6c919154b79fc4e4c9c3834ded834a09ff82b74439dc3382bb0d3569e0225352

Analysis

user interaction
yes
max time kernel
64s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 10:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
een.bat
Size 2KB
Sample260910-ms5kcsge93
SHA256 6c919154b79fc4e4c9c3834ded834a09ff82b74439dc3382bb0d3569e0225352
MD5 8f90c06144fec7b544743151aeacf436
SHA1 ff224ba27b4dabee58d2ee52a9d7182f5d6c5e22
SHA512 17d02f6ce424c0ce89143c25f45f7bc3a649a3e2f32d0c6368c3516a85d6233a12e7c3a3c72b363f5d904b5b78d4feea43ba6d9b9a564bb4805acb140d946e7b
TLSH
T1AD51BC1A36D27012A19C5092193D2EC2B34CE14B6948BDA1606FBCF02DC7CEBF5AD7E5
MD5 SHA1 SHA512 TLSH

Score

8^/10

defense_evasion discovery execution persistence privilege_escalation ransomware

Malware Config

Signatures

Downloads MZ/PE file 2 IoCs

flow	pid	Process
315	5492	msedge.exe
367	2244	msedge.exe

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\een.bat	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\een.bat	cmd.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
313	download.itopupdate.com
314	download.itopupdate.com
315	download.itopupdate.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
908	cmd.exe
1948	cmd.exe

System Time Discovery 1 TTPs 9 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3156	msedge.exe
5844	msedge.exe
5492	msedge.exe
5364	msedge.exe
252	msedge.exe
3244	msedge.exe
3700	msedge.exe
2244	msedge.exe
5492	msedge.exe

Delays execution with timeout.exe 9 IoCs

defense_evasion

pid	Process
1072	timeout.exe
1080	timeout.exe
1848	timeout.exe
2252	timeout.exe
3296	timeout.exe
5092	timeout.exe
5420	timeout.exe
4432	timeout.exe
2092	timeout.exe

Enumerates system info in registry 2 TTPs 24 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134335107057645636"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 13 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{A2434CB8-6AA6-433A-BE59-688A7BF76AF8}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{FA8BE6CC-5863-4997-807F-F84926A6FCEA}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{656E14D3-F977-4005-AA3C-9E6959075232}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{51F78FA6-7498-45E1-8845-63B93B7CE191}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{0AC2BA2B-DAC6-4749-89F3-A23CE9A653CA}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{31D69C4D-5C1B-4000-B09D-8C2CEB2F07FC}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{8F8026E2-D45E-4F3A-8857-CBE94BE7D002}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{2F2B570F-E44B-4546-B948-224C2F2FB2F6}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{A4855335-F0C5-490B-83D8-1F95DE8A8C6A}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4384	schtasks.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 22 IoCs

pid	Process
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
4956	msedge.exe
4956	msedge.exe
6056	msedge.exe
6056	msedge.exe
5092	msedge.exe
5092	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
3464	msedge.exe
3464	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5096	msedge.exe
5096	msedge.exe
2520	msedge.exe
2520	msedge.exe
4956	msedge.exe
4956	msedge.exe
6056	msedge.exe
6056	msedge.exe
5092	msedge.exe
5092	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
3464	msedge.exe
3464	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 908 wrote to memory of 4384	908	cmd.exe	89
PID 908 wrote to memory of 1072	908	cmd.exe	90
PID 908 wrote to memory of 5096	908	cmd.exe	93
PID 908 wrote to memory of 3296	908	cmd.exe	94
PID 5096 wrote to memory of 1180	5096	msedge.exe	95
PID 5096 wrote to memory of 3752	5096	msedge.exe	97
PID 5096 wrote to memory of 3156	5096	msedge.exe	98
PID 5096 wrote to memory of 3752	5096	msedge.exe	97
PID 5096 wrote to memory of 3752	5096	msedge.exe	97
PID 5096 wrote to memory of 6056	5096	msedge.exe	99
PID 5096 wrote to memory of 6056	5096	msedge.exe	99
PID 5096 wrote to memory of 252	5096	msedge.exe	110
PID 5096 wrote to memory of 252	5096	msedge.exe	110
PID 5096 wrote to memory of 252	5096	msedge.exe	110
PID 5096 wrote to memory of 616	5096	msedge.exe	101
PID 5096 wrote to memory of 616	5096	msedge.exe	101
PID 5096 wrote to memory of 616	5096	msedge.exe	101
PID 5096 wrote to memory of 5680	5096	msedge.exe	102
PID 5096 wrote to memory of 2036	5096	msedge.exe	103
PID 5096 wrote to memory of 5680	5096	msedge.exe	102
PID 5096 wrote to memory of 5680	5096	msedge.exe	102
PID 5096 wrote to memory of 2036	5096	msedge.exe	103
PID 5096 wrote to memory of 2036	5096	msedge.exe	103
PID 5096 wrote to memory of 4844	5096	msedge.exe	104
PID 5096 wrote to memory of 4844	5096	msedge.exe	104
PID 5096 wrote to memory of 2520	5096	msedge.exe	107
PID 2520 wrote to memory of 3984	2520	msedge.exe	109
PID 2520 wrote to memory of 252	2520	msedge.exe	110
PID 2520 wrote to memory of 5204	2520	msedge.exe	111
PID 2520 wrote to memory of 6052	2520	msedge.exe	112
PID 2520 wrote to memory of 5204	2520	msedge.exe	111
PID 2520 wrote to memory of 5204	2520	msedge.exe	111
PID 2520 wrote to memory of 6052	2520	msedge.exe	112
PID 2520 wrote to memory of 5052	2520	msedge.exe	115
PID 2520 wrote to memory of 5780	2520	msedge.exe	116
PID 2520 wrote to memory of 5780	2520	msedge.exe	116
PID 2520 wrote to memory of 3928	2520	msedge.exe	117
PID 2520 wrote to memory of 3928	2520	msedge.exe	117
PID 2520 wrote to memory of 4436	2520	msedge.exe	118
PID 2520 wrote to memory of 4436	2520	msedge.exe	118
PID 908 wrote to memory of 4816	908	cmd.exe	119
PID 908 wrote to memory of 5092	908	cmd.exe	120
PID 2520 wrote to memory of 2760	2520	msedge.exe	121
PID 2520 wrote to memory of 2760	2520	msedge.exe	121
PID 2520 wrote to memory of 2760	2520	msedge.exe	121
PID 2520 wrote to memory of 1144	2520	msedge.exe	122
PID 2520 wrote to memory of 1144	2520	msedge.exe	122
PID 2520 wrote to memory of 1144	2520	msedge.exe	122
PID 2520 wrote to memory of 3144	2520	msedge.exe	123
PID 2520 wrote to memory of 5000	2520	msedge.exe	124
PID 2520 wrote to memory of 3144	2520	msedge.exe	123
PID 2520 wrote to memory of 5000	2520	msedge.exe	124
PID 2520 wrote to memory of 1852	2520	msedge.exe	125
PID 2520 wrote to memory of 1852	2520	msedge.exe	125
PID 2520 wrote to memory of 1852	2520	msedge.exe	125
PID 2520 wrote to memory of 4956	2520	msedge.exe	126
PID 4956 wrote to memory of 3996	4956	msedge.exe	127
PID 4956 wrote to memory of 5784	4956	msedge.exe	129
PID 4956 wrote to memory of 3244	4956	msedge.exe	130
PID 4956 wrote to memory of 5784	4956	msedge.exe	129
PID 4956 wrote to memory of 5784	4956	msedge.exe	129
PID 4956 wrote to memory of 2108	4956	msedge.exe	159
PID 4956 wrote to memory of 2108	4956	msedge.exe	159
PID 4956 wrote to memory of 2616	4956	msedge.exe	134

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\een.bat"
1⤵
- Creates a file in the Startup directory
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:908
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn "MyBatchStartup" /tr "C:\Users\Admin\AppData\Local\Temp\een.bat" /sc onlogon /rl highest /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4384
- C:\Windows\system32\timeout.exe
  timeout /t 50
  2⤵
  - Delays execution with timeout.exe
  PID:1072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cointiply.mobi/5yN4wK
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f8,0x2fc,0x300,0x2f4,0x258,0x7ffb19bbc188,0x7ffb19bbc194,0x7ffb19bbc1a0
    3⤵
    PID:1180
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1972,i,3430516208510504341,10331155391880973992,262144 --field-trial-handle=2496,i,17047282653031961841,16356151553547881800,262144 --variations-seed-version --mojo-platform-channel-handle=2492 /prefetch:2
    3⤵
    PID:3752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2128,i,13136741235375860403,11056833202372722536,524288 --field-trial-handle=2496,i,17047282653031961841,16356151553547881800,262144 --variations-seed-version --mojo-platform-channel-handle=2524 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2556,i,1172530561457597033,10989077334136021897,524288 --field-trial-handle=2496,i,17047282653031961841,16356151553547881800,262144 --variations-seed-version --mojo-platform-channel-handle=3276 /prefetch:13
    3⤵
    PID:6056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3580,i,8891593842673829113,4876156040571500302,2097152 --field-trial-handle=2496,i,17047282653031961841,16356151553547881800,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
    3⤵
    PID:252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3584,i,4381287902033606098,9022658844775189519,2097152 --field-trial-handle=2496,i,17047282653031961841,16356151553547881800,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:1
    3⤵
    PID:616
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,16384620580892894254,5124236612193206210,2097152 --field-trial-handle=2496,i,17047282653031961841,16356151553547881800,262144 --variations-seed-version --mojo-platform-channel-handle=4788 /prefetch:1
    3⤵
    PID:5680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4240,i,12070922744442487369,17749154433428292730,2097152 --field-trial-handle=2496,i,17047282653031961841,16356151553547881800,262144 --variations-seed-version --mojo-platform-channel-handle=4792 /prefetch:9
    3⤵
    PID:2036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5060,i,6319937164590727358,2960130768976983827,524288 --field-trial-handle=2496,i,17047282653031961841,16356151553547881800,262144 --variations-seed-version --mojo-platform-channel-handle=3708 /prefetch:14
    3⤵
    PID:4844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
    3⤵
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x328,0x7ffb19bbc188,0x7ffb19bbc194,0x7ffb19bbc1a0
      4⤵
      PID:3984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2036,i,4922723463494587551,17029834435470333202,524288 --field-trial-handle=2488,i,17088500146682548645,13129283613768622747,262144 --variations-seed-version --mojo-platform-channel-handle=2516 /prefetch:11
      4⤵
      System Time Discovery
      PID:252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1832,i,1989993168773053745,10778134954208636918,262144 --field-trial-handle=2488,i,17088500146682548645,13129283613768622747,262144 --variations-seed-version --mojo-platform-channel-handle=2480 /prefetch:2
      4⤵
      PID:5204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2432,i,17425778326442442229,18099460655154889599,524288 --field-trial-handle=2488,i,17088500146682548645,13129283613768622747,262144 --variations-seed-version --mojo-platform-channel-handle=2776 /prefetch:13
      4⤵
      PID:6052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4300,i,13386304790216475472,6438458190921702066,524288 --field-trial-handle=2488,i,17088500146682548645,13129283613768622747,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:14
      4⤵
      PID:4160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4300,i,13386304790216475472,6438458190921702066,524288 --field-trial-handle=2488,i,17088500146682548645,13129283613768622747,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:14
      4⤵
      PID:5052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4808,i,5469390614849010673,2645188505097049695,524288 --field-trial-handle=2488,i,17088500146682548645,13129283613768622747,262144 --variations-seed-version --mojo-platform-channel-handle=4796 /prefetch:14
      4⤵
      PID:5780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4796,i,7550902120730534771,11156162855091581609,524288 --field-trial-handle=2488,i,17088500146682548645,13129283613768622747,262144 --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:14
      4⤵
      PID:3928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4888,i,14839206446394694356,14531610525367229287,524288 --field-trial-handle=2488,i,17088500146682548645,13129283613768622747,262144 --variations-seed-version --mojo-platform-channel-handle=4900 /prefetch:14
      4⤵
      PID:4436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=4928,i,10699403560452945036,6392469435147205215,2097152 --field-trial-handle=2488,i,17088500146682548645,13129283613768622747,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:1
      4⤵
      PID:2760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5124,i,17393049938546305675,5402990016815464903,2097152 --field-trial-handle=2488,i,17088500146682548645,13129283613768622747,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:1
      4⤵
      PID:1144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5656,i,16771497710834561542,6266633720612961701,524288 --field-trial-handle=2488,i,17088500146682548645,13129283613768622747,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:14
      4⤵
      PID:3144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5660,i,14777261636789870622,16704981499338880428,524288 --field-trial-handle=2488,i,17088500146682548645,13129283613768622747,262144 --variations-seed-version --mojo-platform-channel-handle=5740 /prefetch:14
      4⤵
      PID:5000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6168,i,3122371010038320046,3717942297291513590,2097152 --field-trial-handle=2488,i,17088500146682548645,13129283613768622747,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:1
      4⤵
      PID:1852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
      4⤵
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:4956
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x270,0x7ffb19bbc188,0x7ffb19bbc194,0x7ffb19bbc1a0
        5⤵
        
        PID:3996
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1936,i,976460032559228366,2619328788417603943,262144 --field-trial-handle=2496,i,16960125680037349517,5358047118302729026,262144 --variations-seed-version --mojo-platform-channel-handle=2472 /prefetch:2
        5⤵
        
        PID:5784
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2128,i,81979053368480951,16064243022740202616,524288 --field-trial-handle=2496,i,16960125680037349517,5358047118302729026,262144 --variations-seed-version --mojo-platform-channel-handle=2528 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:3244
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2624,i,9886241107709946579,3638671477392377113,524288 --field-trial-handle=2496,i,16960125680037349517,5358047118302729026,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:13
        5⤵
        
        PID:2108
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4428,i,10338603293518764902,1243606814302542953,524288 --field-trial-handle=2496,i,16960125680037349517,5358047118302729026,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:14
        5⤵
        
        PID:5356
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4428,i,10338603293518764902,1243606814302542953,524288 --field-trial-handle=2496,i,16960125680037349517,5358047118302729026,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:14
        5⤵
        
        PID:2616
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=4836,i,11680447946277540594,15015700711803425434,2097152 --field-trial-handle=2496,i,16960125680037349517,5358047118302729026,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:1
        5⤵
        
        PID:1204
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4832,i,3361932034363493831,14591337971527191388,2097152 --field-trial-handle=2496,i,16960125680037349517,5358047118302729026,262144 --variations-seed-version --mojo-platform-channel-handle=5016 /prefetch:1
        5⤵
        
        PID:820
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5360,i,17566852963250588540,11705484350789620661,524288 --field-trial-handle=2496,i,16960125680037349517,5358047118302729026,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:14
        5⤵
        
        PID:968
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5080,i,5339225600533107490,645511177122985416,524288 --field-trial-handle=2496,i,16960125680037349517,5358047118302729026,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:14
        5⤵
        
        PID:3380
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
        5⤵
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        
        PID:6056
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x240,0x328,0x7ffb19bbc188,0x7ffb19bbc194,0x7ffb19bbc1a0
        6⤵
        
        PID:3488
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1592,i,4400109430712753521,15926979183205935385,262144 --field-trial-handle=2260,i,356706217882999381,13225588960440286830,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:2
        6⤵
        
        PID:3164
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1800,i,11269065898797868829,5826004105671811981,524288 --field-trial-handle=2260,i,356706217882999381,13225588960440286830,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:11
        6⤵
        System Time Discovery
        
        PID:5844
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2528,i,15219014210458756330,12010987089575352077,524288 --field-trial-handle=2260,i,356706217882999381,13225588960440286830,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:13
        6⤵
        
        PID:2252
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4384,i,7991764580573844892,2352420755504579646,524288 --field-trial-handle=2260,i,356706217882999381,13225588960440286830,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:14
        6⤵
        
        PID:5792
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4384,i,7991764580573844892,2352420755504579646,524288 --field-trial-handle=2260,i,356706217882999381,13225588960440286830,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:14
        6⤵
        
        PID:4608
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5084,i,16019652203399584782,13146470241255912590,2097152 --field-trial-handle=2260,i,356706217882999381,13225588960440286830,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:1
        6⤵
        
        PID:2120
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=5092,i,2006503116901351437,6329510882081114224,2097152 --field-trial-handle=2260,i,356706217882999381,13225588960440286830,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:1
        6⤵
        
        PID:5528
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5652,i,1876609814776187938,3512637632789864804,524288 --field-trial-handle=2260,i,356706217882999381,13225588960440286830,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:14
        6⤵
        
        PID:384
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5656,i,13827225214099473377,4461058206488575094,524288 --field-trial-handle=2260,i,356706217882999381,13225588960440286830,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:14
        6⤵
        
        PID:3260
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6328,i,5804628628150870918,8955772802426571530,524288 --field-trial-handle=2260,i,356706217882999381,13225588960440286830,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:12
        6⤵
        
        PID:3752
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5372,i,4060580294788513696,16372260223852512476,524288 --field-trial-handle=2260,i,356706217882999381,13225588960440286830,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:14
        6⤵
        Modifies registry class
        
        PID:3820
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
        6⤵
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        
        PID:5092
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffb19bbc188,0x7ffb19bbc194,0x7ffb19bbc1a0
        7⤵
        
        PID:1380
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2144,i,7254548539176878128,10485443219854081014,524288 --field-trial-handle=2732,i,1609248948404766197,7860550203472364204,262144 --variations-seed-version --mojo-platform-channel-handle=2872 /prefetch:11
        7⤵
        System Time Discovery
        
        PID:3700
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1956,i,3798746917920808257,17821429981402825777,262144 --field-trial-handle=2732,i,1609248948404766197,7860550203472364204,262144 --variations-seed-version --mojo-platform-channel-handle=2728 /prefetch:2
        7⤵
        
        PID:4908
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2488,i,5413799675255094899,6187624451006343707,524288 --field-trial-handle=2732,i,1609248948404766197,7860550203472364204,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:13
        7⤵
        
        PID:4164
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4428,i,17558336076111240587,11629138602717967608,524288 --field-trial-handle=2732,i,1609248948404766197,7860550203472364204,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:14
        7⤵
        
        PID:5132
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4428,i,17558336076111240587,11629138602717967608,524288 --field-trial-handle=2732,i,1609248948404766197,7860550203472364204,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:14
        7⤵
        
        PID:3360
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4816,i,3233299297235800418,17231555629033051038,2097152 --field-trial-handle=2732,i,1609248948404766197,7860550203472364204,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:1
        7⤵
        
        PID:4092
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=4820,i,14989534188650944449,927087238539199334,2097152 --field-trial-handle=2732,i,1609248948404766197,7860550203472364204,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:1
        7⤵
        
        PID:5188
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5336,i,17240364855363145700,3451269256883576422,524288 --field-trial-handle=2732,i,1609248948404766197,7860550203472364204,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:14
        7⤵
        
        PID:5524
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5344,i,3247521821094132564,13260476047490397422,524288 --field-trial-handle=2732,i,1609248948404766197,7860550203472364204,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:14
        7⤵
        
        PID:1416
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,14933190890061534373,5665060382373428420,524288 --field-trial-handle=2732,i,1609248948404766197,7860550203472364204,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:14
        7⤵
        Modifies registry class
        
        PID:4684
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6028,i,898225373602016111,8674530218624717145,524288 --field-trial-handle=2732,i,1609248948404766197,7860550203472364204,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:12
        7⤵
        
        PID:4256
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
        7⤵
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        
        PID:4968
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2d4,0x7ffb19bbc188,0x7ffb19bbc194,0x7ffb19bbc1a0
        8⤵
        
        PID:1956
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1584,i,4032602244950209359,2645657241537333678,262144 --field-trial-handle=2364,i,1927851016091062832,17398397291475393551,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:2
        8⤵
        
        PID:4528
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1796,i,14849571392476304192,3423718874924095491,524288 --field-trial-handle=2364,i,1927851016091062832,17398397291475393551,262144 --variations-seed-version --mojo-platform-channel-handle=2388 /prefetch:11
        8⤵
        Downloads MZ/PE file
        System Time Discovery
        
        PID:5492
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2484,i,7280147825143912010,3315953045738298038,524288 --field-trial-handle=2364,i,1927851016091062832,17398397291475393551,262144 --variations-seed-version --mojo-platform-channel-handle=3152 /prefetch:13
        8⤵
        
        PID:4648
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4380,i,12629317373652419998,5703177271889184217,524288 --field-trial-handle=2364,i,1927851016091062832,17398397291475393551,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:14
        8⤵
        
        PID:1344
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4380,i,12629317373652419998,5703177271889184217,524288 --field-trial-handle=2364,i,1927851016091062832,17398397291475393551,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:14
        8⤵
        
        PID:1740
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4852,i,4431645174047936519,18233008472104425900,2097152 --field-trial-handle=2364,i,1927851016091062832,17398397291475393551,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:1
        8⤵
        
        PID:3936
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=4856,i,14260613089708070494,722893541831926675,2097152 --field-trial-handle=2364,i,1927851016091062832,17398397291475393551,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:1
        8⤵
        
        PID:2740
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5384,i,17274517497815663877,8604819422874801002,524288 --field-trial-handle=2364,i,1927851016091062832,17398397291475393551,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:14
        8⤵
        
        PID:5872
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5380,i,14515809526842481734,3698623257285530316,524288 --field-trial-handle=2364,i,1927851016091062832,17398397291475393551,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:14
        8⤵
        
        PID:2428
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=6140,i,4983052269419565974,5312379795192497503,2097152 --field-trial-handle=2364,i,1927851016091062832,17398397291475393551,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:1
        8⤵
        
        PID:3812
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6152,i,17976183524201126246,8863419365433975947,524288 --field-trial-handle=2364,i,1927851016091062832,17398397291475393551,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:14
        8⤵
        
        PID:2600
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,7676780042351625143,6640025794761103303,524288 --field-trial-handle=2364,i,1927851016091062832,17398397291475393551,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:14
        8⤵
        
        PID:2180
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
        8⤵
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        
        PID:2512
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x270,0x7ffb19bbc188,0x7ffb19bbc194,0x7ffb19bbc1a0
        9⤵
        
        PID:2752
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1916,i,16563445036768752684,14027520759347113154,262144 --field-trial-handle=2488,i,11013457418643020004,17367093879014321961,262144 --variations-seed-version --mojo-platform-channel-handle=2484 /prefetch:2
        9⤵
        
        PID:2604
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2120,i,17030135492290876961,16688978327251504494,524288 --field-trial-handle=2488,i,11013457418643020004,17367093879014321961,262144 --variations-seed-version --mojo-platform-channel-handle=2516 /prefetch:11
        9⤵
        Downloads MZ/PE file
        System Time Discovery
        
        PID:2244
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2624,i,5521136805758500425,14828371088166400636,524288 --field-trial-handle=2488,i,11013457418643020004,17367093879014321961,262144 --variations-seed-version --mojo-platform-channel-handle=3084 /prefetch:13
        9⤵
        
        PID:3224
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4332,i,7007762825878635286,16117862077417380545,524288 --field-trial-handle=2488,i,11013457418643020004,17367093879014321961,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:14
        9⤵
        
        PID:4416
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4332,i,7007762825878635286,16117862077417380545,524288 --field-trial-handle=2488,i,11013457418643020004,17367093879014321961,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:14
        9⤵
        
        PID:1584
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5008,i,408285755471662752,18286110957126916110,2097152 --field-trial-handle=2488,i,11013457418643020004,17367093879014321961,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:1
        9⤵
        
        PID:4376
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=5012,i,8008657202627110493,6368462366655466100,2097152 --field-trial-handle=2488,i,11013457418643020004,17367093879014321961,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:1
        9⤵
        
        PID:5152
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5540,i,17652782956045192711,15751197709653953150,524288 --field-trial-handle=2488,i,11013457418643020004,17367093879014321961,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:14
        9⤵
        
        PID:5148
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5316,i,609746287894514214,11668177411760266380,524288 --field-trial-handle=2488,i,11013457418643020004,17367093879014321961,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:14
        9⤵
        
        PID:5024
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=6020,i,13890596201723185474,4576280734954335658,2097152 --field-trial-handle=2488,i,11013457418643020004,17367093879014321961,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:1
        9⤵
        
        PID:2200
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6236,i,17731652625635008657,4008579752322253522,524288 --field-trial-handle=2488,i,11013457418643020004,17367093879014321961,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:14
        9⤵
        
        PID:4640
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6452,i,4385395405198528288,5544167386575333559,524288 --field-trial-handle=2488,i,11013457418643020004,17367093879014321961,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:14
        9⤵
        
        PID:5464
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6444,i,14798290349424621727,16452283535239901264,2097152 --field-trial-handle=2488,i,11013457418643020004,17367093879014321961,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:1
        9⤵
        
        PID:1192
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6600,i,5252586982700810322,1962464548251064086,524288 --field-trial-handle=2488,i,11013457418643020004,17367093879014321961,262144 --variations-seed-version --mojo-platform-channel-handle=6708 /prefetch:14
        9⤵
        
        PID:4448
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6624,i,9973193039002759886,7303920875656970288,524288 --field-trial-handle=2488,i,11013457418643020004,17367093879014321961,262144 --variations-seed-version --mojo-platform-channel-handle=6728 /prefetch:14
        9⤵
        
        PID:3088
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
        9⤵
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        
        PID:3464
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffb19bbc188,0x7ffb19bbc194,0x7ffb19bbc1a0
        10⤵
        
        PID:3088
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2080,i,9434444678265134617,9106626936688434700,524288 --field-trial-handle=2496,i,1862496050073825035,14783400625304817437,262144 --variations-seed-version --mojo-platform-channel-handle=2520 /prefetch:11
        10⤵
        System Time Discovery
        
        PID:5492
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1964,i,14281786946633298158,12400056734338460005,262144 --field-trial-handle=2496,i,1862496050073825035,14783400625304817437,262144 --variations-seed-version --mojo-platform-channel-handle=2492 /prefetch:2
        10⤵
        
        PID:1316
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2644,i,15832006431511311886,5126749308233681778,524288 --field-trial-handle=2496,i,1862496050073825035,14783400625304817437,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:13
        10⤵
        
        PID:1260
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4304,i,1660633180853786720,731253871690780742,524288 --field-trial-handle=2496,i,1862496050073825035,14783400625304817437,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:14
        10⤵
        
        PID:3876
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4304,i,1660633180853786720,731253871690780742,524288 --field-trial-handle=2496,i,1862496050073825035,14783400625304817437,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:14
        10⤵
        
        PID:4760
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=5048,i,17146038394853029629,18031578865983527115,2097152 --field-trial-handle=2496,i,1862496050073825035,14783400625304817437,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:1
        10⤵
        
        PID:5924
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5044,i,15146956283003686409,17671211179029595937,2097152 --field-trial-handle=2496,i,1862496050073825035,14783400625304817437,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:1
        10⤵
        
        PID:3176
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5596,i,8605162680276029519,10472112527227140574,524288 --field-trial-handle=2496,i,1862496050073825035,14783400625304817437,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:14
        10⤵
        
        PID:4872
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5600,i,6112731448731552662,9429579300888915278,524288 --field-trial-handle=2496,i,1862496050073825035,14783400625304817437,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:14
        10⤵
        
        PID:5224
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6164,i,1900962588891663183,13709552989862865954,524288 --field-trial-handle=2496,i,1862496050073825035,14783400625304817437,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:12
        10⤵
        
        PID:1596
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
        10⤵
        
        PID:5844
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x328,0x7ffb19bbc188,0x7ffb19bbc194,0x7ffb19bbc1a0
        11⤵
        
        PID:2244
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,11874757847515310087,7473614954134127391,262144 --field-trial-handle=2304,i,783953233657115710,10274977638326469268,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:2
        11⤵
        
        PID:4888
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1836,i,7195830346078776889,18234806220384482025,524288 --field-trial-handle=2304,i,783953233657115710,10274977638326469268,262144 --variations-seed-version --mojo-platform-channel-handle=2404 /prefetch:11
        11⤵
        System Time Discovery
        
        PID:5364
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2380,i,4726075722983044697,12646846049085909010,524288 --field-trial-handle=2304,i,783953233657115710,10274977638326469268,262144 --variations-seed-version --mojo-platform-channel-handle=2888 /prefetch:13
        11⤵
        
        PID:5040
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4460,i,5264425191744304025,16471583907389556149,524288 --field-trial-handle=2304,i,783953233657115710,10274977638326469268,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:14
        11⤵
        
        PID:5644
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4460,i,5264425191744304025,16471583907389556149,524288 --field-trial-handle=2304,i,783953233657115710,10274977638326469268,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:14
        11⤵
        
        PID:1136
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4916,i,2524393995751186426,4139614707206497878,524288 --field-trial-handle=2304,i,783953233657115710,10274977638326469268,262144 --variations-seed-version --mojo-platform-channel-handle=4556 /prefetch:14
        11⤵
        
        PID:928
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4924,i,3494406965649945959,428086984451777148,524288 --field-trial-handle=2304,i,783953233657115710,10274977638326469268,262144 --variations-seed-version --mojo-platform-channel-handle=4936 /prefetch:14
        11⤵
        
        PID:5164
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4928,i,16720883432601578893,8433162484829520973,524288 --field-trial-handle=2304,i,783953233657115710,10274977638326469268,262144 --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:14
        11⤵
        
        PID:3468
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4908,i,14798572361725520844,8497298892529203539,524288 --field-trial-handle=2304,i,783953233657115710,10274977638326469268,262144 --variations-seed-version --mojo-platform-channel-handle=4960 /prefetch:14
        11⤵
        
        PID:4416
- C:\Windows\system32\timeout.exe
  timeout /t 600
  2⤵
  - Delays execution with timeout.exe
  PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://primeopinion.com.au/register?ref=a2659aab-b56f-488b-a6d2-a1637d426487
  2⤵
  PID:4816
- C:\Windows\system32\timeout.exe
  timeout /t 600
  2⤵
  - Delays execution with timeout.exe
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://diceblox.com/r/robuxfr
  2⤵
  PID:3332
- C:\Windows\system32\timeout.exe
  timeout /t 600
  2⤵
  - Delays execution with timeout.exe
  PID:1080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://rorush.com/?ref=Rorushrobux
  2⤵
  PID:3088
- C:\Windows\system32\timeout.exe
  timeout /t 600
  2⤵
  - Delays execution with timeout.exe
  PID:5420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://skinrave.gg/en?r=skinbucks
  2⤵
  PID:5780
- C:\Windows\system32\timeout.exe
  timeout /t 600
  2⤵
  - Delays execution with timeout.exe
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://goto.itopvpn.com/downloadcenter?product=isrpc
  2⤵
  PID:5972
- C:\Windows\system32\timeout.exe
  timeout /t 600
  2⤵
  - Delays execution with timeout.exe
  PID:1848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.opera.com/computer/thanks?ni=eapgx
  2⤵
  PID:3896
- C:\Windows\system32\timeout.exe
  timeout /t 600
  2⤵
  - Delays execution with timeout.exe
  PID:2092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://skinrave.gg/en?r=skinbucks
  2⤵
  PID:5056
- C:\Windows\system32\timeout.exe
  timeout /t 600
  2⤵
  - Delays execution with timeout.exe
  PID:2252
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K Bat.bat
  2⤵
  - Executes a command shell one-liner
  PID:1948

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3184

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2140

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3088

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4800

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1992

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2108

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3876

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4380

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1176

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2976

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 53f5b28114b85b3360b91f38eb906e7d9342668ce949b7a87a7792dbcd67f3cc
MD5 4df07526c6a86e88bbd28ee7026f2878
SHA1 7792ae899a4f814848d752b0ddfd9c53aaf45854
SHA512 7ecce9bc4cb692df398976447d734ef76838e61c735caee50beaae962f8445d75777e82dea23ac135780e787011d7c9682adeb1c15e2f1459ffa477af3d8d50a
TLSH
T13FD0C0A4CCA8BBE4E03A103D03760100318D8F01DB03F005808023128C9508224FCDDD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ebfcdba7774c3a859da234da55cd44e5a8b1b607f4fb6787453ddd00b8f0b1f3
MD5 9ebc7093ece96094092d8a5a2ef8b4f8
SHA1 2401e52ea3caf002c137ce3c1eff372b7cb234b6
SHA512 da96cbb7e2ca85ee3403707b8c468e1476f6ca38220f08399ee0bc6434a8dcbc1fabde004afc5907f6e9bba11ffba0f2bbc6a33751143608584f3f1f3e316914
TLSH
T132D0C0A0CCA4ABE4E026103D03B60100318D8B02DB03F009808023129C940A224FCDDD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 acda00d544842c1e90f41de2b929d8195a9e40af69807a91f5cecdb482381ecd
MD5 b970cf127c58c728fbb888ca8dda36d5
SHA1 e304d43930a6191cc772ae84c08026c8087bad94
SHA512 a369fede2a80ff18cfdb5fe808d30570499891843a8ab7ff857cd72fe25977946e17e6b0339338c1dc4a7527dd2a51c2396249d07bbbaf4ebe3665cdb4265e6b
TLSH
T1E3D0C0A0CCA4ABE4E426103D03760100318D8B45DF03F005808023128CD408224FCDDD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 deb7f2f9fd6b1d67b9f47075f677407895092a5430444313faa9e68b8485c553
MD5 ef49f91164fd4d10cb862b18795464b7
SHA1 248705621f348eaac1a21903e57db9ff2f71fa9a
SHA512 9953e150c23ee6c63e3cb332059b651b0d1248f3ee30e0240f7107acc9da09f0d1f875d7d2ffe15d61c37ad3ae6f116aaf7bca0695355fe6df74e337d4be224e
TLSH
T122D0C0A0CCA4ABE4E026107D037A0100318D8B01DB03F005848073128C9408274FCDDD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e413e02b9e80ee8d76d52c1043fc32251e2d7634d4b2fbd970df9ace9d91831a
MD5 22959b3a06a842ac30237dd57e8a3801
SHA1 0b7c28071a592034aa2607038000f085c7bb6362
SHA512 644add9ab912ad7fdfc55bc7a1b84482c75cc9bc69a59d169bae63a0400619d999846ebbadb0ef2bd6d35c2bd08a5f07053b600874dd5dfcbda7e8f3076131fe
TLSH
T1A5D02BE476408A0CC980203335F6524092018910D801D1480040B325CC845C1257F0DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 619a7c6ff6b11ec948831bb191203c24c318acb3ada6580a9db45a69015ba08f
MD5 e832046f7249c3595e31ea1b3fa7ed8c
SHA1 4fbc39f796932462081657bba61a4dacbc2b7cde
SHA512 816d2918534d0b91580cc24eeb71aeafbbceb74e00feb98053f61c75b96f6045a56621f87cd9cacccf9e10e633f9916b8e719abe920d5ccf8f8dcaf6b3f5a04e
TLSH
T100D0C0A0CCA4ABE8E036103D03760100318D8B01DB03F005808023128C9408225FCDDD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8aaa68aad07ba45abe53bd513aa5f7e7b21bd1b29db6e1d5c1e0a79a5f4eb890
MD5 74012bbce5fada7634c1da1b567562b3
SHA1 09db27f38f27e35986cfd407b57f6f83c8fc59f8
SHA512 c1a6a98f972793c84274c29552107bfe07b775c7c8121e5fdf137ebf9a7cc3f4eb43fe9eadfc842e7b92ca7281bbcea3d660bdd8fc9adc56add068510c41e48d
TLSH
T1FBD02BE07640890CC980203335F75240920189108401D1480040F335CC845C1257E0CF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3c7dcc6172e121dcfb010a75dbecd29977e4ce81295a4bf9f5bdc1d47a8a4d5a
MD5 79cbab071ceed0006ea70662c68f0a76
SHA1 d8c8a444df926ee92c7658d2508cdad89f35d35d
SHA512 33cbc88c0fae6888a753316031abca5bb49fdfcb3c5eb08dac6b3df6a733dfc8d6666f37fce2e7151fc1f2d2a3b4639c7adeada50e5f13e7a3253e3d6dc9a77e
TLSH
T10AD0C0A069109FCCC544203222F1010092004A12DA00D2480000B225CCB40C229BFDDF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d2baf012a8ef1167d7d9a1be9fc8657e4ef7d8c388e2eaaffa517b3f1784b344
MD5 772ea6acf43ad50dda7cf67a2004dc51
SHA1 09ba8bafa75852dc8c983af4f19b582b4e4d3ebd
SHA512 b08cfd374acca5e6a8ad21bf25cfda8315f1125064cc5945eee94b190405510603fda5bd747a72bff2ed6ab5bc3eb66c629e5f9e36a7e647b232e2e0ed7ec35c
TLSH
T18AD0C0A0CCA4ABF4E026103E03760100328D9B01DB03F105908023128C9408234FCEDD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2b2fc6940876dc05f34a481d032f7a2f588ddff53716eedef9afcc7c321f1400
MD5 35bb1c89fde60ec3c9eaefac823a9c5f
SHA1 b9036f771558e12d8a5aa87ad7fdf69e554ae3a1
SHA512 17d0286d38b9221e11c271d4cd42da3961878b764ef2a88a83cd23ed3113470dadf775605892c4d9be276db2390eee2479037235b595abe1c48f2da81588e24c
TLSH
T166D0C0A0CCA4ABE4E026103D03B60100328D8B01DB03F00580C023228CD508228FCDDD
MD5 SHA1 SHA512 TLSH

Submit Download

3cfdc7d6-95f9-45f1-9ff5-2168b072065f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3cfdc7d6-95f9-45f1-9ff5-2168b072065f.tmp
Size 11KB
SHA256 5f155ebaf3f373a7412206708c1af1de04a25fd35489ff039fcb8f337f1a19d8
MD5 51d64b872fe78fec0733414abc8040f3
SHA1 e5dcdb7629f888a2a59aeabd8310976d0cc4b174
SHA512 aa238b0eb6ec5b133d98e08da8e76cdf3869188338c161dc71318617116f0e1f8720d54f8ff0c9422a81414463b39c84b58dfc4b833e5988433d80e1acd8f2d0
SSDEEP 192:sxRgRiCp/fSsDWpVQbprQ5uzoA8pi/g6+WNIYnYRhvgrIgVRJ:sxRgfp/fSsDWvQbqi/5IFLeJ
TLSH
T15842B816AD28A83B9CC7D21DFB657F63D6F9503261D06E58A6FC8A1C04EB6DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6d804c7f-d9e9-4b05-841f-f38c97c851a9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6d804c7f-d9e9-4b05-841f-f38c97c851a9.tmp
Size 18KB
SHA256 d351096b18a3e7117346432cfef947813e35cec078f7a33dbf05d1b2e673d27c
MD5 c7bf136be72cf8cbcc7d208558e1ab62
SHA1 f36883fd9db78ae635377ce4ba55c437e0e8adf7
SHA512 19f0db96de2f6a134cd897cbec9965ec4d8e6cb3fe4cf88eac548edf41a8580822b2df8a25587a00770bef43fb734bfca5c7b99118eef88be6d9b7648af9d098
SSDEEP 384:sxRHtp/fSsiWvQlbO2C/56YGYX/w6IgfVlqpdvSV:sDtp/fgYmW/5bjLfDqpdvA
TLSH
T1DC82B457E834597B4CDBD12AF655FB3BD2F9102298C09E44ABFD8D2C00E76EDA102847
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 790dfdf7b20129a24b88c047b1c0d29d842326c549dcd7771bfa95de1f65feb1
MD5 8d5d71d54c3004ae468af9c38ec53609
SHA1 d35ca2e228e1541618689dab5ed632ffe4f5696e
SHA512 ad22de01b026863d1140e9a3f5b771ce684ca87c4e5834e15fcfdcd99eeab73861c5de883e9fb3ee17a1c95d900c7bf61734a53bfa8204ea28b3c9206ad8b741
SSDEEP 384:Jd6zyelgQa0fTxU40mwMFLmrHgJzSHjrjuq806:JQhgj0LxQkpq80
TLSH
T17913EBBFBB806C6DC6D28A7C591BAB750331EA7ADCC5605B063771088A21F405ECE523
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 03acb8e93dded819d2b7eeb1eb5097df77e58f0c92221e134b4850ab9ea51c5f
MD5 7924376f1f41f16bcdcc5a1721014233
SHA1 afd6628c6125d2a6f503ab4e33f5eae4f01934a8
SHA512 e0ee5261e11007c5278e2d8e3823290dadccaf79c03363fcc95f86aaf7d94c093e8b9804b2b7dcef262b21d643feb5af8e94ca9aec3ea224622cbc02c160bd3c
SSDEEP 1536:t/sRL/TlL/r8XXpbyVEPEgNQJHoviY1SLpwaL/bVL/6L/:tERL/5L/IXGdBuSPL/bVL/6L/
TLSH
T1CB444EF70A51A01BCBA812F5E6033A3ED177851D7CD1F8E9D1784C852829F32B6BDA85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 eb95730343c72a39741f12c58069e675161ca7269f5399736f3fcf7f61b3f421
MD5 3790798f53a82225adde56fd718cb592
SHA1 b7845fe983d03215d7bd10227bdefd3a325f518b
SHA512 79f95a1d79ff468088f9e51aefee58bc4ab11e6125501fae11152a6ee3697b4c0936600cf6a63a20c63c1ad28b60f3252e56bb825b4f8fbc2a8be7e5367c4fb6
SSDEEP 1536:Ri49G+PNaMuANdbg1tWkjIiHMXhJDh8Dz+rWRepIHl13YFloShZbjgGOsfdGjdS6:Rv9G+HNF7JiHv6K42F70frdDkkr
TLSH
T1982528EECB282C82CE6B877074E0E9077E712183B64DD0D39944C5D997D6B8176E82BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 3f297bc3e3673e46d19fa83a421cb10da62edc5014d7fdace192d895c19db864
MD5 b5a45aed9561425a2f3538f8ea980014
SHA1 eac122f27610d3d370f332f04b765f4b9c7831d4
SHA512 d13cb2250f00a05f45254f1ee704025c7d1d20fa01b39f8d85770e9b9aafd09d5b9d4e117011a4286d7f5244139e9b8a86668bf492d813774f983d3ba67d9b19
SSDEEP 24576:dH9yij4MP0StZl84JIhZZ4dK2kCMXFJ34kC+VQtm4:ddynMP0huI/pCMXFt44I
TLSH
T11E166DEDCA6858C3CE639A30B4F0E9577C7413C3F594C1D6889CC584026BBC5BFAA669
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009c
Size 33KB
SHA256 faa24ec881e6040655c187a681d6dc496eb8aa41e1bd0652a180b3a40b457187
MD5 f953f499c9824953791551bfef65fe61
SHA1 00fbf8d23d0e9549798383179c9b0eae5d653f9f
SHA512 07bf316d186ac8d6eb8cf860fd0dbce854ae74ae26276be3950bd32b06894c7b24268280d504bb490218c5ec0e85b4eeb7e858011dcf4de64bbb06e4eb296fca
SSDEEP 768:Pr8FwJ2kfmG7rCq0GJtSBVRF0UGuEuOZejwpiUCTVwiYz:PVJ3fd7rCqduSduOZnIVVwvz
TLSH
T1D0F2F185B0036A346E502FB459DBE6CE1FADF8041A5318EDCE9DC30BA394C7648792BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 1eeaabb1a136cc023e821bd39f688fbbca4879c9f3b8fbb3c2c1ed09f4642166
MD5 f0b0e67389e832d0a7ae5d4081dcfaf5
SHA1 8d1599facbd04e6cfb36b942ec19a5cb58d84492
SHA512 82ee4c509ac54f34cb4df39d29159f8e2c14601c1b3b5db4fce7876ea561bba530937af1a504ad4deaa5f486cd69989b277e89fc502b5fc1aaf58be5257f0d55
SSDEEP 96:EDFMRBh/LjQUZ2o0SlTpuf6huafwnbgl8988Z4uheukAn:2F2zQUZ2/eTSApC88kO
TLSH
T137E163E62299B095FBB4067214A42E0731F446A94C037FD381ABFD79F827EC602F2617
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 ea6afa50ed30a024ebec210f43595c74ea705ebc393aff1ff3626e8291c39845
MD5 4cd847b0f262620a529018f6ea54ebea
SHA1 bd1bfc33e07fc0be0973a5fea809da9e0a47a5bb
SHA512 bab1eb530863029777136a4a306a95f2dc4a4fc1f0f63ce4a509826b8e693ab87622ea4e0c614d5664f8a7178ceb92efd9bf428cb9943f5834f0eb6d0f5fa93b
SSDEEP 96:Vdt1oMYR+5JC4ysIe0lrMWphjn76MJqNa65SqMMwhIAj6Uxl:XERt4ysIe4h+5A0Stj9
TLSH
T19BE175E52294B090FBB4067214A41E0631F446AE4C077FD391ABFC79F827ED606F2607
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 8KB
SHA256 16ce7ee73addbcd4beb235efcfa9ba6a3c1aa1f8140ee1698bd3231caca0b75d
MD5 b4403cfa15c66b58514232616c1c8e96
SHA1 3f1812536cc1d52b865f9b708c98616cc96a7a5e
SHA512 d900adc2402161e2df76119b0e6c9e8cc78308359d1695834fb22222188c85acdb8ecee3f89f8635f6d794635b94c1c662a0159182ce8efb77fb34a2edb79cde
SSDEEP 96:CXWcC8MdsMbx5QVCvRogHCpGNfZOwgNNnamY9ExdlW6RpNGTb/8Z/dIi1A9/o:CkR5OsoFpwO9nAEpRpNG3/idIo
TLSH
T1ED0275E632D8B985FB65063214E01A0772F696A949037FD39167FC79F827ED602F120B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 89c317a1b19bb81eb95f68dc6cc3624b8d0f0d8acd44461cb0dbc1b721be56f1
MD5 f97f56487e50e2b501331b5384d0d49f
SHA1 af95e80c7642b5f68c00bca314149afef88699c1
SHA512 ae827523a38b4bedf1364f398e376186f9ed1cb0cc73c963c0fb71f2cc6847f41af4b64a11d32e3dae5adf0f6ec1b33776026c8610163524df6df266af23c902
SSDEEP 48:1vBbdT+DCOkS8I+Mgtdp0SYcp504nXspCj5BnuGSTMu2LndbgpSvQsLUXS1vbvAX:XZTZMgtdp75lspKiT7gGiESRsS0
TLSH
T1C19172E622D92595FF790A7310952E4432E147E04D077B8380A3FE79F82BEDA51F521B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 f0381e35f7e0a8d2e170b0514bc9380dca46bb8e62bedf42f1d3bbd3c13f6fba
MD5 2ee187b5786b8a3201474b2ccb63c7ec
SHA1 a6f84a7f60695492d694b85e976a2c2b83150ea5
SHA512 f7cb34f62813d727886216381a3aa6d6816bff145b1c8dea8f366a2858bb03f78df91f18744b7320886d794414c634dfd7c34b1ddfdd6a68a37b4cccbb9ff5fc
SSDEEP 48:nQy8bS1pl5UgFCkL+r/5B9NKrfv2DAuEwqc3KYwTqCnlPAo6CPSMrnr8wwhFrb43:Qytgn5NOnsEwnuqPl5Mrr8wA98stbRzu
TLSH
T178B171E612993095FB750A7310A42E0732F14BA44D037F9282A2FE79F82BEC651F611B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 8c34b1b97e91f789e7f2d19d816a96ede93380a82aed55f0076eda5c57a43779
MD5 9cc93830466567f63a32797358c75b94
SHA1 3b1054b38a93d358e97e65334894b0ca2af2a5c1
SHA512 23620a09b2cbaf49f6c5aff529fcdd6cc0dfa3f58d4ce65d98809e5d88246be3f25263ab7b845e496e4d60b9b85c92a6227a2d76bc980b89da19324f4eaf9cb8
TLSH
T17661214B236E04E9D36A4A7250D9774436F086704D07BF8080F6DEBADC2AF5892F921F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5912c3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5912c3.TMP
Size 3KB
SHA256 1c13ccdccc1ffd0b24e2a8be1875755d98ec9fd850cd1ee958d16d3ad9eccb5a
MD5 ea758b85ee93543a949cf6deba942398
SHA1 0f6222968ad94f31060d3f24d799d4936f387790
SHA512 a9c5dd5c660c4770962a356cb4039fac31fe43328289d6fa823de174d3c6d33caefc88eb744a3ef36bced6bedf84db18c8999e418185265b6004129e09079953
TLSH
T19261410A235E04E9D3AA4A7250D9374432F186704C07BF8080F6DEBADC2AF5892F921F
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 343B
SHA256 fe8aa44f5b0462469095a3c429edb120c8498c01ae5cb0a10bf5a5cd6c573167
MD5 b9499c98fc755389f9b74355524c2fa7
SHA1 9424a59cf43128cac2784ac810543195fa0dfff8
SHA512 b0e0aad8ff41abf9b5641bc919709779b650f87555debef1e01ece1e1af4c1358978d7b47c52f31509a0585275a317f3a57ec4ca41288a16ae2835d43a1b42f0
TLSH
T17AE0C09159C6C11DD41078F305306F18C6D43D57C79C2E033744CCCC3706170B647152
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log
Size 266B
SHA256 c7db8e6b956909c549e1a01710917898d7f403724f1e25aa83e2bb7175684f8d
MD5 23545cd766bfa59b0da06fdcf3a429a5
SHA1 9220aa9d16de417210e4c45bc1fc44c0e15b352c
SHA512 436e7434c8d9529a853df7d470e53979e41257508829e50eba39090ab7ac511cbc11602ccaf710fedc43b3266d04b5f5e3aa9f9bb27e01bdb865443ce3548e82
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG
Size 319B
SHA256 5f718b9f1ea6d172dc99e9b229e2da514e5ab9798a05864cfb68bf6e9c63689a
MD5 25b7e60a889aea555afe294671823403
SHA1 862b20f9786221170f67b1e2dca16b75d574c7d0
SHA512 61f57071a46373714a9aa3544e4a7bbe6e44adbcf22596b87393578cfe6539e6c7bf0292dc2e4f61ae50acd00348b320306b2f32fd4096baf258ea7cebb92ab3
TLSH
T1F1E0204716C8C11E9058B987CAB49F1CC2A0390ED38C3B41BB0D88887001A48F24D1A0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG
Size 323B
SHA256 6d1b630ffd65348e328890f9a2f28981dcf1aa299c2beb2b245da2ae24c5806e
MD5 458a4b8c1944898fb98a1578c38112be
SHA1 2fff3550b92863835a465b5aa3b4d7009019fd88
SHA512 f6bed0172505eb6b5dcb97aad9c94b2d36d18cac6de380f25e27ca1b752c7d58798daff32529ab78bb705b1f7987940920b99c5975ddc1a99ad20750ed8689ad
TLSH
T105E026890AC8C12F90547DC78B74AF0C82F2390AA38C7B827B09CC986005B80E6AA290
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 285B
SHA256 fff9c841af450dfefe7f284f645d4a26b048e6bd5709ad766b308172bc260a53
MD5 785c71b68bf89a0e9973e06d76434ab1
SHA1 2eb96ed892a724f5f223fe37abbd075d448d45e3
SHA512 a84d94a4b22d325a41b84c193a2e279bc3969085d87eda3fad0dc1032989bd26e67aba7cefa085838590e5aef8958c40e22a000d158fd80782b614dcdbc55030
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 319B
SHA256 906bc925c2527ce764c472b832ceba1d8e55f756460df569f60f35b0169d0a97
MD5 9547cb33315ac2b48be949cd27f534b8
SHA1 710c7c25c53d4254f6cc460984085cd14d620727
SHA512 94e4341d1a2d610a549ef4510e322e67e52eef0d2589c5a234621f5551732471e9ae07eb6db2cc2d426599fad429e75b5ecb8108ec681e2f913816e4dbf836e2
TLSH
T134E026090BC8C12AF1946D938A7C670C87D9398AA39C3E42374C88486149365F38E292
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1
Size 264KB
SHA256 85b21177b31f737a141877e98fee4cd03aae624e034a05f9418db9d5572dd02f
MD5 99bc7159ecb56182beb056aca7f1a951
SHA1 a4335c1cb041f66454612f92cfebcb29da5e886a
SHA512 13e45f52d5c01bdcf226307887457fbfb761b097956f887190597d64358fba90118c89dd94cc23167083cd85e724cc2c80a38cf8a5cc017f1a4596ab8d6de90e
SSDEEP 3:MsEllllkEthXllkl2zEfl4qlt:/M/xT02zBq
TLSH
T1A344040C7FD00C0DC5003030D051C3703770F4140511D74335D50437DCC75404D10000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 5e91da69a98c672e3af8229f5e27169fa9b5b3120a7402a19c75a8cc655feeb2
MD5 71ec48f3f7cb6aafa1148470735fa2a0
SHA1 ae19aa5465090b73cfa0afe63144758c2a62188e
SHA512 8566573658bab146f459e198d1463ec58333b0bebd7d4eeaf1f139ae1ed58172e6cdc704be555edf0104c8fd8d6234c4621f4ee55ff0934e52f8e705b55bbd4c
TLSH
T153E0206246CDC15DD2442547463C7B0CC7B4390AD78C3F416B04D848B409144F7897D1
MD5 SHA1 SHA512 TLSH

Submit Download

5f5e0ce1-592f-4440-ac8f-79f1a76e66b5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\5f5e0ce1-592f-4440-ac8f-79f1a76e66b5.tmp
Size 1KB
SHA256 fcaf3b289666b81127bc0132202878232defe4d986140ef7adba1a614e8b1b7b
MD5 58e043bfafd1e9a8012fa4e0661f12eb
SHA1 124f8fa3ded953116f9691b9dbcfb206bfd768a0
SHA512 a3dce07933f130feb3733128b407438bbdc6c251811b6d7e709f658030875e1edee92d97c90e302e6ea89ee5e3786d628069fb86cf7a246900ad79c6b5e7614c
TLSH
T1F0317857857FB46B102E486F0F847C452AFAAC38096296F4DFA2826C72C15F75B1F422
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 24KB
SHA256 d1f363a87073a75797b6ba14746d31a196f2d46297843d20ba05b46871d79d4f
MD5 537de4f0f7943ea54c1b0270b57696d9
SHA1 1f328d1353cf5caf8bf4fcfd2450e717748e2349
SHA512 cde4f5a7d5c2b0f867c4e2e6195539b45ff0df7559ad10946042f474df324f587e19701aee91a5914f26452fc528edcb1d0894a4c1d99579817bf5ba33dc2224
SSDEEP 48:Txk/LopFMaty423w/a9NUuTjAw7oHHwt7rrDrk:qDeMatha9RA7HQ7PE
TLSH
T170B20C4D5F307211D1F44B77EDD184222E7C211CC3732A5A9E6860F38DA366FBA0646A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 c7c98c84db59dffda0c3de392872dbdeba350399b96bcef94de0806c7943eb24
MD5 721dde3e4e8eec428a01328eb6cdb40e
SHA1 9bb9b668bbacec77ffda07a883972f98e22eb0e7
SHA512 eba5ac2d2b1985ff9e0ddc92fb2c7eff308bc6e7f60d6061dd8d06112dc7e2951ca94ddc5b9068b367dfe3bb35c99c124318a4add0f132d818638a91fb2c6d8a
TLSH
T107319EF743B4957E9B1195F0AA086E2FCE6C0521436C7CAA85E4AD2793E3472E041A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 3865408f9209a65f17001e821e5549895664daaff08c0b570ffc2809baa4d25c
MD5 838beb57943f4beba71f7ee726e62374
SHA1 7ebd65d6704d185f85226c4863fa6d35376c8f96
SHA512 6510a69869fa26484d30bcb2ec9623a63138b0c2fb0cf0cbbf39ae22451374f3a7f9cb638c834df313914eefa11c9f971da46507012ca2c803d3ef3ad19cd000
TLSH
T19681C0F383B4897DAE0299F4AA095F1BCE581524536C789A88E46F17A3E34F1E14065F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 bb26ab026485a44551a0808543a0788c9357bd349410d8292d4dcf06f00fb86a
MD5 5ff387de91202b5984fd3d0c58e84b36
SHA1 bf17224c18310895369e058adbac59585c11adca
SHA512 1011653a02a83350b926fd545f1fee24a99a516ac6f5f780376ec76bd6cd7396c14b820793726bf2e3ab6310a4a9e200f061c4db66fc44796d43b4fe17d9d0b6
SSDEEP 48:YcVafo7CZsfQzsXzBvTscgmgDIlsxZgVlsy9ggsS9VaeYsJC717wEsp1Aa:FVaaDZzBvhiDIWiVt9gq9VaepG5wNJ
TLSH
T19391CEF383F4897DEE0295F4AA095F1BCE580524536C786A88E06F17A3E34F1E14065F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 4bf9193e4b31ecdfa8f466aa9400d5dec4fc8bfd999ee0fe1423216711585252
MD5 923515bcac3bc5f0115621879756f36e
SHA1 909086340fcfd5e17e02c07d0581c7ee2d420b8e
SHA512 b24e6087e257be60390380ba23cb8b85f89bc25af20ea1d0431a0f510df5d08309b6ca070b3400d8e82aae41b4c022d39157f17875bed20569acd734967d63c5
SSDEEP 192:FVaaDZ1vhiDIWiVt9l9VaetV0GkqxUqjWqOKaKfT:FVaaDZ1vhiDIWiVt9l9VaetV0GkqxUq7
TLSH
T1D1D1ADF383F4C97D9E0196F4AA095E2BCE680924536C786AC9E46E2793E34F1E14065F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 2e7484718ecc654863cbfb6700114ec23cbb5c070fb036e46b3f80f3c3d788d0
MD5 3085f6552810c0247f883b0d81c209b2
SHA1 272ac1e048cdc0a61fa8ec140813d843965332b4
SHA512 49cfb14faf8ff55fe10c4db10ae188415b48715c85168dd118883f64bf307fae8a75fae6c362876bac7480d3b791628b36eb82d6ac4c1611af610d896c7d3d8d
SSDEEP 192:Dj1VaaDZ1vhiDIWiVt9l9VaetVuqxUqjWqOKaKfkkL4fLbLai/NfOqEnLVRyqbLu:Dj1VaaDZ1vhiDIWiVt9l9VaetVuqxUqu
TLSH
T10332AEF7C3F48A7D9D0156F4AB551E1BCE6C1924532C3C6AC9E46E1BA3E28B1E20064F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL
Size 36KB
SHA256 054eb1ddff8b4ae5cb1ff52b291a0044dfcce55614b781c8629f0c9e160a89d0
MD5 1eab26d701a2add9e46ef3d52b444421
SHA1 9841e50292f0dde4fbe2a343adf42b608bad0b63
SHA512 3ccc945fba4aa4a7a2df23c6db15b3d8c8d19841747136465cda2a05c5dfeb734f262093cf673a56785b059f2d90a8202b680265784eb96fd28df7881d7f3f9d
SSDEEP 96:OIEumQv8m1ccnvS69f3kacf6CnFpjQ4my4g:OIEumQv8m1ccnvS6dU
TLSH
T1EFF2CEFB07276105D99444B0E4019FCEAF16010B47B6B6DC66D447E3F7A20E2B17975A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 188B
SHA256 0ef47d434a4f19b015ef51c41ffbcfea376577c4c16e95dd1bd400cd4b560926
MD5 1a09ed327d99ac660a4175c059415ace
SHA1 6ae5be09245b9455b97142e999d92f5a37f3d313
SHA512 78f489b600c8254ff308942e6bb0002bcc0ecc2bdbeb1aac079f06552cc8cbd24cc7f9c7273ee9b902fd6c942503072100e994b1182428183164abc8cba419c4
TLSH
T13EC0221281F8E83A01640A3D6A8068887EB4C430000180E4CAB4D33CA2800B76A2E03A
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 55683f56a75b676ef048f9e69783138d0e102057f174206ec62cfc4780324deb
MD5 44811e37b6df3c23a40a3c72576884b0
SHA1 72944f04045b5aaf47743fa825046ebeacfab57e
SHA512 7f328a6212a7802bbb16e9698335b8c8517fae79ccc811cdc9d2d849273a59545d1bb4e66301aa84ee74ea193b643fdaf955401ed215e295c6c6a92fbb541dd4
TLSH
T1E3217853817FB42B142E086F0F887C456AFAAC38056295F9DFA6826C72C15F30B1F432
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 2KB
SHA256 67bddd6c81d1c14998aa8cc17fc576abdf6338a723c09777ccc965115ad39ed1
MD5 5c4ce404322e7a5523bf5e70a3b97e14
SHA1 5c715ec3411fb75854a440645e1ace6dc3e784e1
SHA512 39772d45e0646e6ad034348f176d120c904c2444a036a60a226fec27695aa0b3480db5eef8d800561f3fdd5f4b512a60c300922538b09102b30d6b3b7d63aff4
TLSH
T1EA518957C57EB42F102E097F0F447C092AFAAC351561A8F5DFA282AC72855F34B2B427
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 3KB
SHA256 28f6e31574b0b9efc4051818a164da2c8257d085159c52906a1fc4689a3c0d0d
MD5 8619e17529586a058c6932048bc2753e
SHA1 90dccb5fd99af5b0a33a8be5e936287062ac091b
SHA512 3b167bc7a157a0436c1367c819e99a581fda3cd4027cbb5abca86e7d9cf79dfcdb7f11a4738bdf079ec971c289771fb43d61c20965e315867597cc3f24b7430e
TLSH
T12B71C997857EB82B102E087F0F447C096AFABC310652A4F5DFA2836C73819F3072B026
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 3KB
SHA256 c42d470be53068829bd5534f6272ef20c755f00618c6a2e0bbb3d8f4a89f3346
MD5 6135996ba5eef67e9b383aad8bdbb0d1
SHA1 ce4f838db8bb525a432a917b0bc0e6d22a8d84a3
SHA512 1bffe7d3904d7b64700ff5f9e13e6491bba6a74d449eeee005ee12c873106ee54f1a5559ca43b1fbe402d019aad85a9c6ba1c87c197b5ff7ce31949bb514c653
TLSH
T106718957C57EB42B102E097F0F447C056AFAB8311561A8F9DFA2826CB2855F3072B427
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 b1a9dca459fe3eded691004922a9a14b714498d25dbe3fddadbe79e72bbd7954
MD5 7233b3c1ab6a79d91d27d9a97204f748
SHA1 e636f067d01a570e36c4f9a465c2c80319397eac
SHA512 4dd5c3899c46afca4a7c61ab8636ffbb8dc1ff1abd83e2d4b36de02230bd8b1e1e5cd89072a8a76506388fe5e7e90b328454941b87fc5da7f38369146cc03f4b
SSDEEP 192:sxRgRiCp/fSsjWpVQbVZNXXzoA8pI1/g6+WNxHw/+5tOnqRhp+GrIgVZJ:sxRgfp/fSsjWvQbbsc/5K/+ZLpZV
TLSH
T18C42D916AD28A97B8CC7D21DFB65BF63D2F81032A5D01E54A6FC8A1C04E76DD620780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 88af178b64602f1afbbfffc399748abd27569521a73ded52d9caecad43fb6522
MD5 27335a0409682a4efae8773590474b66
SHA1 9ed5eb32d3d7650bd9b517ddb76525829724f2cc
SHA512 59baaed2b402775ed62da470db9acc64cedef62771c3635de73260cf60ffa2cba4be5fd1280da7ae8b8c0c734790c6114c4e345516d16ce001d12cb55a45c3cf
SSDEEP 192:sxRHR5Cp/fSsAWpVQlVZNXATGszoA8p1d1/g6+WNU2V5yOHw//s5tOHnUshpd8gR:sxRHmp/fSsAWvQlbOaJ/5cX/EGXpdRV
TLSH
T16362B717A924A97B8CCBD21DFA55BF63D3FD103294D05E54AAFC9A2C04E76DD620380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 1a4a24b1e07f3c2361812ade93fa098305e4d045b50e36b9a2b41a0d438338ba
MD5 5f58d5caeb409aa35f18f6fafa33bfe6
SHA1 b942e8acebf9a279ea5926687d0cf53771f7b103
SHA512 041f5fc78a27aedf25f677e30c42dc2410be371fd7a68a208615110d98b2e21392b58113630fdce42588069d053f6298cccea0e35e87abadb89d5b3e61192f53
SSDEEP 192:sxRHRDCp/fSsQWpVQlVZNXATGPzoA8p1dXY/g6+WNUnIV5yjtyOHw/BQhs5tOHn5:sxRHIp/fSsQWvQlbO10/5eYX/fSppd1V
TLSH
T1F362D747A934597B8CDBD22AFA55BB67D3F91032A4D05E54ABFC892C00E77DD620380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 cfc6383a465715eaa4ac0ce08babdf3a1f2b62fb69a5519c7f71489a49ef2425
MD5 abee8834a7e12b9438cb8202706b0d1a
SHA1 e36d311cd7dbafc4cd122c397f065b1c89bfa767
SHA512 c877496c698d9e2ad39240a68794387bc1c34b2a74e219f5c9e2fbeb020ffe3af7a40e02f4b263baafbf305b93006a097ec93df712128655e92d802bb5c96f06
SSDEEP 192:sxRHReCp/fSsGWpVQbVZNXvzoA8pI1/g6+WN+rHw//s5tOH1pGhpWgrIgVZJ:sxRHnp/fSsGWvQbbkc/5r/Es+p7V
TLSH
T10552C817AD24A97B8CCBD21DFB55BF63D2F85032A5D05E54AAFC8A1C04E76DD620380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 93e883d173e6dd2e9eb335821bed72957745b15b14339c85c0992a4822d06dad
MD5 233d91f2f9fdd9c8764b9630bb1aba82
SHA1 7a057a839f7762ca7f5f88480ac95866b44c4da5
SHA512 6710af8a4ab4712696292fa9334f9e120f1ca1a14ff4bc798d128ad2f5b8edb422f60d0fd769eeeef70a3985ec2c0a3639ac9aba005a6512cd7fc11033214a26
SSDEEP 384:sxRHop/fSswWvQlbOWd/5XYGX/weIJfVkOpdvCV:sDop/faYml/5zP+faOpdvw
TLSH
T1BF82C657E834597B4CDBD22AFA55FB37E2F9102298D05E44ABFD892C00D76EDA10284B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 de23e2bdecd342d853440f70a659d8748a39f0b55a7c4ee8a61f00405ababaac
MD5 89a813f8ec622f96689d6e3ad420703f
SHA1 8f6b2a2529fddfff532cfd5df4b4d56188d0f50c
SHA512 f4dc07bcf5566af6a7f3ae59a80fc214e750a1d632521c92a3d12745794dc3478acd6b4096469747f445bda3c468027d1f6f921ccbc9b9c047f2bdbf457a0720
SSDEEP 384:sxRHRp/fSseWvVlbOp5/5NYx4X/w6COfVoYdvRrn:sDRp/fQYTS/5/jTf+Ydvh
TLSH
T16C82A357E834597B4CDBD12AF655FB2BD2F9502298C09E44ABFD8D2C00E76EDA102847
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 7e67ee2926f146901bd6871e5a355e4b5f2a284f6110e44c43ee09ec7f0ac451
MD5 c45ca7a620b34ad062a967c8165d09eb
SHA1 8c1f6d40ca8fad1b0599efc9afa7b7737dbc1976
SHA512 59d76ad36f489184492ba4efa30e1906886a8f423a474eb8855cadb0fbdd18c626a22b4f6c32878981693c71effdc1340db19a669fabec65c5195a04a7cd2f84
SSDEEP 384:sxRH0p/fSsWWvQlbOWd/5XYGX/weIJfVkPpdvzV:sD0p/fAYml/5zP+faPpdvh
TLSH
T13982B657E834597B5CDBD12AF655FB37D3F9102298C05E44ABFD892C00E76EDA10284B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 c9860235d1bfa527e0c6514881f26b9df7cb4201efa05511b97d4dbc40c0b6dc
MD5 af7a3adc534365aac49dc2c002185c29
SHA1 23af8eace685df029fb3c1c853d53a889459be0d
SHA512 23086d92abfdb81dfb64bf8ddf68a050f23eb45ce22d0c3bfd0017c9753f3caa4496992d1fd4b304032f57d63c67e12aa66af896ac72d58da5c4bcc2a4ac10b1
SSDEEP 384:sxRHRp/fSseWvQlbOp5/5NYx4X/w6COfVoCdvRV:sDRp/fQYmS/5/jTf+Cdvr
TLSH
T1E682A457E834597B4CDBD12AFA55FB7BD2F9102298C09E44ABFD8D2C00E76EDA102847
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 6b214672f8f6abda4205d8d1c83f124b1a877c567acbd767a9da58628672435d
MD5 7e08660f7f96592a84daa39baf539b4a
SHA1 09597ad7f580fb7b6f6049207a0e664e1851e476
SHA512 9df5b7b1b2d677dc54a337a2ae6d7bb8c8d059a18a87f6cd8c6c37d043848a1a51374ec52eefcd09b2e5a4fe6df0d53a5da2419f80dea4fb2d3d412048670186
SSDEEP 384:sxRHRp/fSstWvQlbOp5/5NYx4X/w6COfVoLdvMV:sDRp/fbYmS/5/jTf+LdvG
TLSH
T1F882A457E834597B4CDBD12AFA55FB7BD2F9102298C09E44ABFD8D2C00E76EDA102847
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 895b6db54653b23b06f30e5471a4945a11e5a0af15247fc1a2f903a1beb89310
MD5 caaacd266d304b7e66f6c589dc7cc9cb
SHA1 756be2d8206d229663bc5f8bcbe9c273e64cb631
SHA512 baba6457681fe38963e6e6cfee1ebe8165e2ffb6136b344269bebc9850b710b6e89c24b020c66f22544391e05f31c811e20abd8079539d0aa6b525363a299d5d
SSDEEP 768:wb8d9g7pLuL7r6Wgouf6M8F1+UoAYDCx9Tuqh0VfUC9xbog/OVdu46OMroh6w85c:wb8d9sE7r6Wgouf6Mu1jaCV6Quq
TLSH
T194C2D97B740C8B7E4F800ADDEC19BE9F6DA802CB5AD8CD5047FE951C02C6BEA51164DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 338B
SHA256 97bfbee782e5e189cff772623fffbde55ddcd40328f3ac8251fd7eab1992563f
MD5 1ee075502fce34cbd38cc58353613d66
SHA1 846b02f3098074b63d1fca91bbcd520871235436
SHA512 6fa9dd55b8f3844b1e41a9febbbf9e58dbfa1b81d49662d55e4fee4563b931711d4fd2da3474654e311fa71482c84ce81486af7232a42a180a5ecd8dde9356e2
TLSH
T188E0DFA10AC8C179E05736470E24AB0C83EC792BD3CC3A426F808848614B624BA9E190
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG
Size 322B
SHA256 404865840d9a2875eb52a3aebd21f01999c19640604734dfe79382fdff5aeb8b
MD5 404bd07fa56cbb7fa6284fb1c41a043b
SHA1 9797ae47a9d851b3c369b85fb8f7ef7f442c8be8
SHA512 b4ecb7c0af308ae689e40d57c114cdcf69a0e7a873b9e88befa681b42c4701127ee6dba68863e5f45955898534e1ead63fb80ea611307b25bee9882a7036d087
TLSH
T18FE0267505CCC13A915068970A34670CC3F9790AE39C2E822B00C8487206225B7CE5B1
MD5 SHA1 SHA512 TLSH

Submit Download

Tabs_13433510703898551

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13433510703898551
Size 848B
SHA256 b4e4be7b3ac768dca71bcfde9de45f6c76296778b7146f844a58fceb7934c726
MD5 777a33ef29bf30744b3e0b7c996f698c
SHA1 b0a597778d58c120ed20ecafa91438f2bd13b123
SHA512 d80104d3feefc5e0f87459910e888ef5683db64c8703993471b8ea28bd16e8ae5fdd3aa2b587bacc251a8507343b2d85b1a3f410177472e066efb56ead920f0a
TLSH
T1DA0127390D88073AC27E0C7AC18901E5E2306C0172814C5701B235A888737929B61D89
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 8fab6eb1b27fa876c55b289e4afbef6f8345701ebc61a2ad25c1516a16bbde90
MD5 629eefe574225722d8da95315164dcd7
SHA1 b56b0889ad21146d7e5ecef02bea5f0ec3fdc6d9
SHA512 a1a877d2062c90909da407965eade9be5119f13062fac71b12a5a41adb8daa4c1198d80e07ca9cc8bd783e1cda7515c72fde6154acd4db96b2a6dfe544d6674e
TLSH
T1BCE0D8711AC9C72EE187358F4724EF0C82B6790AD7DC2A613B08944C620F254778F190
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 2aafe1b062c1c6057a4b29dbe3f92bc34c267d26fcd39bd4b41d4716034333bc
MD5 769e4f23fdcfb1c25d390e86a7903164
SHA1 9914746f1497fa5fe738f599cb91fa35c75c42d1
SHA512 707540ddccffad19c8c4e43de91c79e37c2e263c7526a2d6f530a4f0cd1bb87b2c4db0a39f3f845a2e379673cb6c3347489ae3fea41452f47fdede99145478ba
TLSH
T18FE026B146C8C639D04375974A78AF5CC2F87E0A93CC3B8267084448F14A220BBAE190
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 e8acd79d0664d99154a2eeab64dddb3ee459e4ca7814bbf8d14562c9abd8638f
MD5 3176a2827b339a5cde73f1e8f02b1c1d
SHA1 350bc04785703da08e21d7f8db7fbf9adddcd89b
SHA512 2bffbe6cbe973a50f02ab9e79eec27c8796918ea5c58820f18ddef9c1bd569c7291b18936cf07ba4c422b806fac74e89c3f9725d6775653233db417553450645
SSDEEP 96:KRtaTHd3LfWTI2gPfK4Ogxfc1NAj70HS3eyEkUyW8pBgiyK43gYyciKxQNgAKdy+:CtaTHd3LeTInPlOgxU1NAj70HS3eyEkU
TLSH
T113A18706303A0240787E7A1DC4A8C92FA6C67473341AA66F7BAD56B54F2EF124DFD4C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 c80c600f7582545e18a3cba5e04a7fb18993e15179a77a64731c43bb7aee2a1e
MD5 2cac0a0cef77c51d9ee24483400f834c
SHA1 4c408fe869917df0fdf1bb7f9909597cd5df1e7c
SHA512 7ff853c1ebc2d63ceb66673b610c05e3e358364952743031dac123e2848d77ab1a9f33761897bc31dc1cd3e164ea1446f1521d680ba69d40ede5422b69cd69bc
SSDEEP 384:DNrRZyCSDnxTIC7MEhIKyll7svbFKfk7:xFZJSDni9yI1l7svbF9
TLSH
T12044840A7B747001EDE6DD725CB080771E3CB16D8F22A6916DA254694DB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ce8179e2-383c-4362-a6ee-55766a03b244.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ce8179e2-383c-4362-a6ee-55766a03b244.tmp
Size 414B
SHA256 c3e47c795e27cc0ac0acf72b8e9ecff686a7ad40faab49f3db4270c39e8aff49
MD5 31764a734fa636ecf557524355ba7dad
SHA1 93a2e51ed38021d77db1f375012564060f3dc3c6
SHA512 d541809fdde33565a19eea0f30b18e9b352dc6e569439f43fb6dfd59374faf9b086a703127806c82327d051b4ea3dd7e73a27fd978d1efdc6a3a84a59a72c7b2
TLSH
T158E02BB9D811AC270EFD071920610E87E74403172A50495F773D411D8FB0A3A4645C5C
MD5 SHA1 SHA512 TLSH

Submit Download

load_statistics.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db
Size 88KB
SHA256 06a40e0b1e7fe038aec920a54c37a3f6bc5eec628eaadc8952da2143353e5035
MD5 0a9bda2ea50c868b52a317cf8c751262
SHA1 4b1531db40a041fb188a62780cfa7f3da91e1823
SHA512 49cda7a4575b480b0a60f79c48694d7e0698f887c44ae10115a06ad81a075752146c817e622e302bc016ec4a0e9f27800261e44093f56873387a5f572b49c2a9
SSDEEP 768:ogtJzIpXSd9sDGHyIFqaQcQQ3OF3AnTmcS3NexQy826KKzeK0TO5Fc4JySVsO/7D:ogt59cAnSCoCOWdU
TLSH
T1B193EAF7AD0AD1A6DECD91B8A40BFE8454738625C620E9E9B93C08C33B7D6023D755C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 18KB
SHA256 5e93174c17c2d8b23aba356051f2573bd8dd59f12217b9cdadf1fb6284d62d26
MD5 8b44e49e1d5eadb1fe53651932422b48
SHA1 f55f99fca5c676ee4a3fcdcd4bc12043680281c4
SHA512 129bd44f4f39d6a0c6a46a9685152142f15414cb6551ae65442fabb98df4df22d67d08105a425745cfaa4eaf60a40bca13732d0aaae82e2bcd6f142a43c46601
SSDEEP 384:Qm9seqswQlW7sIIIyVb3sMIMyCi6ypBgW0cxgd:3OezwQggd
TLSH
T11582089767951F73C39E6B75123A93C506EAAC894E12911C3062680ECDF3A27CAD17F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 497B
SHA256 ed947047eb92e83aa5570f5ff5af8471cac6bc52648cfc7a6d5b287328b190a5
MD5 54eea156d2a563e6828e5f03d4cf1456
SHA1 2df39b76709000b36740300b10a0016340415712
SHA512 e56fcc8a2f2ade67c9c1c1012359889eba33e961ac07db305c3cb421af66d403a43f27c929857fa3e0b8f70b4918d7f1a509c68c3018731ce3e32b3f9e130d66
TLSH
T1B6F0AECB6E030577CC02507150336783FF2189CB0024646703CD202B2A1D2F1C5CC0E6
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 322B
SHA256 007d71c1641c5d1e5af21ec77c3e2143f9741b51d52e05359b34d31d02861be7
MD5 365c8ccd864963a5a7582dd5cb2dbe6f
SHA1 8a30dc97deda7bff1d1480f7e8decf47557cf2e2
SHA512 08be951e8c52157f2fac51fc31a8f67109993daa279f8154d8fd93e8ec24afa2d4b13d420ea414f7d437071ba879830494e0bc9a78e7fd87a3c794107c6ee2ac
TLSH
T123E02696AFCCC16FF455248B19345B28838C3E0BEB9C2A862F08C44CE045620FA8E191
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 c5e544d586ff2d72be03a442e0087a70dcab901bb7c45239f1121076e2f0b2c6
MD5 caaddcb91ed3685ee80efe23182c970f
SHA1 1841c9d4c2467c7be78913821752fe6f5bd91169
SHA512 dae0ce2be1bbc0ace2d2198b3df6c700b0f5680fff66276b8f59b5340f4392733a97375be71957fc6cc30bd97ac85e5e3e91417cf00bd7707ebd258126440869
TLSH
T13D219E55F330D118E54E923A60AE9B261338D8438FB8ED0F44B570652E72B542E8B2E6
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 340B
SHA256 66ab47c36b07496965c2b1acb850f619b7e602bb443f0e146c4391a9fe53f275
MD5 0f3ec63deb574c2ee5f3ca8195572cc8
SHA1 e65ad766738ecb822df93374b97a37f1b25b5914
SHA512 ccb4baad66983452ae239147fe6ccbb255583fd4d2be01de5095c74a68a4daa1b5ebf2bf0da3a9ab8d1597b08d41c75d07d7bd5114ae9f1ccd4723c70c3aa95d
TLSH
T1D2E02615ADCCC1AFD05124870974AB4882D93D0BEB9C2F422F08CD8CA105271FA8E191
MD5 SHA1 SHA512 TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 5ce4b70714a14d6edd3984aff6ffbf91500bc469237550e8fd2812a4b6ad0e23
MD5 c2cc02209692a818860bc7cca262985b
SHA1 eace9a5e211534271e6c46edbfb65dcd62031ffd
SHA512 ba7e89b94315fd7c09b67a6a9ad133e4c1b566da570f2096d931cc8263bac30d4f9ec28d491e3f20ed22b7bb5b71ab7037692a40d790e4a0d5292d02fde33f58
SSDEEP 3:MsEllllkEthXllkl2zEflxI/:/M/xT02z
TLSH
T1B2440404FFC0040DD50010304051C77033F0D4104535574334D30473DCC75400D74440
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 9319a453c459bfe130c27749277bb17b6e06ca48999e91ed97badba972a4c84c
MD5 e0e3fa179d9a9e2d1c1aa98b7a29606c
SHA1 099ce220046b005d8a30592c9389ddc390a15145
SHA512 ee3c0d1e3e88e8ad601cca2a03cc27ab3b013e9892c2e153444ce9876a9fadcb7f4aa1ee7ac916c9f131d5840c06b5d14e85689b8c93f79fc12db5066c77dbdf
SSDEEP 3:MsEllllkEthXllkl2zEflWhEt:/M/xT02zb
TLSH
T1C0440204AF808549C9001430406183602370E45505115743289508229CC69C00C14010
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser
Size 120B
SHA256 9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4
MD5 a397e5983d4a1619e36143b4d804b870
SHA1 aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4
SHA512 4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816
TLSH
T1E0B012203BF9062CF3F74D00AA73AA3428BFF4080A14811D505102080C33E19C478FA3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 4a4ae125ff49f9aae9bc187e6744f2aa78afa822e3454847558f7a212e0b018b
MD5 d5260dfed14c63a5ccf4e6f75803aadf
SHA1 b31bf344ba131ca4d5d53c11431b3632569c4f11
SHA512 abaae85f7e0700363d8f0ba0772d5a9f04341e3ea908948adc484ffdbec309c473d2bb9a0311ee0978dbaa949d19259c7b187ff39390907dd2dae0b58b9ee113
SSDEEP 768:6rv+4UNbds3cBDZIO0sNzc4ReyIsXzeVH1S5D:6bsbS3Qtc44bsjEH1Y
TLSH
T1A303CE33A8788937ECF6A686B50B76137EF8612B82D81B90C5DE5F0C464B5DD130B923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 2dad477b020bf43d9ec23cb7fdd310629c73da703ab56654e220651b2601b3de
MD5 761ec98bb4be632c1a88c19fca358ddb
SHA1 87cd0b8f93c2fa5453410ecb9b3405cf25fbdf2a
SHA512 541b416b7059a93fe3684cb003c3670a42c621a660e91bd7454bf8fab8dd2cdf151c894acad07548473f76ae77395a7737314cd407773797ed97bedcd34a695a
SSDEEP 384:nLZcIL8NDE/7QW6ZwJDZDfL/0XOVSUU+IlETRzcoXfK86sfxEZxxsIj4loCzTF92:TLZ68DZ/cO0N2Nzc4ReyIse259s+knF
TLSH
T1DDF29D36EC258D3BDCFEBB42B60A76526EF4513B81E81958C7DD4B0C85136ED631B822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 9779659ccbbe0733f2fff0077eb4e398182b28bafcb464b28d1bd808eace4957
MD5 83af4b4417a56213578095400ce2d039
SHA1 f9f1be03e096009ae6a7f2166714c5b1f8116e03
SHA512 2d6755cf912d060187b52c0bfbb73b41b0bf5ebe5f09cc719c5fcbe42c0a8498c4846911c7e32100c3a6a860debd50ef8117e97671438478bb7e1d9744208fc8
SSDEEP 768:zgVv8DZIO0XlNzc4ReyIsMX/KRZrb/knF:zgDtc44bsQ/KPrb/knF
TLSH
T16BF27B7EAC618C3F5CEEB305760E2662ADA8513BC1F85958D7DA4B0CC43369DF71A812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 cb535943a81535d131944eccd55068f175c72cf719f29897ebf0c203ebc78490
MD5 64c624d456343c0947a25a9982cf0b37
SHA1 0d644c7e33d154753b79f1c75f286a26bb023e03
SHA512 e365eb6840aee5a777aefb6e9791a9076fa48dca48e3a46b0250f0734107e756df654b18245e711abe3dc18b39d1dfd38d2b15e3b4048fe4ea238fda907b0952
SSDEEP 768:r3LJ8DZIO0X6Nzc4ReyIsisqKRZrT/knF:r3wtc44bs1qKPrT/knF
TLSH
T12FF27B7EAC258C3F5CEEB305760E2662ADA8513BC1F85958D7DA4B0CC43369DF71A812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 8692c89660ec4550c1b40860b48ddc979ba18907491616510e3cc25de04c2aa5
MD5 8c8988d405ed39d023e7cd22302459ac
SHA1 60e5fd447742553b1cb4acf3a7c64667e934dd02
SHA512 539fec7c45dda1082bc1a67726e3ee024c97ab49dadd00f834439a5258818056d54e445f67ca06bd6773674bae466643a022a1013e7d5f7f255df6d0f0adbe19
SSDEEP 768:DLEU8DZIO0XNNzc4ReyIs/VmKRZrk/knF:DLNtc44bs9mKPrk/knF
TLSH
T17DF27B7EAC618C3E5CEEB305760E2562ADA8513BC1F85998C7DA4B0CC43769DF71A812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 9272a18f5ab7812e12cd46d7e466977cba11aabf68372eab09dcd2ebe2cbc8d2
MD5 c57193c1c093c2c67ce20547030d3ca7
SHA1 a8a8d17ad398809ec62c7074e4cfe1108942ed35
SHA512 f9e7ef430487dd3f59485a10632663da41e19fd3b7d7a552f7cf398f35508e8175dd69cf29987c63bc3394eecedadff8bdb205a381f4c150b01e519b806aebaa
SSDEEP 768:V56Q8DZIO0XsNzc4ReyIsT8uKRZr1/knF:V5Ctc44bsYuKPr1/knF
TLSH
T190F27A7EAC218C3E5CEEB305760E2662ADB8513BC1F85958D7DA4B0CC53369DF71A812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 ee327621492ba2be7590809f0f5ac5fc957fecc9384e334ff860e9101a3b6031
MD5 fe097694f35b94662ed3cc7ccaefd453
SHA1 a211fa74a558fb08a6f6c9101af0a0dde5285130
SHA512 4e0ef71e471db70e1f699dbed5deceec84c8268f0ab26bdd0f1a8ec40ca456504cd92ce6f23ad421dc1df65caf1d1449492a9c3529f776d7e062f01a51faedc6
SSDEEP 768:rrv+4UNbds34HGDZIO0X5Nzc4ReyIs2ieVH1S5D:rbsbS3ctc44bs5EH1Y
TLSH
T18C03BE32A878CD33ACEA6686B14B72937EF8612B85C40F94C9DA5F0C4A471DD171F927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 9b5eda02d965835d5a9f577292587f10817e7232d1d43a3eb118b15846bed46c
MD5 9c79d58e509fdd149da0c3c0f871496c
SHA1 0fb5cb104447b7945be16eb39bb7a871f9f365ef
SHA512 96e4302790f57f15b39bc82e1ffa87335cc2c7e88ef7db52c6f7f5ab9d9ada4f119a5ac9f5eb4366ac10cfcbf656d4d40779e86f8cc1f5ea293111582d9d928e
SSDEEP 384:nlZcIM38N2Z/7+WZZwJDZNfNoXOVSUU+GXRFuETRzcoXfK86sfxEZxxsIj4lKA/O:dM3dZ8DZIO0XxNzc4ReyIsMA/knF
TLSH
T1BFE2BE72EC65CC77ACEAA242B6063292AEF4513781C85E94D5DE9F0C09472EE1B1FC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 2d657af1f14266a1f3fea5b2b162f404485d4f38474207128c49f4a374ed8fb5
MD5 35736b64ea340271c09aa14df873a33b
SHA1 e064905191bf9ffcf983d91de3208da5f7f0649e
SHA512 7805543271424713c53240238d069326107b8646f5feb0636dddadc905bfda6a8a4d0e8598c6fbeb0fd5d69baac3735f3fb3bd49226ea41ea81a6faaf2765b7d
SSDEEP 768:bbh78DZIO0XjNzc4ReyIsNv/KRZrV/knF:bbxtc44bs9/KPrV/knF
TLSH
T1D8F27A7EAC218C3E5CEEB305760E2662ADB8513BC1F85958C7DA4B0CC53769DF71A812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 7474172edb8cacaa2bb36a94c5ce7631cd2c61b0bcc8ac1a11bd3fdd7083624a
MD5 c79b0cc155a92dbc00dfd1a4c44a16fc
SHA1 39237f9a59d47a7b922f6e321777228bd4be37de
SHA512 1d866034266ec9337590763df5cfc300d70762f2b4e2c69a74e49132cd6ac0994c5aa199eb8225e80ae50b6645ab6b5dfd9a094a07a49f787acaec3d15553662
SSDEEP 768:RDnd8DZIO0X9Nzc4ReyIsl0lKRZrQZ/knF:RDntc44bsOlKPrQZ/knF
TLSH
T177F27B7EAC618C3E5CEEB305760E2662ADB8513BC1F85958D7DA4B0CC43369DF71A812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 3eaed2090c8701385ea1f3b0b07fb340e16fd5768d34d1ce524dce3b01bc1e0a
MD5 c115c452fa9d5c243abd92b27c1dad77
SHA1 f574a84e0e9f419b35a8dbb59df27401b93f9cad
SHA512 b37a3cc0f037283344a160b17e36a6ef63f98f8af28eb729bbd14b3e4bc54d5460feac01801f642ed8adadca0cce70243a5cb494a278b98a938f8d58f962a806
SSDEEP 768:Brv+4UNbdX3R28DZIO0X4Nzc4ReyIsPpL9NN/s:Bbsbt3ntc44bsx7N/s
TLSH
T1B7138C3AAC24893F9CEEB345B10E35236EB8413BC1B419A8C7D91B4CC53A59DF71B912
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 57KB
SHA256 dc89520be26330ddc46d382080196ce96fb6585b54deb3bed423eb35bc38078b
MD5 c33127999b7d5bad411d2dedbb79762e
SHA1 991b1416f91d90cafa64711ce79e85ccef9cdd2a
SHA512 25d12d862726b9309507f12eca1128d4352c177cbaa6e5be9f88a2c0e546b5108e3b4fb6fb1129d54aa6b4098f6a041f4fa13001f2fe61cf4affd710d96c6808
SSDEEP 768:uFpLGwgY4dZwnNzc4ReyIsUBavewfIIe1X1J8wNA08tQ632Zt259s1nknF:uLFtc44bsJvewfteFoQ42ZQQ5knF
TLSH
T1C8435AF689D7897AD8ED6B87A73D2D469DBCC067B0989894F7884E0CCC525BFC306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 75c23714268cc3f747362960fe5d4acdce7746ade9d644b89116e3e65b236015
MD5 32d26bbc23e9c8f7535520dd1cbd97bd
SHA1 d61807f4628cfe61df4038a7918207ba55cff53e
SHA512 ff6404e7ad3962a1013067fb8cd70247457d4cecdf8f4c9f6387fca394201249a35cd5cd717543889516a30c3f0d4d658337ba455fff03496be3d7158309e420
SSDEEP 384:n9ZcIL8NDE/7QW6ZwJDZNfNoXOVSUU+GXRFnETRzcoXfK86sfxEZxxsIj4loG/Rs:lLZ68DZIO0X8Nzc4ReyIseG/knF
TLSH
T10FE2BE72EC65CC37ACEAA342B6063292AEF4513781C85E94D5EE9F0C09476ED1B1F817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 452935f7043504c81795bd91619be3ee7e02b74c2771d7e10887bdf3ab8f478b
MD5 ce4e71d05f3155e7e89113e2b19254f4
SHA1 b4e7b051a8a879fcb77c8b3c0f5c30b7fc498003
SHA512 7932446b14aa601684b30c2df1cc60b18515324890a3fdd6a7a5272f58ac0c4f23b2373f947ed4a69ebcaa8d3c788972a7c9b4fc109c0a67019953eea51c01f2
SSDEEP 768:8FiC8DZIO0XtNzc4ReyIsEjJKRZrfT/knF:8Fhtc44bsoJKPrr/knF
TLSH
T122F27B7EAC218C3E5CEEB305760E2662ADB8513BC1F85958D7DA4B0CC43369DF71A802
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 72c3f5f1fb1beb08acb09ec468b4f21775648c6dc399b96e636e03c37f5c8199
MD5 6fffbb37a25451ca0fd1ce8b982bd702
SHA1 ee40866929229bc347edfc804e39a3c5cc43adb8
SHA512 12428583e6d01cb824604849c36a07a1e8fa4e989833b90dfc76b8ca17621c72308867209d2c01fca5956783d24393968b7668b119a1b1b6b86c4bfd4ec73707
SSDEEP 3:MsEllllkEthXllkl2zEfly:/M/xT02z
TLSH
T14B44040C7FC11CCDC50034304451C37033F4F4500511574335D10573DCCF5400C10000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 85B
SHA256 b26da4f8c7e283aa74386da0229d66af14a37986b8ca828e054fc932f68dd557
MD5 bc6142469cd7dadf107be9ad87ea4753
SHA1 72a9aa05003fab742b0e4dc4c5d9eda6b9f7565c
SHA512 47d1a67a16f5dc6d50556c5296e65918f0a2fcad0e8cee5795b100fe8cd89eaf5e1fd67691e8a57af3677883a5d8f104723b1901d11845b286474c8ac56f6182
TLSH
T1F2A0120384738407E4144051C45C1341287C84570119C0012068931304240CB039643A
MD5 SHA1 SHA512 TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

63ed4455-4757-4570-b246-b1b77c239e42.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\63ed4455-4757-4570-b246-b1b77c239e42.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

0cc80f94-1770-4b48-a521-89828b043f03.tmp

Path C:\Users\Admin\AppData\Local\Temp\0cc80f94-1770-4b48-a521-89828b043f03.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

15cb58a6-dff6-4fc8-b00b-7e9c42c88b11.tmp

Path C:\Users\Admin\AppData\Local\Temp\15cb58a6-dff6-4fc8-b00b-7e9c42c88b11.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2520_1730033611\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperaGXSetup.exe.crdownload

Path C:\Users\Admin\Downloads\OperaGXSetup.exe.crdownload
Size 3.9MB
SHA256 0b52822d02c4882473e19b959deef1fe9f6e95276f190e3d404246c9561bf08c
MD5 d2627305d8d6d0b56752c8f52b833792
SHA1 433b8b79a9b1c51467cb7e64d26fb4550f596d43
SHA512 165f55921aaa8f90c34792dc3bdc33d412f6f27de360957b06140f70a259cc1e379d756000e4ad3d213a7f63a1339430453480cd3da86bd45e8a9fe5683772b6
SSDEEP 98304:OAIMgGFgx2Ol80YrdDDbW1fbYEPVwjajRV/9Gl0ElJe+IYk1GFV+8:tgGFPOl8FhXWdzCjaAlPlE+rkK+8
TLSH
T104163352BBC0A870F16222320F66E76A92BCF5651F244657779C1ABEDF30441AB39F07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

itop_isr_installer.exe.crdownload

Path C:\Users\Admin\Downloads\itop_isr_installer.exe.crdownload
Size 7.1MB
SHA256 57245dc8f95321253a679a531b259482fea91a4f805bc4fd8dcb83fb7a2a22a7
MD5 50afbc1aca20a32caa3ea97482844032
SHA1 b19fc566c0d5b62017bf48fde3a9cb3ad6df3a10
SHA512 dc86d4255ef0934c7e6fbf7cd0592bd0fcb24d5c73b88009a2243c3381a391dd285aa646220e10c4fd9b199f0fed35ba70bebf70dbeb21260bb8e5f3e4145174
SSDEEP 196608:Ix7073fM6mMwAQY9nZ9va0nOk1CPwDv3uF0jaRCiBrqW4lFV20rx:Ix70o6mMwAQY9Z9va0nOk1CPwDv3uFwh
TLSH
T165769E12A7C58432E4B31F399D3B97A8593ABE205F34D5CB6FA4690C0E35BC0A935397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads