34355723c2ca9e9e8eb389f5b331da7cfead1cc11931ea10ea96305192c55d67

Resubmissions

09/09/2026, 18:13

260909-wt38cs1te18

09/09/2026, 18:13

260909-wtymwa1tew8

Analysis

max time kernel
23s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/09/2026, 18:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ape.exe
Size 59KB
Sample260909-wt38cs1te1
SHA256 34355723c2ca9e9e8eb389f5b331da7cfead1cc11931ea10ea96305192c55d67
MD5 cce9292bae37fdfb85e56b536631e3c9
SHA1 633c5387208088b16a71532b18a4a45305b31501
SHA512 e4a9238491bf53ff9604e8c922c6a0f8866888e6a9b994c31f81e457c446b281327a7f08e2016d0d98a92ac1e33f2a255fd4301d5fcc755e5f439ce7487bb259
SSDEEP 768:mEEqQlY0DqirdFaW6rNArDXZ9LnMVcKD53y8gb:mEETlY0uy6W6x8DXZ9LMv53BQ
TLSH
T1CF43D821C9AA016AD27BEE75DD724801EE33BC874BB4A9CF57805C9A0D329D4CB3D716
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence ransomware

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
8	raw.githubusercontent.com

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\wallpaperctl\\wp_240741578.jpg"	ape.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3764	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4056	msedge.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
4872	taskkill.exe

Modifies Control Panel 2 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Control Panel\Desktop\WallpaperStyle = "10"	ape.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Control Panel\Desktop\TileWallpaper = "0"	ape.exe

Modifies File Icons 12 IoCs

ransomware

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Shell Icons\4 = "C:\\Users\\Admin\\AppData\\Local\\wallpaperctl\\icon.ico,0"	ape.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Icons\3 = "C:\\Users\\Admin\\AppData\\Local\\wallpaperctl\\icon.ico,0"	ape.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Icons	ape.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Icons\1 = "C:\\Users\\Admin\\AppData\\Local\\wallpaperctl\\icon.ico,0"	ape.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Icons\3 = "C:\\Users\\Admin\\AppData\\Local\\wallpaperctl\\icon.ico,0"	ape.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Icons	ape.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Icons\1 = "C:\\Users\\Admin\\AppData\\Local\\wallpaperctl\\icon.ico,0"	ape.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Icons\4 = "C:\\Users\\Admin\\AppData\\Local\\wallpaperctl\\icon.ico,0"	ape.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Icons\4 = "C:\\Users\\Admin\\AppData\\Local\\wallpaperctl\\icon.ico,0"	ape.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Shell Icons	ape.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Shell Icons\1 = "C:\\Users\\Admin\\AppData\\Local\\wallpaperctl\\icon.ico,0"	ape.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Shell Icons\3 = "C:\\Users\\Admin\\AppData\\Local\\wallpaperctl\\icon.ico,0"	ape.exe

Modifies registry class 38 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\wallpaperctl\\icon.ico,0"	ape.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon	ape.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\CLSID\{59031a47-3f72-44a7-89c5-5595fe6b30ee}\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\wallpaperctl\\icon.ico,0"	ape.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\DefaultIcon	ape.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{C62B648E-7510-4F6F-BA46-9B41D1ADA39F}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}	ape.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\DefaultIcon	ape.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\CLSID	ape.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\DefaultIcon\empty = "C:\\Users\\Admin\\AppData\\Local\\wallpaperctl\\icon.ico,0"	ape.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\DefaultIcon\full = "C:\\Users\\Admin\\AppData\\Local\\wallpaperctl\\icon.ico,0"	ape.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon\empty = "C:\\Users\\Admin\\AppData\\Local\\wallpaperctl\\icon.ico,0"	ape.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\DefaultIcon	ape.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\DefaultIcon\full = "C:\\Users\\Admin\\AppData\\Local\\wallpaperctl\\icon.ico,0"	ape.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\CLSID\{59031a47-3f72-44a7-89c5-5595fe6b30ee}	ape.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}	ape.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\wallpaperctl\\icon.ico,0"	ape.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\CLSID\{59031a47-3f72-44a7-89c5-5595fe6b30ee}\DefaultIcon	ape.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\wallpaperctl\\icon.ico,0"	ape.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\DefaultIcon\full = "C:\\Users\\Admin\\AppData\\Local\\wallpaperctl\\icon.ico,0"	ape.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon\full = "C:\\Users\\Admin\\AppData\\Local\\wallpaperctl\\icon.ico,0"	ape.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\DefaultIcon\empty = "C:\\Users\\Admin\\AppData\\Local\\wallpaperctl\\icon.ico,0"	ape.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}	ape.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\DefaultIcon\full = "C:\\Users\\Admin\\AppData\\Local\\wallpaperctl\\icon.ico,0"	ape.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\wallpaperctl\\icon.ico,0"	ape.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\CLSID\{59031a47-3f72-44a7-89c5-5595fe6b30ee}\DefaultIcon\empty = "C:\\Users\\Admin\\AppData\\Local\\wallpaperctl\\icon.ico,0"	ape.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\DefaultIcon	ape.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}	ape.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}	ape.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\CLSID\{59031a47-3f72-44a7-89c5-5595fe6b30ee}\DefaultIcon\full = "C:\\Users\\Admin\\AppData\\Local\\wallpaperctl\\icon.ico,0"	ape.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\DefaultIcon\empty = "C:\\Users\\Admin\\AppData\\Local\\wallpaperctl\\icon.ico,0"	ape.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\wallpaperctl\\icon.ico,0"	ape.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\DefaultIcon\empty = "C:\\Users\\Admin\\AppData\\Local\\wallpaperctl\\icon.ico,0"	ape.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	4872	taskkill.exe
Token: SeShutdownPrivilege	3600	explorer.exe
Token: SeCreatePagefilePrivilege	3600	explorer.exe
Token: SeShutdownPrivilege	3600	explorer.exe
Token: SeCreatePagefilePrivilege	3600	explorer.exe
Token: SeShutdownPrivilege	3600	explorer.exe
Token: SeCreatePagefilePrivilege	3600	explorer.exe
Token: SeShutdownPrivilege	3600	explorer.exe
Token: SeCreatePagefilePrivilege	3600	explorer.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3600	explorer.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4148	ape.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4148 wrote to memory of 3764	4148	ape.exe	90
PID 3764 wrote to memory of 4872	3764	cmd.exe	91
PID 3764 wrote to memory of 3600	3764	cmd.exe	93

C:\Users\Admin\AppData\Local\Temp\ape.exe
"C:\Users\Admin\AppData\Local\Temp\ape.exe"
1⤵
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Modifies File Icons
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4148
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im explorer.exe >nul 2>&1 & del /a /q "%localappdata%\IconCache.db" >nul 2>&1 & del /a /q "%localappdata%\Microsoft\Windows\Explorer\iconcache_*.db" >nul 2>&1 & start explorer.exe
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3764
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4872
- - C:\Windows\explorer.exe
    explorer.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:3600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.google.com/search?q=lol
  2⤵
  PID:2512
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ffdd64bc188,0x7ffdd64bc194,0x7ffdd64bc1a0
    3⤵
    PID:4844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1524,i,1972136333193423298,5979247039422097790,262144 --field-trial-handle=2400,i,7679437618487286415,5311735742466822034,262144 --variations-seed-version --mojo-platform-channel-handle=2392 /prefetch:2
    3⤵
    PID:5456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1736,i,8125636383808575179,10685181486031732747,524288 --field-trial-handle=2400,i,7679437618487286415,5311735742466822034,262144 --variations-seed-version --mojo-platform-channel-handle=2476 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2240,i,4927260563896374397,5517250978286347883,524288 --field-trial-handle=2400,i,7679437618487286415,5311735742466822034,262144 --variations-seed-version --mojo-platform-channel-handle=1404 /prefetch:13
    3⤵
    PID:6008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3584,i,12437001225583167605,4168245068852322397,2097152 --field-trial-handle=2400,i,7679437618487286415,5311735742466822034,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
    3⤵
    PID:4192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3664,i,4944503641732324361,5193745349796965233,2097152 --field-trial-handle=2400,i,7679437618487286415,5311735742466822034,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:1
    3⤵
    PID:1544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4300,i,7977383542944892814,6037883166047719098,2097152 --field-trial-handle=2400,i,7679437618487286415,5311735742466822034,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:1
    3⤵
    PID:2348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4320,i,12304590857308537717,13209045233519298918,2097152 --field-trial-handle=2400,i,7679437618487286415,5311735742466822034,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:9
    3⤵
    PID:4752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5328,i,15661085050556132766,12710696889395711002,2097152 --field-trial-handle=2400,i,7679437618487286415,5311735742466822034,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:1
    3⤵
    PID:1684
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5452,i,14560934212897704652,12260491350191940062,524288 --field-trial-handle=2400,i,7679437618487286415,5311735742466822034,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:14
    3⤵
    PID:1688
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6036,i,13813076311032331702,648406652731733803,524288 --field-trial-handle=2400,i,7679437618487286415,5311735742466822034,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:14
    3⤵
    PID:1352
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6036,i,13813076311032331702,648406652731733803,524288 --field-trial-handle=2400,i,7679437618487286415,5311735742466822034,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:14
    3⤵
    PID:4568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5588,i,11775720562755714477,4294312907635173900,524288 --field-trial-handle=2400,i,7679437618487286415,5311735742466822034,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:14
    3⤵
    PID:2296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5780,i,17617749288423063478,12434789942736517011,2097152 --field-trial-handle=2400,i,7679437618487286415,5311735742466822034,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:1
    3⤵
    PID:5480
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4744,i,10461277401876467423,7891473246551920741,524288 --field-trial-handle=2400,i,7679437618487286415,5311735742466822034,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:14
    3⤵
    PID:1528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5808,i,3021298672084543579,16736409594267521450,2097152 --field-trial-handle=2400,i,7679437618487286415,5311735742466822034,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:1
    3⤵
    PID:4896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6764,i,7657205570072972135,14861499081628820272,524288 --field-trial-handle=2400,i,7679437618487286415,5311735742466822034,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:14
    3⤵
    PID:6564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=7036,i,3113524875231878944,11225373274310500436,2097152 --field-trial-handle=2400,i,7679437618487286415,5311735742466822034,262144 --variations-seed-version --mojo-platform-channel-handle=3880 /prefetch:1
    3⤵
    PID:6572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=7024,i,12428680831535912821,16077445699125043767,2097152 --field-trial-handle=2400,i,7679437618487286415,5311735742466822034,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
    3⤵
    PID:6580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6728,i,10357215299632682357,14469725262588847987,524288 --field-trial-handle=2400,i,7679437618487286415,5311735742466822034,262144 --variations-seed-version --mojo-platform-channel-handle=3852 /prefetch:14
    3⤵
    PID:6800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=5376,i,17896438290187923147,5094259682405239321,2097152 --field-trial-handle=2400,i,7679437618487286415,5311735742466822034,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:1
    3⤵
    PID:6972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6568,i,2903790471397147894,9960750757967523602,2097152 --field-trial-handle=2400,i,7679437618487286415,5311735742466822034,262144 --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:1
    3⤵
    PID:7032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6152,i,3223962939776024243,14823380195967642199,2097152 --field-trial-handle=2400,i,7679437618487286415,5311735742466822034,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:1
    3⤵
    PID:6568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7260,i,7894174071705586227,11609480533175128291,2097152 --field-trial-handle=2400,i,7679437618487286415,5311735742466822034,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:1
    3⤵
    PID:6680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=5416,i,3140627538717070159,16445652542903064213,2097152 --field-trial-handle=2400,i,7679437618487286415,5311735742466822034,262144 --variations-seed-version --mojo-platform-channel-handle=4088 /prefetch:1
    3⤵
    PID:6832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=5312,i,17865665429425012718,7234386791582400349,2097152 --field-trial-handle=2400,i,7679437618487286415,5311735742466822034,262144 --variations-seed-version --mojo-platform-channel-handle=3852 /prefetch:1
    3⤵
    PID:6988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5340,i,10803480175860212018,7385013914010801717,524288 --field-trial-handle=2400,i,7679437618487286415,5311735742466822034,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:14
    3⤵
    PID:4420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4504,i,13465936561858489168,15641538727738171471,524288 --field-trial-handle=2400,i,7679437618487286415,5311735742466822034,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:14
    3⤵
    PID:1380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7272,i,6797391676059792071,5866687238461167368,524288 --field-trial-handle=2400,i,7679437618487286415,5311735742466822034,262144 --variations-seed-version --mojo-platform-channel-handle=7392 /prefetch:14
    3⤵
    PID:4672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=7380,i,4597826227839161496,11679843178356516840,2097152 --field-trial-handle=2400,i,7679437618487286415,5311735742466822034,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:1
    3⤵
    PID:3508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=7508,i,1517425270543619522,3439329473535732946,2097152 --field-trial-handle=2400,i,7679437618487286415,5311735742466822034,262144 --variations-seed-version --mojo-platform-channel-handle=3768 /prefetch:1
    3⤵
    PID:6980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=5636,i,12942613414848247810,917780155589697749,2097152 --field-trial-handle=2400,i,7679437618487286415,5311735742466822034,262144 --variations-seed-version --mojo-platform-channel-handle=2648 /prefetch:1
    3⤵
    PID:7032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=7596,i,74270966119018359,9277208597845387758,2097152 --field-trial-handle=2400,i,7679437618487286415,5311735742466822034,262144 --variations-seed-version --mojo-platform-channel-handle=1868 /prefetch:1
    3⤵
    PID:6860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=7640,i,12803277602216134816,446022677056862184,2097152 --field-trial-handle=2400,i,7679437618487286415,5311735742466822034,262144 --variations-seed-version --mojo-platform-channel-handle=7580 /prefetch:1
    3⤵
    PID:5776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=3004,i,8142531155841562612,5920883053077365774,2097152 --field-trial-handle=2400,i,7679437618487286415,5311735742466822034,262144 --variations-seed-version --mojo-platform-channel-handle=7636 /prefetch:1
    3⤵
    PID:4904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=6580,i,16236873477914972320,7855623789470705789,2097152 --field-trial-handle=2400,i,7679437618487286415,5311735742466822034,262144 --variations-seed-version --mojo-platform-channel-handle=6644 /prefetch:1
    3⤵
    PID:3728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=7884,i,11292626386412817914,1192096999554630762,2097152 --field-trial-handle=2400,i,7679437618487286415,5311735742466822034,262144 --variations-seed-version --mojo-platform-channel-handle=7832 /prefetch:1
    3⤵
    PID:4888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=7632,i,18212726798791403304,658982999576051734,2097152 --field-trial-handle=2400,i,7679437618487286415,5311735742466822034,262144 --variations-seed-version --mojo-platform-channel-handle=7676 /prefetch:1
    3⤵
    PID:4908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=7736,i,859372475690574453,955259381628286718,2097152 --field-trial-handle=2400,i,7679437618487286415,5311735742466822034,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
    3⤵
    PID:6948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=8188,i,10863079099143126041,5176506702642548512,2097152 --field-trial-handle=2400,i,7679437618487286415,5311735742466822034,262144 --variations-seed-version --mojo-platform-channel-handle=7896 /prefetch:1
    3⤵
    PID:5000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=7836,i,13341773544928653551,13122279770670518621,2097152 --field-trial-handle=2400,i,7679437618487286415,5311735742466822034,262144 --variations-seed-version --mojo-platform-channel-handle=7868 /prefetch:1
    3⤵
    PID:7116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8380,i,12239111509390235006,9794934998469321230,524288 --field-trial-handle=2400,i,7679437618487286415,5311735742466822034,262144 --variations-seed-version --mojo-platform-channel-handle=8416 /prefetch:14
    3⤵
    PID:6540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=7844,i,2431813484267805725,1960182933041302450,2097152 --field-trial-handle=2400,i,7679437618487286415,5311735742466822034,262144 --variations-seed-version --mojo-platform-channel-handle=8552 /prefetch:1
    3⤵
    PID:1448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=8732,i,11982989456798118550,16237329363234845402,2097152 --field-trial-handle=2400,i,7679437618487286415,5311735742466822034,262144 --variations-seed-version --mojo-platform-channel-handle=8696 /prefetch:1
    3⤵
    PID:6132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=8176,i,4902419630089499580,9344605627744334186,2097152 --field-trial-handle=2400,i,7679437618487286415,5311735742466822034,262144 --variations-seed-version --mojo-platform-channel-handle=8960 /prefetch:1
    3⤵
    PID:6840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=8992,i,10995139564367271934,6993533351348277256,2097152 --field-trial-handle=2400,i,7679437618487286415,5311735742466822034,262144 --variations-seed-version --mojo-platform-channel-handle=8884 /prefetch:1
    3⤵
    PID:5160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=9020,i,812862549352704346,14335347988428881079,2097152 --field-trial-handle=2400,i,7679437618487286415,5311735742466822034,262144 --variations-seed-version --mojo-platform-channel-handle=8696 /prefetch:1
    3⤵
    PID:3144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=8784,i,11659975383113366772,12574440389784371246,2097152 --field-trial-handle=2400,i,7679437618487286415,5311735742466822034,262144 --variations-seed-version --mojo-platform-channel-handle=9016 /prefetch:1
    3⤵
    PID:4576
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=8204,i,3939842213304048034,10898728648774005622,2097152 --field-trial-handle=2400,i,7679437618487286415,5311735742466822034,262144 --variations-seed-version --mojo-platform-channel-handle=8948 /prefetch:1
    3⤵
    PID:5836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=9252,i,10914324278263127784,5713393228425995060,2097152 --field-trial-handle=2400,i,7679437618487286415,5311735742466822034,262144 --variations-seed-version --mojo-platform-channel-handle=9272 /prefetch:1
    3⤵
    PID:3772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7564,i,15333689120085724033,5797606936675407886,524288 --field-trial-handle=2400,i,7679437618487286415,5311735742466822034,262144 --variations-seed-version --mojo-platform-channel-handle=9464 /prefetch:14
    3⤵
    PID:7160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=9232,i,1513676275327839071,14286027302607105379,2097152 --field-trial-handle=2400,i,7679437618487286415,5311735742466822034,262144 --variations-seed-version --mojo-platform-channel-handle=8172 /prefetch:1
    3⤵
    PID:4576
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=9584,i,5536872002140476632,14507993905611626041,2097152 --field-trial-handle=2400,i,7679437618487286415,5311735742466822034,262144 --variations-seed-version --mojo-platform-channel-handle=9124 /prefetch:1
    3⤵
    PID:5592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --metrics-shmem-handle=9356,i,367155420612253136,18344059745304641318,2097152 --field-trial-handle=2400,i,7679437618487286415,5311735742466822034,262144 --variations-seed-version --mojo-platform-channel-handle=9368 /prefetch:1
    3⤵
    PID:7356
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --always-read-main-dll --metrics-shmem-handle=9484,i,5462794799318530549,18260275869535445154,2097152 --field-trial-handle=2400,i,7679437618487286415,5311735742466822034,262144 --variations-seed-version --mojo-platform-channel-handle=9008 /prefetch:1
    3⤵
    PID:7408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --metrics-shmem-handle=916,i,15894895162122154112,17582981280008301679,2097152 --field-trial-handle=2400,i,7679437618487286415,5311735742466822034,262144 --variations-seed-version --mojo-platform-channel-handle=9568 /prefetch:1
    3⤵
    PID:7712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --always-read-main-dll --metrics-shmem-handle=9560,i,12201427201710902693,11273935582210607643,2097152 --field-trial-handle=2400,i,7679437618487286415,5311735742466822034,262144 --variations-seed-version --mojo-platform-channel-handle=9564 /prefetch:1
    3⤵
    PID:7764
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9872,i,4330191767089788387,533185708429109805,524288 --field-trial-handle=2400,i,7679437618487286415,5311735742466822034,262144 --variations-seed-version --mojo-platform-channel-handle=9912 /prefetch:14
    3⤵
    PID:7988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --always-read-main-dll --metrics-shmem-handle=9648,i,4653861794723275683,9289849995872109093,2097152 --field-trial-handle=2400,i,7679437618487286415,5311735742466822034,262144 --variations-seed-version --mojo-platform-channel-handle=9928 /prefetch:1
    3⤵
    PID:8076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --always-read-main-dll --metrics-shmem-handle=10196,i,866243798538334319,14046012138312149337,2097152 --field-trial-handle=2400,i,7679437618487286415,5311735742466822034,262144 --variations-seed-version --mojo-platform-channel-handle=9880 /prefetch:1
    3⤵
    PID:8124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --always-read-main-dll --metrics-shmem-handle=9304,i,10871374798310052088,8973099876858129350,2097152 --field-trial-handle=2400,i,7679437618487286415,5311735742466822034,262144 --variations-seed-version --mojo-platform-channel-handle=9104 /prefetch:1
    3⤵
    PID:7208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --always-read-main-dll --metrics-shmem-handle=8820,i,607628755309785216,11764722204316820082,2097152 --field-trial-handle=2400,i,7679437618487286415,5311735742466822034,262144 --variations-seed-version --mojo-platform-channel-handle=9764 /prefetch:1
    3⤵
    PID:7224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --always-read-main-dll --metrics-shmem-handle=10180,i,6879762248155815850,11443206208626640403,2097152 --field-trial-handle=2400,i,7679437618487286415,5311735742466822034,262144 --variations-seed-version --mojo-platform-channel-handle=10184 /prefetch:1
    3⤵
    PID:7512
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --always-read-main-dll --metrics-shmem-handle=10248,i,9748048192673486829,4284708505228764289,2097152 --field-trial-handle=2400,i,7679437618487286415,5311735742466822034,262144 --variations-seed-version --mojo-platform-channel-handle=10400 /prefetch:1
    3⤵
    PID:7908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --always-read-main-dll --metrics-shmem-handle=9856,i,12253885419739242050,6984680124144918501,2097152 --field-trial-handle=2400,i,7679437618487286415,5311735742466822034,262144 --variations-seed-version --mojo-platform-channel-handle=9868 /prefetch:1
    3⤵
    PID:2396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --always-read-main-dll --metrics-shmem-handle=9080,i,11987003309890566320,5844438721078740619,2097152 --field-trial-handle=2400,i,7679437618487286415,5311735742466822034,262144 --variations-seed-version --mojo-platform-channel-handle=10460 /prefetch:1
    3⤵
    PID:2996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --always-read-main-dll --metrics-shmem-handle=10560,i,4023470858016189860,3055104042737751586,2097152 --field-trial-handle=2400,i,7679437618487286415,5311735742466822034,262144 --variations-seed-version --mojo-platform-channel-handle=10172 /prefetch:1
    3⤵
    PID:7704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --always-read-main-dll --metrics-shmem-handle=10232,i,5169493988438609737,5270440553993179969,2097152 --field-trial-handle=2400,i,7679437618487286415,5311735742466822034,262144 --variations-seed-version --mojo-platform-channel-handle=8784 /prefetch:1
    3⤵
    PID:7412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=10520,i,2421401871032510974,6514266014210114654,524288 --field-trial-handle=2400,i,7679437618487286415,5311735742466822034,262144 --variations-seed-version --mojo-platform-channel-handle=9736 /prefetch:14
    3⤵
    PID:7252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=10780,i,7169436799696822460,1197975386653020061,262144 --field-trial-handle=2400,i,7679437618487286415,5311735742466822034,262144 --variations-seed-version --mojo-platform-channel-handle=3320 /prefetch:10
    3⤵
    PID:8056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --always-read-main-dll --metrics-shmem-handle=10780,i,17686229227728207324,8989732464757098986,2097152 --field-trial-handle=2400,i,7679437618487286415,5311735742466822034,262144 --variations-seed-version --mojo-platform-channel-handle=10784 /prefetch:1
    3⤵
    PID:6888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --always-read-main-dll --metrics-shmem-handle=10460,i,2133501780452107884,481678511763066110,2097152 --field-trial-handle=2400,i,7679437618487286415,5311735742466822034,262144 --variations-seed-version --mojo-platform-channel-handle=9968 /prefetch:1
    3⤵
    PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.google.com/search?q=lol
  2⤵
  PID:3572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.google.com/search?q=lol
  2⤵
  PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.google.com/search?q=lol
  2⤵
  PID:6956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.google.com/search?q=lol
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.google.com/search?q=lol
  2⤵
  PID:6860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.google.com/search?q=lol
  2⤵
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.google.com/search?q=lol
  2⤵
  PID:6916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.google.com/search?q=lol
  2⤵
  PID:2656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.google.com/search?q=lol
  2⤵
  PID:1124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.google.com/search?q=lol
  2⤵
  PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.google.com/search?q=lol
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.google.com/search?q=lol
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.google.com/search?q=lol
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.google.com/search?q=lol
  2⤵
  PID:612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.google.com/search?q=lol
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.google.com/search?q=lol
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.google.com/search?q=lol
  2⤵
  PID:7340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.google.com/search?q=lol
  2⤵
  PID:7696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.google.com/search?q=lol
  2⤵
  PID:8060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.google.com/search?q=lol
  2⤵
  PID:7460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.google.com/search?q=lol
  2⤵
  PID:7824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.google.com/search?q=lol
  2⤵
  PID:7252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.google.com/search?q=lol
  2⤵
  PID:6740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.google.com/search?q=lol
  2⤵
  PID:7752

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3936

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
PID:2092

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4548

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:6520

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

7-Zip File Manager.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip\7-Zip File Manager.lnk
Size 1KB
SHA256 6730898e5b169aece30f5cc730848b6af64fb135bd01f4d21461738d68e1b869
MD5 beba1c1cc43f8fb3a7c1a8682aa6f79e
SHA1 325520f11431e7f75ff436c940d1ecc318a9e700
SHA512 9ce4f2976d2fc06af28637837b00ab4442f8b55a13e172c8f88e1559ef0905a0bb05051ac63c68a0a1b9a620be349f6aad77290d8fcbfe884f92f7f82558743e
TLSH
T11231E6169AA61B30E3F7C574BCB615239F75FC10E2905F5900C183852E74D006D59F9B
MD5 SHA1 SHA512 TLSH

Submit Download

7-Zip Help.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip\7-Zip Help.lnk
Size 1KB
SHA256 890bb11ef54153dfbfc4cec4084e35205d7b7a5f01eff15319ae37be2d5f2487
MD5 1b3df33416629d7b6d48d42a0f5b36b2
SHA1 58fa3e5b01f3ebc46fb9978d9bc4de9068b97fbc
SHA512 5e7caf794dcd9961befad23d5550d1057db2fbe11b489588a1ef0791cd24adddd235dc9e814163e5545abb30a8956e74de7a80680df867f74eb29e5707bd2765
TLSH
T1343112129B6A5F20E7FBC1346CA62623CB38FC10E690AF574082C2952E75D002E58F5E
MD5 SHA1 SHA512 TLSH

Submit Download

Remote Desktop Connection.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Remote Desktop Connection.lnk
Size 2KB
SHA256 91b75da071d664d3ff256f85cfec2852ad7c3c502d41c83dc7cad6db76660585
MD5 c49df57edbe50775c87c8b0b6f2b540d
SHA1 6bda851ccd2db0a7c2a6201b61a1ad9f4e4a92cd
SHA512 e4f19103062492ef82bf0d8dddbe7cbf5a629f6766605beaaf4eebc23fc000288753fcee17dc36ff41d7cd9a2e49e73cf415833c47e88f5ed471eff90b18c81c
TLSH
T18C41701473FA6B20E3F68D356CB8902609B5BC25DC63C70E0191D5DE193DA14ED39F66
MD5 SHA1 SHA512 TLSH

Submit Download

Steps Recorder.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Steps Recorder.lnk
Size 1KB
SHA256 4f138ab1221f21ca44163107883be0d0670663afdec9b28d7d589a1903a3d23d
MD5 a53e85fc59439af2d837768cadca84e6
SHA1 4265d85f4f46c2a54b4e303f9a723109b207ec4f
SHA512 3aa294b912384009127877b76a5db6fc180b24c5c7289822f938aa7e0795ea407471060e346c4ccc392013ad8e7a84fdbd2446f0a4a6ddfb3d91cc22a1c08b93
TLSH
T14241420873D96F10F7778E367C78D12109B5BC21F962874D019191DD197C9549A29F12
MD5 SHA1 SHA512 TLSH

Submit Download

Character Map.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Character Map.lnk
Size 1KB
SHA256 7c098113ed91eedc0971cf884775610cc585312ecf2d96fa7ec1a0b644262c48
MD5 640dbb7b74500cf26e8e43a6f13da008
SHA1 a5920a3955e178016c7012d8d252742d63fbe278
SHA512 96a08086be207806b06eb9fd3c7f345578dfdba17f099ec5d63ffdb1580bfd56485cde16f4ed5988b330789c4a8cd84af3def0f5a28c71bf8a3fdd0002ba41d2
TLSH
T12741A20873E97B10F37788367C38A0215DB5BC22FAA28B0D0181D1C81C3CB58AE29F17
MD5 SHA1 SHA512 TLSH

Submit Download

Windows Media Player Legacy.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows Media Player Legacy.lnk
Size 2KB
SHA256 25540fe058dd4c9936a6184b541b0517ea9a127aa7686441127dba91f64461a1
MD5 dd4a99b4cb2c88695909e86fb454c382
SHA1 66bffa77f3b75255e96b0427d23bc35b7da55af5
SHA512 7397e60be7f70389a224bfd7f8078578af85b27919c9b254f725a983c17495593d5a344d2d514ea050f297f98c1583eaa36b82e68a93fd1557fc6e1d975a8b19
TLSH
T1CA41C004A7FD5B14F7F34D303C3266211A7BF810F965C34D0241C1891C7AA689A2DF67
MD5 SHA1 SHA512 TLSH

Submit Download

Acrobat Reader DC.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
Size 2KB
SHA256 5d526ea3488a4eecbf8010198a7fc4109c865d31ca457858a845d7da79abd75c
MD5 2ed9b95b6d9fc4feee369699173c1b0d
SHA1 0fc733e7a46098bf95b07f2faa31a7d0e306dd42
SHA512 0ce947e7b2344244d35f8100a5f728e75211204c25a30bc298c04bf42220db1e191c916d27d834697cff9b29427299bf439352214378cfc5cae209f77b3173b9
TLSH
T12F516D0069AA5B01EBFB5DF2B9F676305E79AC10AF558A0D0406804D1939F54EF16F2B
MD5 SHA1 SHA512 TLSH

Submit Download

Component Services.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Component Services.lnk
Size 1KB
SHA256 baf1f26e06223646d6e02395c5db2b067e0077df9ef01dd0e7c00e83d3c18d80
MD5 92ac990bee5d3ff4d8596ac15b2a8f33
SHA1 982ce8e40bb30ef58e69bcd870d98d8fa3866ad8
SHA512 d54ef7b613294cc46f214e07e6c412d3f2be5f2367a182e9a001030a99a5a596297daea8494a785ed84457bb09d9c58e7455c3f6a4edac2fa9fb8d5af4f37b0a
TLSH
T121412804A2ED6B10E7B74C397C2861258EB5B821FDA28B1D0181D0D81C6CE54EF3AF66
MD5 SHA1 SHA512 TLSH

Submit Download

Computer Management.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Computer Management.lnk
Size 2KB
SHA256 5443a020b187b8d0609df6fe698053d32ae4003638ca43f9bd1eeb584549aebb
MD5 4e0477a101fda101a8321f67759ea9ee
SHA1 1e1fe6c0a8b6ea3ffbf20068cc4abb1977dda588
SHA512 62557a4a00d18c1bfaeb49f94a5e800a7b8973def44a397878b4a9161fc2b2c89d79a4307daf05945740198b0c2527310fafd3965bca6eb846010f4c752c41e1
TLSH
T19D412B0972EC6B10E7779C367D24A0214D76B811F962871A0140C0DC2C68E54DE2AF66
MD5 SHA1 SHA512 TLSH

Submit Download

Disk Cleanup.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Disk Cleanup.lnk
Size 1KB
SHA256 968dda174c71503a69ce08db942a8b9311254d91558129190bbc54bfc8f07dc9
MD5 dc654fd3da1e4933b1986ba4a9e289b5
SHA1 351d2329e0a435160b836bd781eeeab9a31fad62
SHA512 fa636a2fb571dc3e541a901738c7432537c95f257adedc670e803faf262bcd915b5a3a61b03be4d306272563490aa64c2af84e3e27dee6e19897acb4d26c8775
TLSH
T1BE412D0863D96B10F777DD367C78A02159B5FC22F9A2874E028191D9183DA54AE29F26
MD5 SHA1 SHA512 TLSH

Submit Download

Event Viewer.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Event Viewer.lnk
Size 2KB
SHA256 601da77aa34a042eb4654648d45fa539e286bdcfaf0d2c1181dc6ec418f03cc4
MD5 e0108328d65bce7b4bb118e54744e9b8
SHA1 88a9648421ee933027b07118a4cf692554185200
SHA512 a4a8950811bbd4ed99113547fab62a167df3a9331694f304481ed59917f126a042bdb4c4a360309ff77308a03f3afffe50cba8a8dee27e628890c4eb8208d1fd
TLSH
T1CA414E0863DC1B10F7BA4D3A7C7860261975BC25ED62874D0151A0C81E3CF24EE25F21
MD5 SHA1 SHA512 TLSH

Submit Download

Memory Diagnostics Tool.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Memory Diagnostics Tool.lnk
Size 2KB
SHA256 592457cc76c24e5e4d0c0e448bb8a45e3102125340035d6050ec801cf5bc21f5
MD5 94d81cd4b078f866fb0986b9b2a6da25
SHA1 8ff43e5d792294247fa7b4c18188e380192436fa
SHA512 4443ac7fd1b400d0e0de48ad89eaf271359ea23647960330ea978620d61b06aaa18d9edfaded0fb94a26f9585768a31517c02ec65297d3db07fa1837dcd76d72
TLSH
T155417D1873D96B20E3B698357C78A02219BBFC25E9A38B0D0181D1C92D2CB14AE29F21
MD5 SHA1 SHA512 TLSH

Submit Download

ODBC Data Sources (32-bit).lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\ODBC Data Sources (32-bit).lnk
Size 2KB
SHA256 5628b06ed0b31312f8c2390b8e37d540d9f1d00d899c637d30ab19d848b8abe0
MD5 e04dcb174f274c8709c6c24e5c08c202
SHA1 59bd9de500633f7492e836a013007ba8ef93d22c
SHA512 41614d8ea8d029dcf027f477d0b6455e45178cb65c634e9d7100e27f68284b1248147e8474c72bb293fac1f14378541a9b7d9818e236ff7ff302bd712b5e0ec3
TLSH
T1E4417818A3E51B10E7B64A3A7C25B0322DB6FC14F8D047998182C1D82DBCB64DE2CF27
MD5 SHA1 SHA512 TLSH

Submit Download

ODBC Data Sources (64-bit).lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\ODBC Data Sources (64-bit).lnk
Size 2KB
SHA256 06e0bbc431c72aac31eaea702cea5c370cdefe0241212c45c9a7d9d53f9b7a5e
MD5 8cbc340d4ddec99d24cdc2c4cc6b87d7
SHA1 2f762f179f1ebeb1fb2f859448ca73924c378b74
SHA512 7766c6dc668d3292e204bab9f310a1ffbd85ec1f8c620ddfe46b5579800e41148541a6ca5354df16261aeac7b422f18749261c039e9f7a287c4b7e88e43eeb46
TLSH
T15B417D08A3D91B10E7B6893B7C29A0311DB6FC35F8A28B1D45C2D1D81D7CB54BE29F26
MD5 SHA1 SHA512 TLSH

Submit Download

Performance Monitor.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Performance Monitor.lnk
Size 1KB
SHA256 6dbc6e9ff4597c517c4bd94b696f370166533c5d70f1f2922c162860042424ca
MD5 e4c70e28fdcfab1ace748ec8ec064bcf
SHA1 0591bb7c7a435231dfd9b25789d5f2b406b1f004
SHA512 30c42c478ca0d12b1203ecb2aef3a329197000ffce449bca6df5f20dce0f811a13c8b0b0eefd03955727b4a3998b04d883355e5cec8b2d068c02eac52e242774
TLSH
T1C741F40862EC6B10E7764D367CA8A0250AB5BC21FDA2871D024191DD1DACA14AE2AF66
MD5 SHA1 SHA512 TLSH

Submit Download

Print Management.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Print Management.lnk
Size 2KB
SHA256 190253c957e27c6aa923cdfc6a23a8e97e07de65effa9e853c91c733f297aa29
MD5 21de566f56577e8202d25e965f4eac3b
SHA1 f6a59e767297bfab3772b1481ff0f4a25a91196f
SHA512 e146c91edfbc578e703b5ac5e7b3d8f3c471ccd46cc6d35ff7981b8f460baf25f360baad6625fd94fbed49ee611b522b7d7f0dc9ba996ab289f402b9e038a86e
TLSH
T14141F208B2EC6B10E7775E36786491210AB9BC11E9A2D71D0260D0DC5839E54DE3AF76
MD5 SHA1 SHA512 TLSH

Submit Download

RecoveryDrive.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\RecoveryDrive.lnk
Size 2KB
SHA256 c70bd22dbde3e3f9faf049813d9b63abcd602ff896cec14659676dff00b04df1
MD5 099cb93e813196273e205a20043ab835
SHA1 a93c88bb84e8eb9d09d1fb0c73e351c3aca22a06
SHA512 f9deab7ab2ab4fd68bf1bed08474a3276cda8dff601411600c8aec43588dddaf5c1485eab423b0ba2cd6858a69797d73729662fe1826fb03c568b088d4fb779a
TLSH
T1DA419919B7E89B10F7B249397CB890310AB1BC12E8A2C70D028291C90A7CD20DE69F13
MD5 SHA1 SHA512 TLSH

Submit Download

Registry Editor.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Registry Editor.lnk
Size 1KB
SHA256 d2d5c9d82118c74d899ca464f0fd716692511721123f7ce9aca1dbe6a2957260
MD5 2ec619bfb91367ed2e0b2cbff9d2f69a
SHA1 32db09c44ba2662197cedccd3a8f0d3e4b7a4852
SHA512 f8895d7be786abf65813dd9294acf83d6649cb0bbc26518e97c382cb7a691a4c4937e64af9a018509f2a3b8058c1610e3d4b3d876036a0c6644e01b388633a7a
TLSH
T1CA418424A3DA6B20F7E645396C78612B2976FC14F8E2875D0082C2D93D79B140E1CF27
MD5 SHA1 SHA512 TLSH

Submit Download

dfrgui.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\dfrgui.lnk
Size 2KB
SHA256 e46cd2261dfadf573848c1cafcf14f4fe87bcb8d56515e52932101fbcab6061c
MD5 8667362f586cf1cdcf6df727becf7e2a
SHA1 7996f8d2730d55bdf52344c275daee4198ff75e7
SHA512 f8432724ec052c910aba816821d31673e440233d948ef748c73ae5fcf05a23a46198d169c4b0c3886a7add737142c95aeac26cef805a7a08afe3002a392b1dd4
TLSH
T1DE41FE05A3E95F10F7B68C357838E12105B6B821ED638B1D4584D1D81D3C714EA39F16
MD5 SHA1 SHA512 TLSH

Submit Download

iSCSI Initiator.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\iSCSI Initiator.lnk
Size 2KB
SHA256 5cd76f2e44fe97ae20a96be90838ff5eb457bbca44ed3f94e27e44b689dc7364
MD5 91491d912e5f3bc779c86502bbabc70c
SHA1 ed6bed7f27f3f8a7328c94ebbaac512d9facecb4
SHA512 2ef9bb9934b99e22676274f7aef9491f14d45003ef65cb0e0a8a5e8803b70371787466a51fb5b3c8cc3ee2b28ea1057486d0dbe69cb54d8b1c5df470d8fef05e
TLSH
T10E414E0873D95B10D3F64C397C68A0211DB9BC25EDB2875D018591D41D6CA14EE3DF26
MD5 SHA1 SHA512 TLSH

Submit Download

Calculator.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Calculator.lnk
Size 1KB
SHA256 feeffaa904804c5c87ba34c5d6b157f0ef31d8f1523021fd72ad59f17155f0db
MD5 4df73ed091bc12cdd403770816aeb677
SHA1 58dc0ca30446b58d24963260f9fe2e8976fb9b82
SHA512 4e44900a39755872a259b178df42d221982d2402a5aa2e4551f8e36e57fdc9c7074748eb0d3e9fc36a3bf73fbb1e655112b34a7e97bce5faeaafb06163e99aac
TLSH
T135417D08A3E96B10F377DD357C38B0215DB0BC22F9938B4D01C191C91C6CA14AE29F66
MD5 SHA1 SHA512 TLSH

Submit Download

Excel.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Excel.lnk
Size 2KB
SHA256 faaa1735a96998cd8df3dadd7d2084dfbb680027fcecb1804ce12cb550855ced
MD5 9a2db4bee3a4e1c9364e82fef9ac066d
SHA1 7db79c8f582b2ee12ce9c739a6e28fdd586a028f
SHA512 ec70f8deef7d26ee40502a139b67e3be3e804ec878d222b3790b79e45c4d8ed9a46f3588b0a4a6f55b360660938c586bbc5045c9d79564c45ba59758d5880309
TLSH
T1A941FB10DBB26F30F3FB18752CA56971AF32B810DA78972E00428049197CE50ADA8F77
MD5 SHA1 SHA512 TLSH

Submit Download

Firefox Private Browsing.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firefox Private Browsing.lnk
Size 2KB
SHA256 28db1303c9309a545cd894e693b504b4ab1397548668a7e8efe6ac59a61a58e4
MD5 b23673f7b079b0c3feae8c4fe5e3db42
SHA1 02ea93ca9ecbee2ca78ae7312290ce8b3e43f1d8
SHA512 1bff1005e98d9f4d09bf914d241ee976d8e8ff17f655d22de79631ddf43147e21446193603f8060fa53e04880597b2fcb3dfda9722e3a97850c063d860ede36d
TLSH
T19D41330097F60778F2F7C539BEE136239B37FC02E6649B6E4086C1850A769105D59F5B
MD5 SHA1 SHA512 TLSH

Submit Download

Firefox.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firefox.lnk
Size 2KB
SHA256 268fb1d4dbf8af50f79e8e6d8f6e873e91261de639312f317c71a726341b67e9
MD5 436925f8e2c80e0a26a3880c6d30b61e
SHA1 03761d4169046f5f4bee77d59088338427cf93b3
SHA512 582ff1b9d3302d53b7234a06a4ad4d72042c9fb37c67e151181b9a9766ba6ede406a3d62b0170556d52ff56ce22a8768a20e1577cf95a4646e3a5c812257d979
TLSH
T1BE4123009BF60774F3FBC535BEA126239B37FC01E5606B2D808291850D36B005E59F9B
MD5 SHA1 SHA512 TLSH

Submit Download

Google Chrome.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
Size 2KB
SHA256 b4e7eb9767caef545817699302e075f4353f1ada4887969365b473863c396d08
MD5 258fafd68c70fb4264ed339ee9c4b47c
SHA1 cfdac8be050620f7b45812d773e188a2f01d46ca
SHA512 d7158beb5d4c1c61a551e9d7f1997b684916c0f12ebe482b6f5d2b352d6c45740f1facf3c090ca87b5f93f6f8b49cc8665819be690eb6741519a0962006ca202
TLSH
T186418B01BBFA1B58F3B389366A7727314F7BF822D960972E4181814908749101E98FB7
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft Edge.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Edge.lnk
Size 2KB
SHA256 7dd8655c19d77a7ae73ccfe0d1a08648a83df4f5d9c9f924f7b7e1b09cc87632
MD5 3e61a5aa1f05e2a5306a2a8d7f06ebf0
SHA1 425ed3d0eb4bafc427eb59847547cc737ae79b3c
SHA512 90dcc91a00b590c61fca37c5fe59306c04a6b1e1be005a558c1c052da0c1bf82c43996abc3999313503bfc5c061e6b7cf00a1dc7a1d9031fb56fe9219eb48080
TLSH
T122410001AFE61F15F2F7A971A9B7AB316E7BB805E5248B0E0046810D0C35E005F68F77
MD5 SHA1 SHA512 TLSH

Submit Download

Notepad.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Notepad.lnk
Size 2KB
SHA256 6b2a191299d0542e6c2e04c64d4f0046f13b96384d100face35875dc6b244bec
MD5 3d43a619593c3ca535707f9c40a4c6a0
SHA1 dc3176c74a29dc981d6f1814582e368cb7efeb5b
SHA512 42a839f0cfe3a8b7172ba1f3d38e5e8a51c8cbbe350011c06494ba3cd25005b345ac51ef53d4af0c5b999f008bc90c19d4ddc8d8faa671542dd718b3f3fccdbf
TLSH
T12841490872EA6B20D7B799367D78E12159B5BC21EA63874E0181D1C92D2CE14AE19F22
MD5 SHA1 SHA512 TLSH

Submit Download

OneNote 2016.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OneNote 2016.lnk
Size 2KB
SHA256 2cb5319c916b63bdf1f37857033fef6f4aa61c478994e735026af27c10d6cc11
MD5 7967e568579bdec5c66f54c022c2c52a
SHA1 6aa8f2ab6755c3d7a263eadfdad12704b2a72fe7
SHA512 be9ae188522748deeacd26169f2b5ac6bc7aadbb9cd3fd6182c7bf61feb8b85235ec3820402be00eab785a3e359f3a7c463505306a54e5caada31f265166d58b
TLSH
T15A41D20097F65F35E6B729395DB2A531AF35B901DA7AA72E0002404D0DB8F509FA8F77
MD5 SHA1 SHA512 TLSH

Submit Download

Outlook.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Outlook.lnk
Size 2KB
SHA256 432f8923539ee0636ef1bd307ee2e600356a0d9a306650917ed9c9eb2c4d881d
MD5 48cfd969e7f3e273b1f9c2be7dbd0991
SHA1 e254f6de9945a20fd784502d8b4e681fcc245c99
SHA512 b11f719a043ae1a0227db3d69e983033f1443a26a6891ab0d2a64afe97613f3d4180f7545396efd329df36220854edfe3503051c96799157e09a5b4df3cafcc9
TLSH
T1B3412200D6F26F31EAB628355CB52531AF36B811DA7B972D000280891EB8E50AE68F27
MD5 SHA1 SHA512 TLSH

Submit Download

Paint.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Paint.lnk
Size 2KB
SHA256 98b061f37cf713a89289bf8ada8f971966fcffb4eab7237d1662581a449a3442
MD5 60aa80b21eca3bf886ecc47742ed8c4c
SHA1 a4fc38b56cce7b570b0aa91cf3ad62a9465bc473
SHA512 0f2fdbe7512c0f071f0eb8108d67c29c3bb635278ae115795eb3fa2387939affe23bd4fa3e1b714d21b60bdd6a3f7173fe92fcfd8996f8a41655cf811305e7fe
TLSH
T165417D08B2D95B20E3778C367C78A02119F9BC22F962874D019191D8583CA28EE2DF62
MD5 SHA1 SHA512 TLSH

Submit Download

PowerPoint.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PowerPoint.lnk
Size 2KB
SHA256 9801b51ea3d996805f7565fbbbed1daeefc607c09a070481dc32a9329855929b
MD5 026d80d57f0aba942a24375641cacf83
SHA1 e48d7524e9edec1b798c472b64d7113a65a7642f
SHA512 41641dcc902816957dd7331a43510a0138f3380316eea07c50d072a3b4a543fd38180aa597fe72b80177f37281706b1d72b33b617d79b12a3bd20f61ba62a40b
TLSH
T10F41FE00A6F26F31E6FA1A365DF21925AF31BC11EB79972E0002504E0978E509E68F37
MD5 SHA1 SHA512 TLSH

Submit Download

Snipping Tool.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Snipping Tool.lnk
Size 2KB
SHA256 59ae3b7b6623e19ebc19a0515ee37375d226832a7490a41b2fcc39f56d71d4d0
MD5 9c79ce5b7ee8ca63735fd040fdee0636
SHA1 7858c29f5d18e8b60b13099c653f802445db4a0d
SHA512 73f6c714536ce20fc0080c92e36cfe8d801a778917b06deb5f05f1e24cff4277a10001e9637bd6590e4d1f26f927a617056a869e97ce4c960d60381993fd6c5e
TLSH
T149417D0572F96B14E7F69A377CB8A02109F9FD22E6A2834D028281D9192DE149D19F37
MD5 SHA1 SHA512 TLSH

Submit Download

Word.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Word.lnk
Size 2KB
SHA256 ece4486484d086a478931c4b03c715cf65bb365765b4a7f2b47c546903dc367f
MD5 0a32314381b8bae341e23a4bf41e62a0
SHA1 e1560a5d97ac120cc34d6b5e13ee73346755abf5
SHA512 5efdd98a78a23a9af2b95718f358950265693ba7b9ce188c9624d7429b402c2d9e98cfe61d809de91cfe5690f0a37848b326cb1570bf92e87a940025b59e9a94
TLSH
T11C41E200D6F65F21F2FB1D796DF22631AE75B811E975972E0001808D0D74F509E68F67
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

f_00003a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00003a
Size 519KB
SHA256 94b542379323c05f6745e6aef918f25206d763fae93b092b407f384e46b105dc
MD5 7797d9fb321906bd42666c15e2baf075
SHA1 7ae33b172fb50b62b6696acf11e2372c32809e7c
SHA512 968a7fa48a25166073793e53f9e3d8fe75cbd233b371b85c4b89196bdebeb04480e4a2cd15f1b297e0cd8a648228bad95d6f89fd45144541a29aea6acc4f654e
SSDEEP 12288:HurfyUilInfsP16D5Lm93UmJnLhcex7f5kKwyIlsMXFv:HurKUilKkPNSm7c8fSKwyIq8
TLSH
T1F9B4236118D55A024A1DFFBE0075E7852CE3B6FA0620CF9AF43C92601E6DD77364D8EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00003b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00003b
Size 87KB
SHA256 38106711a3306af02257ac9e26038b6aa8b9445672d9e8a48de7ce96be1524ff
MD5 ca828b6a87f068a324b2cc84cc34c033
SHA1 ed7f841143ee782b7ba66c6ebcc15d1e90925de5
SHA512 d284831a68979f369258615fac773ee75c975a7a0e2f7052afb16e26c40d970e380cc570106005798cf0755e6e03878805f4870a75a75e307151ca094bdc55b5
SSDEEP 1536:uGvn8NqESBtMlcEqSbt68MRZYOEuVv3+fP+R4iIhwCow03RdKt:u88jSHMlBBAzEuh3sm3l/waO
TLSH
T148931239217FA2D2EB46BA4F55D57C358D363A40CCB0C2DB735AEF63B1981E66430088
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00003d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00003d
Size 437KB
SHA256 a451b8791f9183f16a2b30959f9f69e20f35117f8ca6e34e463916869328f3c8
MD5 15d9ce7fe8b446c91cc0598983dde50a
SHA1 b2ad1e9b11a41f5176e3cc495dac68aa26e0955f
SHA512 39e14f23bbde8278b586057eeb648777afc1e6d11b71f3e5529688341f7868b61d0d7ef43cc925189a70def4a6b53e863a06fc8d36e7551c9a50745be6607529
SSDEEP 12288:9SyJNj5Vy52pw6eyroMIW3/dJhlzOH7pVUa0Uiku:9vJzV1pw/yroMfCIUfu
TLSH
T10B9423CFDB2108E7FE76C411CDAD9FE8049BA554056D8CB35BB6066D825A0808636FEF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00003f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00003f
Size 519KB
SHA256 fc502bc9cd724126c83418506d2bc77ad1996595651e8e7c6cdfb3a187ccd014
MD5 c5ef465137d3cbd3c92b3bdb0ab31c28
SHA1 56d7205c31d67fe89ba72088f442229d141c9483
SHA512 f48471b42bbbef9760ed01e37d4d9e64e55f14352f1682f04d378eeb5b05a84676d13cf97ff054a033156eef61d7f81eaa81c2935832513a7a17e3ff543ea7f8
SSDEEP 12288:/Wn4Lw1Htnxsbw/hRHMkirLpKiPg+tNacS170DL4eAY5t87gQor7M0W3:gEwVsGnHuHEiNacS1WEeAm8U3MT3
TLSH
T100B4230EDAA43551D20D24F94236EDEE5084FB816110EF56BD892B26DE144AEC9EF3E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000043

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000043
Size 38KB
SHA256 7165713d3e1a610399471a5e93d5677508f62ef072c1151e72273bf4bd54f916
MD5 9436affc97843765a966b3568fa7e5ec
SHA1 7bfda74bb30589c75d718fbc997f18c6d5cc4a0b
SHA512 473ec3a843c33e18d6d194651fe11353fcd03a7959225faeabf8c77484155ea6a7bccb72dbaf2093ed53c408faa3be9f6fc907f7a5ddf8223375f9d09b504456
SSDEEP 768:eUEh2+iKBVQbBhu8vjenqz2Ez6Y/AxHLEaP72sV9qKYbDblXqhP8qwFSE3uk:eUEEoBVQDjeQaLnP2pfZTqgSEB
TLSH
T11703F112148F7FA1C244F224A4EFE416ACC3F565ABA15E6980B8B7C7010E3C657A46FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

af3b6a9118a5a96a_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\af3b6a9118a5a96a_0
Size 340KB
SHA256 78e904eb9478eb904bd86a09c4f39dccf5ec597ff57f5d7ee8fe9559ff532bb7
MD5 4c3faa6fcc45bb9d9f92800dace0fbc6
SHA1 61c869d5ac83a1ae6d9dbb7585e3b244ce00dfd5
SHA512 13e3f30ef18718cbdf33d98e6a789e857e4a7629e50a80fc9bf22226f264ccdb951ec3fb48257acd677e9f97103b7c6a002b9b6ce08f782ee3a1508cac8b6bed
SSDEEP 6144:j/WN8ICiYa3Yt/T6TCxGUoNk4k/OLE82I3vzAOjXHrC0U82lbKWl1/M0Z6fLX0+4:UCM8/eblCNWE8lZeEvg
TLSH
T18E74D690A7C96FAECE2B93F94AA39E577231405D2FC7D30722E0D7252C292F50E55C4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3342cbe29dc7f81_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d3342cbe29dc7f81_0
Size 352B
SHA256 bf6a0ace003055df7fb1bebb6cf8dec268a79cf568e4f643de9088882ceadad2
MD5 1b6b0feef98598b61600a44fb0ca897a
SHA1 4551e8f5f36ee9240863543a45b60d89d857f411
SHA512 688019b9d0e1740d9e0f83ab1da7103a4b074cba31d7b815f6d1269b37e8600681a6945df9cd7e5ce7c153bead60b17d6efa00a3a6b8af49bfeae8bdfd9b8705
TLSH
T19EE020B30521DC44D98A92BCEE67721B6432C0A9495E55D1C40471FB85451A90F14991
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

fd4fb269-61b6-4744-af92-9a8cb1875c5f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\fd4fb269-61b6-4744-af92-9a8cb1875c5f.tmp
Size 5KB
SHA256 87858e181af6fdf38e9a449d35f618838c3b2ea748b68ca875eb30ac26632f49
MD5 4d81809549017d894f340ee53898fa79
SHA1 7ee22421b566f40637baf7ed447207277b0fe578
SHA512 62dac227d149f8b156055b5f3d027d046fc9e22e294edf1e51ba851262efe49d8e61e06f859b3491d9cc809d72b5ae60ab8a7d96ace7ccaaac8469ee9332f556
SSDEEP 96:DZJOtkFtoE8tVkAazrIaVaZjhBbAzQiwwJAklcdTE:DZMtItoE8tVkAazrIaVaZjhBbAUiZJAw
TLSH
T18AB1BBF7C3E8C22DC91256F4AB15AF1FCE1D0A14432C3D6A88E4AE5B93E2471E101A5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 47615ecf39edb138ba75009513954e22b3ef15fe67f9bc54d7111cd107f6a845
MD5 049cd32dc4d528cb6d853d8a197acb9c
SHA1 ab02d5af78794285d904542550f796314b7a0385
SHA512 2de4fe9bccc3abc471edf288d1fc43dcfb4a5a248441a3c71938cfdfd16ab9e4584cda4964257af309aae30c1ae27e8f0f2cfccad45feb715de55d250e4a7ffb
SSDEEP 192:sxRdRYC7/fIsZDde5lS/zoD8pj81/g6+WN9Z00fYMoVyluOEGt/IgV1ZJ:sxRdN7/fIsZc5lGg/5vfwgt//
TLSH
T1D142C616AD28AD3B9CC7D20DBB55BF53D2F91132A1941E58E7FC8A1C04EB6DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 5edec8bdea4282df9b7265f157e86901710251d5d56a55c41b3f07cd9e7e710f
MD5 e855b42d4b19350b300e71f99cd78fec
SHA1 353f5cee29618425b16b5eb252cdce145cba89ae
SHA512 85a413817359ce6d5c7ee2283ab416b5eaccc861d52398775b1c8f37b5b38bf16c6082e7e0e0a2f3537e58488d0068573bb59bb5cba30b6f146f9f89983ebfb6
SSDEEP 192:sxRSRYC7/fIsneUZYb1zoD8pjTi/g6+WN9/02hYMoVSHuOEGt/IgDV1ZJ:sxRSN7/fIsnequa/5bhwQt/j
TLSH
T15142D816AD24AD3BACCBE20DBB65BF53D2F9513261941E48A7FC871C04E76DD520780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 4e1be2162181707a607e4196401490102104c0214e69fc98848e0ea616c63cab
MD5 a46b01680abdc21973e8f78b96b5ffeb
SHA1 4e74642153cfa9e0fee0b18f99d0027c21216ec8
SHA512 b516bf3a84ca5a2ac4f244b739439a5f1561d76bcaac855ee012afcf2f3ce80dac81b24699f2f5de464d9ebd6391dc83fa0ea37b4f15c5559b3658c039d78add
SSDEEP 192:sxRSRYC7/fIsneUZYbbzoD8p1qO/g6+WN9B0thYMoV8HuOEGt/IgDV1ZJ:sxRSN7/fIsneqQr/5uhw6t/j
TLSH
T1C842C716AD249D3BACCBE21DBA65FF53D2F95132A1941E48A7FC861C04E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 63e192657ec39f98410a0041432cf8f6e8f5983139eb7def19fd4bd2fe8d09b7
MD5 7fac5b1bf8bd940fe8dad26c35498688
SHA1 edb486259bcd556f1d7a651934fd1788387d45e4
SHA512 68c8b7ad1570e54ddadbcd2d4e753a0cfb8803e61739e0984413e487006492007a98705f50265f24700ecb7bb536a106a0167acb40089cf30e8a7be0515f946c
SSDEEP 192:sxRSRYC7/fIsneUZYb5zoD8pjvE/g6+WN990EpYMoVIHuOEGt/IgDV1ZJ:sxRSN7/fIsneqYQ/5rpwat/j
TLSH
T11F42C816AD249D3BACCBE21DBB65BF53D2F9513261942E48A7FC861C04E76DD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 2e08164977f331036b0aa3ef96b3985bfaebefba0d0dd641405476206d4cdbef
MD5 dc2b49b0e3168a1e62451fa9be7524b3
SHA1 612b3d202bfdae925cbfe502d3259fe352b4a065
SHA512 c9fb452008d16ace26470929d30b9e1b9c340b80ff6ae4f73ef9c1839a043215058c848ac8207dcdc62746d3104e3c3293f5af8afec43e5fd6beb4be24fc205d
SSDEEP 192:sxRSRYC7/fIsDUZYbvzoD8pjwF/g6+WN9f0lZYMoV1luOEGt/IgDX1ZJ:sxRSN7/fIsDqyo/5kZwft/d
TLSH
T10D42D816AD24AD3B9CCBD21DBA65BF53D2F95032A1946E48EBFC871C04E76DD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 d89c803b88d7712bde396a96a4a373d719523adda69cb3af56f93f581f9952ea
MD5 89eb057f2991c0418674c36017ce9d36
SHA1 af39f6a0fda75871c8a66962af5ee700e3a4b422
SHA512 52385a6afef038864eaa1eba800c735ad3cd180ec91535e27aea000d67722611d099fb3796867be8d599b3ca6e2dad110f0604d7278feb264697ec82f0496d09
SSDEEP 768:jC+voN7pLuL7JQWgQ+f4+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVKQqchroZBG:jC+vo7E7JQWgQ+f4+u1jaxVcaLG
TLSH
T168C2EA7B640CCB7F4F804ADDEC197E9B6DA802CB5698CD8047FE941C02C67EE52194DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4b2ca65eb8a31067_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\4b2ca65eb8a31067_0
Size 1023KB
SHA256 e926dd67601bc5b49ab82eb6d977da16cdcf4d03bedbc7b17ec32a525d93e8b6
MD5 05a3fd54ec9a5ec1d4694a020b4d52b8
SHA1 058996c3a3b245daefd4674a748e800b543f523d
SHA512 eba90e28598f900152a2b2a40f5a05071c67406b7e2fd482a9fe021efac8775e1b1cd863380bec494c292a0d9b6a77185514ac9c85a99a8278e5836dbbb34053
SSDEEP 24576:i5jPxGPIdvQK+OTz3kXlOGURooelw+J6/ve:i58wdvQK+gkVOGURooelw+J6/v
TLSH
T159253BD873A3B46362B1F195416F428BB3AEB892F049886CB5A8DCD12DB4C5541F7F38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5e6118ecee5ff894_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\5e6118ecee5ff894_0
Size 255KB
SHA256 c33bcdea09c839ea38fcca78602a5de50ad582f6d8649a8ab123a6457bc95feb
MD5 fd18674648a79974d813423e54661a8f
SHA1 910395f60ecb7ce3e4b2a23ad4cd5896dcc87b16
SHA512 2726eeab9f8275de59145220312c9776236df6b32c839d18f29a095a7e33a199b414181524b0b7ddbc3ca2d1ab1e07afd5a6c6ed053e5a0bdb5cf6ae6d6c9da8
SSDEEP 6144:lXOy0ffCxMoe+856ebasE8yIZBFI38zR+7U0Jb2X86R8fCKW/:lXOy0Hi8+OE8yIZXI38U7U0I8S8fCKW/
TLSH
T195447D723300B13FA8278EA5A67E7F0D3835F217DD2705B8D6E4E9358BE6EB61412548
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 49447d53febb9e9fa07ba2bc9d6029d834c69af8d68983c0bf1068e37203cf99
MD5 ac33a4a0c92eb86de56e561a03fdf480
SHA1 504b7308a8ecba24238c3f830a36f5200604cb3e
SHA512 8cc355ff0fd9d2ab32a6c7db0bf789c081b8307808237a54990be9c9caf08d3f0f466c867ef0f07e823286b89d1bd9217210c48ef42a40099d94d33b1f44eb5a
TLSH
T1C0B022AC00C00F82CF2E03F202CB20FC33A32E322303C30E0BA00C2CE223202220A200
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 03b03071c9fe73c16ef416d45fed8c2abea028e3a135a7e0121f182722fb4e95
MD5 e1a34c867bc8a50a2f84a9699afb3638
SHA1 ba4dc0fa30a3cc239cc2afef1502f98f8f54a1f9
SHA512 04bea22ff88427df146276d72000e39d7eaa3bb2134195d481601b62ffd95791a8c065016df73e9339f8097b7501f20e665dddc8ce8d0e23c1e10e1771aa701a
SSDEEP 96:KRbEBVj5J1WdSIg91K4EgT1c7j6dJOHFSr/VPTXWbAOgHXK42gZXc9lggbWqY6W3:CbEBVj5JAdSp9/EgTK7j6dJOHFSr/VPP
TLSH
T1E2912310317B4380387DA90C81BC8D6F879174B2341AE66B3FA845A61FA6E565FFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9f889bed-9a57-4ea4-859e-fcea9082430c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\9f889bed-9a57-4ea4-859e-fcea9082430c.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 2edcca2205f68d57956e1e9f3bf4fa19dbc4e7e6f42b5b50cce9fcfd4ee49404
MD5 b346d7a8ec58e61bbba3ffe5d2415525
SHA1 d668df3ecbe62929ad7563bf079c8bea85408e3f
SHA512 ebef84b164bb6246f9d25d0660ab2fbe0981a0777510ba99566958de4f8c6c1d1b9ef2d5d169c63b74dc314a5f6e130dea520c2e63d3bcdd1c0ccf7b8d8a7f11
SSDEEP 768:S+FQc3CwgjJQVFCp8+p3bd66j+4BRv86aLIWNcTR4A/:Cc3/c8+p3Z6n4yzcTR4A/
TLSH
T1B6F29EB3D8A9CD77ACFACB48B6563743AEF511A389C15994E5CCAB0D004729E170FC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 c6a08766261a82b70683da02c81dfdfa32f20333011b2796fb51ae5b5cec2762
MD5 b3a7d9d38295ace6ed185a4fb3f404a9
SHA1 b6859e1983b97242743f477d6ee809bf00845a5b
SHA512 7a4d87ef19ff53081ef2b6cec2d344f93bc2990dcb39d6c6870ffc7c4ea745d0754ed8bae390ac211ef48efaae16a6fdef89c820ad1ebc326ccd3f68e54a1e1d
SSDEEP 768:Drv+4UNbdD3th5QVxZp8+p3bd66j+4BRv86aLIWNQ:Dbsbp3eH8+p3Z6n4yzQ
TLSH
T11203AE72E8699D339CF6C648B2873B837FB411A385C10E94D9D96B4D458719E270FC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 6465e3ddfa65ddce86106a497addc00c5e43b0bed3b252f713189baee352b609
MD5 a7cc2c2dfa3c65d3b824dd0dc7e23066
SHA1 a85606aaf0348d0d7eb97ebc555cadd3c4c4daf0
SHA512 f146ef20be98a5f27a61cf94adc132c0d706cdf80cee53f6243d68a343e6ba3f7b07c1e286aa49044fbdde0e4c0de39594a8fb106d800d5b56de286e87c5f6c6
SSDEEP 768:Prv+4UNbdD3ExQVxap8+p3bd66j+4BRv86aLIWNcTR4I:Pbsbp3LE8+p3Z6n4yzcTR4I
TLSH
T182039D72E8A99D339CF6D648B2873B837FF411A345C10D94E9D96B4E448619E270FC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 88892beb61f4f60c0469009acdf7827f10b998e57a37a9ab28e48721f3cde286
MD5 dfa28338f261079c2163c5981a584273
SHA1 41e3045feb31fe6c465334d08b009c47106be345
SHA512 6f2884d54dd77cc50b3f4729d502176616d752a834458a471edc6a29757c36aafab2662e0a33e244b0b1bef71a90f056c7d31e343cdf3939f4ebc5895a070db9
SSDEEP 768:6mc3D9QVxap8+p3bd66j+4BRv86aLIWNcTR4A/:bc3yE8+p3Z6n4yzcTR4A/
TLSH
T15FF2AEB2E8A99D339CFAD748725637836EF451A385C05D94D8DD6B0E048326E1B0FC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 323259a34710853419a0bceec881f7d16021056d3860c74ed63e181d75c8a3c5
MD5 7bb53edeebebd0d7aa14703bcdc688e2
SHA1 1e34d740ac89d1ef12fc34a5fc97088e3fa392ad
SHA512 827da8c4ca7980e8a58a5df78346204d9bf007eecc55edae4033b62a07dfc03f4b4b69e6e9e02c6795ae5c5fa50cca085d4fc537bb2a60b950bf2135cad2e380
SSDEEP 768:Irv+4UNbdD3fcQVTNp8+p3bd66j+4BRv86aLIie2bwCl1:Ibsbp3zL8+p3Z6n4yw0ww
TLSH
T15603BE33E9A899739CF6C648B2467B433FF851A396C10AC4D5DD2B4E419A19E230BC77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 99842b95f892f23e771cd1b1f7bab086bc47179806dfde983a3554b7a8628048
MD5 e33e10717db02a341da50e39b518f815
SHA1 00bd51faf944a121d770f14bb260172c5593a317
SHA512 d5a3e89eafeb494120777c834aa40c529d2952eecddbcba9834989a9c347e430b40c713024156a6929e3a4bd829e8ffb7b5507429adea5b0bcba5c90b2f2df54
SSDEEP 768:zrv+4UNbdD3tTQVxNp8+p3bd66j+4BRv86aLITN2bwCl1:zbsbp3eL8+p3Z6n4yY0ww
TLSH
T1B403BE72E46999339CF6C608728677833FF811A389C10E94E9D96B4E405B19E270FD37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 86cc3b5f6c0aec244dd4185d837d209600593bc1609606e156858c746c740daf
MD5 ad37913bf9901341544dd371ddae8e86
SHA1 478b88b99822d8c38af3656988bbcfd3baf62ce4
SHA512 cf44e2c5972a2ecd9f0496f6d9e5ca1c2fafb627c02ae46cd518be4ef663995538221dba4af206894ff9e3416de55d4fd8381b8368b92222a90f374b5fc67467
SSDEEP 768:lc30pQVxap8+p3bd66j+4BRv86aLIWNcTR4A/:lc3zE8+p3Z6n4yzcTR4A/
TLSH
T129F2AEB2E8A99D339CFAD648764637836EF451A385C05D94D8DD6B0E048726E1B0FC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

3fab0f77-ebd6-4956-8e9d-7152ac0e6269.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3fab0f77-ebd6-4956-8e9d-7152ac0e6269.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

iconcache_48.db

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db
Size 1024KB
SHA256 2295d82ca9af84d322ee4c4ffe6985f9e75b7d1c3bf06fcde8f9afc2085c4666
MD5 f79dbbc8addfd5d09d7c7d5e61ebb817
SHA1 c443ee162f65cd4978f6d8ab35f9043f2070bfa4
SHA512 992762e8861ab0227c26b67eb044b439c6f6eb0325a31ab0d09e32cef0a8c15323653b021d6093b434e7ae97ac26d2285fd87bdc020e18d4d28fdfde3678bf78
SSDEEP 96:2nnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnvGbIDvqxRx8HmeQELc9m1aBBIHdXchQK:eufWoYkG4rFyD4
TLSH
T19225EE207BA9DD78FD98C8B9EE8AC6F12613ACE1C4C101E722DE7F6B31705A455F9118
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iconcache_48.db

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db
Size 1024KB
SHA256 4ff3b8f54428fd04e52c534dcf721e7c60a1ff6960e92dacbf51611e23d8b51a
MD5 f635e0e784e0f49db81fd0c5411cb4be
SHA1 fd67075dda5e411cddd2fa14e30e8218a8d04dda
SHA512 23d7a7332f82f2c324ea8dadcf16138ff45b474fb7b30f4434af055e934ec1438d4ea51618f02902655b5a919a1381b1b66de683c5238515251ae129090da846
SSDEEP 3072:4sbooYLskGEo+nKVY37wOlJWMYwSUoYsUYYUYUYUYXEGos2ooZQ+nKVY37wOlJWV:4qoorO/2oo
TLSH
T13325EE587B5CDC78F898F478EA95C5F0260BADA4E0D401BB218DBE67F131A8114F9C6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iconcache_idx.db

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
Size 7KB
SHA256 4d0774e3322bc14b7207b0d7fa36090a7a7d670de8b2f34aadf0c3bfb53f1dd2
MD5 8741ad88d6d51906b73cb626929b8ee5
SHA1 d2762833f46ac32fa4a38decd06eb4b1aad194ab
SHA512 9f36a060ada4cf9069b87a25012f3ae0dc59ed595e7cb036e227a59a16d62f9926ef0b881d965bb9ed81b3e699220706249f59db8cc80ff7c5680d8cb27d31f4
SSDEEP 3:tnVlIlFnl9wxAVlURZSRd//MssMURJ/AaRd//IFh8RC/Ld//:DmoAuZ0dXMV5JxdX4cC/LdX
TLSH
T13CE148533085CE06CD0C0D35AE9DC0ED58063F018D24060B3080F32F0BF21C01521008
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iconcache_idx.db

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
Size 7KB
SHA256 b3978d6a97bc3f6eb1812fd2f7afa7f273ed7409c43aab95008cfe8aa7843e8a
MD5 e03fd7bb24c6b2de097e51934b2b091f
SHA1 6850ec4e557b3f9d2a6d9bc6b8932bff255cb82b
SHA512 164588eee18e2aaa1e30ea8bad794dd9ae7be2d05d046d5e52da59cb998b6651675f2285e702a1a30978911615291b2e9c4c73122f4312f48c2516c3609c8415
SSDEEP 24:jtN7L1i6t9Y4w7pAPAQwxjBO/QRT8jmVPKpKSmRfAajDT:jtBL1i6t9c7pqVwxNgKjK8pAaD
TLSH
T107E1EC52B949DA12DC482C31AFCEE6EE69227F48DE60235335C0F79F5AFB4C00C2A584
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 599B
SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
MD5 658ab8c32d4cc5deb36ac5f63da4658b
SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
TLSH
T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
MD5 SHA1 SHA512 TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2512_1759564762\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LiveCaptions.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\LiveCaptions.lnk
Size 2KB
SHA256 3033efef3adb4816f1a748d8cec975f38203a4bb0d216519a8c2fbcf44c7157c
MD5 528e7541af3aa541b6d0cfa515f5857b
SHA1 6d452ef1d86012d05986392bc0d9741965d05cbe
SHA512 0fcf52bf3e68f5dcfe75d56cc3dc9dc87a55d5761f7aa7c5e9fb7f0e5b4a8a07f4f5c84e30ea1c0097810bc2694ddd587f7070dc7cec77514f3e8b1ec2361a5b
TLSH
T1F441490C63D97F20E3BB8935BC38A0211AB5BC25F8E2871D01C2C1DC186C714E92DF26
MD5 SHA1 SHA512 TLSH

Submit Download

Magnify.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Magnify.lnk
Size 2KB
SHA256 6edb13ab17b7b89222ae9f1bc216340b2820f692f87078270dd9c3b00a44c144
MD5 1294f6cedf134d5b81ca767de11e070a
SHA1 c97f5f0b3a25fbbf9e26845b4781746ce7a6ab92
SHA512 240bb1d64ac33c4b85c0fb2b086efb8e9d0c1b93fe7e1e2e63ad4878c2b40806ce54fb38d6718a2a7affcba09f0eb4a3c9afd6b086f1d920181758fc548811d0
TLSH
T192417D0C63DD6F20E3B788357C28A0315AB5BC12F8E2470E0181C1D81D3C714AD19F25
MD5 SHA1 SHA512 TLSH

Submit Download

Narrator.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Narrator.lnk
Size 2KB
SHA256 c3168a4b38ecb82e267642c159bf6b1e7b2dc229d8f61bf0478f57ce03b587fc
MD5 f4cca09a27e1c1e7f02e4ca9f3791420
SHA1 f41055403753d62cde0e4e9a592b793605ef5ca0
SHA512 c4ed5901acf8afe54a03583749c675af87f84630c61ca5b8c995d1781a696f85a5dcaf65c02d22b5bc6153f75a398b3db6a25f15f8fad1cda7a1260da489cbe6
TLSH
T1AC417D0C63E56F20F7779835BC28A03119B5BC22F8E38B0D018281C81C3CA14AE19F22
MD5 SHA1 SHA512 TLSH

Submit Download

On-Screen Keyboard.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\On-Screen Keyboard.lnk
Size 2KB
SHA256 466bd0bb14ae7fa820b9729cc34904d75a5f7a06a861c3020fa406a161c6e7c2
MD5 a4ba879d9c8b2794521b4df0b2da235e
SHA1 8464376e32609ca29691765184b95042101c4ae2
SHA512 2d472961b1fc1e12f6941d127a531fc3896dd5bbc8cdf4412d6f5d4e30cd0f05cb15e835adae78cec0750e32def1b023aba48ad6b8a24c0ebf101fcdbfb97d2c
TLSH
T1FD41780C62E96F10E3728C367C78A03159B6BC22F9A38B0E418191C8182CA54EA29F16
MD5 SHA1 SHA512 TLSH

Submit Download

VoiceAccess.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\VoiceAccess.lnk
Size 2KB
SHA256 ae3c917f4f7eaede4577473cb58bbdda3eb5d772d66a69c582f50855aea1d579
MD5 02278b263f9c5e6bb5f022011a6cabe7
SHA1 cfe1d8cb9a73183ef61482156142be95e0a308ad
SHA512 9075a27c68bf99ab781b6f9ecb82e1d80aab4fdf8cae7c4328d1702e4442c6ca1cc5ecf2804bfe3cbb2f58a67aa088e13160ffc6046018e97bdb9d45cc0111af
TLSH
T15541490C67E96F10F3B79C35BC38A0212DB1BC12FCA28B0D018181D9197CA58AE29F26
MD5 SHA1 SHA512 TLSH

Submit Download

Administrative Tools.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools.lnk
Size 2KB
SHA256 a542a8e35240990b399d02d6309b28803c31409f0a09fc9df4da62d2fe75c72f
MD5 e56a120f6724b836306c1200a71e337e
SHA1 9b0187466e5733b5179c896491e06037e0707289
SHA512 25a54f9f1efcdb2a9e0898b09505032db3b09126dc4c6674da790cdd1856d069feb1fbfd1d314a994f5c8664a533ddf0c597d4b17a849c69ad7be6a68bc6818b
TLSH
T16E41F90953F96B10E7B65D357C69D9201977BC21F961C70D025491CD186CE14A935F27
MD5 SHA1 SHA512 TLSH

Submit Download

File Explorer.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\File Explorer.lnk
Size 1KB
SHA256 5fad16b72a526772ffd89e9ab119744d41db3fa3ce325f88ec80ff20cb2f6180
MD5 0dc314b0ff78033b5c12aaab5d8340e7
SHA1 496b61008f0cb4f7df8a6e0c96d204d34a67c704
SHA512 b2f51be72e8aa4d5948dcba49f7a6e173a073bec64bcbedab0f57bd7db4ce75c6040ba3cce8020776f4f53440b32ad740493bb5f3dd620a71c7a8468faca2301
TLSH
T15821C904B7F98B20EB779C3ABC38A41049B9F822B941871E0240819D1C3CA185F24F13
MD5 SHA1 SHA512 TLSH

Submit Download

OneDrive.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
Size 2KB
SHA256 b8c285cad3e367336e8fe9aef181af891c9971b80262ce3c04549533080ca5c8
MD5 8f10cad7c5ffe6f2ce9ac351bed15b2e
SHA1 25ba79f2ee7b518306f4783bed205eaf65f326b8
SHA512 4eb3af34bc3a7017edb9a1d8dc4f05fec081afa46b4e728f810d9c2428d585c8881053656307106f745cfca459e62c3114aaf693effac7c4d4d12b54157c2209
TLSH
T10041F001E6E55F30F3EAC93A59F725369A76B892AA249B6D0100811C1938E50AD94F7F
MD5 SHA1 SHA512 TLSH

Submit Download

Command Prompt.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Command Prompt.lnk
Size 2KB
SHA256 bcc853183959fd3c2002b368195c57f4b7905bd251fa97e6307fb82383a8fad4
MD5 b7788ba26bc380d2c4257239ba7a90d1
SHA1 8a14351b00a201ab4b2804fa80c0dfa5e33db88f
SHA512 bb7b0bc6c8bc63a19847158db462f0a841b7c072e1cabd8a4bc27bbfdaa93de50ee13c9381c118fd6af293f797cf29cce80b22699ab1765e2fb97686ba664717
TLSH
T11341490863DD6B10D3B79C36BC78A12159B2BC11FAA34B1E0181C1C52C6CB14AD19F25
MD5 SHA1 SHA512 TLSH

Submit Download

Control Panel.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Control Panel.lnk
Size 1KB
SHA256 4bd83274d685925139f5deafa8c23fbf0d6d1c3dbbcdc4b49d5fa08cc817ba63
MD5 fbe8279534de5cd15d4fdb45eb814db0
SHA1 2ecd6085bf381bb531a2e7c7fefe8378c2115ab4
SHA512 5ea7dbc70aebbaa01463e94027eb6789859d31151e62d47177612a574bd61a8cd67c2de30e73cf858ca3938a277d2781871b428d47f045be71e0947341a70e36
TLSH
T1F7219E00B7F65E10FBBB4934BC76B9250D79FC25F940922E0045818D1D39E540E18F27
MD5 SHA1 SHA512 TLSH

Submit Download

Run.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Run.lnk
Size 1KB
SHA256 e6f716c5bb68c7615b158e5e73673e790017aa4f1fdcb328954849046ff1af43
MD5 5c4db2c28a64ddad49381e4d8fed8117
SHA1 b78bd8b84d47ff2a888451864b1b6a121d855f07
SHA512 7a34b5fb62a68a8a750ff2d4d0670eeb77add499143f34a8b7cb4887858053aafaa0bfa064aa6d4c760c705fc4ba9b9a356b6ab02d0db2c3186835a8f257ace7
TLSH
T108219E00B7FA5B30F7B74939BCB5A5264DB9F821E941821E0100C25E1D3DF580E04F23
MD5 SHA1 SHA512 TLSH

Submit Download

Windows PowerShell (x86).lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell (x86).lnk
Size 3KB
SHA256 32b874f6716999a1ef1cad585ee12effcb4f4bbeec2037ff611dcb50e2f7237e
MD5 a2b9931603966ef9f6f5f650bab31715
SHA1 ce0d348f32bf8bfe339771c0120db749e972cc76
SHA512 5000f2f311456c7ad73ed3f12a251a0670ecbfb3785539c838a2f33fdc7f45fdb606c1d8e4971da180bd4c091e2150587bdbf5dc38fa186361f3d97ff0543095
TLSH
T1F451021457F51B28E7B79A39FCB5B3219936FC00F65117CF82808109AC25514DA68F6F
MD5 SHA1 SHA512 TLSH

Submit Download

Windows PowerShell.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk
Size 3KB
SHA256 2466028b0a27de33ee6d38e3030af2771eecd3f2da3c18422fde6a127e592357
MD5 28a2619907c81966468769beaef9b544
SHA1 5c92e3898a33a60fb54395dc99b112326f890c92
SHA512 7e60b67cb5945d3419b6f107b71a8b5056a2b9d60b6a48e90e3f917d17c930105a4cf20ff02b5c53929e98f6f093ae61643c9771582e7edaae6dc0b4e2a5b06c
TLSH
T1E651001457F95B28D7B78A39BC76E3318836FC00FB515B9F42C08149AC25514EA78F6E
MD5 SHA1 SHA512 TLSH

Submit Download

Acrobat Reader DC.lnk

Path C:\Users\Public\Desktop\Acrobat Reader DC.lnk
Size 2KB
SHA256 b66cbde3903f4b861a07f32b69f770234f7c6f364b38b1ad222f72d71ef9168a
MD5 52656f7f59be99309dd66a78069fb323
SHA1 94fb9fa03a66fe8f7e513926fa39feddbddb960e
SHA512 6542cbfaddfc28984527c3848de20afca70213c0f2af1a3f8d76c36f7e59a080a38e4875e3f861d1e3ae7625af3968f6b5c2071bfc808e0ea12f0f844b3c1ca8
TLSH
T13A41ED009EE21B60F2A788FAAEF219318F75B810D6945B0F0046810E0D71F44AD44F2B
MD5 SHA1 SHA512 TLSH

Submit Download

Firefox.lnk

Path C:\Users\Public\Desktop\Firefox.lnk
Size 2KB
SHA256 87b1affc1a2b8d558008b4d65a410de146c2202039b6fd1cf431628906c84ddc
MD5 0b66963e4222fa096c6608e266313c4f
SHA1 3cb4a9f309dc1b5c801dfe5e7b3f75a449a93be5
SHA512 590f4f82875285fd48146223db1b27562f24293fad43221db3521eff79793538ac9fcc2aa41a8ab5dae68d4b9042648783acc4df1171dd486900f41da7da682f
TLSH
T1C84115009BF60674F2FBC535BEB126139B37FC01E6505A6D808292851D76B105E59F9B
MD5 SHA1 SHA512 TLSH

Submit Download

Google Chrome.lnk

Path C:\Users\Public\Desktop\Google Chrome.lnk
Size 2KB
SHA256 7ed7d1d9e76996fd431cbf8a4eef0a74db0885630c9cccefa60d35f5caac6e47
MD5 8d339b7bc4430586fb784206dbac8101
SHA1 e588f9851fef78f9056a4fe003521fc160ec5663
SHA512 d46eab3ce2abc4124a670b2160e48afd680e8c3e39b45c814b1aa013a268cc90d8d4c51c02dd477aaac4eaf668c419fc6e625389ae60682f37c61e462caa1d06
TLSH
T11E419B01B7FA1B58F3B38576AA7336314F7BF8229920A61E408581490CA49101E98F77
MD5 SHA1 SHA512 TLSH

Submit Download

VLC media player.lnk

Path C:\Users\Public\Desktop\VLC media player.lnk
Size 1KB
SHA256 fb7c885763d928e751520bd573371030d9980dbceb8609502ce10b1e39a98276
MD5 c90fc9a7cd886709633bf8328ced3312
SHA1 e92d659d0ce63488078aa41e039a3630efdc6e8e
SHA512 06839c452f74d901f9e2563f063a18aa177fcbe04e1e4118b6042cb499ed55ee9733e62ed7074010d5e3f14e070037c14dad0c09e275b3fdf68ec407a27e8953
TLSH
T1EB41E105AAB55B05EBE7C5F9AAAA12229F7BF410D6406B1D4082814A2C34F00AE55F9F
MD5 SHA1 SHA512 TLSH

Submit Download

icon.ico

Path \??\c:\users\admin\appdata\local\wallpaperctl\icon.ico
Size 766B
SHA256 96dd2e10f7bccfb6e60a0c8d82d9c2dd2a115dabf00f4a66e0f5e304dfcec840
MD5 ae7981e75bd03e85402d81a5ca4572cc
SHA1 795699e58918029e915c080305f4ae7c440799e1
SHA512 87b0463671b845378748e17cf47e9062d374326a6a0d768c0511f1f72ebaf96b4648fafba8c0303959b90ce3227a7f7ecbe6bf4801bde66dbfe19fd7bebae6b7
TLSH
T17001D431531E8529C8030E39858B0B7EAA609CDE4A5A05F7C5D726DA2F105E34CBA2F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2092-203-0x000001E594000000-0x000001E594100000-memory.dmp

Download

memory/2092-202-0x000001E5819E0000-0x000001E581A00000-memory.dmp

Download

memory/2092-233-0x000001E594330000-0x000001E594350000-memory.dmp

Download

memory/2092-187-0x000001E5801E0000-0x000001E5802E0000-memory.dmp

Download

memory/2092-213-0x000001E581E00000-0x000001E581E20000-memory.dmp

Download

memory/3600-428-0x000000000B060000-0x000000000B1EE000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads