hxxps://bing[.]com

Resubmissions

12/09/2026, 13:25

260912-qperbaxgqa6

10/09/2026, 13:03

260910-qadkpsha9310

Analysis

user interaction
yes
max time kernel
397s
max time network
400s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 13:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://bing.com
Sample260910-qadkpsha93

Score

10^/10

discovery persistence ransomware spyware stealer

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs

description	pid	Process	procid_target
PID 3120 created 8	3120	Setup.exe	81
PID 3120 created 8	3120	Setup.exe	81

Executes dropped EXE 2 IoCs

pid	Process
684	MSI85F5.tmp
1884	MSIBA55.tmp

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\taskschd.msc	mmc.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
3120	Setup.exe
3120	Setup.exe
3120	Setup.exe

Drops file in Windows directory 17 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2728_2139074814\manifest.json	msedge.exe
File opened for modification	C:\Windows\Installer\MSIBAB3.tmp	msiexec.exe
File created	C:\Windows\Installer\e5b82da.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI85F5.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBA55.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFBA77BB1910BDE253.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{5999E0ED-9F3C-43F8-945A-82C26D12034D}	msiexec.exe
File created	C:\Windows\SystemTemp\~DF5FE7FDB800F40245.TMP	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\SystemTemp\~DFAD039D4AD0955627.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF860A2CE6016D4C30.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2728_208067133\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2728_208067133\protocols.json	msedge.exe
File created	C:\Windows\Installer\e5b82d8.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5b82d8.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dllhost.exe

System Time Discovery 1 TTPs 4 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5324	msedge.exe
668	msedge.exe
4392	chrome.exe
5440	msedge.exe

Checks SCSI registry key(s) 3 TTPs 16 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000085dc765dd76e689e0000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c012000000000000000000000000270101000088380185dc765d0000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e8410185dc765d000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e385dc765d00000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e685dc765d00000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe

Checks processor information in registry 2 TTPs 15 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MSI85F5.tmp
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	MSI85F5.tmp
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134335190037376170"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 30 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	taskmgr.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2301830172-776172150-2531349243-1000\{F349B9FB-6274-4229-9962-B1A62173901F}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 050000000400000003000000010000000200000000000000ffffffff	taskmgr.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\5\0	taskmgr.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\5\0\0	taskmgr.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\5	taskmgr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	Setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2301830172-776172150-2531349243-1000\{D4515496-A624-42F9-8BA3-3832907DBDD9}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings	taskmgr.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	taskmgr.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2301830172-776172150-2531349243-1000\{DC8F7907-7E6F-4779-84E1-CC309038B74B}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	mspaint.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2301830172-776172150-2531349243-1000\{97E66746-13F7-4586-BBA5-983F2DF2C2B3}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202020202	taskmgr.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2301830172-776172150-2531349243-1000\{41804C1B-AABB-4A0F-91D6-CFE2239A5DF7}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
684	MSI85F5.tmp

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2584	msedge.exe
2584	msedge.exe
684	MSI85F5.tmp
684	MSI85F5.tmp
684	MSI85F5.tmp
684	MSI85F5.tmp
684	MSI85F5.tmp
684	MSI85F5.tmp
684	MSI85F5.tmp
684	MSI85F5.tmp
3140	msiexec.exe
3140	msiexec.exe
5792	mspaint.exe
5792	mspaint.exe
3120	Setup.exe
3120	Setup.exe
3120	Setup.exe
3120	Setup.exe
3120	Setup.exe
3120	Setup.exe
3120	Setup.exe
3120	Setup.exe
3120	Setup.exe
3120	Setup.exe
3120	Setup.exe
3120	Setup.exe
3120	Setup.exe
3120	Setup.exe
3120	Setup.exe
3120	Setup.exe
3120	Setup.exe
3120	Setup.exe
3120	Setup.exe
3120	Setup.exe
3120	Setup.exe
3120	Setup.exe
3120	Setup.exe
3120	Setup.exe
3120	Setup.exe
3120	Setup.exe
3120	Setup.exe
3120	Setup.exe
3120	Setup.exe
3120	Setup.exe
3120	Setup.exe
3120	Setup.exe
3120	Setup.exe
3120	Setup.exe
3120	Setup.exe
3120	Setup.exe
3120	Setup.exe
3120	Setup.exe
3120	Setup.exe
3120	Setup.exe
3120	Setup.exe
3120	Setup.exe
3120	Setup.exe
3120	Setup.exe
3120	Setup.exe
3120	Setup.exe
3120	Setup.exe
3120	Setup.exe
3120	Setup.exe
3120	Setup.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
7812	mmc.exe

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
684	MSI85F5.tmp
684	MSI85F5.tmp
3120	Setup.exe
3120	Setup.exe
3120	Setup.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 49 IoCs

pid	Process
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
7600	chrome.exe
7600	chrome.exe
7600	chrome.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	4512	7zG.exe
Token: 35	4512	7zG.exe
Token: SeSecurityPrivilege	4512	7zG.exe
Token: SeSecurityPrivilege	4512	7zG.exe
Token: SeShutdownPrivilege	2636	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2636	msiexec.exe
Token: SeSecurityPrivilege	3140	msiexec.exe
Token: SeCreateTokenPrivilege	2636	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2636	msiexec.exe
Token: SeLockMemoryPrivilege	2636	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2636	msiexec.exe
Token: SeMachineAccountPrivilege	2636	msiexec.exe
Token: SeTcbPrivilege	2636	msiexec.exe
Token: SeSecurityPrivilege	2636	msiexec.exe
Token: SeTakeOwnershipPrivilege	2636	msiexec.exe
Token: SeLoadDriverPrivilege	2636	msiexec.exe
Token: SeSystemProfilePrivilege	2636	msiexec.exe
Token: SeSystemtimePrivilege	2636	msiexec.exe
Token: SeProfSingleProcessPrivilege	2636	msiexec.exe
Token: SeIncBasePriorityPrivilege	2636	msiexec.exe
Token: SeCreatePagefilePrivilege	2636	msiexec.exe
Token: SeCreatePermanentPrivilege	2636	msiexec.exe
Token: SeBackupPrivilege	2636	msiexec.exe
Token: SeRestorePrivilege	2636	msiexec.exe
Token: SeShutdownPrivilege	2636	msiexec.exe
Token: SeDebugPrivilege	2636	msiexec.exe
Token: SeAuditPrivilege	2636	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2636	msiexec.exe
Token: SeChangeNotifyPrivilege	2636	msiexec.exe
Token: SeRemoteShutdownPrivilege	2636	msiexec.exe
Token: SeUndockPrivilege	2636	msiexec.exe
Token: SeSyncAgentPrivilege	2636	msiexec.exe
Token: SeEnableDelegationPrivilege	2636	msiexec.exe
Token: SeManageVolumePrivilege	2636	msiexec.exe
Token: SeImpersonatePrivilege	2636	msiexec.exe
Token: SeCreateGlobalPrivilege	2636	msiexec.exe
Token: SeBackupPrivilege	2532	vssvc.exe
Token: SeRestorePrivilege	2532	vssvc.exe
Token: SeAuditPrivilege	2532	vssvc.exe
Token: SeBackupPrivilege	3140	msiexec.exe
Token: SeRestorePrivilege	3140	msiexec.exe
Token: SeRestorePrivilege	3140	msiexec.exe
Token: SeTakeOwnershipPrivilege	3140	msiexec.exe
Token: SeRestorePrivilege	3140	msiexec.exe
Token: SeTakeOwnershipPrivilege	3140	msiexec.exe
Token: SeBackupPrivilege	3360	srtasks.exe
Token: SeRestorePrivilege	3360	srtasks.exe
Token: SeSecurityPrivilege	3360	srtasks.exe
Token: SeTakeOwnershipPrivilege	3360	srtasks.exe
Token: SeBackupPrivilege	3360	srtasks.exe
Token: SeRestorePrivilege	3360	srtasks.exe
Token: SeSecurityPrivilege	3360	srtasks.exe
Token: SeTakeOwnershipPrivilege	3360	srtasks.exe
Token: SeRestorePrivilege	3140	msiexec.exe
Token: SeTakeOwnershipPrivilege	3140	msiexec.exe
Token: SeRestorePrivilege	3140	msiexec.exe
Token: SeTakeOwnershipPrivilege	3140	msiexec.exe
Token: SeRestorePrivilege	3140	msiexec.exe
Token: SeTakeOwnershipPrivilege	3140	msiexec.exe
Token: SeRestorePrivilege	3140	msiexec.exe
Token: SeTakeOwnershipPrivilege	3140	msiexec.exe
Token: SeRestorePrivilege	3140	msiexec.exe
Token: SeTakeOwnershipPrivilege	3140	msiexec.exe
Token: SeRestorePrivilege	3140	msiexec.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
4512	7zG.exe
2636	msiexec.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
2636	msiexec.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
4832	taskmgr.exe
4832	taskmgr.exe
4832	taskmgr.exe
4832	taskmgr.exe
4832	taskmgr.exe
4832	taskmgr.exe
4832	taskmgr.exe
4832	taskmgr.exe
4832	taskmgr.exe
4832	taskmgr.exe
4832	taskmgr.exe
4832	taskmgr.exe
4832	taskmgr.exe
4832	taskmgr.exe
4832	taskmgr.exe
4832	taskmgr.exe
4832	taskmgr.exe
4832	taskmgr.exe
4832	taskmgr.exe
4832	taskmgr.exe
4832	taskmgr.exe
4832	taskmgr.exe
4832	taskmgr.exe
4832	taskmgr.exe

Suspicious use of SetWindowsHookEx 15 IoCs

pid	Process
2636	msiexec.exe
3140	msiexec.exe
5792	mspaint.exe
5792	mspaint.exe
5792	mspaint.exe
5792	mspaint.exe
4832	taskmgr.exe
4832	taskmgr.exe
4832	taskmgr.exe
7812	mmc.exe
7812	mmc.exe
4832	taskmgr.exe
4832	taskmgr.exe
4832	taskmgr.exe
4832	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5820 wrote to memory of 5676	5820	msedge.exe	89
PID 5820 wrote to memory of 2780	5820	msedge.exe	90
PID 5820 wrote to memory of 5324	5820	msedge.exe	91
PID 5820 wrote to memory of 2780	5820	msedge.exe	90
PID 5820 wrote to memory of 2780	5820	msedge.exe	90
PID 5820 wrote to memory of 3560	5820	msedge.exe	93
PID 5820 wrote to memory of 3560	5820	msedge.exe	93
PID 5820 wrote to memory of 1284	5820	msedge.exe	94
PID 5820 wrote to memory of 1284	5820	msedge.exe	94
PID 5820 wrote to memory of 4632	5820	msedge.exe	95
PID 5820 wrote to memory of 1284	5820	msedge.exe	94
PID 5820 wrote to memory of 4632	5820	msedge.exe	95
PID 5820 wrote to memory of 4632	5820	msedge.exe	95
PID 5820 wrote to memory of 1316	5820	msedge.exe	96
PID 5820 wrote to memory of 1316	5820	msedge.exe	96
PID 5820 wrote to memory of 1316	5820	msedge.exe	96
PID 5820 wrote to memory of 2476	5820	msedge.exe	97
PID 5820 wrote to memory of 2476	5820	msedge.exe	97
PID 5820 wrote to memory of 2476	5820	msedge.exe	97
PID 5820 wrote to memory of 1140	5820	msedge.exe	99
PID 5820 wrote to memory of 1140	5820	msedge.exe	99
PID 5820 wrote to memory of 1140	5820	msedge.exe	99
PID 5820 wrote to memory of 2680	5820	msedge.exe	100
PID 5820 wrote to memory of 2584	5820	msedge.exe	101
PID 5820 wrote to memory of 2680	5820	msedge.exe	100
PID 5820 wrote to memory of 2584	5820	msedge.exe	101
PID 5820 wrote to memory of 5016	5820	msedge.exe	102
PID 5820 wrote to memory of 5016	5820	msedge.exe	102
PID 5820 wrote to memory of 5016	5820	msedge.exe	102
PID 5820 wrote to memory of 1128	5820	msedge.exe	104
PID 5820 wrote to memory of 3344	5820	msedge.exe	107
PID 5820 wrote to memory of 3344	5820	msedge.exe	107
PID 5820 wrote to memory of 3344	5820	msedge.exe	107
PID 5820 wrote to memory of 4108	5820	msedge.exe	108
PID 5820 wrote to memory of 4108	5820	msedge.exe	108
PID 5820 wrote to memory of 3376	5820	msedge.exe	109
PID 5820 wrote to memory of 3376	5820	msedge.exe	109
PID 5820 wrote to memory of 3376	5820	msedge.exe	109
PID 5820 wrote to memory of 2464	5820	msedge.exe	110
PID 5820 wrote to memory of 2464	5820	msedge.exe	110
PID 5820 wrote to memory of 2464	5820	msedge.exe	110
PID 5820 wrote to memory of 4588	5820	msedge.exe	111
PID 5820 wrote to memory of 4588	5820	msedge.exe	111
PID 5820 wrote to memory of 4588	5820	msedge.exe	111
PID 5820 wrote to memory of 4176	5820	msedge.exe	112
PID 5820 wrote to memory of 4176	5820	msedge.exe	112
PID 5820 wrote to memory of 3852	5820	msedge.exe	114
PID 5820 wrote to memory of 1108	5820	msedge.exe	115
PID 5820 wrote to memory of 3340	5820	msedge.exe	116
PID 5820 wrote to memory of 4132	5820	msedge.exe	117
PID 5820 wrote to memory of 4132	5820	msedge.exe	117
PID 5820 wrote to memory of 3496	5820	msedge.exe	118
PID 5820 wrote to memory of 3496	5820	msedge.exe	118
PID 5820 wrote to memory of 3496	5820	msedge.exe	118
PID 5820 wrote to memory of 4668	5820	msedge.exe	119
PID 5820 wrote to memory of 4668	5820	msedge.exe	119
PID 5820 wrote to memory of 4668	5820	msedge.exe	119
PID 5820 wrote to memory of 1068	5820	msedge.exe	120
PID 5820 wrote to memory of 1068	5820	msedge.exe	120
PID 5820 wrote to memory of 1068	5820	msedge.exe	120
PID 5820 wrote to memory of 5836	5820	msedge.exe	121
PID 5820 wrote to memory of 5836	5820	msedge.exe	121
PID 5820 wrote to memory of 5836	5820	msedge.exe	121
PID 5820 wrote to memory of 3588	5820	msedge.exe	122

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://bing.com
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:5820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2cc,0x7ffde5b5c188,0x7ffde5b5c194,0x7ffde5b5c1a0
    3⤵
    PID:5676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1588,i,2729577254290946074,363216056974331832,262144 --field-trial-handle=2236,i,17195349090796677219,15036331792080969946,262144 --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:2
    3⤵
    PID:2780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1876,i,11755431584795322617,2737311185434782915,524288 --field-trial-handle=2236,i,17195349090796677219,15036331792080969946,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2248,i,17437188251823545865,10774125179342183602,524288 --field-trial-handle=2236,i,17195349090796677219,15036331792080969946,262144 --variations-seed-version --mojo-platform-channel-handle=3300 /prefetch:13
    3⤵
    PID:3560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3592,i,2618479953976133789,13325415004584092968,2097152 --field-trial-handle=2236,i,17195349090796677219,15036331792080969946,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:1
    3⤵
    PID:1284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3596,i,2849239426597389341,16433504727128965986,2097152 --field-trial-handle=2236,i,17195349090796677219,15036331792080969946,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:1
    3⤵
    PID:4632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4308,i,5444558636634188099,14402033082774202964,2097152 --field-trial-handle=2236,i,17195349090796677219,15036331792080969946,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:9
    3⤵
    PID:1316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4272,i,17524374739331281432,14659812123275908111,2097152 --field-trial-handle=2236,i,17195349090796677219,15036331792080969946,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:1
    3⤵
    PID:2476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3824,i,4956760388189550874,4448052521225485110,2097152 --field-trial-handle=2236,i,17195349090796677219,15036331792080969946,262144 --variations-seed-version --mojo-platform-channel-handle=3764 /prefetch:1
    3⤵
    PID:1140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5520,i,4120758487856645524,8320679485497625896,524288 --field-trial-handle=2236,i,17195349090796677219,15036331792080969946,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:14
    3⤵
    PID:2680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5524,i,16651519147900396538,10012282615526476131,524288 --field-trial-handle=2236,i,17195349090796677219,15036331792080969946,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:14
    3⤵
    PID:2584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6228,i,17676610995109183684,2093896513419162021,2097152 --field-trial-handle=2236,i,17195349090796677219,15036331792080969946,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:1
    3⤵
    PID:5016
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6500,i,3954740395727360628,7821023019479443236,524288 --field-trial-handle=2236,i,17195349090796677219,15036331792080969946,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:14
    3⤵
    PID:1844
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6500,i,3954740395727360628,7821023019479443236,524288 --field-trial-handle=2236,i,17195349090796677219,15036331792080969946,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:14
    3⤵
    PID:1128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6828,i,8165618900781393257,14954648744619983438,2097152 --field-trial-handle=2236,i,17195349090796677219,15036331792080969946,262144 --variations-seed-version --mojo-platform-channel-handle=6844 /prefetch:1
    3⤵
    PID:3344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3820,i,14552438475787729919,6752179260618917418,524288 --field-trial-handle=2236,i,17195349090796677219,15036331792080969946,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:14
    3⤵
    PID:4108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6500,i,16688470989347109303,375577600840322369,2097152 --field-trial-handle=2236,i,17195349090796677219,15036331792080969946,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:1
    3⤵
    PID:3376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5016,i,11318604391670220144,10317827972760484902,2097152 --field-trial-handle=2236,i,17195349090796677219,15036331792080969946,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:1
    3⤵
    PID:2464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=3904,i,3127029081656391904,10698497875825719259,2097152 --field-trial-handle=2236,i,17195349090796677219,15036331792080969946,262144 --variations-seed-version --mojo-platform-channel-handle=6752 /prefetch:1
    3⤵
    PID:4588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4080,i,8735754259205692375,1976666936753913541,524288 --field-trial-handle=2236,i,17195349090796677219,15036331792080969946,262144 --variations-seed-version --mojo-platform-channel-handle=6472 /prefetch:12
    3⤵
    PID:4176
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3744,i,17029395796519611830,6812547847618283597,524288 --field-trial-handle=2236,i,17195349090796677219,15036331792080969946,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:14
    3⤵
    PID:3852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6344,i,9410625404601838218,714163988361837188,524288 --field-trial-handle=2236,i,17195349090796677219,15036331792080969946,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:14
    3⤵
    PID:1108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6356,i,8176772051185744927,2177864810375718960,524288 --field-trial-handle=2236,i,17195349090796677219,15036331792080969946,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:14
    3⤵
    PID:3340
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4992,i,10604928562010156543,14504631585970273750,524288 --field-trial-handle=2236,i,17195349090796677219,15036331792080969946,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:14
    3⤵
    PID:4132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7412,i,3950880625495545041,11368208408672354510,2097152 --field-trial-handle=2236,i,17195349090796677219,15036331792080969946,262144 --variations-seed-version --mojo-platform-channel-handle=7440 /prefetch:1
    3⤵
    PID:3496
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7444,i,4388466103443211266,6131462926054710809,2097152 --field-trial-handle=2236,i,17195349090796677219,15036331792080969946,262144 --variations-seed-version --mojo-platform-channel-handle=7620 /prefetch:1
    3⤵
    PID:4668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=6908,i,3844323089952137341,8892149960945185270,2097152 --field-trial-handle=2236,i,17195349090796677219,15036331792080969946,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:1
    3⤵
    PID:1068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=6720,i,11495402417750394441,1131124260413959637,2097152 --field-trial-handle=2236,i,17195349090796677219,15036331792080969946,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:1
    3⤵
    PID:5836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=6916,i,9915188434104021653,17009723639998266989,2097152 --field-trial-handle=2236,i,17195349090796677219,15036331792080969946,262144 --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:1
    3⤵
    PID:3588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4320,i,4891109868671327367,17651036298731947594,524288 --field-trial-handle=2236,i,17195349090796677219,15036331792080969946,262144 --variations-seed-version --mojo-platform-channel-handle=7616 /prefetch:14
    3⤵
    - Modifies registry class
    PID:5408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7932,i,7132938529089013807,8249257289686655602,524288 --field-trial-handle=2236,i,17195349090796677219,15036331792080969946,262144 --variations-seed-version --mojo-platform-channel-handle=7936 /prefetch:14
    3⤵
    PID:2168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=8108,i,7534421437512824439,10117712705973383721,2097152 --field-trial-handle=2236,i,17195349090796677219,15036331792080969946,262144 --variations-seed-version --mojo-platform-channel-handle=8128 /prefetch:1
    3⤵
    PID:5712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=7664,i,2319307370441695994,7843302443749572741,2097152 --field-trial-handle=2236,i,17195349090796677219,15036331792080969946,262144 --variations-seed-version --mojo-platform-channel-handle=8420 /prefetch:1
    3⤵
    PID:4208
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8716,i,8948889462209854122,3345584881656559873,524288 --field-trial-handle=2236,i,17195349090796677219,15036331792080969946,262144 --variations-seed-version --mojo-platform-channel-handle=8712 /prefetch:14
    3⤵
    PID:3924
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8716,i,8948889462209854122,3345584881656559873,524288 --field-trial-handle=2236,i,17195349090796677219,15036331792080969946,262144 --variations-seed-version --mojo-platform-channel-handle=8712 /prefetch:14
    3⤵
    PID:2336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3740,i,2879145319226401157,11414058136312367185,524288 --field-trial-handle=2236,i,17195349090796677219,15036331792080969946,262144 --variations-seed-version --mojo-platform-channel-handle=3876 /prefetch:14
    3⤵
    PID:2748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=3900,i,3879719891667914626,12569033387712619155,2097152 --field-trial-handle=2236,i,17195349090796677219,15036331792080969946,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:1
    3⤵
    PID:3088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8264,i,2446836690149721011,13298875935103161103,524288 --field-trial-handle=2236,i,17195349090796677219,15036331792080969946,262144 --variations-seed-version --mojo-platform-channel-handle=8896 /prefetch:14
    3⤵
    PID:5844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3692,i,4437523534574614519,12915430454101063596,262144 --field-trial-handle=2236,i,17195349090796677219,15036331792080969946,262144 --variations-seed-version --mojo-platform-channel-handle=4972 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=5588,i,16788111456304189422,4673480062507795641,2097152 --field-trial-handle=2236,i,17195349090796677219,15036331792080969946,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:1
    3⤵
    PID:3032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8436,i,11370002112653739940,17383723881439769551,524288 --field-trial-handle=2236,i,17195349090796677219,15036331792080969946,262144 --variations-seed-version --mojo-platform-channel-handle=3872 /prefetch:14
    3⤵
    PID:5668
- C:\Program Files\7-Zip\7zG.exe
  "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\" -an -ai#7zMap4451:88:7zEvent12649
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:4512
- C:\Windows\System32\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Desktop\Set-up.msi"
  2⤵
  - Enumerates connected drives
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:2636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffde5b5c188,0x7ffde5b5c194,0x7ffde5b5c1a0
    3⤵
    PID:4448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2100,i,17700817012590216228,3543739841564941550,524288 --field-trial-handle=2428,i,15584175334881194589,15431315154396568541,262144 --variations-seed-version --mojo-platform-channel-handle=2468 /prefetch:11
    3⤵
    - System Time Discovery
    PID:668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1888,i,11896319159499657623,6213126801549339159,262144 --field-trial-handle=2428,i,15584175334881194589,15431315154396568541,262144 --variations-seed-version --mojo-platform-channel-handle=2424 /prefetch:2
    3⤵
    PID:2892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2780,i,1787387951426033311,3834344830644538751,524288 --field-trial-handle=2428,i,15584175334881194589,15431315154396568541,262144 --variations-seed-version --mojo-platform-channel-handle=2816 /prefetch:13
    3⤵
    PID:3876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3620,i,12124501259402945905,12385125835574736077,2097152 --field-trial-handle=2428,i,15584175334881194589,15431315154396568541,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
    3⤵
    PID:1980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3616,i,2023344850972264004,5902675741441226536,2097152 --field-trial-handle=2428,i,15584175334881194589,15431315154396568541,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:1
    3⤵
    PID:4604
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,16775117107168402739,16071333542675724591,524288 --field-trial-handle=2428,i,15584175334881194589,15431315154396568541,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:14
    3⤵
    PID:5504
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5236,i,4924641180981455278,11173075061588264984,524288 --field-trial-handle=2428,i,15584175334881194589,15431315154396568541,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:14
    3⤵
    PID:3156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3672,i,15063566367986431585,1540804375473962888,2097152 --field-trial-handle=2428,i,15584175334881194589,15431315154396568541,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:1
    3⤵
    PID:4372
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5232,i,11954411985709404946,8169634479464141581,2097152 --field-trial-handle=2428,i,15584175334881194589,15431315154396568541,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:1
    3⤵
    PID:2032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5224,i,4149577834098932028,16568931939081683109,2097152 --field-trial-handle=2428,i,15584175334881194589,15431315154396568541,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:1
    3⤵
    PID:2960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5980,i,18361755138429028228,3135400348810783280,524288 --field-trial-handle=2428,i,15584175334881194589,15431315154396568541,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:14
    3⤵
    PID:4776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6288,i,2621814210247480451,14421830840424967760,2097152 --field-trial-handle=2428,i,15584175334881194589,15431315154396568541,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:1
    3⤵
    PID:1116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6008,i,18416091255732102393,16376558315503678382,2097152 --field-trial-handle=2428,i,15584175334881194589,15431315154396568541,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:1
    3⤵
    PID:5060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5680,i,16716170388672055732,3683524698665114298,2097152 --field-trial-handle=2428,i,15584175334881194589,15431315154396568541,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:1
    3⤵
    PID:3776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6856,i,5792221426337009399,2687851851726676752,524288 --field-trial-handle=2428,i,15584175334881194589,15431315154396568541,262144 --variations-seed-version --mojo-platform-channel-handle=6872 /prefetch:14
    3⤵
    - Modifies registry class
    PID:3888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6852,i,6903039188564172388,12555824045678551312,524288 --field-trial-handle=2428,i,15584175334881194589,15431315154396568541,262144 --variations-seed-version --mojo-platform-channel-handle=6820 /prefetch:12
    3⤵
    PID:5816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=7032,i,13274615291461630541,5318877842954374393,2097152 --field-trial-handle=2428,i,15584175334881194589,15431315154396568541,262144 --variations-seed-version --mojo-platform-channel-handle=7044 /prefetch:1
    3⤵
    PID:2352
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6692,i,12506351886911310364,13600612530705305272,2097152 --field-trial-handle=2428,i,15584175334881194589,15431315154396568541,262144 --variations-seed-version --mojo-platform-channel-handle=7188 /prefetch:1
    3⤵
    PID:5716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7344,i,569530723723334873,15211008981926784828,2097152 --field-trial-handle=2428,i,15584175334881194589,15431315154396568541,262144 --variations-seed-version --mojo-platform-channel-handle=7160 /prefetch:1
    3⤵
    PID:6292
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7540,i,169904742644965997,7373841433081977170,2097152 --field-trial-handle=2428,i,15584175334881194589,15431315154396568541,262144 --variations-seed-version --mojo-platform-channel-handle=7552 /prefetch:1
    3⤵
    PID:6348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3940,i,10452372634785050364,2377483758409234878,524288 --field-trial-handle=2428,i,15584175334881194589,15431315154396568541,262144 --variations-seed-version --mojo-platform-channel-handle=3936 /prefetch:14
    3⤵
    PID:6624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3932,i,9632489254217518390,1872156131904260747,524288 --field-trial-handle=2428,i,15584175334881194589,15431315154396568541,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:14
    3⤵
    PID:6632
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7848,i,7520520514112759880,13665780848751512662,524288 --field-trial-handle=2428,i,15584175334881194589,15431315154396568541,262144 --variations-seed-version --mojo-platform-channel-handle=7864 /prefetch:14
    3⤵
    PID:6712
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7848,i,7520520514112759880,13665780848751512662,524288 --field-trial-handle=2428,i,15584175334881194589,15431315154396568541,262144 --variations-seed-version --mojo-platform-channel-handle=7864 /prefetch:14
    3⤵
    PID:6728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8288,i,15514720342361214619,10721538631954024568,524288 --field-trial-handle=2428,i,15584175334881194589,15431315154396568541,262144 --variations-seed-version --mojo-platform-channel-handle=8336 /prefetch:14
    3⤵
    PID:7008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8496,i,13590236442129767493,2491221422097022286,524288 --field-trial-handle=2428,i,15584175334881194589,15431315154396568541,262144 --variations-seed-version --mojo-platform-channel-handle=8504 /prefetch:14
    3⤵
    PID:7040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6552,i,16971347527985707653,10030685561106264161,524288 --field-trial-handle=2428,i,15584175334881194589,15431315154396568541,262144 --variations-seed-version --mojo-platform-channel-handle=7456 /prefetch:14
    3⤵
    PID:6356
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8392,i,1014355978052956242,15006212406856606224,524288 --field-trial-handle=2428,i,15584175334881194589,15431315154396568541,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:14
    3⤵
    PID:6428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=7092,i,2325024775850052611,6583638662996874252,2097152 --field-trial-handle=2428,i,15584175334881194589,15431315154396568541,262144 --variations-seed-version --mojo-platform-channel-handle=6748 /prefetch:1
    3⤵
    PID:2660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8724,i,15642380108560432444,17558494737862867890,524288 --field-trial-handle=2428,i,15584175334881194589,15431315154396568541,262144 --variations-seed-version --mojo-platform-channel-handle=8684 /prefetch:14
    3⤵
    PID:6928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=5032,i,8377433030576957592,12842273764069642510,2097152 --field-trial-handle=2428,i,15584175334881194589,15431315154396568541,262144 --variations-seed-version --mojo-platform-channel-handle=8396 /prefetch:1
    3⤵
    PID:4492
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=6728,i,9544927745719752630,14309269783402153586,2097152 --field-trial-handle=2428,i,15584175334881194589,15431315154396568541,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:1
    3⤵
    PID:6568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6792,i,10126060783336680054,2028057589654975628,524288 --field-trial-handle=2428,i,15584175334881194589,15431315154396568541,262144 --variations-seed-version --mojo-platform-channel-handle=8588 /prefetch:14
    3⤵
    PID:5056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=8740,i,6588041356325534341,5497633678974908407,2097152 --field-trial-handle=2428,i,15584175334881194589,15431315154396568541,262144 --variations-seed-version --mojo-platform-channel-handle=8744 /prefetch:1
    3⤵
    PID:6600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8748,i,6516286007345250836,14626282480757790110,524288 --field-trial-handle=2428,i,15584175334881194589,15431315154396568541,262144 --variations-seed-version --mojo-platform-channel-handle=7864 /prefetch:14
    3⤵
    PID:7148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,2328988069842045789,5892277445025792861,524288 --field-trial-handle=2428,i,15584175334881194589,15431315154396568541,262144 --variations-seed-version --mojo-platform-channel-handle=7984 /prefetch:14
    3⤵
    PID:7160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5768,i,11894344059103572627,12582047047126249426,524288 --field-trial-handle=2428,i,15584175334881194589,15431315154396568541,262144 --variations-seed-version --mojo-platform-channel-handle=7988 /prefetch:14
    3⤵
    PID:6164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=1268,i,16313194429388350652,9673884001404119550,2097152 --field-trial-handle=2428,i,15584175334881194589,15431315154396568541,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
    3⤵
    PID:3760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8960,i,11187985953314131451,15931835623633676479,524288 --field-trial-handle=2428,i,15584175334881194589,15431315154396568541,262144 --variations-seed-version --mojo-platform-channel-handle=8980 /prefetch:14
    3⤵
    PID:5600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5608,i,1814160313892327648,13348690727422173053,524288 --field-trial-handle=2428,i,15584175334881194589,15431315154396568541,262144 --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:14
    3⤵
    PID:2940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=924,i,10780788972448589286,6586765344711846615,524288 --field-trial-handle=2428,i,15584175334881194589,15431315154396568541,262144 --variations-seed-version --mojo-platform-channel-handle=1464 /prefetch:14
    3⤵
    PID:7032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=5172,i,10611348022782727761,3468706315093774925,2097152 --field-trial-handle=2428,i,15584175334881194589,15431315154396568541,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:1
    3⤵
    PID:3564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=5388,i,17941399903064392134,12221381149850044183,2097152 --field-trial-handle=2428,i,15584175334881194589,15431315154396568541,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:1
    3⤵
    PID:7436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6728,i,5209700730498243620,11265049339249301452,524288 --field-trial-handle=2428,i,15584175334881194589,15431315154396568541,262144 --variations-seed-version --mojo-platform-channel-handle=8440 /prefetch:14
    3⤵
    PID:5844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=5348,i,13918301098056615094,2275757887377327913,2097152 --field-trial-handle=2428,i,15584175334881194589,15431315154396568541,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:1
    3⤵
    PID:8148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=5760,i,8592395561259794622,3125309159221873737,2097152 --field-trial-handle=2428,i,15584175334881194589,15431315154396568541,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:1
    3⤵
    PID:7632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=8968,i,1189473724824295960,7597716502754020563,2097152 --field-trial-handle=2428,i,15584175334881194589,15431315154396568541,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:1
    3⤵
    PID:7972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5388,i,2909217863264721603,13256643641894925250,262144 --field-trial-handle=2428,i,15584175334881194589,15431315154396568541,262144 --variations-seed-version --mojo-platform-channel-handle=9280 /prefetch:10
    3⤵
    PID:8144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --metrics-shmem-handle=7932,i,2585531868387993126,15493639213312131033,2097152 --field-trial-handle=2428,i,15584175334881194589,15431315154396568541,262144 --variations-seed-version --mojo-platform-channel-handle=7672 /prefetch:1
    3⤵
    PID:7832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7132,i,5368690951824949679,2615397656524432935,524288 --field-trial-handle=2428,i,15584175334881194589,15431315154396568541,262144 --variations-seed-version --mojo-platform-channel-handle=9356 /prefetch:14
    3⤵
    PID:8168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --metrics-shmem-handle=9400,i,12742984891313621642,15797846401046788991,2097152 --field-trial-handle=2428,i,15584175334881194589,15431315154396568541,262144 --variations-seed-version --mojo-platform-channel-handle=9408 /prefetch:1
    3⤵
    PID:7464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8876,i,14121248585919109762,11313377678585566619,524288 --field-trial-handle=2428,i,15584175334881194589,15431315154396568541,262144 --variations-seed-version --mojo-platform-channel-handle=7160 /prefetch:14
    3⤵
    PID:364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8124,i,9097136596309565901,11663737806165082033,524288 --field-trial-handle=2428,i,15584175334881194589,15431315154396568541,262144 --variations-seed-version --mojo-platform-channel-handle=7476 /prefetch:14
    3⤵
    PID:7100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5176,i,17600672009754959947,10611126400886306146,524288 --field-trial-handle=2428,i,15584175334881194589,15431315154396568541,262144 --variations-seed-version --mojo-platform-channel-handle=9272 /prefetch:14
    3⤵
    PID:3388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --always-read-main-dll --metrics-shmem-handle=9240,i,3029026115626761238,2599731462855842207,2097152 --field-trial-handle=2428,i,15584175334881194589,15431315154396568541,262144 --variations-seed-version --mojo-platform-channel-handle=9256 /prefetch:1
    3⤵
    PID:3732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
    3⤵
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    PID:7956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x284,0x7ffde5b5c188,0x7ffde5b5c194,0x7ffde5b5c1a0
      4⤵
      PID:2608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1856,i,4187612159889646607,3111698263288817214,524288 --field-trial-handle=2280,i,3941842540820865621,3415191760891444774,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:11
      4⤵
      System Time Discovery
      PID:5440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2444,i,17113024068023608514,3062434526333382579,524288 --field-trial-handle=2280,i,3941842540820865621,3415191760891444774,262144 --variations-seed-version --mojo-platform-channel-handle=2880 /prefetch:13
      4⤵
      PID:6260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1568,i,2469673362370837724,6515109002471064926,262144 --field-trial-handle=2280,i,3941842540820865621,3415191760891444774,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:2
      4⤵
      PID:6516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4420,i,14023267614726976906,14245643002059478370,524288 --field-trial-handle=2280,i,3941842540820865621,3415191760891444774,262144 --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:14
      4⤵
      PID:2192
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4420,i,14023267614726976906,14245643002059478370,524288 --field-trial-handle=2280,i,3941842540820865621,3415191760891444774,262144 --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:14
      4⤵
      PID:1508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4904,i,14933051356588521409,13998979369305570009,524288 --field-trial-handle=2280,i,3941842540820865621,3415191760891444774,262144 --variations-seed-version --mojo-platform-channel-handle=4504 /prefetch:14
      4⤵
      PID:3184
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4908,i,15403811431247561242,16094710732461125958,524288 --field-trial-handle=2280,i,3941842540820865621,3415191760891444774,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:14
      4⤵
      PID:7828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4912,i,17137711316365335108,9445954848448875733,524288 --field-trial-handle=2280,i,3941842540820865621,3415191760891444774,262144 --variations-seed-version --mojo-platform-channel-handle=4856 /prefetch:14
      4⤵
      PID:4676
- C:\Windows\system32\mspaint.exe
  "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\PASS KEY.png"
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:5792
- C:\Program Files\7-Zip\7zG.exe
  "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\" -an -ai#7zMap21390:88:7zEvent5636
  2⤵
  PID:2708
- C:\Users\Admin\Desktop\Setup.exe
  "C:\Users\Admin\Desktop\Setup.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:3120
- - C:\Windows\SysWOW64\dllhost.exe
    "C:\Windows\SysWOW64\dllhost.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --no-default-browser-check
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  PID:7600
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffde57bc728,0x7ffde57bc734,0x7ffde57bc740
    3⤵
    PID:8016
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1484,i,10697676113360944837,3649238814450910198,524288 --field-trial-handle=2036,i,2575547221323577868,2814180816086532439,262144 --variations-seed-version --mojo-platform-channel-handle=2056 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4392
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1660,i,13646329951634035312,10499115254755784056,262144 --field-trial-handle=2036,i,2575547221323577868,2814180816086532439,262144 --variations-seed-version --mojo-platform-channel-handle=2032 /prefetch:2
    3⤵
    PID:6608
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3052,i,18405378499793485565,10755981419633277596,2097152 --field-trial-handle=2036,i,2575547221323577868,2814180816086532439,262144 --variations-seed-version --mojo-platform-channel-handle=3056 /prefetch:1
    3⤵
    PID:6552
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2256,i,1288953164368630284,13952761097216765293,524288 --field-trial-handle=2036,i,2575547221323577868,2814180816086532439,262144 --variations-seed-version --mojo-platform-channel-handle=2192 /prefetch:13
    3⤵
    PID:7124
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3068,i,14336751896199942384,6731965514875504987,2097152 --field-trial-handle=2036,i,2575547221323577868,2814180816086532439,262144 --variations-seed-version --mojo-platform-channel-handle=3084 /prefetch:1
    3⤵
    PID:3940
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4368,i,1698185758734763108,17489254232604588422,2097152 --field-trial-handle=2036,i,2575547221323577868,2814180816086532439,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:1
    3⤵
    PID:7792
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4740,i,2139702802429409759,7497423025413256205,524288 --field-trial-handle=2036,i,2575547221323577868,2814180816086532439,262144 --variations-seed-version --mojo-platform-channel-handle=4752 /prefetch:14
    3⤵
    PID:7004
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -headless -no-remote -profile "C:\Users\Public\.ff_tmp"
  2⤵
  PID:4264
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -headless -no-remote -profile C:\Users\Public\.ff_tmp
    3⤵
    - Checks processor information in registry
    PID:1848
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2808 -prefsLen 24445 -prefMapHandle 2812 -prefMapSize 268500 -ipcHandle 2876 -initialChannelId {123d8288-a035-471c-aad4-1bc48cfea83d} -parentPid 1848 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1848" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 socket
      4⤵
      PID:7604
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1832 -prefsLen 24657 -prefMapHandle 2024 -prefMapSize 268500 -jsInitHandle 2028 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2052 -initialChannelId {371c51b1-2c1b-4d95-8715-071a7cdbeeb6} -parentPid 1848 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1848" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 tab
      4⤵
      Checks processor information in registry
      PID:7256
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3836 -prefsLen 25541 -prefMapHandle 3840 -prefMapSize 268500 -ipcHandle 3848 -initialChannelId {dc7169c1-1df2-4a01-a547-2aa613835d27} -parentPid 1848 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1848" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 rdd
      4⤵
      PID:7460
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4224 -prefsLen 25688 -prefMapHandle 4228 -prefMapSize 268500 -jsInitHandle 4232 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4240 -initialChannelId {53271f71-6518-4c25-a69d-642bc4d814cd} -parentPid 1848 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1848" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 tab
      4⤵
      Checks processor information in registry
      PID:1564
- C:\Windows\system32\taskmgr.exe
  "C:\Windows\system32\taskmgr.exe" /0
  2⤵
  - Checks SCSI registry key(s)
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:4832
- C:\Windows\system32\mmc.exe
  "C:\Windows\system32\mmc.exe" "C:\Windows\system32\taskschd.msc" /s
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:7812

