0f2051005cf9120f471f4d8f3c92e366eb330200c539c5019cfda5be6cd8435e

Resubmissions

08/09/2026, 12:18

260908-pgvxwszdkh8

08/09/2026, 12:10

260908-pcfmeafc448

08/09/2026, 12:09

260908-pbnavszcmb3

Analysis

max time kernel
900s
max time network
896s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/09/2026, 12:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ransom.exe
Size 22.6MB
Sample260908-pgvxwszdkh
SHA256 0f2051005cf9120f471f4d8f3c92e366eb330200c539c5019cfda5be6cd8435e
MD5 4b1c93963ad6437d493d9707d898d94d
SHA1 6eaedc8e8a48ebb746593555695052f476844a1d
SHA512 1090af2ed9bf3a70632433bc0f0483501f306874bccdba0cc8a1f9a32d7aecdea6ea4ece67414890467dd942636e3f75652d2983ae7c4e01226bb54ba3703d8c
SSDEEP 393216:jtDs7TSTyOyxE1XstMHsuKdD657mLzV0ty0bTr47d6aGbsDoXq/TUE6t+ajxOOEz:ji/STy3uXshJWcoZ0causDoXqYE6oaj2
TLSH
T1A837DF15E263E704C1ED9536D942C9E48311BD464F1299EF2078FE8B7A72383BD3269E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence ransomware

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
108	3412	msedge.exe

Loads dropped DLL 2 IoCs

pid	Process
5780	msedge.exe
5780	msedge.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_1542284413\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_1542284413\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_1542284413\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_1140316644\extraction.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_1140316644\travel-facilitated-booking-kayak.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_1073682069\deny_etld1_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_488011960\arbitration_metadata.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_1542284413\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_1542284413\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_1542284413\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_1542284413\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_1542284413\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_1542284413\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_1770193045\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_1542284413\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_1542284413\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_119409304\Mu\Analytics	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_249934376\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_436826709\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_1140316644\classification.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_1542284413\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_1542284413\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_1542284413\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_1542284413\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_1517592294\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_119409304\Mu\Staging	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_1542284413\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_1542284413\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_1542284413\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_1542284413\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_1181958671\edge_autofill_global_block_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_939679122\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_1542284413\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_1542284413\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_1542284413\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_1542284413\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_1542284413\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_1542284413\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_119409304\Sigma\Cryptomining	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_1542284413\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_119409304\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_119409304\Sigma\Other	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_939679122\kp_pinslist.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_1542284413\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_1542284413\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_1542284413\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_1542284413\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_1542284413\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_1073682069\deny_full_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_1542284413\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_1542284413\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_1542284413\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_1542284413\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_1140316644\automation.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_119409304\Sigma\Fingerprinting	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_1542284413\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_488011960\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_119409304\Sigma\Content	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_1542284413\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_1542284413\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_436826709\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_160273925\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_939679122\crs.pb	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_5780_290729732\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_109_1_0.crx	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3412	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134333435446471021"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3989226554-2204910950-1522900112-1000\{C953631B-1416-4002-B1A9-0CF1738A8EA6}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
5780	msedge.exe
5780	msedge.exe
5780	msedge.exe
5780	msedge.exe
5780	msedge.exe
5780	msedge.exe
5780	msedge.exe

Suspicious use of FindShellTrayWindow 13 IoCs

pid	Process
5780	msedge.exe
5780	msedge.exe
5780	msedge.exe
5780	msedge.exe
5780	msedge.exe
5780	msedge.exe
5780	msedge.exe
5780	msedge.exe
5780	msedge.exe
5780	msedge.exe
5780	msedge.exe
5780	msedge.exe
5780	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4160 wrote to memory of 5780	4160	ransom.exe	89
PID 5780 wrote to memory of 3272	5780	msedge.exe	90
PID 5780 wrote to memory of 2376	5780	msedge.exe	92
PID 5780 wrote to memory of 3412	5780	msedge.exe	93
PID 5780 wrote to memory of 2376	5780	msedge.exe	92
PID 5780 wrote to memory of 2376	5780	msedge.exe	92
PID 5780 wrote to memory of 3132	5780	msedge.exe	94
PID 5780 wrote to memory of 3132	5780	msedge.exe	94
PID 5780 wrote to memory of 4788	5780	msedge.exe	95
PID 5780 wrote to memory of 4788	5780	msedge.exe	95
PID 5780 wrote to memory of 4152	5780	msedge.exe	96
PID 5780 wrote to memory of 4788	5780	msedge.exe	95
PID 5780 wrote to memory of 4152	5780	msedge.exe	96
PID 5780 wrote to memory of 4152	5780	msedge.exe	96
PID 5780 wrote to memory of 5996	5780	msedge.exe	97
PID 5780 wrote to memory of 5996	5780	msedge.exe	97
PID 5780 wrote to memory of 5996	5780	msedge.exe	97
PID 5780 wrote to memory of 5956	5780	msedge.exe	98
PID 5780 wrote to memory of 5956	5780	msedge.exe	98
PID 5780 wrote to memory of 5956	5780	msedge.exe	98
PID 5780 wrote to memory of 1372	5780	msedge.exe	99
PID 5780 wrote to memory of 1372	5780	msedge.exe	99
PID 5780 wrote to memory of 4476	5780	msedge.exe	101
PID 5780 wrote to memory of 4476	5780	msedge.exe	101
PID 5780 wrote to memory of 4476	5780	msedge.exe	101
PID 5780 wrote to memory of 4324	5780	msedge.exe	102
PID 5780 wrote to memory of 2680	5780	msedge.exe	103
PID 5780 wrote to memory of 4324	5780	msedge.exe	102
PID 5780 wrote to memory of 2680	5780	msedge.exe	103
PID 5780 wrote to memory of 5452	5780	msedge.exe	105
PID 5780 wrote to memory of 5616	5780	msedge.exe	106
PID 5780 wrote to memory of 5616	5780	msedge.exe	106
PID 5780 wrote to memory of 4136	5780	msedge.exe	107
PID 5780 wrote to memory of 4136	5780	msedge.exe	107
PID 5780 wrote to memory of 2812	5780	msedge.exe	111
PID 5780 wrote to memory of 2812	5780	msedge.exe	111
PID 5780 wrote to memory of 1392	5780	msedge.exe	112
PID 5780 wrote to memory of 1392	5780	msedge.exe	112
PID 5780 wrote to memory of 4392	5780	msedge.exe	113
PID 5780 wrote to memory of 4392	5780	msedge.exe	113
PID 5780 wrote to memory of 6072	5780	msedge.exe	114
PID 5780 wrote to memory of 6072	5780	msedge.exe	114
PID 5780 wrote to memory of 6072	5780	msedge.exe	114
PID 5780 wrote to memory of 3552	5780	msedge.exe	115
PID 5780 wrote to memory of 1676	5780	msedge.exe	117
PID 5780 wrote to memory of 3724	5780	msedge.exe	118
PID 5780 wrote to memory of 6136	5780	msedge.exe	119
PID 5780 wrote to memory of 1284	5780	msedge.exe	120
PID 5780 wrote to memory of 1284	5780	msedge.exe	120
PID 5780 wrote to memory of 4528	5780	msedge.exe	124
PID 5780 wrote to memory of 4528	5780	msedge.exe	124
PID 5780 wrote to memory of 1100	5780	msedge.exe	125
PID 5780 wrote to memory of 1100	5780	msedge.exe	125
PID 5780 wrote to memory of 3572	5780	msedge.exe	126
PID 5780 wrote to memory of 3572	5780	msedge.exe	126
PID 5780 wrote to memory of 3844	5780	msedge.exe	127
PID 5780 wrote to memory of 4608	5780	msedge.exe	128
PID 5780 wrote to memory of 4608	5780	msedge.exe	128
PID 5780 wrote to memory of 5084	5780	msedge.exe	129
PID 5780 wrote to memory of 5084	5780	msedge.exe	129
PID 5780 wrote to memory of 8	5780	msedge.exe	130
PID 5780 wrote to memory of 8	5780	msedge.exe	130
PID 5780 wrote to memory of 4256	5780	msedge.exe	131
PID 5780 wrote to memory of 4256	5780	msedge.exe	131

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\ransom.exe
"C:\Users\Admin\AppData\Local\Temp\ransom.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?framework=Microsoft.NETCore.App&framework_version=10.0.0&arch=x64&rid=win-x64&os=win10&gui=true
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ff95e8ac188,0x7ff95e8ac194,0x7ff95e8ac1a0
    3⤵
    PID:3272
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1592,i,14196857646741927967,15402212790168168207,262144 --field-trial-handle=2340,i,7378349198373751947,731372251256992431,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:2
    3⤵
    PID:2376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1896,i,15429692840714236934,9142635040107801206,524288 --field-trial-handle=2340,i,7378349198373751947,731372251256992431,262144 --variations-seed-version --mojo-platform-channel-handle=2752 /prefetch:11
    3⤵
    - Downloads MZ/PE file
    - System Time Discovery
    PID:3412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2468,i,5576158654733174402,16474306178459754983,524288 --field-trial-handle=2340,i,7378349198373751947,731372251256992431,262144 --variations-seed-version --mojo-platform-channel-handle=3000 /prefetch:13
    3⤵
    PID:3132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3604,i,12337582127148880357,12948466657481006323,2097152 --field-trial-handle=2340,i,7378349198373751947,731372251256992431,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:1
    3⤵
    PID:4788
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3608,i,13253444065141450857,6736784529927436412,2097152 --field-trial-handle=2340,i,7378349198373751947,731372251256992431,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:1
    3⤵
    PID:4152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4216,i,7940935543469680257,9134758040890706768,2097152 --field-trial-handle=2340,i,7378349198373751947,731372251256992431,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:1
    3⤵
    PID:5996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4240,i,17019076278996832349,13996575134905719875,2097152 --field-trial-handle=2340,i,7378349198373751947,731372251256992431,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:9
    3⤵
    PID:5956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3732,i,17841004889755548826,11919048790952705072,524288 --field-trial-handle=2340,i,7378349198373751947,731372251256992431,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:14
    3⤵
    PID:1372
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5284,i,3069405931053764040,4349351705390528180,2097152 --field-trial-handle=2340,i,7378349198373751947,731372251256992431,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:1
    3⤵
    PID:4476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3696,i,17119004846437511591,12619194478914215691,524288 --field-trial-handle=2340,i,7378349198373751947,731372251256992431,262144 --variations-seed-version --mojo-platform-channel-handle=3864 /prefetch:14
    3⤵
    PID:4324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3900,i,8419835044442817753,8444634528317202826,524288 --field-trial-handle=2340,i,7378349198373751947,731372251256992431,262144 --variations-seed-version --mojo-platform-channel-handle=3744 /prefetch:14
    3⤵
    PID:2680
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,7483450985020955074,2143917535171362444,524288 --field-trial-handle=2340,i,7378349198373751947,731372251256992431,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:14
    3⤵
    PID:2760
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,7483450985020955074,2143917535171362444,524288 --field-trial-handle=2340,i,7378349198373751947,731372251256992431,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:14
    3⤵
    PID:5452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6392,i,15675919558468012377,2648124627704735390,524288 --field-trial-handle=2340,i,7378349198373751947,731372251256992431,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:14
    3⤵
    PID:5616
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6436,i,2357597568727745467,7868132871031769303,524288 --field-trial-handle=2340,i,7378349198373751947,731372251256992431,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:14
    3⤵
    PID:4136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6340,i,7662825808483299418,17007333925449493089,524288 --field-trial-handle=2340,i,7378349198373751947,731372251256992431,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:14
    3⤵
    PID:2812
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6724,i,8840707839335982501,4006184255574266433,524288 --field-trial-handle=2340,i,7378349198373751947,731372251256992431,262144 --variations-seed-version --mojo-platform-channel-handle=6524 /prefetch:14
    3⤵
    PID:1392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6356,i,6696396421891614621,14674739920754161783,524288 --field-trial-handle=2340,i,7378349198373751947,731372251256992431,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:14
    3⤵
    PID:4392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6472,i,7465352556040005757,742645123508324725,2097152 --field-trial-handle=2340,i,7378349198373751947,731372251256992431,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:1
    3⤵
    PID:6072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,4820064460014575347,6081915482732102989,524288 --field-trial-handle=2340,i,7378349198373751947,731372251256992431,262144 --variations-seed-version --mojo-platform-channel-handle=4408 /prefetch:14
    3⤵
    PID:3552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,18265197618177439575,14713436031139341080,524288 --field-trial-handle=2340,i,7378349198373751947,731372251256992431,262144 --variations-seed-version --mojo-platform-channel-handle=7296 /prefetch:14
    3⤵
    PID:1676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,1132381613830247590,13339891851956216606,524288 --field-trial-handle=2340,i,7378349198373751947,731372251256992431,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:14
    3⤵
    PID:3724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6272,i,14952828418481727592,13750976288188987843,524288 --field-trial-handle=2340,i,7378349198373751947,731372251256992431,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:14
    3⤵
    PID:6136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6960,i,4489966854226313949,8335739121431143003,524288 --field-trial-handle=2340,i,7378349198373751947,731372251256992431,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:14
    3⤵
    PID:1284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5176,i,12758399141594646918,9814919441454496407,524288 --field-trial-handle=2340,i,7378349198373751947,731372251256992431,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:14
    3⤵
    PID:4528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5580,i,2843652976799691626,6803828970978111008,524288 --field-trial-handle=2340,i,7378349198373751947,731372251256992431,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:14
    3⤵
    PID:1100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5420,i,1431503171865840988,15259979686998927243,524288 --field-trial-handle=2340,i,7378349198373751947,731372251256992431,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:14
    3⤵
    PID:3572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6056,i,8614010543958795284,10617014742631742279,262144 --field-trial-handle=2340,i,7378349198373751947,731372251256992431,262144 --variations-seed-version --mojo-platform-channel-handle=3860 /prefetch:10
    3⤵
    PID:3844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5760,i,12071804792213195273,7637519013730348415,524288 --field-trial-handle=2340,i,7378349198373751947,731372251256992431,262144 --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:14
    3⤵
    PID:4608
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5984,i,4338140761132398083,3482221291609439442,524288 --field-trial-handle=2340,i,7378349198373751947,731372251256992431,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:14
    3⤵
    PID:5084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6028,i,8089785211947623652,12446804280755862039,524288 --field-trial-handle=2340,i,7378349198373751947,731372251256992431,262144 --variations-seed-version --mojo-platform-channel-handle=3920 /prefetch:14
    3⤵
    PID:8
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5064,i,18339976745878749370,6059181367398903207,524288 --field-trial-handle=2340,i,7378349198373751947,731372251256992431,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:14
    3⤵
    PID:4256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3668,i,15641489283434628860,17750248171307193734,524288 --field-trial-handle=2340,i,7378349198373751947,731372251256992431,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:14
    3⤵
    PID:5452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2380,i,12856942618811534353,14180283396817028609,524288 --field-trial-handle=2340,i,7378349198373751947,731372251256992431,262144 --variations-seed-version --mojo-platform-channel-handle=3016 /prefetch:14
    3⤵
    PID:2496
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2380,i,15403414186654394352,14723143533579872189,524288 --field-trial-handle=2340,i,7378349198373751947,731372251256992431,262144 --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:14
    3⤵
    PID:1444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5988,i,15223926179132674191,9200893840229413647,524288 --field-trial-handle=2340,i,7378349198373751947,731372251256992431,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:14
    3⤵
    PID:5832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5988,i,13866939996743738625,14865551746044991935,524288 --field-trial-handle=2340,i,7378349198373751947,731372251256992431,262144 --variations-seed-version --mojo-platform-channel-handle=7012 /prefetch:14
    3⤵
    PID:5032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5924,i,6924608556436879525,1460016248028626068,524288 --field-trial-handle=2340,i,7378349198373751947,731372251256992431,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:14
    3⤵
    PID:1780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3680,i,18283308264242644590,17868638674369121284,524288 --field-trial-handle=2340,i,7378349198373751947,731372251256992431,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:14
    3⤵
    PID:4120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3484,i,8681120719107853927,13955835077841209263,524288 --field-trial-handle=2340,i,7378349198373751947,731372251256992431,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:14
    3⤵
    PID:2424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6192,i,9187339243224980995,17257246301895085507,524288 --field-trial-handle=2340,i,7378349198373751947,731372251256992431,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:14
    3⤵
    PID:2560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5524,i,9070480397197490119,13761791570049829283,524288 --field-trial-handle=2340,i,7378349198373751947,731372251256992431,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:14
    3⤵
    PID:5632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3584,i,5691190956108660262,2959796860174484649,524288 --field-trial-handle=2340,i,7378349198373751947,731372251256992431,262144 --variations-seed-version --mojo-platform-channel-handle=2088 /prefetch:14
    3⤵
    PID:4388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5216,i,11915359490153940906,5711298220512008191,524288 --field-trial-handle=2340,i,7378349198373751947,731372251256992431,262144 --variations-seed-version --mojo-platform-channel-handle=7032 /prefetch:14
    3⤵
    PID:3400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3016,i,15287909483679645961,4825293916134422393,524288 --field-trial-handle=2340,i,7378349198373751947,731372251256992431,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:14
    3⤵
    PID:5760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5044,i,2523490544879379631,4252435653880944972,524288 --field-trial-handle=2340,i,7378349198373751947,731372251256992431,262144 --variations-seed-version --mojo-platform-channel-handle=7296 /prefetch:14
    3⤵
    PID:4188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,1680037428166510435,2433557510295610350,524288 --field-trial-handle=2340,i,7378349198373751947,731372251256992431,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:14
    3⤵
    PID:3136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5760,i,12723327017576997837,365237615929664189,524288 --field-trial-handle=2340,i,7378349198373751947,731372251256992431,262144 --variations-seed-version --mojo-platform-channel-handle=7024 /prefetch:14
    3⤵
    PID:3676

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3288

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5992

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3832

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4904

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:368

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7f7f7efafb9f87082470af84df3b906033b9d533fb7a188458a4e181362f2170
MD5 8af1f60999c332d8cf9a392cd968a81c
SHA1 93834a1f070ff24041a0deb17d95d868998c98ba
SHA512 95d5c6b0fed3c3dce459178eafa2e9fa13b06caf50a5b294d66ecf16bf91357eccebec57e01d50e054232862c252fc80f7300e865318ec24078f9288a88c63d4
TLSH
T17BD02B206A444A4CCDC0B03064A2EA18E2104135680013C44001B06988901830B970DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5e34bc4625bf22507150f49d8c28444bda8222ea36c2a7d431bbdaae5c134a9d
MD5 e1ae04b3e73ad5ac4854b3b71e22d4d3
SHA1 221461b4f2d9e84e2f881b5a79edfef3705178db
SHA512 58529610d3f5dd7778bff3b81dd8abd9d79702eff78583d0294f3999089de0bbf84f0abad703269c0988835522b1d8d48e9f3c65472a409c5868fc3547c3fb1b
TLSH
T138D02B206A54494CCDC0B03464A3EA18E2004135140013C44001F07988901830B970CB
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 74914b31cbecc37f87afd88bfccee7501a8a6ff7123bc751536b23744654bd81
MD5 95a9818a20317d490efe81a53b061e4f
SHA1 0169eee70a6cc12f81bfa7a91ed4c46d58c8309f
SHA512 a37bbe8285ce8734cbce5153b0e69a5f6a6f0cc9cbf4e4871d66632ffa43fbfc9f588c01b8bf0492771d67dcc89fff0f4dc1cf2f6b16f98e1e27fd15c810ca86
TLSH
T12CE026D525C8CA2EF649A54F51AD5B0C82C03B4A93DCAA5E2B008DCAB101590E3D37E0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 b1e615a5a2d03658d27b1c7a6e04ae356fc8bd8af0b10f97e75bcc76fc4aeb0f
MD5 47266a1291041ed6d0f8c11954bacc33
SHA1 0c6726935e58c77f756fe030bd97ddcbc8bf2438
SHA512 f319016b5d1ba56e38c847cd58828eefcb024e7437d04696622e15f64d04582d22a473aaaba175cd1b03fb439cd61518cc89df51d02c29edf3f11908fc9498a1
TLSH
T1C5E026C525C8C26EB610F48B52FC770C92C03F0AA2CC6A8E1706848970028F0AB837A4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 9e5b09d86797120e73d1b5518225ca2c3761a44210e04d1dd192498e6b9605f9
MD5 5c305c5de52d522499ca408126c769c9
SHA1 b175d170d551b269da7917db2ad1e11a4d3398da
SHA512 06d3c87c3edcd97b8c8198169921bf88eb4003e79c84ace2944354a9c43fb1f987241c8c504f3004e93acbd9f7d6a75334452f24d68dacdc0bba66b5ac06ba87
TLSH
T1FAE026D915C8C23EA620788B527C9B4CEED03B0FD6CC6A8F1F05849670468D0B3976A0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 9a9bb66921e9b7179838711761a73d75d5137490c60810dfe3294c9ed8cf125d
MD5 7c64c3a83c49058bbbc3fa9737992cb7
SHA1 f2ec4409bd981ec230acd881d6290bd7a1ff35d0
SHA512 c9dd4452aa68eee1277e58d41edd3cdc475e5582b46b6b88e31a526634466d8da8c2974726c4d92ad688a8487e4b21ebfbc05f3503b1ca5c835075a148de9360
TLSH
T1225161B16B6317A1FFE854B572EE84E8B23280491163EE2B5054A3744CCB7BE50D7019
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59f37e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59f37e.TMP
Size 2KB
SHA256 e76e97bb75b7a045df14e09f9042664a98bc5de3383d0c15d0d6a9012426bc77
MD5 7599332f2bd8a43578eaf1d691f4122a
SHA1 a016a43bfbdcb85ac56462749f06dc060a5f9556
SHA512 dad93126a6fc6d97d00ea246e2ca1c0e4784dccae5a41de9e3afa828f9437b4f5ec11065b277cf5067c317d1034519f80668bde114772a1425130f1248c7fd84
TLSH
T19F512FB06B231BB1FFE895B573DE80C8B27685594063EA2E405063744DCB73E50DB058
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 77fb905be074867fd95dda20183a1103aa5a79cf788d7c298f85d8626e76a5d4
MD5 37059535c827eeaaf68f38d173a0877f
SHA1 722744235b0684cfbc1a6fceb0e017749b51ad24
SHA512 2a3bed55741b9ba643339e2fafcdb508771a4496ec8fc6a55b8ff9d15fb0e80665961fa87ea87d0de9046957582d3f97cff82fb11fcd15d3eaf84a09e6185d96
TLSH
T138718BF787B4856ECA0196F0AA18AE2FDF2C0615431C7C2989D4EE27D3E3472E10265F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 2a54a5d4659324faf884d55e6522eb8cf7e984f83973d367db3db4a76e034301
MD5 14e721d3ee17fb099c99583cd17b5d25
SHA1 dcd3899f06b957a9e615b4db06c7cd3515e58fc1
SHA512 b190e52a7a63116bced4f9c41f857489a7d12832610342508fbcb7ba220d5fcd378d04ea607798790e5189af0aa649459e32e0f3e9c3ef9bf3b2eaa01e7eca29
TLSH
T1A1718BF783B4856EDA1196F09A18AE2FDF2C0615431C786989D4EE27D3E3472E102A5B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 8af53bb424a7d5c715b0143479b46b4a667e66ad8a823b7ca82e01e2ac160bd5
MD5 6b41df81fb34d32f53d6f4ad6f8eff29
SHA1 fe2af9e04498bfa6d9c01d5ee739339a3e66be1d
SHA512 ce2a29ee44d84cccf16e3e84762d7891f2e9e00b63ebfc4eac0a409c3693b17d554669fc987f603228a8889c2fe74f840b4e7e33c1314ee3f516aa8360bf91d4
SSDEEP 192:sxR9RHTW/fdsc1Y3axZmT+zoD8p9l/g6+WNZ4P/AD3o5DEYG/IgDrim4J:sxR9dW/fdsc1Y3afmWv/5q/z2s
TLSH
T19D42E916AD28A93B8CCBD20DFA55BF53E6F9613261955F48A7FCC61C00E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 be415fbd5eba30271f2f42b35f50bfc69bcfdfb00c601fd3a44bcc833db4029d
MD5 c4e1f40454e4e12adb05d603783edbf4
SHA1 630afdac2dd7072bccd2903c6cd7578dc92228f9
SHA512 13d44f4640a4c1f278638abdfa201f59b32dbd6b84e76ace60199b79f2e0974557deb491a12317eced5f980fa89df20a614972f54d538ae159db6d01ec527d46
SSDEEP 192:sxRORHTW/fdswY3zxZmT+zoD8p9l/g6+WNZ4P/AD3f25DqYG/IgVim4J:sxROdW/fdswY3zfmWv/5q/wU0G
TLSH
T1BE42E916A928A93B8CCBD20DFA55BF53E6F9613261955E48E7FCC61C00E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 26KB
SHA256 f310b0700404c376a05b6e464004a116f06d1d3bc35bd650e43a895d3a72d6a1
MD5 e5480fd08a33c04561ac67fa09f697b0
SHA1 6d5e81b09197d221dcd1e07e660e6ba0436a408f
SHA512 48bac030d0179ccc3495baa25d3a610416cb663febdb7059634a6a9708bf6267b1fdf2a8b300a0b4a5cf1df7b041bd3492e557c15cc88da39a8f30f9479d3cea
SSDEEP 384:sxR9dW/fdsc1Y3S66s8qMpRiYnazAW8pZS15posJWeT+OfmWZ/5q/z2s:sxdW/fjQS4Mnc7WeT+Oeg/5Qzt
TLSH
T150C2F8059924C83B9EC39D19A53D7E33EAEC505222C5DEDE56ECCA1C019E1FDAB07817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 ae5494987acfdffc737878bc7caedadde75e5ca6360f589e0c448decc77e65d0
MD5 3f3c10ee6615c230fdf0205266f984bb
SHA1 96e65e8c4366bcd8a0b1b95dd497174f5ecf50cf
SHA512 ed22edf45d13ac58908253aaa4c70d050ba59ff31fc06f4fc5fba8bc3de6f8e373e78f7cd92a6cee68b28df5075e8192bf22c7d3f3f058e726f4722b135a3805
SSDEEP 192:sxR9RHTW/fdsc1Y3zxZmT+zoD8p9l/g6+WNZ4P/AD3f25DqYG/IgDBim4J:sxR9dW/fdsc1Y3zfmWv/5q/wU0+
TLSH
T11A42E916AD28A93B8CCBD20DFA55BF53E6F9613261955F48A7FCC61C00E76DD220380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 389c86571ca6d20d614dfe81262a1064c20d4426b24fa98610896e422d4ebfd3
MD5 3e36a7c58dee745c58166c91c93e85f3
SHA1 c44dede2b98a35f4e872bc3a7386506994710286
SHA512 403c7d3edd5a832b46c1b02c1f4fbd174523b989017183ef311fed99c318afae359ac207956a084cbda26b94b473dfb804d0b80edff599bda60e0ce0bcd5c17b
SSDEEP 768:GTEb5Z7pLuLz3kWg0CfKs8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhCgMWcqro97ij:GTEb5vEz3kWg0CfKsu1jaeCgFcB92j
TLSH
T130D2DA7B640DCB7E4F804ADDAC19BE9B6D6802CB9A98CD4047FE941C02C6BFB51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\2bf2e504-a337-41b4-a12a-9fea46f32f10\index-dir\the-real-index
Size 240B
SHA256 d824d1ee7c726a9f57dc283a7b14d70356e367248568a8d4cf4abbf94dcc63c5
MD5 253f9198a8686ca6c9b8c71db40301c7
SHA1 251e18a4b919a516498cdd2ef0413a2f0de49029
SHA512 54c2ffea38094e8012a9046780badf1eb4508056b9d9b789f82a35730c0ca4ce93c87d30287994236c174b6f0d1803a022f2427ff4acd5370d9f2d5f43fb3e5b
TLSH
T13ED0224DAC228555CB12283204733A25233303EE224A6E2140BC140A64A003C814600C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5e2d48.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\2bf2e504-a337-41b4-a12a-9fea46f32f10\index-dir\the-real-index~RFe5e2d48.TMP
Size 240B
SHA256 02c4b0f45f7e7b5ba012426ffa6bd4afa0fdd3690488ab2fb26a460dfb798401
MD5 3bcb441baadbe964395e9b97e59b5549
SHA1 2f187ce382f917cbf9d458c90b20e68fd44d48f7
SHA512 25c78d85a68292635e15a0937ec250f2d47f5afbb0a3996fd759ca026a234c95a448b322fbda780058aac6d24c1b3748e0f1651d5a96f694f2470b6a73b1db24
TLSH
T1D9D0C0CFD461B930CF072D313403651A33370C251016EE3100A5040F04700ECC15600D
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 2cfff6c63f83dd74aba2afc39b020daf7815ac04bb70f14d099a773016d338e7
MD5 f09caaa94c0887c784548efd43886bcf
SHA1 1765586b74abf78892ca92cc2eff3c976001f184
SHA512 707ca508737590d2e51514194d02ce7711e1dfca70c877be9dce812001d473f093d0a396bd77d642580187744d8c2dd426980cf25aab8f422fb28c8f65f5af47
TLSH
T145E0D8B63AB61414BC7FA2E62431949541417854C605ED9F256AA38760B1319299AC63
MD5 SHA1 SHA512 TLSH

Submit Download

domain_actions.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Domain Actions\3.0.0.20\domain_actions.dll
Size 82KB
SHA256 e5c9378b540360fb4ab0b16bf40ed18bd99cf4a8a5a6923f4f240d373fb441cb
MD5 aeb538c29f46cf0e19827ce47594488b
SHA1 db32b33a5811c303b1e37e1ab956df20ba44b355
SHA512 38488a42e5c532442a65fd4edab683f1f63eea71bae3ba2f801693647f633af9d836171dc751b342dc2e0e7784266eb9a40f677c0d3c9f651e7374f1af707852
SSDEEP 1536:NocewxXknaFpdgxBf8paY3JQzQik428fKagFVbydki806yav7Sz:NZvx3bgrfrPza428fIe76yaDS
TLSH
T1F783F1C0DA6C0117EE6B4D75D17959CA6BB9D6B50BA0B3EB2372845A0E02FC5EF36700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

06195a57-8024-4a88-815d-de871db13b1f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\06195a57-8024-4a88-815d-de871db13b1f.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 f46b0943beb340e432db8ed225726160c266dfb735c8e3cdb794525e53de468a
MD5 30adff9328f3a72c9a418af4de4c631f
SHA1 2c2941d237172ecd731202d6c68916c49a5ccada
SHA512 47d084aa89fb0b0795c72a61f87306f1996d527ec8b1925ba1e879f633075742b403cf0408f576b0e2cc8a78c6e65b80cc2d2b18a6b839037d1f2dfee84074b6
SSDEEP 768:4p3DlTSec+wfZOLf/66RfI66PXvShCQREMgJD:4p3phwfkfC6Rfb6PXvSYMgJD
TLSH
T194F2AEB1EC602A738DE7C7957A467B13BEE4A26391CD5A48C9DC4F0D01C329D270782B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 f0d64ad17d1a40b51483272b12589fd05b53133d2d740acc0b362d695b46c8e1
MD5 00a5034d23b445037fd024d1e8b5b6cc
SHA1 a75db55dc2d412616df723f1fdae63b26820b802
SHA512 b074b9c1f392dc41958149aeff5ae8ab9c087e56e6b9401f7388b098d6fe988d15412fa31e92fb262a1a642f315b83a8c7a5c45d5048d04ab4cb09bd6b061101
SSDEEP 768:Rrv+4UNbd43Yjkc+wfZOLf/66evShCQtm2bwWV:RbsbO3YawfkfC6evSK0wO
TLSH
T1F603D072E86899339DE782487646BB63BEB86273C8C54784D6CD1B0D018369F370BC67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 a4a088d1e30b1e4e19504a2f9dffd30ed120ae4786ddeb0bec544c39238279ae
MD5 150460c06633b7fcb3394dd752217164
SHA1 5462131b603387656e77ede3bdb65edd71383c49
SHA512 767748f150a26b423378f9d84ec69dab4993d4651a323952d459b832b4d1d39054b6087e772a21d0a1a07cf6ada98c00fa0932fe7d875a48609cddd266376836
SSDEEP 768:wFbz3NwgBlTe6gtfZOLf/66RfI66fXvShCQREMgJD:Gz3f0fkfC6Rfb6fXvSYMgJD
TLSH
T133133AF198D39576D9AE8787673D6E02ADFCD163B5889984BBC84D0CCC821BFD306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 3593554579fe01b370101a8bd4a7f6d29c0a5f58b4ac855bfdf964e085eb0948
MD5 9c9a173eac962cef6dd99626371a6d21
SHA1 20ba913c56a38458c8f318b6548b1a1c386d7667
SHA512 879276eef67f880e0a8aca76ddb0b3fef29b5dc4cdc6373d002acd1dab97b18c1ebb5e3030cc5f8e2c5b7f8ffed19e0bc41209e5ee38d0429d9cb9209948e278
SSDEEP 768:gp3AlTSec+wfZOLf/66RfI66PXvShCQREMgJD:gp3shwfkfC6Rfb6PXvSYMgJD
TLSH
T19CF2AEB1EC602A738DE7C7957A4A7B13BEE4A26391CD5A48C9DC5F0D01C329D270782B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 31fdfab483cce72af96c3da7f4cf21dad43bae6ffc905a77f5cda92420a16807
MD5 0eb4af68de274b0bd2e97a54e8660060
SHA1 5a6a94d2186e741543d784e3881bb360e25318a2
SHA512 61bd524a10786f85e11dd5c5acf4f616982b94a625ed435056f0722de46822e4642eb8c5f073cc5eb321e130da71efcc7db7bc5824e87b73d742f4a244eacbdf
SSDEEP 768:Vp3UlTIec+wfZOLf/66RfI66xXvShCQREMgJD:Vp3YTwfkfC6Rfb6xXvSYMgJD
TLSH
T173F2BFB1DC601A739DE7C7857A4A7B12BEE4A22391CD9A48CDDC5F0D01C32AD270782B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 7936aff86e28c24f50c62f2bbee6eb1243e68b078ffe9e2d736869e54abe8288
MD5 f35ea5ace0a988a98b8815e4e257f16a
SHA1 ba8a66f55e51cc50306ab0d323aa50cc8a167b01
SHA512 f81414ea701c9d7ece82e927a2d45922e0ac251c3cedd7a02d3b2234db3a332f03e932950cdac833876afed69111b86558a30a705555cb57d1207dcd6fd16e9f
SSDEEP 768:Prv+4UNbd43ZAc+wfZOLf/66RfI66IvShCQsE2bwWV:PbsbO3AwfkfC6Rfb6IvSP0wO
TLSH
T15C03CF72E86866739EE38A44764ABB13BFB99263C5C54684D9CC0B0D01C769E331BC67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

well_known_domains.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Well Known Domains\1.2.0.0\well_known_domains.dll
Size 572KB
SHA256 2778063e5ded354d852004e80492edb3a0f731b838bb27ba3a233bc937592f6e
MD5 f5f5b37fd514776f455864502c852773
SHA1 8d5ed434173fd77feb33cb6cb0fad5e2388d97c6
SHA512 b0931f1cae171190e6ec8880f4d560cc7b3d5bffe1db11525bd133eaf51e2e0b3c920ea194d6c7577f95e7b4b4380f7845c82eb2898ad1f5c35d4550f93a14b6
SSDEEP 6144:XbBXgDO9CyiiKPFv3GPkDNiTHoIDiXkCBIvzVXCfwX5pWr+W1gUe3h576:XbBQDwi5FvGPkDNirYBIvzVXCoXWiWr
TLSH
T130C49E02B7D846A8D07AD0748A574642EA76BC950F74A6DF02E0B27D2F77BE45B3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ceca6941-5d80-46f8-9bd9-f79439feecd8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\ceca6941-5d80-46f8-9bd9-f79439feecd8.tmp
Size 1KB
SHA256 a1c77989fba5da5b15e6b586f2ad6a8250047f9d6591f5e2a33207ea766cba48
MD5 093410af29773c928c55a7005b0d3ff0
SHA1 b055205bfaf7aea639c85d237eda57f51d90091f
SHA512 37662d0a1d175f4771c083fd7371140812caa7718a86e979411d2a10e81dad858e36d9ac02c26960296cf47f0809f8c74552e108e7b955fcda455de386e8d254
TLSH
T116311CA1583D1AD1C5BE0DBFB0972AEC54EC9212F8A834392898E968963A51E315083F
MD5 SHA1 SHA512 TLSH

Submit Download

dd57bd9f-a61f-446e-9e9a-3b76043ef597.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\dd57bd9f-a61f-446e-9e9a-3b76043ef597.tmp
Size 2KB
SHA256 1583df2a430025fafc7b216ac91bc4547af710e45a0c50745eb59592711d4711
MD5 6ac3d8abda70c32758115d5ff9a5a343
SHA1 6c98b246ed4f839aa719d75fc83c4982f81575a0
SHA512 bde4292bd1406244d3314c72450865680dba0116845a41748043fea31f5a2edce7b8b74c2dde4567bb778c95a2e94e1640803a43830c067559986dd8181aef14
TLSH
T13B412EA0583C1AD5D4BD0DBFB08735EC84EC9366B4A434392899E9AC9A7A60D604083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 732B
SHA256 cf5e5467ab3de71fcb419acbbb754c3effd5e787864ffa7c767f24ff9bbe5ae3
MD5 87299a8105078d6252386ba9d333ff05
SHA1 c43e027b4174d2ae2c7f138de07b18ac0407148a
SHA512 f6678cce079ae97838bf5aebf3c195a2c82d27dd6546fd7e5428396130ca4bd2c809f2d2edca4f130da479624c3418beffe998ae1a032451706b9a47bad62885
TLSH
T1670110D14C3E1AC3C6B90EAFE04717EC40C89512B0D8387818CDF8A4917A41E345182E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 7b2857f745c5e76ee4f34f002ebf9a0ba7ea2e11fa307f8161f4f00c1c44292a
MD5 239d99b4b4f2db2c36c272ab3c707dea
SHA1 50e5b5fd061016ed9d443c377afb6e1005f9656e
SHA512 1fa4f93e10fc0bb9a5c2e18cd5c8e8c03c280031e8b6e22cc5fb342ee3aee96f5c2b1b7a16539501c7c56f188a8ac4574496849ffee7f3903a69d687a93b917c
TLSH
T1FA3110E05C3D1AD1D17D0DBFB05726FC44EC9252F8A474386899E9AC9A3A50E345083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 612B
SHA256 918167fab0fb4435546513252415c1a2e44b6e8e60caf6f31d07587ba0a71ab0
MD5 5ca920f0e1c81dfb329b916e242a4065
SHA1 1d068ad79883fd23c27647c98e761858e46f48cd
SHA512 2b99239123f922883dea3137835bb8b74713799981e5aa1434ea70db85e7666f2372db684f94bb599ecff70c8c31d02286b0587ffe620333eb1d4bbc7feb84b8
TLSH
T11DF002D04C3E19C3D5B90E6EA40717EC50D45517B0D8383804CDE894D07A05E315183E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 852B
SHA256 cc631188ae4a22c0621e596be3d4335218373ee3aafe98bb7b213069a0dc3b70
MD5 1a8162cc03c34509f59ea81728419884
SHA1 459f726ff17ed37a212bf5291cc592b4745c3c06
SHA512 129393fb77432dda8e2c4181dc778f609f56572e69213f9f8cffc544b845119929242d41078170b2dc72a678116df340544edb181c2aff069f8cd4ac2a541083
TLSH
T1E8011ED14C7E1AC7CABE0EAEA0872BEC44D86522B098347818CCF864917940E3451C3E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 daa704ae58dac475370bea2bc4f2d004c2d26bbcdb85f70132b75038897ee2b2
MD5 ced9e4d151ba7e09b2807d061d2e8795
SHA1 5775520d9091bc0cb37afffa22f77f4125147b68
SHA512 136346ba203b3a12d03d8f6a8154e2166e539f06afc9bb342bf55cc7345dab0ebbc21a1b8eca50aff719cd1e1fb454f0499bf6300007c8463ab980dd4bbf3b1e
TLSH
T14A21F0A11C3D1AC6D5BD0DAFF0972AEC54D89312F8E834342898ED58913A51E3151C7F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 49d123bf2473c05a20f7a392fbc09922b1156717b461bf3f184aabd930cfd6ac
MD5 ae55f93136b118b8ad8bb8697714b706
SHA1 6ae028ea7ea58bf0901b7a6fd445dca7e3174ea8
SHA512 1b61dd2cba0b73d15bbee0980aceca91be7a6e458e25e9f5e414832ca74464fd4017bff15c803b56cdc30e637296ba1e2cc6231199d2bb8d4fa4788c40b24129
TLSH
T1EC3122A15C3D19C1C57D0DAFB0972AEC54EC9312F4A8343828DCE9A8953E51D3450C7F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 972B
SHA256 ff2333c17048bfeb6f6976f16f4e5f8a88fd57126a97a8d900daac20c2ed6d2b
MD5 b5b4a703ceb94aceaf4175e4de754cfa
SHA1 baa31117b9d7664e41a45d501fa7ff49260b22c4
SHA512 0eaf3f0d2adc5b26b43864dc08f4bae37cfcd4428130bba34beb206775d7a76ada8640c727123d6eac432909b882a49c00af06ba7f7a2248701a449ab3aa8425
TLSH
T1661110915C7E1ACACABE0EAFA04327EC14D86717F4A8307418DCE958917941E3451C3E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 340cdb1ea8958f214ddd84236212066e3ae3362c0efc98a906c9064b4fca0265
MD5 a164ee15d0f9bd144a073da31e53783b
SHA1 5d713111b2b1e99f17704c4102e8decaae6f3649
SHA512 efa998c576126973c6ff6841f4c77c86a387bc9db50a3b000222cef170bd7463c027d55a384b7070f16a5e99424ad0e5285fbe7327017a157908c16b40631370
TLSH
T16C21CEA11C7A1AD6C5BD0EAFE0832AED54E89216F4E834742898ED58A23D41E3451C7F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 dfc32509aeeb166fb2a3663287004cd940a0be3e002abbd0cd5c36802f1c85c6
MD5 69451b9eb8283e76ea5d0288486ebbb2
SHA1 30912ca0f937ec01be3804a494bcba091699f792
SHA512 b093bab58d1b0dd74988744177da474ec8eec152b5d26e5f0330501f86870092cad3068106ec721fb8113944b5594c78f53e53ea1d2e6d2af07f04a4c184c2b2
TLSH
T196310EA0587D1AD1C5BD0DBFB09726FC94E89351F8A474396899EDAC9A3A50E314083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 c73e0683e6a6bad7e9bc811c2a4c4938c58df833e845e9ee3ef2b84e6696d9db
MD5 7206bea5a7e3b35822153d3dbf418c32
SHA1 156d014a74c465163cbd6cd5ce2b96a0b8f98f1b
SHA512 0e101fa28c3919c0d8a5acb9a2390a23014b53c3fef2db812c0a5e88825569d388a5f83aa6f0a14e6dc2c8f5b29a68e4c859092386a7e8a7709378e46b3907c7
TLSH
T16E4130E05C3D1AD5C4BD0DBFB08B26FC94E89362F4A434392898ED68967E50D304083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 ce012fdb8d369cb3d3e3dd4350534b012960cbfaab1295aa7f74df9e444fdf49
MD5 9ecadcfee8e22df226f556fa73f715df
SHA1 0fd31a2cdb0625bad0f8bb6fdbc7bbd5d94e8892
SHA512 7a995f1a47c5ed74a12eb7ccc13e44de0e7b70aad270fe33ebd6d233364c6786efbe72a2d3d804087b6365585cb05471870b18bc357f1d969a25f45fbefb1915
TLSH
T16611FC921C7A0AC6C6BE0EAFE0833BED44E89316B4A8307828D8E958913941E3051C6E
MD5 SHA1 SHA512 TLSH

Submit Download

a947ae35-87f3-4bd1-b984-e7889a8e2e4c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\a947ae35-87f3-4bd1-b984-e7889a8e2e4c.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json~RFe59aba7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json~RFe59aba7.TMP
Size 132B
SHA256 a0b1a35a86cbd2e671521525fc6903162d450e3b301948d913d05ef458794c20
MD5 22215f69c4a5231b8c568620e783d7fe
SHA1 c64663b6efe0023ca5978374d785f1202d924d1b
SHA512 9e38513132672de4a65c01a6eca3c8c3a878cc6e11e2c0d2235798b78e3338c9a13a15d261c4b4fc6c60657f42407b98c8435aa4352366d1809843ddda068e22
TLSH
T1A5C02B79481924CC2B00043C6004012B19B0560023C413F48C1B8D80007537CD30817F
MD5 SHA1 SHA512 TLSH

Submit Download

aa09b3d2-282c-47cc-a81c-a075b0f2b85b.tmp

Path C:\Users\Admin\AppData\Local\Temp\aa09b3d2-282c-47cc-a81c-a075b0f2b85b.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5780_2038097926\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Other

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_119409304\Mu\Other
Size 34B
SHA256 2b4a47b82cbe70e34407c7df126a24007aff8b45d5716db384d27cc1f3b30707
MD5 cd0395742b85e2b669eaec1d5f15b65b
SHA1 43c81d1c62fc7ff94f9364639c9a46a0747d122e
SHA512 4df2ce734e2f7bc5f02bb7845ea801b57dcf649565dd94b1b71f578b453ba0a17c61ccee73e7cff8f23cdd6aa37e55be5cb15f4767ff88a9a06de3623604fbf0
MD5 SHA1 SHA512

Submit Download

LICENSE

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_211613017\LICENSE
Size 1KB
SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
MD5 ee002cb9e51bb8dfa89640a406a1090a
SHA1 49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2
SHA512 d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c
TLSH
T17D31535723840B9306DA2B4566AEBDC4B0DDC02D7F27AE05186EF394537B52ED8B3443
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5452-516-0x000001DB83D60000-0x000001DB83EBF000-memory.dmp

Download

memory/5452-497-0x000001DB83D60000-0x000001DB83EBF000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads