsbV3r/SIqnpEH1l
TLSH
T16303CF32E4989E338CE2A3D6B147B6437FB86057C6800790DCDE2F4E069B59E130B957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 5eca2beb7a5f491b41f8608c080588a442b6994eee02595b69af12e787ff537e
MD5 7c34daaddff1b44d186e6b99ddccc644
SHA1 c4b025cf8050a315e0d7dae5bf1254975e5c7040
SHA512 6808860f3db70ea74bb088756a65fcf8c091810e9427f206c61a9c4cab0cc5e2ad2a19985119e6b57398971d04d3897272ade8d9411f09db565dec195daf1f0b
SSDEEP 768:brv+4UNbdz35u/TBOW1r+cONXyer1IRCzniwgeVH1SK7:bbsbV3ELSIqnUEH1l
TLSH
T1CB03BF31A199DE334DE6A396B147B7837FB82067C5800B90ECDA2F4E059759E230F957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 eac9392f75e15af0d7f7887c70855feb58bc7e36734005b99a54034697b8f312
MD5 7fefe7ce291aad4a718afad159970378
SHA1 9e9e926d628f0a0d04588c8264cff031c64accde
SHA512 09e215329a82dfde46116aa4b717b9d0730f0e9d40fb49acefe7cf146b93c4fba1b2c62cc26b12fdac9de8e80be8c47f8e0571aa7174e68639e86c3f6cf6b91c
SSDEEP 768:8rv+4UNbdv3ZhM8/TBOW1r+XONXyer1IRCzni9gJ:8bsbp3Hv6SIqnrJ
TLSH
T16303AF31E1999E338CF59285F147B7837EB820A784C10A94EDDA1F4E059755E230F957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 6547308ed450c6fc7e635e20e8018e4d00d3317745c82b121a30d95f64bdde56
MD5 4133c4f777d2a0b01f9c84af72f7e06c
SHA1 e784dde1322bfbd760321c76c7cb7bf7a2502aca
SHA512 0ce4662a34ac1dd8406baf90b68f4b19b7d83cc2976456873aca980c38e3454c2e26d085cb2c25346c631f662486f0ec13c0dc1846feae16824296cf2d63a34c
SSDEEP 768:YQ3ZhL8/TBOW1r+BONXyer1IRCzni9gVyLTRi:YQ3HYWSIqnri9i
TLSH
T177F2AF31A5E59E334CE5E386F24777836EF81063D4C44A80E9E96F0E059765E270F81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 e8104ceb84126f096b7d9998fc323cb9f085b809b117582366caed643e57338e
MD5 254facc79658ae757e376c5447fe0ed7
SHA1 f94caaace144f71b068efdd3afd6851c9c9c5ae5
SHA512 318c0575d6b612a9d98fd4569f0b7bfb23e14a475a3e8e6ef4c5323c36047d8db9ccf23934d7417add45f7145c2d78930d6c2eac9fddd6066c565b6dfade100a
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 7516d88ae0553112c316424e69b4f3609a73cde153c28408e38fcf0935179571
MD5 0eb95be616f753bff4ff3e464c5b3445
SHA1 29972248bbd472c6a300022258c30bdccc7c4792
SHA512 3784121352b5cb92d28f60ccc6f99fc72840678b244c63d448ef99c2d3937f9a4f78f4570490a1da199e1109dd129c53986c3d1ba845706debd6182595c3347f
TLSH
T144E001031B4000EAC038077440931B602AE3C03002A202466E2101690D623002F60EC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5c5a0e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5c5a0e.TMP
Size 392B
SHA256 8f8a29a9301f8139cee1e315e8c968ec9a6d5bf4e3dad18ad1b0ff36b6b8f020
MD5 a4284f45e396cb2b6a59dca673b171c2
SHA1 cdeaef9bcb23615c1fc62e43b0a9a3e611c5742a
SHA512 344c11e2c222730fed217f9c118c63a31a45854c975e9e5234158c2739474a68f4d17248688c7b0934b1deaffc357abc4d6a71bea7cfd1996782b81127c0a1da
MD5 SHA1 SHA512

Submit Download

22d90aa8-5e9b-445c-a36a-26186c17943b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\22d90aa8-5e9b-445c-a36a-26186c17943b.tmp
Size 1KB
SHA256 68dd4a6a0b1711003690c2995fd0b77ba3c9ae6c27dd853ff492b52bd7701bc5
MD5 bc900814bda342e30ca622ecf6edf1a1
SHA1 58549077a989da91156012baf9dbfc98ecfe429d
SHA512 c918bfea1c94a06e69e13a1edffa87e69fd698fc8ddf310fc5545d1e2a80613e7617e19110e5496fa91c8e8037bc67a81e300b571bebefb407ab16a384d97fa1
TLSH
T124111FD11C7E1AC6C6BE0E6FA4833AFD40D8A622F4E8307818C8E964927951E2451C7F
MD5 SHA1 SHA512 TLSH

Submit Download

abd93a6f-4035-427e-b903-f59bb6c5218a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\abd93a6f-4035-427e-b903-f59bb6c5218a.tmp
Size 852B
SHA256 cc631188ae4a22c0621e596be3d4335218373ee3aafe98bb7b213069a0dc3b70
MD5 1a8162cc03c34509f59ea81728419884
SHA1 459f726ff17ed37a212bf5291cc592b4745c3c06
SHA512 129393fb77432dda8e2c4181dc778f609f56572e69213f9f8cffc544b845119929242d41078170b2dc72a678116df340544edb181c2aff069f8cd4ac2a541083
TLSH
T1E8011ED14C7E1AC7CABE0EAEA0872BEC44D86522B098347818CCF864917940E3451C3E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 612B
SHA256 918167fab0fb4435546513252415c1a2e44b6e8e60caf6f31d07587ba0a71ab0
MD5 5ca920f0e1c81dfb329b916e242a4065
SHA1 1d068ad79883fd23c27647c98e761858e46f48cd
SHA512 2b99239123f922883dea3137835bb8b74713799981e5aa1434ea70db85e7666f2372db684f94bb599ecff70c8c31d02286b0587ffe620333eb1d4bbc7feb84b8
TLSH
T11DF002D04C3E19C3D5B90E6EA40717EC50D45517B0D8383804CDE894D07A05E315183E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 972B
SHA256 4d2b47e594a4d5d9d0c079c2ff5fac0e47e26ffad46c371ad51e472b3dcd0669
MD5 54b0cf5610d4cbeadf10f35941bea007
SHA1 8bcec79787775ec6c2625b88611eb0de385e393b
SHA512 3f6d82da490f1b52647d9f376be4aa3159f57072ad2b52a048895bf7f53255d860bc12cc4b5af53cf9d9ce8c76cfab722e47cef3b58fa776a8ffd7e991630253
TLSH
T1841184D00C7F1AC7C6BE0E6FA0872AED40C8A622F09830381CCCF964917901D3451C3E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 0e2427c94f170f6dda5a9a85ddaaa0dc0088899c19efbb73c05e3598cb541423
MD5 95ac3c4f8946991b2f4b965a390aa896
SHA1 864730b7c80ff406dcef7eefce17b842687c2bd8
SHA512 b13343c0c56d9943ac874eacdf49f82ad4ffcf8be1ca55600fbc7e0ba55c6203da11354a956eb54c11ee241672e2d8c66d8469e722cfb0c0129f0dbbe3c2167c
TLSH
T1942112E0183E1AC2D5BE0DAFB0872AED50DC9612F8D834382898FD68967E51D2550C7F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 732B
SHA256 cf5e5467ab3de71fcb419acbbb754c3effd5e787864ffa7c767f24ff9bbe5ae3
MD5 87299a8105078d6252386ba9d333ff05
SHA1 c43e027b4174d2ae2c7f138de07b18ac0407148a
SHA512 f6678cce079ae97838bf5aebf3c195a2c82d27dd6546fd7e5428396130ca4bd2c809f2d2edca4f130da479624c3418beffe998ae1a032451706b9a47bad62885
TLSH
T1670110D14C3E1AC3C6B90EAFE04717EC40C89512B0D8387818CDF8A4917A41E345182E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 0dcbd641392011e3042d4affe27de6b54e3bfe1fed2f238c1326586e38dbfb80
MD5 5791c60bac582e1f169aefd7494e8b65
SHA1 fc220a11a5357f3b3134686ea018f8327ad6720a
SHA512 7ea314ea2431da694bb2d6ab59852e9e0458aedea4693b1d78718c5a54c1c97849afbf8992b044f2295319673c112e8e40e08f8732d473893c556cad7c1d8183
TLSH
T12A2111E11C7E1AD2C5BE0EAFE4833AED50D8A616F4D834381888FD68A63D51D2551C7F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 824de99fb2d26a9652ce4d147d41b5f42d8eb58933629e98754b359ef813de81
MD5 c854428d46d0bd8106d3a4b26b2c17af
SHA1 3414466742a52757c163c28cc508953129b9067d
SHA512 1de7dd4e62a741fd98b414fa13966befbe757d57478e2eca3d9d49fc11f15eff8310633888dec1ae7c7fd5ab938d39ed341567261f568dc0a1838e5acd6da636
TLSH
T1E93122E0583E19C2D1BE0EAFB0872AEC50EC9211F49834382899E868967E51D3550C7F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 ebfcef679bae978f992c072279b9af13502ca903c4d4b13f2462698c29598f9f
MD5 e0544f9552e2ac952828b7fdc57948e2
SHA1 a47db84e65f552a1b7ed7bbed7bc751eab485407
SHA512 aadd766c6493295580580f21cfd6f92741a6e299cba4078e34bec526b3d4dc4bb350ed98bd3d0bd4777025882443f0dd8c1d39e39d0da9f52a13abf455eb9a72
TLSH
T1E23122E0587D1AD2D0BE0DBFB08729FD40ECD222F4A434382899E9685A7E51E255087F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 eacf1adcab56ea7707951a59a1d5415c83ac02e038089cf23fd24d14c5a52cf2
MD5 13fbadbf74e4028d922652c3b1fb7281
SHA1 2cd5239ea161b2a994b9b84a77f0296997a22ea1
SHA512 c1600d8593594bf33e8eea3c0e9b7153a41c3ed3ee25dc39ca5b63f2eb3a021af51fb979ffea4d93c39aff5ea2b0e6b4348c8eaaec269e725dc1eb353379cb59
TLSH
T1A43153E0583D19D1C07E0DBFB08729FC40DCD212F49434382898EC68967E51D254087F
MD5 SHA1 SHA512 TLSH

Submit Download

e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 a0b1a35a86cbd2e671521525fc6903162d450e3b301948d913d05ef458794c20
MD5 22215f69c4a5231b8c568620e783d7fe
SHA1 c64663b6efe0023ca5978374d785f1202d924d1b
SHA512 9e38513132672de4a65c01a6eca3c8c3a878cc6e11e2c0d2235798b78e3338c9a13a15d261c4b4fc6c60657f42407b98c8435aa4352366d1809843ddda068e22
TLSH
T1A5C02B79481924CC2B00043C6004012B19B0560023C413F48C1B8D80007537CD30817F
MD5 SHA1 SHA512 TLSH

Submit Download

b6eedf55-ca97-4392-968e-57524e0a6a64.tmp

Path C:\Users\Admin\AppData\Local\Temp\b6eedf55-ca97-4392-968e-57524e0a6a64.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4544_1096032169\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4544_271388131\LICENSE
Size 1KB
SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
MD5 ee002cb9e51bb8dfa89640a406a1090a
SHA1 49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2
SHA512 d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c
TLSH
T17D31535723840B9306DA2B4566AEBDC4B0DDC02D7F27AE05186EF394537B52ED8B3443
MD5 SHA1 SHA512 TLSH

Submit Download