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5984

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4092

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:5424

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1412

C:\Windows\System32\DataExchangeHost.exe
C:\Windows\System32\DataExchangeHost.exe -Embedding
1⤵
PID:4264

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3140
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3360
- C:\Windows\Installer\MSI85F5.tmp
  "C:\Windows\Installer\MSI85F5.tmp"
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:684
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --browser=chrome --no-first-run --no-default-browser-check --no-startup-window
    3⤵
    PID:1912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --browser=edge --no-first-run --no-default-browser-check --no-startup-window
    3⤵
    PID:5024
- C:\Windows\Installer\MSIBA55.tmp
  "C:\Windows\Installer\MSIBA55.tmp"
  2⤵
  - Executes dropped EXE
  PID:1884

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:2532

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5752

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:6716

C:\Windows\System32\DataExchangeHost.exe
C:\Windows\System32\DataExchangeHost.exe -Embedding
1⤵
PID:4804

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
- Checks SCSI registry key(s)
PID:6980

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:7040

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:7640

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:7360

C:\Windows\System32\DataExchangeHost.exe
C:\Windows\System32\DataExchangeHost.exe -Embedding
1⤵
PID:7584

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5b82d9.rbs

Path C:\Config.Msi\e5b82d9.rbs
Size 7KB
SHA256 9ddd6dbaffcc6a5dec1aa309d19d00c774d96825c2e565a90fe14c8e74acb0da
MD5 f911a9792dda8a77167f9609c3e9eb0d
SHA1 18117cac562dbc63c0967a032b53d191035ba47e
SHA512 fd9bf9cbddfeae519b691b281940685e6715c9f842aade490a2dc9f0bfe059bcca159947376f1b7024aa83bdfebd2e757afbe1174afd0ee876b7f07f070d5eff
SSDEEP 192:Ou4GCn4940VNGAwIPNGAwYX4B4h7Eo44G4P4G4svNv4BpBDHvpvCvxv7vGv7vkvg:Ou4F494ONPLNPXX4B45Eo44G4P4G4sva
TLSH
T1AAF1EE42B2A489D1D89A2335C71B17603BBAE3DDCA11775F0ECD85200F733F99B2919A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 3b576e5cb750626bd453379767ba16c4b6daac77cf47186014d678470243c3af
MD5 cb9584ba091c67711a8238cb22105d13
SHA1 b28dcb058d8691856db18194abc351aa7d85c84d
SHA512 89b357b4a85d41f72f9142dde9c115c8cc5dbe52681ee5888d1f96f9160aed4f726ccbe2b9a54f8d5476b1e6154c7e0198a0e021fee7ce3316c51842fab45d44
SSDEEP 192:MBRhpo+bv7xkAPRp2T9GHsb+WNn7R0Rki38kwYa8SqVyIsnAUgR:eRhppjfXMgw90Gis4aTqR
TLSH
T1E432A62EE914793B6CDAD229FE227753D7F5102135E42E88EBF88A2C15D36CC2227457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 b58b823a04da8136d49236104ad27b3332678bbc599188ab7c445be429bdddbb
MD5 ce62eaa56c38b9cd997f479151720260
SHA1 e2849d92f99ecc02b3d473ca2b21dbb585e40898
SHA512 3bd4327823769de9823d62e0d7b6a3f68aa55056f207e9f7e39e9f08f0176cc125afdf8a6de1714f69da7319908701b0fd0a7cc34e239baa6a947a71986db235
SSDEEP 192:ezs4K6hN7KxkXqK4I40pUZNCgVLHrKHfFKslEGbFXzKD/CN+ErUkKN9TgJiMna1b:2sjaN7KxkXqKf/pUZNCgVLH2HfgslHF0
TLSH
T1E032E867A48D9A3F0FE8D50DDC16AB8BACB4425672780C2857FB9D0803E57CE114A5FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 d635cf9c0657338db94165c88fc412b8b7c84a17819c36149bd43158830d37b1
MD5 fbee45bf8e804d86cda61163bee0773e
SHA1 beed2effd62b9855519aa83202acbac3d80c1be6
SHA512 95db63091154f1b76ed4b1631d8b22b2879d8db1644e28b0f228c9e19e661265ff26632f5a192e5231acb115a1d209ee16e8afba5d09643b583ca6843444e680
SSDEEP 96:SC0d+CVgOeTnnGBfYZSK3/jKRDotok5RcDdPB6gGyvhyLfOLZEbZP9v4a:SC0JeGnpDUD0HE1mLZEbj
TLSH
T1D4A11C75F02D997344BA9849B5926A43CDA561ABDA31AE44EDC95F0C02FB0EC0342577
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 2251d7149ad271f067cff70da601a17e38f2497a6fe1ce0ce9ff3987d0e7ddab
MD5 f2c6a24aab87ac30514f5f54b9342c89
SHA1 9360821629e73b2ac611f09bbec7474f7bd972c6
SHA512 d656c040d5b7a5de64dc59545411478fb46d0ae0a5c446b54622217e47f894a331e6b7ff04810227a8cdd72ef8c93a8a07af85d0e8deebd8f949a02f312588a9
SSDEEP 96:EC67d+CVgOeTnnGBfYZSY3/USl8h4otop5RiDdPB6yXGyvhyYMUGsakO0AGXszXB:ECkJeGnRiU2mHn2aMUGsWXWiaZ6Uu
TLSH
T114C14C75F46EAC7349FBA899B4022A47CDA071AB99529E94DED94F0C02EB0DC0343923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 fe87a5781d34f47ac92f55514e08d8ebfddb7d4a2ad0aa25fe97998a94e521a2
MD5 c4050a4df962a019e6223b13f04eb055
SHA1 736f136c0ef4b6296d85c89f0c086ad32843e3aa
SHA512 6222ddf87504fffa613e5caccaa250caf3947364943de69df91934b6472326fb4dd53a1ab03030d080ea0257e3f4b0e0e535ef02505e91310046727b23a91e1c
TLSH
T1CDD02BC8B8483760D033303D0212830331D88814B4070043C0A0064E0C0475302F6138
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 581c02b7ed803d6d4c02ba509f99a1b362620c2ffdd40609993a137c0b1746fe
MD5 009128071be72c95644f8ef8e181753b
SHA1 1522347f3a507b79b2bfb8ba7a6c850e00d26a33
SHA512 bd49dddd7e1ff32f4c5fbb9e0e41abf731533d1a37e7c2b7771b1fb4aee0fa5fa8f76a9fb0ec0f5d2937cca3e7446a7b6e730d727e31c3255c34e440efee2f01
TLSH
T101D02BC4B8483660D033303D0212831331C8881470070043C0A0064E0C0475303F5174
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 97a6513f10d71fd5298ed3e060f4fda7b7220dfd2f281de3506a5fb473d84049
MD5 cb36384e31c0de66f71f305fbb04d23a
SHA1 fea66c8df2fb8567a3bc6a01b2669a03dd53513a
SHA512 5e1eb30994057f436aa1b7e3043023dc21b005452e66e0ced9b80386a8b77c19c2a97ba0ac32dcbd499790dcf3b76de02f732400501e6baaa916dff7a7a314df
TLSH
T164D08CD4BC687BF4E032303E0362820272EC9A67B617114BD4A08D9E0C687D356F6EF8
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3e84c0fea0e5ac1aba91f3fda0250f37ff741bffb4b80d4a1f9da7345c74d90a
MD5 5de642d6014d5ed1e20fa8a225f6834b
SHA1 85f6354fd4f3abf2b6fbde3e517280d3e55226ab
SHA512 a56080b16f812e032022538c18974c111fa97ca35300863960e65c280f9fdf9dbd4afa801bf06d4a1dbf360a94d6d287753a931f08995b585e47485dd22d571a
TLSH
T1F0D080C4F6446B74E133543D1355831B72E9DA15741754179495198D1844B5343F5564
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c36ac766a384a109222b8b647d2f5c1c2e6c4672a4a2c6b8a01f6eac0a5df074
MD5 f9f896b0e6f281d55b1ca3fa3c1ccdcd
SHA1 db44df3874cd86a961c82d25f3ae2004f249b2df
SHA512 6b8c8d305c2d7e4a3b5efb6e1967d7db1b1ffdb7979edd315013037da369c923060dae4ef8a7219176aa7e0bc1fa4cb98e48470ea2f569243a95d3301f5a40bd
TLSH
T160D09BD575046A14C5A1303A21D1935392604835741945874051E55D5C5479743FB5BD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b53c58762bff2a5723ae446675e8f65fd50818b95383c8f3c7efef01af06e466
MD5 629a18fe1b7a241215c77a30d7d8d7ee
SHA1 5e7bd5b514f4e46a4b986c8b89d0025cf81a1f36
SHA512 04fd58619789dc107f680a57dba3aec42e4bab7c29c0defd7e1b8ca2d078ca4c91317932ff076171bae60d370b28de32c94039c6ab690d5004ddcb857977f38a
TLSH
T182D09BD575146914C5A1303E21D2935392504835601945874051E56D5C5479743FB5AD
MD5 SHA1 SHA512 TLSH

Submit Download

70a94232-3a2c-40a6-a86e-2e9dea567185.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\70a94232-3a2c-40a6-a86e-2e9dea567185.tmp
Size 414B
SHA256 e4be95cb6851ba0febbd3afbf47872169d58e68baa58abfdec9fdc0aba7bf7fa
MD5 17983b15a7f393adf583a5d698266401
SHA1 2f16dbb5a8c4137e824153ad441284c4d7e9b370
SHA512 2ac0416077fee0bff34235cb6c7d334e7b39c257ae4f36a51bb56a5588f1e87f1afa512922c04a8e58d3c26204390af0ca5c7c3625b470f37425c24efab1faf0
TLSH
T15BE0ABA9C810AC370CF9072810148345E34113672B40489F363C860D8FB1AB74585C6C
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 2a5c06f0919558e3816b6e25dfd995922418fc98f8ef224ca775bcf7636bf75f
MD5 0675443dd736288dc5a7851db86da44d
SHA1 9e6bcacfa1a861eca01fb9421be355793b93086d
SHA512 b531af441ea2fd0834f460ada1559888fbee8c35232e3b47df6aab43197135dc359a69409031f1df5fae905d4c1c8e2c34e5647793735f465de1e94a2cad7420
TLSH
T10CE02DC003CAC22EE250E08B0168E78DD2A0BF4EC2CE2F0B5700CCC13001A40B6C2292
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000081

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000081
Size 63KB
SHA256 caecff4179910ce0ff470f9fa9eb4349e8fb717fa1432cf19987450a4e1ef4a5
MD5 226541550a51911c375216f718493f65
SHA1 f6e608468401f9384cabdef45ca19e2afacc84bd
SHA512 2947b309f15e0e321beb9506861883fde8391c6f6140178c7e6ee7750d6418266360c335477cae0b067a6a6d86935ec5f7acdfdacc9edffa8b04ec71be210516
SSDEEP 1536:tLQFdWY1+jAIuhc5s3JBP2ffX195jJqu1H5g60:qFdv+jA/cizOfTdRJ260
TLSH
T10E5302D829DC2DF4466490C19420E379C6FACED8E4485B6F5B2A2E0DF78DD7527C7242
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000af

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000af
Size 68KB
SHA256 fc70b88dddb2da85326b7ff7e1fa801f0099e5c0d3a85863afd2737af9b199a2
MD5 cb3d1e69fbf9c94b15e92f2fa26892f0
SHA1 b8e5aff1547d49a1285e2e0c4cb43dcd9993f468
SHA512 0f890af69b223aaec8bbc753bbc626f6cf0e0660182e38871a03337f1eec7be6b47cb9d5034a3cb8c226feb6cd964d396f56fecf07257f3cbc13de642c175ac2
SSDEEP 1536:1RrPSv8UR94fNhLVxko8PojNVcL7tk9/yGeJ3GI:PPZGefNhLVxko8MrcL7fJWI
TLSH
T16E63026A7FAAA437FB2C87016FF23034D1F8FD579034042826515BB5A4578E92326F99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000b0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b0
Size 60KB
SHA256 a221cbf72963df1c02c8bc202b159379f26e3d0d06225a5933209e745040e35b
MD5 b90c0e06b88c09158b13db21c7fc9ef7
SHA1 a4b968f5abcd2addd2d8f2d3e6fc01f4127c95a3
SHA512 430aadb5315738f414c2d4ca0d9e2be42f5242a3b28765993602aed4b34e334d854a88a051e6519877b7ffd8a5bf4ee7276885d6daec541826dba878f8c07f2e
SSDEEP 1536:iw916VqIkIFHzR32SF2Sjm+KW3IS7uchJEsZP8:nngaGzR32ceS7uchJ1ZP8
TLSH
T18C530227CA3085D2572D05004B9EF35A1A6079FDEA09CD7E920157F772ACAACFE20E21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000b1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b1
Size 19KB
SHA256 c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f
MD5 2e86a72f4e82614cd4842950d2e0a716
SHA1 d7b4ee0c9af735d098bff474632fc2c0113e0b9c
SHA512 7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1
SSDEEP 384:eV4Eqc1qgk/XDVGi8m7JEM9TUKPqivdjfommfP974oNF38:eV9qlxhVEM9UKPpMV74kFM
TLSH
T1D692D043765579E9AF1280C82397E6A4EAAD9A88D6C0FD0950F56CBECF708D32261825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000b2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b2
Size 43KB
SHA256 14ef713f8c26bb48eb58aee7291d24bfec7fe04461af055f0c9ad63a298c5a93
MD5 e7f31b312430a58beebf02569971cecc
SHA1 6a36445d1f2bd9ded564f13fb047b896f1ada7db
SHA512 f069e3981fc381c27bb2f3c1a36251142fce8661d614f92058b9418def9a950323957fc9df7453bb671b7639869542656cce9df96e0b45e6e12a6637ebc6e1d8
SSDEEP 768:3CZ1Qapm3DP4Q8Ag1BGBa0p/PE+4dxquLkDOBFwQ4aUjnlxGR/Yy:SZ6a43DP4RbGBa0VPE+pWkDOBFwQAjne
TLSH
T154130200E0F0CE82941B5C8A0D78948A7B210AD49EB5737486E8DFF7C51BDB8C6DB05B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000ef

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ef
Size 59KB
SHA256 05d2434aa9cc3d61148a133339b5fe6b8fc8da57b6c8faf27a838baf30707162
MD5 944b5e83d61777e889aa5d07506b77fa
SHA1 3d7a5f4059431efdc36d8f73fc020702a7df3564
SHA512 587f112450b7ecb16104e0be775cb195d987337fa8cd22fa87eaa46be5f8aede5785a0f136938a8f43624c1db3a920ef011b8acf427e474d2778d53db7cbe0a6
SSDEEP 1536:vRQJwYht0TaX+e2SHchwJr5FDNwVzVnle5cmobDq:GrhtRz1HxJ7DuVhle9obm
TLSH
T19753F1BAA2C102BDE01D38C959E285C3DE6FD06793CA564100EA46D9FB44FCC7A1AE75
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000119

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000119
Size 33KB
SHA256 539628bdc4f3b107aeb78713c741ab9b5f4737532233506d8f1b1fdc4c81040c
MD5 a06c8f49a760752dc8b3ee4f217bf4fe
SHA1 2c159af5b7341c03cbce67afffafbbae2cbb7787
SHA512 af3b5c625bf4c83616c3ae1e2380df3bd35119998ca75cb96cd590c18b9227d18a03a50cf22880ddf41edd99ac7b8b9918c93a7be90d4dd3a8e6602c8e2b519c
SSDEEP 768:f+QHjwElyDV21n98SlMi1MEOV1IyItHdLqO:GOwKyD01n9RlfyTVJYRqO
TLSH
T1F7E2F15B2127014BED8CA143576EFB4FA9E374AC5609A24F547BE0AA7B8938754BD0C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00011a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00011a
Size 96KB
SHA256 00b42308115826481315f6a815745f8d445a89d855fa587f627b7b4388810023
MD5 89341da90f4120b2461a9bafeef01775
SHA1 90e281f4ff94fc0eaee2e876234884e16f69894d
SHA512 bb3e8fd234ec764c6450622ff2d5f2e6e777cac6006fa23b9c3e986d79b89911b9a57ebca3bb3f3e15b8437d0b305634eea968e7d8808188efca4840bf4d5112
SSDEEP 3072:OFM4gnEp7667akyq8ez5pqVo0cvK4Dhq/8fQVT:8cIwdq87ouczQR
TLSH
T1F8A312DE415A5AD9711B87D540A18F2E140288FDAE3AC206E3C7493E1D7E1BED2392DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00011b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00011b
Size 72KB
SHA256 fc886667b90ffad1b0229b102c340d9c93c8250aee944f4df3f35d8833811b04
MD5 2a55cd14779a918e614e873501c38d05
SHA1 4a59f4c5582092271e6c87e69d06d092d722fb44
SHA512 8c3523bb283d22d6ac7e65811cb0e17eaf879368210c26a20fd553204df2e06cb9cf58d4c19fe3b1dead430907fd186d87bb9c9a7afb09fd389d69cc9b39fecc
SSDEEP 1536:kNS2AXW7axoDItayH1pEPAfFzELcpceTwoX0eskqoMf0PHKi7+XF:JWktnHwAfJEL4ceTV0c1HKG+1
TLSH
T159730227B008563A93A0C78C371A48359FFAA0FA1B1452BFF1DB50DBBFE450635589DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00011c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00011c
Size 408KB
SHA256 7a50cff2ba27964e1dc892708f201b97f5513ecfedfc4e7e82ecf6c1246f6132
MD5 42af94577490c2f5dc901ea2d3e2e4a3
SHA1 8c93675968611faf7d148c12c1b2170c22075770
SHA512 273d37acb003a2626c57183301d729164bc310d682f159493c63f51f56ce1424e8367db630cfffdf452451011996a79e492c8f78c0ebe75765e1b1f3a94e5515
SSDEEP 6144:CCPRy65+Rj00vSwG8VeWXC8WSMLJI4U1HWUDjfK7PROSLw10UXiA7fg1wfN4kZiQ:LxUAa1d7MLHpU/MQCwqUXiA7LekM5ZY
TLSH
T1C39423D0B157AE489DD980FC00E12ED0CD16D2AD6A077FB61490FA9ED5AE7AD0C891CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00011e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00011e
Size 77KB
SHA256 bd327a1e13ce02fb13c19ebfd9b6178b3faa3cb5831e2e595c3fc27d3a3c5ac9
MD5 d6f7fb9f6e9370925bdcf782d6d6600e
SHA1 bd0a01298780756556d87c653abd9f05d5bcc8f2
SHA512 8e6bdd08144bba4a0a337dba4e16165c6ed0d6dad83cf946236c00f73bfec3fa6a6ec07aabb86f0f59bc409e7ba701aac45b4fecdd6ee25df3ca1c292ba197d5
SSDEEP 1536:2m6ek/PzC2k4Uc0cLnCgUyQOgjPp9OasORDyRgkAqF:2xek/LC2G9SnCgUyrgj+iR+RJ
TLSH
T1A4731286B7995FEADA42F4158830E32377F8DA735D724C378C04C0466BD0278A969BED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00011f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00011f
Size 27KB
SHA256 64e79147a82c808d8a3daae687c53b872bd0f3990445a7d146f16d0a5bcf5148
MD5 f1d6ac69d6247fd7d5a820b1d6b5112a
SHA1 26f6a525b97b7f2a9c008e8e4fa6a193091e071a
SHA512 3a2cb9a7defda2b8d3479cee40457053e50b41974ec090737e3c8a77b3d6b697a3b49f446d02422f6ae9a98c50ebbecb2a739670fbb0bd70825344a5a874458c
SSDEEP 768:itNT5p0OyEHO9J1EMdzwfKgbcNHC1lgET:QNTf0FEYNdY9bcNiIC
TLSH
T107D2E106CA539FE6238354A5473364DE5FBE12211123EC108421672EFADB59B7BCD0F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000137

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000137
Size 205KB
SHA256 13c6d94c43808a3414c4426e68647100b76abea4902ebb9ab0f5469c2de04f21
MD5 d3eb73bb74601e34486fa4063f218494
SHA1 198da432f5fab87454a1542aab1774f384fd333f
SHA512 0d2ed6f2093b9ac475fba2d244b24c1730732b2977f0f65f2b769082c11b160d1ce4f9cb1a18a746b59e552090c610259ad2b3c4ab03a6e03849fc9527060d42
SSDEEP 6144:gmVNxgdbFRI516A/KpTPf1HNDxMkASzAqGv9K6:gmVjL1pKppHNIws
TLSH
T1B02423B53BEC19EBB26085E335DB358785885CAE883CB38BB82001AD1CE55795F4F5B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000139

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000139
Size 70KB
SHA256 21ae1a0fbe44c2e43e3b3c538076d8ebc6d284bd8d34d5605119c68fdf93f153
MD5 4f5996c1d474aedda865b2ab81b79acb
SHA1 ed97c95c081b460433b98e880c7948c7f34aefde
SHA512 fd2c1c5324b4f7e5aaf2d5132ddacf11f53f5c4acb4b49e91298619d4069cacf976895a46763f80ffcb7be05fcbe167d75595c73e903f14394187bcb1c7c95d2
SSDEEP 1536:uvsmGbORJcMcE4Prf0SVhmqI8A0xNTeGGrFp+3Nuw6XyN:uvsmQScMcE4Prf0I+85nC1FQ3IX8
TLSH
T164630286FA85F4DB2EA59D8C356291F71ABC44EB501EDC092FD3D8FC9E85D1C828E085
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00013a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00013a
Size 30KB
SHA256 f8425893dd95d3719cb1f6bc96e1c61f69b577dd15185d5e0e0e1f34330780e9
MD5 989eff2c685217537d8b3b8c4b778289
SHA1 161119129f50d06ff50a79d4efcbaeaf0bc0bc18
SHA512 3561cdcca526cb95fc398456e18dcd1062ec7abf19f3775b06bf5871d1e5fa57dbe2f6d902edd7ec94d4b32925f69233cb0a0453f8e5a77d90802af216b9a653
SSDEEP 768:UoAdua2J3TOJyn9E5LnKOt2ugnfY6/j45qLcegiKEH76OI:UoWuh1O4nkLtFgf1/05qLUAH76p
TLSH
T186D2F123ABC9FA34F5E0D0997F7A8E8239066195A174E143DE4CA05E3FA11E5572EC38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000142

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000142
Size 62KB
SHA256 dbd7a510f3f0f430a831acd9b7ff82825cb04b203ba03bcf0097ebab0530c471
MD5 67ee7bf546fd9fb2b0135bc53df15f55
SHA1 2624a86a07e9e0472bcec33f455c5f1eaf366afd
SHA512 fdc04ce6c470084998a4e352a6601374af90809f5cd69d699a60bbc37dbd3251087cb234abebe9b64dbe660857b25b8527027ffc6e2246e5da14f556fbd245ed
SSDEEP 1536:yoWVVn9bug3EeDjRtTDXlaXDPVYzwdcsXSofTF6lehh:eVnxf3pDjXfMXLV9OFMTF6lehh
TLSH
T1A65301E94EDD736B3CCEB089E2DC8911472622A1704D2A13C5B643EF6732E2795B35D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0001af

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0001af
Size 42KB
SHA256 1404ca348bd75ef836f4dd8b6f2cc719458642d1237c368296b2fc652dca47dc
MD5 665db5e157d2138835c4037c971ff3a4
SHA1 41ca6b7e4818eb81531d8006ff7ddd971c640879
SHA512 6c999466673c9873b1b112d6ab95c7cecb99467ea156e3e046b54c5f3d109c3845b05cbb2a0245d178430c7b2ceacd5110f7d8faf7e041100f44852b0c29fe9a
SSDEEP 768:tMTmVhyXCrekkraPAjrWMMWD3UJmw0FRwoglekm+hQ7//geceSF/mEQBPMAmDu5:cmHkCrHvPAjrWMMI3UJswogl4j7/hSlW
TLSH
T1F9130231EB70EE59962C903454E7FDA9433B1457D731ACA80E99A1CE6F8103454FACEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0001d6

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0001d6
Size 40KB
SHA256 2d8107d590ef47e4f93c07c9471bfe1480e70a7c8f5ea782fcd4447f4dc6887e
MD5 bd447cbbe116aa0a3fd9e84694f63f21
SHA1 e8fe7a998161696f9febc38df081f5bd76033adb
SHA512 f344ba29a8b21f036dea8309b9c475cf8ca1b560f8f545b5583b5df3d458863e7e14696875f38b867e882d0ef1de2a256148f8a1694882510a035ab351058521
SSDEEP 768:XRr3FYgxxLo78EHMe/s9iyIqsWFoA9/CgNDQU08YUFarjGacWhWqrHRqRas5T07q:XRr3Bxx87RMtiyI4t9T5V08AOnqT9s5F
TLSH
T1B81301A558F79360DEBF47F0085BF87EC6207A37413E6BEBA559175F023A64643A06C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0001e4

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0001e4
Size 1024KB
SHA256 f01e0aa4aecc77fe10af737bce395eabc5e0fb73117d0355a20747a2b7971c11
MD5 5e2acb167064c6f8f66e96cbf04add8c
SHA1 6a8848f1f8ff777409fe9eba73774a00d291d5a8
SHA512 2fa470c30b2c596ac698c829ae1fc471c3bb9080f3c4f419d78cab964fbcd17ffadce12d048ea1e2d690d9450485ceafd5d4b8e497e783510fb8c14446d5adfd
SSDEEP 24576:OgFPwjyjS4MXxlVV/iMzRlnKsuwz1Tn4I0V0:nFPvjSLTfzR5dRT8e
TLSH
T18225336C71BE9C5F8369A433A10D2FCE1C1AF62849E91E01726E7550AF7534CFB2AC58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0001e8

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0001e8
Size 1024KB
SHA256 2afc25596787fe99f6c0e0f423e36cae2f3630c798d0e3afafb68d40200df2f4
MD5 0f48318d01093b20a407e31a00a1d756
SHA1 7d43d572989715972f4b436544ad4bb43f2daa8a
SHA512 4e0e76cea01bc908f06c6b8907c925ff4f66584a69024458c0513ab4fc9dc9fdec2b671ce2b26f540dcc6ad876470f4b85d5dabc271419995e7106d600f9a990
SSDEEP 24576:FNwpukfJ70dZYos+aD4euwFC2Hrs8lqE4cfaBHZlX62UIFE:FnO0dZPTozHLYsRzfaPPy
TLSH
T1572533FCB9F19ED81034902F5F5273783ACC2461545A36FBCA2F3D5B79A674A0AA0254
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0001ea

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0001ea
Size 292KB
SHA256 a0727696d145fb4c57ab295839b23ea7a855f4664ca7f93c5ade0ab2e002bd97
MD5 23e3749f5ecbf367868f395235604fbc
SHA1 7d8cf91062aa271a297e06fa366b5ce11b1acafb
SHA512 fa546d72ee56621bfe95cca9455da1f5de1712e7877cd1a2339564162b4ea7828980c063fc5bae618ff614fa844d673f3471477088e24d2b28f95774e63f0d76
SSDEEP 6144:9syfdkodMfZMHkc2VBbeAWO5GUUytYz5Awqqmi6FaWPRXQSC7N6TOV+XO5+L:CyfZeqHkc+4LMUt5ADlFa+C5h+XO58
TLSH
T1CF54231B0F563E68C4A3107E06554305E935D7A6AF8D430FA9926FA90E735CE3F2878B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0001ed

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0001ed
Size 354KB
SHA256 9d945d7495c872870c92010bb98bdc515ea7d926d88a1ccf917cb87a9a8d7ac7
MD5 af41c8d93d79fb178f384ffdaf073453
SHA1 0ad6a10f80329780a54c051ca1b4b13337b38e81
SHA512 c5fb29e969f5c92aee77570150e6e429626d701ad72fde526823c64aaee25bac3988ed69b3b39b702de566bfeaa370605851928576a7a5ae385755c176c83b2e
SSDEEP 48:yoLpM9TBAPPcwkIrf4vvvvScfcFcvvfcScFcfc8WalmrJnsHjanu0i/fc9O2GvLp:yuEmXcwnrf50a0Na0GqZMi/Yap
TLSH
T1C8748793A3124C86E4B13D38D3614369B6FCEA66CB1D8A873596C0C56F941D85D43B93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 11KB
SHA256 450bce2b8485e3e20b57814308755210e4242549c72af6c4e11937b71d1cbdfc
MD5 5ee12384abaebea0aa35377f33aae1b8
SHA1 2c9c4577161fc176413dec1a3ad09e851c1b867d
SHA512 b47684a52813491587f34723c8e2bbfcafefea6a34b0a447eeef742e5c82f57b569cdcc5c45fe43eb366cb279cade75f4c350d6eedd01ff95ca0a097c94360bb
SSDEEP 192:XYI9l+F/9e8m69brmmHghF+h1qtB+3yXOSg9BWBJDmJ8z0ip20NnWmaZBY5tzmaP:f9b8t6mVh1Wp2uvnnigHLSjpQ
TLSH
T1234274AE52BF19D0FF22277430950ACB76379BC925533F1320F4E6752D832859B60DAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 14KB
SHA256 a91b21218d2446936d22728873c1a8ad0c0757ff32941cbe73c55b07c04c0a63
MD5 609e1b259ecb242e173dda963d7051ef
SHA1 66c8719db3214fcb2d04a05900f686d610ab98e0
SHA512 b4b4512430ee2816492f2f180f9d85436af838574a7bf5b2651cf92e2c9e90d278316a78dbc62038254724354c66fb5ba240ae70073e4757c2f85095548c8c01
SSDEEP 384:49c83K+nVmnh9vNSMiu0UbcWnAxukY8jxY:+csUnBfiu0Udn2JNjy
TLSH
T1A762509E52AE15D0FF322775309A1ACA7A374AC926433F0320F4E6712D833895760DAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 7eb9bd757d73283bb5aaebcb56e0a88e4ef2734a0bd8b783e3448091eefdfba8
MD5 bd1c324e859eebbc2062e22468933ffa
SHA1 46da66986ab26c77d0c574d3a3583ab3f4062e19
SHA512 122235b1ec349d25e05b584f109daee9a437a8787b85d25d170d95126a443959f88d8cf677406027c2c966a4e484b54f57f9c1e78b6f7b1776c9e164c919b182
SSDEEP 192:kCey+dLaaM1n2uAwiYjHw4DtQnMcFEPCTU3GYH48gd2Ru:YFTO2cjjvPCTFYt5o
TLSH
T1E5F1658AA27E19D0FF2417B510E899CABA335D5A649B3F1630F0DB30350335A9F68DB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 b7ea3efb586bab46b21a0e28f4b90e6bd228fc593eec5055d76e305c9d46fd38
MD5 736b963f6040e5b7d7b61fa849b1b1f2
SHA1 fc5ce176400a5e6cad4ffe528292e2ab32f9f2e1
SHA512 105687a4e031b5bac27e617482b0bfb13838fbd80547abdf8c684917f65ffa1600831ab3491e5adcf58b684a1ee44788cc5e3d5e01f636e9830d893a3ee9c35f
SSDEEP 192:VCey+dLR1M1n2uAwiYXHh4DtQnMcFEmCEU3GYH4Ugd2RX:RFLO2cXevmCEFYJ5t
TLSH
T1AEF1438AA27E19D0FF2417B515E859CABA331D5AA49B3F1630F0DB3038433569F68DB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5aa2e8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5aa2e8.TMP
Size 3KB
SHA256 dec76dbb4c4956141d6789352fa775425ce6c7535cd93a18055b66a114981ee9
MD5 ea7b9e69990214c54e8b631b9ead7a35
SHA1 7a271b917241913dcf685d3e35005766568fb40b
SHA512 9ebbdc03fbea978f1fd81620c8cf1ad1e9ec61f0fef9d84ae05b77e2b2d4d37822eb36103ad3f9aed118643a9dfe34754afbc8bf6dd85c692680b1911c56e070
TLSH
T1C9617F8F233E1AE1EF20AAB820F554CDBE734C9505EBBE0430F563745817A01AF266B0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5ca705.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5ca705.TMP
Size 9KB
SHA256 13aa1c81a8a3e4ada35f84616dfe72130ddadcabc86a3548dd0246b62daf73fd
MD5 1fd285a30fbfc12e8b9835664981c356
SHA1 bd01dcc11e67958ca149918e0f5d319043eddbc9
SHA512 c25977a1dc0234890d3b5fa9707377be06b36e83a29f25d2abb0d8a1c3eab8f359d653d5c2585c92bed9c8b221564f2edf1d3682be8433560a53274e06dd0d59
SSDEEP 192:G7SD/8q/APtcbWcS9RjhxkVHJUGPAz+m0DpOTXOu6ma9ZQ4iAro1h1eZh/GIU7Ao:B8jBz+68Fro1h1Bz
TLSH
T1B6121E4B233E19D0EB20677574E557CB7B33DE8921932F1124F4EAB01E123469B60DAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 256KB
SHA256 9ddabf50c4fb9a30b7450c4c839656b3d45bf5657455527d8e2fe6e8c0adcb58
MD5 3d6f4b17faed49a52c0aa3eb9dd9415f
SHA1 3772aefa64122ed75ec87bc9f6d0385f64407928
SHA512 ba2e6c44e57042b6c8466b9427356f9f320f0883cd26c5e89919295ab453b7238f1006ac2d5c66e4dbd6e77fcdbeb1d1c5108fa2f81559634b8c08ffe3933fe8
SSDEEP 384:y1wJwIkUI3ijVOWN3qL/0ziOvb1VrE6qAXQ6I6VJQA36i6DegP616AJ6R2WBGS6F:yiJt4ib3qDjOvb1tvmjO
TLSH
T10F44E9FF7F937A0BDAB8F17861B9E0685C5EE51FCB4352D5A40800A4CAF99D2096C4D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\000003.log
Size 182KB
SHA256 1940da628978defaccb4ae7486e8025e93e99dc7b4898741bf45585dfc936190
MD5 8af21cc8891d691f9eaab1a534d4f119
SHA1 155fd861306202edf869188d46fc7b1a7967b428
SHA512 f9993d49b59910c2579bad2304cd53a208c66b66ffdb1e3ee58347bff04fac1ff30b6a5e3e2bde390a4695a1a4434bef405f0a89d10b801ee48c8886e6971f47
SSDEEP 3072:7JhnMpDCjFJxyyQYk7iMwAkX+D/jFJx7qYTvE0mOWXM1M1rCx:dlk7SK5
TLSH
T1CF04E8255256A3C9E53E83B313124E1BD3369DC4B69D3459BAF27B0C26B7B003F2472A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\LOG
Size 353B
SHA256 72a2efa746fb44ad4b27255b1651d18b22ba606de1e48749deba5369ff417e96
MD5 e01a4110381ab6885892975a893d73c1
SHA1 66f554506ff4246388b8d1b9ba6229a08c558f05
SHA512 a963ab16dc816bb12bb5ed8e91e60ed191701b3d0d49de996e326be4cd2ce11a4b2369538c79c49701b4f787f2f237e8b32e6f79c2914277064548808d189cc5
TLSH
T113E0682884C9C15FE1A420DB44307F0F959FA60E9ACCBE560E40D810748A648982E241
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

000004.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000004.log
Size 26KB
SHA256 da060581fe894ac64a0d08b6bccd507eabb6bb553dbc90b6bfc789c894db1517
MD5 3b3cce78a9d634c6eda128fc4da5c29b
SHA1 ff1ff6b3cd4707a03e76403ccff39618f2fa38f2
SHA512 f982bdd8cd962a49adcb8bfaf973d00a3ebf7bc9e5506b6b97810598effd675d576a8f15698994d4a4e893441c1204cfee710859a4492263fa77f903a0ddb8f3
SSDEEP 768:gPocXPTFc0I7XflxGA2BSgT6A/KGdCFGEDvb9:q/a7NxGN8s6A/Fa
TLSH
T1C8C2C0F3EE68C88AEF5BA4E63123747C80D9B55579CCEA84EC810905C798D726E29770
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000005.ldb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000005.ldb
Size 26KB
SHA256 8659d4477ce49a99bb73893edf8f587bf74d38317cf21dfaa3cadc348b8f0bde
MD5 144aad7424b929fba268723e8460a541
SHA1 e35829a754387c4f79110245a6aef362124d9dd4
SHA512 7fb21a1bc97d8a2e385f7f89838141d6e2a64edd0142111223caa1c46e48f74255707ab17fce515d569758e087ba1e2f50f15ccb04384bdcda0ee3f587c6249c
SSDEEP 768:lVwAnxgBHhLHtTxIFX4EihlAy3Sl6efxZO:DnsHhjpxIFXSlAyIW
TLSH
T15DC2D093F9D6D59AD6F189BA88F6A391186B3B75FE1490B13104EF0412089456AF0F3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 36KB
SHA256 ffacf95e71de04086304a4062f6eeede2ac805b277ae1967211b746db5b84204
MD5 96e24981ae90262ebc1d0fcb7ed13c60
SHA1 b5fb01c6024f64c2dfec437fdbfce35facba1fea
SHA512 b14330d113fd69f8605f16709db3b21aec84cb442a64d8cfa14ff031191220fdd6809affa5fd4db78a4140b84a118311671fa705c0162f5b93c5a772b1523e8b
SSDEEP 384:D6TF8bORFfQOjF2bJfJgg7Ny+seiDyetRy+CMqozfFJ5DD/FSz8nnbcF5H1DycsF:fhYpLUsoLVhtCKwKF24RYFT
TLSH
T1AEF2BDF7C3E8872DDD1156F4EB153E1BCE190924432C3D6AC5D9AE0BA3E2471E241A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 15KB
SHA256 08ba21c16ae0e2ed6e2cbaa5a44e3c96bd8ec085ccc3a5b43fab54f38bf9313c
MD5 a982c26ec87f4f8595b0559e76f41509
SHA1 0af90446459d57b6518a1755834a01fd1dab2ae7
SHA512 428c35c5be223ef660b022447b34c445e71a4fae83f135f3e2694b6782c4b80013d9c8c0d536375b18335837dd99855e41abbf62fcc756a837a1bc9db00d27e6
SSDEEP 384:DvAKvNbVhqUFW6NmJIJzL0s/11DycsTGSuIsesLsxsdsZscsAs+smRB/VvC7BI6Y:iKigELwj6V
TLSH
T1AE629AF7C7E8C62DCC2116F4AB193E1EDE1D0924431C3C2AC5D9AE1B93E2871E255A5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 37KB
SHA256 84aeaaf5797ab8ae152a8e3b80b14024b00416bf232c4fe601dad03d4a6e7d2e
MD5 68cdd7d96785ad61d02e1d3561e38794
SHA1 7e0efd0913ec949dc5e2c68f2e6bf666bb70ff3e
SHA512 fb19d791b7c742ecba31c6925a8892f8aa4a51cfaf2eaa4ccae002e822631aa030ff3563996ce7ce2d98ccf029ec8201a797d04e9aedcdc069695a1414b31d6b
SSDEEP 384:Dfr271GWiPtxIF2bJfJgg7Ny+seiDyetRy+CMqozfFJ5DD/FSz8nnbcF5JK7beMj:HhYpVUsoLVhz+gwWYdVRkDX2
TLSH
T19903AEF7C7E8872DDD1156F0EB153E1BCE190924432C3D6AC5D9AE0BA3E2471E251A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 17KB
SHA256 bbc610e971615cce067b368125afabdde6c5da3af20e0bbd20dd0594a7c9fba6
MD5 2324afddb4830c81694ff3785eb74965
SHA1 e63dd2d8c022c852f29c7a98b2c411f4d095c9c3
SHA512 0fb5be683e9b8f120a5fc6495eb18a5cc1712a2850723bc6488f07f2bdc5480d20212e486b56a739826ea990d9d11857e3fce4668d6c98aedf3e6917d4e22a09
SSDEEP 384:DvAKvNbVhqUFW6NmJIJzL0s/rJeZDyuWKXb1DycsTGSuIsesLsxsdsZscsAs+smJ:iK7gELwjnS
TLSH
T176829CF7C3E8862DD82116F4AB193E1FDE1D0D24831C3C2AC5D9AE1B93E2471E255A5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 988220698e9fe17193dd9f74ca114d7fa5f3ff6dca641d43b9831ef7657e3a6e
MD5 203cfddc061123b2583c5663ea00b118
SHA1 a75e7f01683bdae4a84d10f835e1cbf8ed60cc12
SHA512 f593d0b36054d473991860b3949cb388dee9e393afac3ae60ae71c6ab87ed34d9b3726d3e90119b2ca8240e32c36e58f0c01f6066ecba58102d81cd5d7814b60
TLSH
T143D0226312C0B2F5A67C7EC140AABC8FC72794280C03DED910F89CEC85314AC6527380
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 46d78d3d882a490bf930f36e37ed9bb820a852e6f9a6d060cd7b12ff2e172f62
MD5 a48a7eb06f486fcdaf1e9fa7fd18891a
SHA1 1bd2d564a235c35d898d8e3ee0fef2a2b0075ac2
SHA512 eb1f8d20291f4ccb39b597aaef469ee5170fd1962e96db6358126243695863e56b323e6acc8034b85ac6b7b96e6de58a375695a9e22395e1f08b45e38f43b4ee
TLSH
T16FD0235311C072B4556C7DD1516ABC4EC32754140C439DD411D858DC053545C29271C0
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 9f440edf86338ba9927032c1378406cc971b889b2f5c35612c06872fe8f39f43
MD5 a8a9b43c2b74ef14fa551bfc04b1ce54
SHA1 f79753a6c3d1bbe6e9996bb08be90ba3554d9f67
SHA512 962912a3d5b2c333aef45ef7da58595aed776759f5d9aecf9aa1fc4e6f863203f21e91af0b74745bd323d25475bb68956b1c9b705f4865fc5b506d03fac10d3f
SSDEEP 384:sxR8YmWd/fxsxfu5r4MZ/5KNasJ/Sk7OU2:swYmWd/fyfArx/52xS+2
TLSH
T17482B593A42489778CC7D619BA31BF22D7F954229CD05E5CAAFCDA0C04EF6FD6206847
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 26KB
SHA256 e78962c814608a647f0c386a98573f6d47c5144c15e913c3b4d8de11ee44a117
MD5 6b83477941c700be71bf0665f4f9d802
SHA1 57984b60405bfdeb638254593716f725308603d4
SHA512 ca5eea0e004c8118c0cc51c3b5e12a1d5da371a442a1d38400e633756b15f397f33063fcf896075e372a8414d74f8af94211c91567ea5ba51d7bcf356eac0513
SSDEEP 384:sxRqniUmAd/fxsCfvuuUr4mYUc/VZ5VNaXxtIRXYhGVy+MXbOU2:sIiUmAd/f/XZUr0Uc/VZ5XJps+WL2
TLSH
T1E3C2B893E430497B9DD7D525F531FF2AD2A55523CCD04E98ABEEC81C00DB6EDA602883
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 89ac9d7658b77f8dbe06393e3db55a10828bf69bbf95faa8fd19337acfba2484
MD5 6d379d0c3e791e8befa080cc14a10840
SHA1 1df929d63f19fc856614c807ce4f0b870b1178c5
SHA512 8900375758a4235007b121962a500c1b3989e03004ff3cad93b85097126bcae8ebf7b6fda20ccdce476b31ef63e27d862722d46802f98db7d919622171ab451b
SSDEEP 384:sxR8jmWd/fxsxWu5r4Ma/5KNasJ/VkbOU2:swjmWd/fyWArS/52xVS2
TLSH
T1D382B593A42485778CC7D619BA31BF22D7F954229CD05E5CAAFCD91C00EB6FD6207847
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 42fe90bd926e9a9a5182ef12fcabe6d50c2526838071bee342230fd37b2012ea
MD5 2540668d3facae1852b23fbc7448c8ca
SHA1 0adc68179785bfb6f8520bacb5901c864a07ecba
SHA512 cbeaf0c02dea9302c6c1377e803ff85b45ca98f8d62a573618db0687a865bcf37fcc6ad6bd1156b5d05461fcd7fa9a3aa0c0caacac2c8be618dd7db6d80948a2
SSDEEP 192:sxRyR8HcBzd/fxsjsmZ92oA8p9/FSp/g6+WNY7B/Yx+l/JkGIIgIFOUSMb7+:sxRyYmzd/fxsjzdi/5i/VkWOU2
TLSH
T16352C6529928D937CCCBD619BE35BF12D7F95023A9915E5CABFCC60C00EA2ED220741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 2efe0f4bc8063bbb3af0e75033c64ca8108b12ed92cc9be49b3a40b1cf61dcba
MD5 5b32f80e2656ae477ee5ea8605ef314e
SHA1 8b9ac4f610c1c9b222ed7d4f51b0a179c8afb709
SHA512 9fccf372501275ef6577d668a2b61a9fc898b0818ea05b616684fe8f94303306ce37367e416784425321861a6414979bdbbed2ea1fa309a1e9395d28c0936e3b
SSDEEP 192:sxRJR8HcBWd/fxstsmZ92oA8p9/tp/g6+WNYlSXYxwl/JkGIIgDnFOUSMb7+:sxRJYmWd/fxstzd9/5VX3kpOU2
TLSH
T1B652C7569924D9778CCBD619BA35BF12E7F9502399911E5CABFCCA0C00EB2EE120741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 21KB
SHA256 7d3645e22e188d7b41be7fd9af5f0391c599c84e6417af56e3e109e5b19266f7
MD5 1d8b5aaea11a5b903b3d821c7bddc4ec
SHA1 bf48bcac95cfa70b45fb0caf08ee320fe86640fa
SHA512 45c3f82d91444d2b465f9d2ff4c074dd59b7f792e911f63dca60d4d34134fd9aedbbbf5232d77f0f316b5df88b66a8a957e5343085af80f24d61c531028890a8
SSDEEP 384:sxRWYmAd/fxsgRujr4m0/5INaN8IJ/hKMXbOU2:syYmAd/f7RmrI/5AUvhKWL2
TLSH
T1CBA2D887A82485778DC7D629B931BF26D2F954238CD05E8CABFCD91C00DBAED6206847
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 23KB
SHA256 6d24e4e15c768526c4f45d23de57d023fcdada5bb0932776691bf54eceb34419
MD5 4698476c5f549545b4f0b0f1109ad787
SHA1 7cebf14aecff5ea8c677925770ef6792c56c44bb
SHA512 0207fd963253fe1170283e608968be072dae200ffbcfbdb30a94837d06ef4e823dfa99203eebedd1d9cfaf1045a4f57b2dbaa7b1c9ec485da33d85df3228cb0d
SSDEEP 384:sxRWjmAd/fxsCfyuZqr4m6Uc/5i5VNaNFxoJ/hlMXbOU2:syjmAd/f/qmqrGUc/5i5XUshlWL2
TLSH
T155B2D993A82089778DD7D529B931BF16D2B95423CCD04E8CABFDCD1C04DB6EDA606887
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 28KB
SHA256 c01a7495e7a2b59aa1e915bb09d40cbe91c975a164de18e81b7824bc5b7e4526
MD5 f41c093d753c9529b3254f663c6c47a3
SHA1 f9f43271ece64d97fe30334e8dbe6bcfb47610d5
SHA512 9ecf5498cf839baf90f7364ddcaddddb4cb7715bea7027e482d860d12a78cc51e61dd72823b5d8b1a902073c9e12fc4ba53614966c1ed9ad02d85a5042c3551e
SSDEEP 384:sxRqnZWmAd/fxsYWv4fyuuLIr4mYUc/hA/5VNaXxtIRXYhGVyhYXbOU2:sIZWmAd/fPY4aZsr0Uc/hA/5XJpshCL2
TLSH
T1C3D2A897E43049BB8DD7D529F531BF2AD2A55527CCD04E88AAEDDC1C00DB6FDA602883
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 22KB
SHA256 869296a0e3160973a5828878ad705f8800d5bb9a760bf2bfbf88ee593705280c
MD5 5d65d10e09f94908dcdf9df04f0693ad
SHA1 244093de30003f3d0fe5f50dbf250cd4ede28bc7
SHA512 63bcca6a2dd02e836df36e16c878cb12e7f85da53d066f28a996be48c159942a5673064201ccff6ff16deeed5d36dd2ad5df100117a3fc502ab99c432d62c7bb
SSDEEP 384:sxRWJ2mAd/fxsgfyu+tr4mfUc/5t5VNaNsoJ/hEMXbOU2:sykmAd/f7qRtrLUc/5t5XUzhEWL2
TLSH
T19EA2D987A42089778DD7D629B931BF26D2B55423CCD05E8CABFDDD1C00DB6EDA206887
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 2fb2aca67c71348c88f5d7d347aca587ad26eea47237290f814eebee321ba52b
MD5 ec6d1f290b0bcf7f9ebdb0e7d0411b8d
SHA1 7a93da9417d6304edebc6209a93982dba83d9178
SHA512 162ff14435e67eaaa724fbb51f8b68ccda51a4235fbbb77c6a004a65683a6e7d79b2b55f1169d13fceeef2b517e1572efc85a66fd31f585f73a1d475a83c4ad6
SSDEEP 384:sxR8YmWd/fxsxWu5r4YbWf/5KNaN5J/VkbOU2:swYmWd/fyWArG/52UTVS2
TLSH
T17682B593A42489778CC7D619BA31BF22E7F954229CD05E5CABFCD91C00DB6FD6206847
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 23KB
SHA256 5d02866ccc3282e18011241f5717e10bfeea1772d9ad271773940a0b43141bab
MD5 2b3ee5c89615566e536072d4c5b903f8
SHA1 e1a134571137a400fbb67cdd691d6015e8d85259
SHA512 2a76d7bea5d2e1434082c86f02071fda72feec4442a22187ac84f10495fd33aa36fc09153b61b881bb345c7eb4c70a1d80495e40d67fcd8ad335156715dbaaf6
SSDEEP 384:sxRWYmAd/fxsCfyuZqr4m6Uc/5i5VNaNFxoJ/h1MXbOU2:syYmAd/f/qmqrGUc/5i5XUsh1WL2
TLSH
T15BB2C993A82089778DD7D529B931BF16D2B95423CCD04E8CABFDCD1C04DB6EDA606887
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 a706643eb8d2e0a7d24ec26113869f4819feeb47775f18f07cda40b3e94b7dbb
MD5 2e0fe6d9aba1273b466ea9ccfe464ca3
SHA1 66977fa3ffa2bb7ef49a255248e0b8683c6c46ff
SHA512 1c9d7ed1e85ac6bc6d1eb4a1976b3d5377ffbc009a835cb5a7c316eb6d9bbe2f9ca2a235e5aab84ac48fbb8a57e683976b7182dffef296c5c49449f153ec0ddb
SSDEEP 192:sxRuR8HcBWd/fxsxsmZG2oA8p9/tp/g6+WNXNubylSXYx0Xl/JkGIIgD5FOUSMbi:sxRuYmWd/fxsxsd9/5XNa7Xbk7OU2
TLSH
T1AF62C7569524D977CCCBD619BA35BF12E7F9502398911E5CABFCCA0C00EB6EE220741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 28KB
SHA256 136028d46b6885ade928411b65020e9a888b5cda8fec0436bfa7a34274e88423
MD5 a39f90a2ff00fbfba2ce9b08e569f08b
SHA1 b06fbc0f20e124edb6e6c6d46b49c77f46dd98cb
SHA512 ec8a9755e36b95ce5b989f01874fa58864a8487b56faa6f9a7d333ab95462aff463b38de163d1014b963c99aa7f9896c74396620f66d07ebabebc42ca9bb586f
SSDEEP 384:sxRqnZWmAd/fxstWvofMY6uuLIr4mYUc/hA/5VNaXxtIRXYhGVyhmXbOU2:sIZWmAd/fyYo8Zsr0Uc/hA/5XJpshoL2
TLSH
T16AD2B897E430497B8DD7D529F531BF2AD2A95527CCD04E88AAEDDC1C00DB6FDA602883
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\94ee17b0-b3e7-4851-a593-02322fdf6d3c\index-dir\the-real-index
Size 576B
SHA256 f486fc15870af9f9ea1533ab009cc7caf382a908a2f605b3cc517d564eff764d
MD5 9787c7791c4a6f84ddfa055211b9af35
SHA1 69aa274b1dc50622cc7a30f19defcc9801000f73
SHA512 1f43a094bf97c4b56047b235653822687569cc4ac2e285502e80398d7fe5e42d3f0086eacfa152d1e248fd004c022b9151af298273fe78cf1161162611085020
TLSH
T154F0AB907690011DECAC07F5827240112B1C384EAA16D3C3E84FA5FE8D5B8514F26AC5
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a7abf.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\94ee17b0-b3e7-4851-a593-02322fdf6d3c\index-dir\the-real-index~RFe5a7abf.TMP
Size 48B
SHA256 ced92a153c141e1e548dc36b43b8b54556a1f1b2d95a7c6e14e42f7250951b80
MD5 7cfbe4b2b2261127a8b06d5927264658
SHA1 8379b5e6db79f3b8e0c1f8b28f1665e179694e69
SHA512 101986e83f1254ea1b5c2490127307524785390426b465870049e8e558274a66108369a938c12fda97ddc5a6afbd83eadfada77e13e1afee35ca887530cc6f51
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\d97ac3d9-ac9f-4f13-a052-fadda65ab1ea\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\e7517c70-b268-4c36-9b55-6c3a96138a28\index-dir\the-real-index
Size 2KB
SHA256 c3fadbf26219b1ef337bc631d7f462e0f5ec4fd63dc2133053fa0cd936bcf1b6
MD5 fef24e2b4903bda591aa069f7c78b695
SHA1 ddb93692783a10002ce912aa19848f4118a74c88
SHA512 e48c32b3df7dcf20d8b2724ebdcd9c706d378b864f7abc4a48f403e7d18bca400ca83a1b88fbe69c8200fd23b2030a17b70c68c888925bc0341a8e8871676e1b
TLSH
T10851404CC9906BAEE87591BA299418B253713D38FC69C29281A4B2B434532B85B47DFC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5aa2e8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\e7517c70-b268-4c36-9b55-6c3a96138a28\index-dir\the-real-index~RFe5aa2e8.TMP
Size 48B
SHA256 2b828280fb133f2c1d93ae8d7dcebd06fb955fdd27def8c8b882830c0da28ed0
MD5 5b5536ff328132e10e05989365b6fe2a
SHA1 f1abec34c4a03fe3868f69d19ac855c499659c41
SHA512 d94a68adc4b456b12f68723adfa385d6fa7897ad6a6fb12c74eb1f26ab98fa1e47f6ef22269b73d2ac7d13a068e23fa9be4d359e21abff307bc99ff1f02a7aaa
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 390B
SHA256 9f0e08a4d88b0308fbd1d3867f3c06fb8a9546924ed3fcf865932ca2c648662c
MD5 acba24fb8bc12b86c88fa6eb8a8c1b2c
SHA1 6ddbe929c46e958fe4ebfd7d89da64f65e598f28
SHA512 0c8dad51e018c3a4161e189cf221ef239444f9456d0759b689271c912953c9aecdb489740964480199235768c38aec0a6f4d9e23a3e1fa54558c35ee079d1fd5
TLSH
T144E068C6E9625144AA334FD5783461BD862A59484A80DC7C79C5201432F550FC121D2A
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 467B
SHA256 462a322eb270a1c3c2054c293b03d1da7a159de93dcaa0bc6c6266bd542f42cc
MD5 59bd290caa63a3da89728c3d6f3a07f1
SHA1 2fe292352317995edeb72c278380e9af7b09c025
SHA512 c2fd33e5500a3316442962a8c19c348853462c0b516d2e67bd056c372c9220f32b11c922949e8a12fcfcaf91a7b5b5a0f3847395a3f1d8b0f7654c187f9cf192
TLSH
T1C1F023C5A672511572734FD13C38A0BD522B6C488E88DC7DACC5705C32F520BC022D2B
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 137B
SHA256 bee98e991917242653f307429c288ab62893851db968a68d07d4021860f0c2c7
MD5 7c69a2d82f98610012b0cd6708fd95f6
SHA1 29e36f61dd992ea118df6245e112e3f7ca3e9dc9
SHA512 0725e9685325c72f25eaa353927b9e4c84a9c2e43d5999ff2f77ebf833a5edddc7816f34efd1528ede60dc5c15b56b58fbcf7c91ee21621085dea99bf641fb8f
TLSH
T153C02BE75110CB8207307FC8503CA31C940B8D4CC8C0CCF4B00AB00130B8803C400E26
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 214B
SHA256 fa58fb96aa39adc0ed577ac204252c8ab17bf464d4e72d92134a78474c01937e
MD5 1cf5d9417df43d79dd9732cf82842730
SHA1 462607d71b7eec938e7f59bb89113bff7e28f866
SHA512 c94ca7259d7f289cfdc1b90c3b9757e10c838c70abb9f5055a3f6a01ed6be41c4920917c224906e4f2bc5d1ece6a611ee447621fb0f14b96699e5c172d7f2400
TLSH
T1E9D0A7EA5270DD5522706B881038629D44255E448890C8D9E505705334F8503C501A36
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 243B
SHA256 f85f654532b296bc1c12dc73551a3556c4214ba7914cadff376f90b3b97e3ca3
MD5 19ffeb1b54781bf937e45a0b59f09d2a
SHA1 eb89d1ab30518503adf7eb49d1b79e8a99661263
SHA512 9eb5ea16a8408cb258b8a9d54556b721e3bef1e0b35484399c2db9c7b8f36353307708fe7069b828fef82a8c68ab0641c8ad52aeef812a5b7cdebef87134fc67
TLSH
T101D097D67952C14012346EC82438A3BC810B8C8C8C80CCB8A5C0300232F8A03C420E39
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 467B
SHA256 06932f767d6c7cb65e888887bea74b5eea06564e21d60eb6eaea6dd05319989a
MD5 d6e63aafba9fdfba8ad7582828f102b6
SHA1 50b5e08a7d63ebf52de2e4393e1788f6e0f3de15
SHA512 a3fe52e0f4ff7349490008c9395a62d55930e901a4f9e17b217fff27eb83165f690d00bd93b591afabed1a76f1576a422742592d3deed2f5a2a50b29108b1a0b
TLSH
T1D2F023C6B671645476738FE57838F07C422AA8468D90CC7C7CC4705436FC10BC012D3A
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 383B
SHA256 1246e42509b6a89007aeb35e5eabf9c60dd35e9eff4d2293a26c4f721d9c0bdb
MD5 f9a3775cad8bad77804a4006fb2c3340
SHA1 27554f3bea383a58114ec626e5c7824721df0b92
SHA512 b9ae6e1180967f264f68bc36a17b7c0e542d9142b0d46b9909dc207e0e455a9ce2133ca36e29559a03b093c6c269141c2f58170c87b8153302c582fdd1d32b25
TLSH
T121E068C6B9519054BA734FD57838B57D931A11484A90DC78BDC4015937F950BC012D2A
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 130B
SHA256 e51d662739ece38bb1d962c42ebfe64905fe8e5863676ebd6e9a6e86a0c5d471
MD5 6dc58c45450a5ab0028b2313c337dd56
SHA1 facf61c5384b8df4d6390a71664c2fb6866ac3c0
SHA512 3730030085591a733959838823fd44ea2f6fe29e9c218b2215252750ddf37740ff03d446721a4e452bea34855f290ef5f80c60cce286a1a3bcfa0cb991680f97
TLSH
T101C09BEB5550DB965670BFCC1078A32DD50B864CC4D0CCF4F549544235B8917C411E2A
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 383B
SHA256 80084f19079a8400c0e4517876be14b1a8ea3f95a0c59bb432a9fd1b972c030b
MD5 60a334e195cf64ce3de254ddadbaeef1
SHA1 f18bb854fcd7ea18e123c89af620a1dcef7766d4
SHA512 11cf5049c11df5fd2522fd431cf65344ac0c1ff77f851a887fa27d0fbb058d3ea5fa6199a250f8dd4b4ccf05f8225c1d8d01b4978f05659a1415f82002abc77f
TLSH
T107E0C0C6F9515054BA734FD53838B17D931F51484A94DC78BDC4111836F550FC413D2B
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\1bb2e5c9-57b8-4e31-9c73-5d8ed2e3fbeb\index-dir\temp-index
Size 768B
SHA256 10111f03a983f9ee40f21e5e0a560476d54636934bd18dd9a62be7ab855f88cc
MD5 753c140fdc45bf781f3c9e0c8b8ef001
SHA1 86549576f39ec199bb23395766e1e6b3c9ddb0ac
SHA512 5341ae2f68c7611fa70457dcffbb0bd3a238716bbb4ee3528639a1b11f907048d1bad7e00fbcfa51b517ee25cafbb50d25dad52e20e7facdbbaeedc2e1ce4004
TLSH
T16D01E167CCD35C43CC22AA77A67B344A373906EC210ADA47005D4E3D8D9753C9D41258
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\1bb2e5c9-57b8-4e31-9c73-5d8ed2e3fbeb\index-dir\the-real-index
Size 3KB
SHA256 bc4f0776c8c0c55228016be2d2c56d2f82d3e75546910cf9c5b4d6cfb0383029
MD5 afbadbe83b29988fac54b886ea508c67
SHA1 fd1b15836686e25047cc860bb31378644c74ab54
SHA512 68ac1b2a8d57ff0a4deae3808e1a5a3da85d9e41726b8c9faf106b8088e89ee89a01c0637e690b0a8826e4133b95e89e343d56b4171e80d2e12485dbe24603ac
TLSH
T1EF51E74E4E075F6EDDAC127114B90494333416CC1378191BAAFEC138FCC7B186C99BA5
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5bcc16.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\1bb2e5c9-57b8-4e31-9c73-5d8ed2e3fbeb\index-dir\the-real-index~RFe5bcc16.TMP
Size 768B
SHA256 d905a15c93022e57e6d0a337d931c00bdefc9c4cf038178bc2d28154385322d0
MD5 b5ccc1613535b575b1573492adf39e7d
SHA1 68c736c1939eba96f3623e6fb094d9cb18ba5f44
SHA512 741dfba9a6450ff23750bfb366e753234ea688ec7641062b849745947b5edd06bab07f58b46f12472fbd97ff89a3788d9376766fd36075954727a94f0490bbee
TLSH
T1C90175E780C2BCC3CC11A5B8B587205A337F4410311EC74F60DF3D6A899363C4941565
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\7f25de63-2aa5-47c3-9175-acfd1b9ed14a\index-dir\the-real-index
Size 72B
SHA256 5f936bdee668e8f92f98b9f5eecedccccacd1b5df6ac9fedc62e04444c54483d
MD5 8ef86de32f2f3db1373dbe5185cd71c5
SHA1 ebea78063c76064eb712cad3efa9ba496b50c706
SHA512 db5e1148785698c1cf98c46a9951bcb8401a37497dddd8fd965b7f0400aa7ef4dcef0f0e1d54ad030cafc02669c1c1e064f730aa9887a451d995c1827d4b5307
TLSH
T1D8A0022542808561D4121BF02BEB13532B14C91F0305130741935084EC6054B4EA165D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\7f25de63-2aa5-47c3-9175-acfd1b9ed14a\index-dir\the-real-index
Size 72B
SHA256 d342eceee7c26c67c069c88e278180823296077fb383b9df79561c21bf184c97
MD5 a8d088fabd235ea1dd566a90ad220847
SHA1 401c4360a90377e991620725229636560b98f98e
SHA512 a070dc487234c3beae7674ff460b168c0089c98fa2028684fb01b026903cda0f590d61f607edcd2e5d0273fade97fd94efc6d85ccbb55c6dab8a49c63fd86720
TLSH
T192A0025503C81047CA13D1B516D743A216459950B101121A40914246CC504A0A96341C
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 24d0025a5ce05de232dde80812fa0704df3a168b5c6fea2b463e357f20db6ade
MD5 d163c6ed137ec13b8b883b2d585f1443
SHA1 4949dcd9b37a4092736ec86bead54192fe6a8f31
SHA512 5410e10111f748502376bb788853997490c69f1bc835e02f43a9cd4ad26ade30e55de35d01a86af57ef625aa2554490ee194eafd78aa2af024d2ed42673e036c
TLSH
T1B4E020BB3EF61634F97FD3D318748AF2464279589900FD4F642592C750B1360645AC22
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 cab236de8b1526d5b5e4d43dfdaa218988971d2633fd32c4493a9cfb4d89eb9b
MD5 dfb3474d50ddb91662164701ef7aed2a
SHA1 28f98fad2f6299df2ef849c8a31e2792cde9b9c4
SHA512 a9485432bec9a8e99774bd3234599ea2d1a9ce25b6e64718c60032ef415b3fe4d144ff155706e7446ddc31a9791b5d4a30ec2286693f6378364b2c1256cf6d50
TLSH
T188E0207B3EF61634F97FD3D718308AF1454279589940FD4F642592C75071360645AC22
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 116ba9bd205dec666bb8ba6333e61042eee1fca6f2c47eb11af0dcfbfaf6f635
MD5 13dd1445fce0101e7220ae820914a691
SHA1 9947e70845460792accfbb7a29a963bb5b021fee
SHA512 37bc834494c670ec8d4b813fffb38eb896dd4fa4b1afcb7010b7670d0b09b94c4276b99b3408c93273ba0bcb47f0988241553a4a55e874e36cbdf5389528f689
TLSH
T152E020BB3EF61634F9BFD3D2187049F2464279589900BD4F642592C750B1360645AC62
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\783b018533f88331578c4c5b850446bc9cfa0162\e62b9aac-1a2f-4a45-bdcf-80bd5d67dd95\index-dir\the-real-index
Size 1KB
SHA256 a3775425d86d35a833c06a97931315bfe9144ce8e9325333f9e6e00be8d37c09
MD5 8bed23b21fac5e30ea527afe155695a3
SHA1 9596ae57888b0c5e25b33fdf3b03fefcc791a408
SHA512 baa54539f988fd589b8b8dd415aee958c2538c15c2df97d45da4eaa3aebeae48415ed7671c0978f37fbaf573b94da99e33a8dceb0cbe50383be5c7afc62354a2
TLSH
T13731948BD7010214CCB65836499C093033BE426DDD461B84A1BDB4B86DC3A4C2F9CBF8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\783b018533f88331578c4c5b850446bc9cfa0162\e62b9aac-1a2f-4a45-bdcf-80bd5d67dd95\index-dir\the-real-index
Size 12KB
SHA256 9ee65368aff4f09f75fedf8da695927240d333e15d7fd1bb36a0ef066ba3fbd3
MD5 cf61a22828dc109bc09cf24a0daa6b75
SHA1 6a4ab591cd82cf09d51894025fe0792badc685ad
SHA512 b20951d9539bd3652bc834a299a2f5aeeb5083c1af925412555360ed5d7cadf82acc85b71ff8da34f9d19dde61a52194090400d2798f21f3c609a028a2a7f349
SSDEEP 192:rs1TAaxzmtgBLKexFM7FBZ9rRvHJ6yialWRx75Wi:rsvytJSM73DRvJ1ialWRx75V
TLSH
T13752A54A6D9A9636CAB854B364F60465373A64CE85AC0F4938DE84353CC323D3F5C3E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\783b018533f88331578c4c5b850446bc9cfa0162\index.txt
Size 287B
SHA256 1058e53d2b8462064f37d444c9bc76be5ff73e39f3dbf59cb4196c8c96439786
MD5 ab711a03636113a71fb5aeb006e85fef
SHA1 57dd916253f7f621844f42d92995ebe9968015ab
SHA512 5f88045cf745e908c18c7fc60a3daf9e955f5913e2af9f80118fdadc4109cf3f1d238b5b8a08c41002f517b5fc66d2b1e6ca82969cb8d3a314af0261a759dd75
TLSH
T1DDD02BD3577B143E7B438D883C7AA4ECC0377F064492CE2D4204022E40B6C37C804E11
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log
Size 3KB
SHA256 4b8138dd5663d885ea8ade7902362539497a44153ac31eb43309d54fb49dfb96
MD5 12c6859a090b5df25efde18611ad08f3
SHA1 61d490e32cb47e64600e89b622c4c3412aac3ae4
SHA512 a72b257c1ed281d4f7cdc38113b170c070323bdd07e030b004d05098766906157bc8e00027a7f2a99e735198537cf9cb41221b9f3854a56b586a8f99c23082b1
TLSH
T1AE618B576B05C187C8D1AAFB1434F2AD691FC40ECEEFDBE2A1965F5C0658B2712107C8
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 bc3fe74369b6a5732d2f730b0de0847cb7b4203f92506010d22531cde0331158
MD5 650ac8ae52b91e0cb2cd067952ddda72
SHA1 73fb96394b8267dfdd13d4a491c32c67dc5717b9
SHA512 9d91a31aec68185ee2e2b5a2defc8fe08ffc83d89fdf1d2844f306496ac2198e3998cae614678a3d448763b5ff99ba1e9f88cdfa8941bc8598878cb4605a0a5a
TLSH
T172E07D9806CAC17DE056204B42A5BB09A3F4BD37E2CC3E026F80DC44714EF08F393180
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 0fc86702a80752f9a13c2f2373e0a5a325d4c9645540914fe1cca99d7e6739d5
MD5 0a05dbf9636a6a6a652e2d71ebb6154c
SHA1 ed8bd4065aefcb1eb2e30f92f4b54ee026ce46fd
SHA512 aff4a0e14ab2c27f2e4850084687bdb5925ac6087436045bf2fa59ecbcab58b234e12fbcdbfe41a4af657438dae6405ea08dc4a77211967d79cdd14919e9c92a
TLSH
T1BEB0029A1C5A5086C82C07B8918B85DC313DBC186B26336284FC80B8D527655422789D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 168B
SHA256 cca579592f7c38d1a393d92960c471c902919c3c9fe819fdebd895b1d0e9d3e0
MD5 bf277166bda36a574ca0acdbb4f3619a
SHA1 db53c124eb068c3fd898a9d4380b47c2ef9e31a6
SHA512 c370019bea75e106043d3ff1c4e375eff8cd18acdf936130f03bac1a94d740e5b4bc0b03adb887998914e90bd6febe08326b1f8f3e5b8f681d2019463f31fc0f
TLSH
T12FC092924E9B8885DC0903BCDCA70A58353A6AA89A28B60A88FD91B5D9AA5350A9505C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a7abf.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5a7abf.TMP
Size 48B
SHA256 e3d8458ac15389421bda240d98e90da56b6a42a12f4fb3f61f695388cf815992
MD5 f852059d91bf993abe70184c5c28bbcc
SHA1 1ed44b387f1fec168e4e3bd1a4979978c79f70c6
SHA512 485ee72171b7094feb0e383190d1ffff5f591e3823428e0e19765700ae86acffb550a9913310b0839d0193a8e80f9690eb2b5db170d5cc4b35ca625ff7dcb50a
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe5c969a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5c969a.TMP
Size 120B
SHA256 dc356ca6fa499788e8132c8f3c880b15d91409fba0ad31e84087f841723188e2
MD5 e667c651ff8031fcab5038d639092f7e
SHA1 7044a5a9163822d24292bc4844e2aaba28069414
SHA512 6d7cc7997fa07d646fcbc03f73160abba1a0bab07c9584549850985b11062cb7fa56d4b3388dd994b7b8d90da93b09264a6eaf547d4c4665277afb1e0ef48bc2
TLSH
T1B0B0125307644584D92401F891069689311D88142658139304A540A48B62441051248D
MD5 SHA1 SHA512 TLSH

Submit Download

Session_13433518997504637

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13433518997504637
Size 113KB
SHA256 d8dbc0c91b76f2949168e95e7dc9cf9999fb623f1450aa339403ced81e85ae99
MD5 a6571d2e3662eacd297423a294eef445
SHA1 4c3f63979c068eae9c41b30bb8d89ed5f687a5dc
SHA512 4924f1ea23f89cae46a3d0233ce4e66f1b67dc8bd65b2768f9b12ade4776a1a4419d58930563b9192848c13f2a3470e75545d3daf3653bfbe452042805af57f2
SSDEEP 1536:jYfljomCvCiCVC/G4UhhhUzAr4Nx5r7q:jYfXwDIkG4wjG6
TLSH
T143B354217AF6453EE17ECA78C6F921B6BD36FA0379908D5E545042080913F429F72EEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tabs_13433518997948275

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13433518997948275
Size 2KB
SHA256 78b0caf699ba8a0063dc8fadc1bd1b9a6792124f3ca031e341ceb294f1271986
MD5 5854afa9fba7cef6315915165dd7bc15
SHA1 3952a2d03ea450c47de8147d0087a39ad8a9fa2f
SHA512 f2e3b1546ed544bf7d7e97f4e72ca3b93ad8b0636afefe2cf7a1f1d6180cf60583caebe41b4e0992907a729ffb265982b8a64cf720072d50ab624b1ba7f09de3
TLSH
T1B451CC2698614637C1BE8A3CC5FA65F6FA347E03B9818F6B426123580C227225BB1C89
MD5 SHA1 SHA512 TLSH

Submit Download

3ff5f148e136b808_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\3ff5f148e136b808_0
Size 193KB
SHA256 7aeddf4fcc0c2157396e97aaaa460d1058e93ab175e23e912d3b66026c5bd73c
MD5 b4c48696ae36c686c4af4fbdd0e0a511
SHA1 970c52ebde72768d83e0f8f699d7f4e38705a41a
SHA512 3949e49dc798044a608f5ac828918eed8d34aa258f2a84e8d219fb11c47ed3c34935ed23fa9d5a28e70d7e4e25595ea96cb018a632d4d4868ad330cba4b2324f
SSDEEP 1536:2oWVFWcK8jE3VIyj/OznBCj1O8/vrbIvUB/wIULnqSZEn7zCo5VeJUuBHvIKcb89:nrFWzBlGbIvlpYPIbPIf8XFjvyuVb
TLSH
T1B4145B755300E43FB923DE61A27E7F4E3C25A167DD0686FCA5A4E430AAD3DF20526B48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 57c4d51e17c24eb5ebed212045cc354df07a161d36bf7392f9ff333ea9ec8e5d
MD5 81d2c82a04bd69315f0ed861d6231c72
SHA1 4ef2f316c781d4c9e799ebeea5a9608920520a7b
SHA512 355bb6c292557089d5d242bdfce31bd14e0398d3e6305b4690130477b881ef94fbe8db88e2c17cd9b9c4466c7a67156f2f025f6662a1551e3ced711dd6c7057d
TLSH
T14CB0220800C08C02CEB023388AC2E880B3B20FB033CB0C23A0E8A082E0A0B22830BE00
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 244B
SHA256 4ed76233cda7b4e22bde66ab502ea9c6bb4b2a90931d94e97c7b52e96d33c75e
MD5 b28c99c523d15fc82b9745f8ad5ca736
SHA1 85c68ead0ab9bcfb33cae483f4b8729973a66e00
SHA512 acabd43519c0b5d54283ce568a27b584e38beca4942e188a073b1e2f95848c5281846c5bd8ebad84951e6bcb1ae6eb3ee8a3db68247f5a7cbf485fb3959ab604
TLSH
T120D02214B3362A19DDCEBE322BC6B3851F50E042006092F3CD5CB6401CCF68E2E92AC3
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 5ace6f4b7264326e9290c90eb2a067dd543d602fcb7fda849d87fc104f2c46e5
MD5 ceae367e093e473cbc553436ad64fbbf
SHA1 82a54612fec65ad777cb11c04efc1ed8c0c24eab
SHA512 96539d9d3812f3a1b796f327361c97296a8048d640baefbed86e2eb9e81a17a943caed004d0c82b4582eb7c472f7e97700479399efb8b644324b35972593dec4
TLSH
T1FAE0D86016CAC62AE186208B4264FB0991A2BD22E6EC6E126B08E844720EB40B253180
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 f30a0b8c0f57be8f8c30df386ec0ba5fbb8bfa7842f731ba82a98cd7851ad918
MD5 f3cbe73abc3df2235b54bb8ace7dfa82
SHA1 5d3f04185dc3315e68de1e008ea0af766ef3e785
SHA512 458abd3ba078b95d35816a86bfbebb974f6d01c8c6a148cf35b6d3218cfb8217e48a95892cd188a18202c32c3a9ef39955289831ba5670a02ae79f6acad55f0f
TLSH
T197E026B44ACAC739D050688383A4BB5ECBF0BD179BCD3B06970CA881A181600B2AE180
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 03e427bfcfa27aac9903b4f34ccf0f29164b077ce407e13064c92c2a4254dbdc
MD5 ca820f6912f06cec277859becbdd0623
SHA1 245396102507eddb8372d16c60aeb4bb2e59a76d
SHA512 1e1f352e7eda3c29acb09239caaf265f29ba5108ba77981b423ec6e1ed31dec6f9eeb86ca83095805fee005f273cb123d990a407570bb88651ff1de539ddb4b5
SSDEEP 96:KsLSXrJBB+rRAl5L+KhL5F+tDLo1bfa+8Knq0JyKasCl:vLSXrJBBERA7LLL5FwDLo1bfnOll
TLSH
T15A912342753A56017CFD2A5C85E0E62B9A817473317BA92B37E850B64F6EF014DFC8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

ad5510a9-14fa-4104-b878-30b5e61f2766.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ad5510a9-14fa-4104-b878-30b5e61f2766.tmp
Size 23KB
SHA256 7996ab03842a2776d5d61548cac1f8f15142b18762aff9f02a2ed72218d657b5
MD5 b74d4d0fd60efe655c41a53cba6a1ca0
SHA1 c410d33e463a380d23124ede2a384dd1c1396dc3
SHA512 1219358451751ca8968795d9f4f5d92ca3ee6fc2c14559aee688b91cf268af553939220c873eaf1fe61dd53d40693906bfd26ed0f0e977ae36b8634b5a31c8b7
SSDEEP 384:0OxEyGzfCtgbpFfp1KhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVht9V3Rkcroru/:0YEyGjWgbrfp18F1+UoAYDCx9Tuqh0VQ
TLSH
T18CB2EB3B604CCB7E9F800AADAC596FD77D9802C797988D4047FE994C03C77EA911A4DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default_cloud_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
Size 13KB
SHA256 f9e4da319fe1f5a7d497c452421f4648a24ec7588f309ebea0f0cd61a6251eef
MD5 256c40bace492c4e28451ce149d2f9ac
SHA1 b48b0eaf986b9efc91d5c8dd394dccb6d82e2adc
SHA512 33b38d1ced015798722180fc8c8ce6daedb18cd5d0e4b3db27d6176c13cf3ccb1bd79f2e68ca390d6eb43ac508c29067e8f1a3ee9f0167cabe37ebbddf6b0ec0
SSDEEP 384:l7BJeojewj9mg1IZyvASoIL5QJwTcoEnE0YU/VwTcoEnE0GU58:l7BJeojewjcg1IZyvASos5FEnE0YREnA
TLSH
T12452007AD2211C7719B8636858BC4692F524137F8281C81F78BC656C8F7FA79A089FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a23a6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a23a6.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 40062360686937cae56b1a66acf5ea64a1f19b41aa8b89bfdc9cb6d3fa1390eb
MD5 29608d553c5d0ec5e4f752709532bf49
SHA1 5df0b98588b7e21504e510beb890129490b32bd3
SHA512 ee63dca3eb9152ab9cbb4a86fd71bdf89424295456abf81f89758c101bffde4d12ab042d8257e9bc003b9a2716d61bf939c46f871dc4cc89d72262f692248b9e
SSDEEP 768:pFZa3Uwg/f5kKL2BcEPF669yrqUjWiIwwxMt6MglJE:ha3TpZPF66INWZTMgMglJE
TLSH
T190135AF158D745B7C8AE8783A33E2E829EBCC093B5845A44B7C9590DCD5A1BFD307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 0855013cf2614f721ee4b6e1b53add2d951a8b478e068501c9e10460f94ef7bf
MD5 f3f3067a2c08b644afbd1cbad778edb9
SHA1 bb4ec4e58a9d9d0a7ddc71dae6e5a430e46c5cd8
SHA512 1d1f078f5b653d22bd04364da5e30395b4313dbbf68d4e6e6abae19c5268cbde81559cef3753000409377f2a3b6990f2ba62ab27418d78cfb411876e153a939f
SSDEEP 768:pFHa3Kwgpf5kKL2BcYPF669yrqUjWiIwwxMt6MglJE:fa3HpRPF66INWZTMgMglJE
TLSH
T188135AF158D745B7C8AE8783A33E2E829EBCC093B5844A44B7C9590DCD5A1BFD307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 025208461ba7e3e44fefa1974b124594605cce30c9d415108c11045d1fb92612
MD5 667e3a1812d532faf1c364bb04ade18c
SHA1 fa17c36fb846fbe6135ebcdbb497b24fb2ec9b37
SHA512 7cc0b4974722f7880a934cc3f6980306bc14584a5961fb6b8497004f7d5411e5cd36a9c7ae21ca49c6044c1a3c83e664436ff45a187b6905792a314d858bcd54
SSDEEP 768:hrv+4UNbdl35NkKL2BTjF669yrqUjWiIwwxMt6/d:hbsbX3QpTjF66INWZTMg/d
TLSH
T12C03BE70B8585AB7CDF3D681B2123283AFB4419386C50F98DADD670E469F4DD234B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 d4f7b24a6245af1e2ae1181272409fbe2861db1cfbb3f61dfa47cad22e1b832f
MD5 75022e9b6d8256f7af37146b73a86417
SHA1 a75cb100e56efe9464c48b2a21f0c41f89b164f4
SHA512 1a6fdd53a965266789559f5553d980747f567d70a441529f3fc9472351074fbfc5534981a75e737b97a321617ed24f4a6811a5d305081cf02ccd3ee4982648d8
SSDEEP 768:pFQU3twgXZ1nkKL2BUnF669yrqUjWiIwwxMt6MglJE:oU38pUnF66INWZTMgMglJE
TLSH
T1C9135AF158D745B7C9AE8783A33E2E829EBCC093B5844A44B7C9590DCD5A0BFD307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 1b6f1a36e427f784342ecccf54f49ba47f02de1416ef3970f51eb3bdc00f9b1f
MD5 872172d46a7a9bb4da211f0c1bea4608
SHA1 628c827cddbbfde1f961643c5aa87396903f8c17
SHA512 59fc5f206f7adf83ebfa528952132aba15edc0ec03ac8c660b4d4fded3d8925646a24c1f4d4f78b7cb7de9dab9eddbfdf750cc130bb45be21117fef73b4cd8f5
SSDEEP 768:ZFj43owg5Qc3TGiF669yrqUjWiIwwxMOJMgr6:b43OTGiF66INWZTMuMgr6
TLSH
T1291328F198D78A7BC8EE8783633D6E869ABCC053B5884984B7C95D0DCC861BFD706815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 5315e981af35738aad8427b5b30ff3319a07933d58d46a2d2519bb3659089032
MD5 7ce32fb33005b3326f31ecae2c21fd40
SHA1 02c8fd31265ea18fd6fb4668e7c93e2a14dde858
SHA512 ab0eae93e6c34ce844201658c9f3b9c7e8c59acd7a5df9594082b7bb3db880742f755c2bdac3337d8307399de04f7434b9a5f84ed9e379a42f2c40d03a720f8d
SSDEEP 768:ZFH433wgMQt3TViF669yrqUjWiIwwxMOJMgr6:P435TViF66INWZTMuMgr6
TLSH
T1601318F198D78A7BC8EE8783633D6E869ABCC053B5884984B7C95D0DCC861BFD706815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 50KB
SHA256 9e236d936d04ade325ad65cf7de97c4ef7dcb4d17a159879ace2410bfaffbfa3
MD5 87975abf229421f2c782d36154be5df2
SHA1 f9b22f8b7c34375f529deb354ea7498d0788ea82
SHA512 533d912ac646b31d84aee55a7986c77a7f9a4fddd0b40d72679aa3758806e4f409e06d16bd5b7537e59e99f636fc19c8ac0fe14b9d17f5a9978cf6a550c283a4
SSDEEP 768:ZFUQ3Mwgffe3TJiF669yrqUjWiIwwxMO8etQ3QqJYMgr6:sQ3dTJiF66INWZTMKMQOYMgr6
TLSH
T14F33B1F89CD6897EC4AEAB43633D2E5589B8C177F1A84894F7855B0DCC620BFE342815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 d65df7209eba63b5c4e63823baf4739df141b59a7ba6f50bd4765e36118cff55
MD5 02451ad4d015e1f318ace0618a107752
SHA1 77e9cd88cd9939725531d6e6d46e738b6f892a50
SHA512 785abbcc7461e49c7045c06e23252a8af63a021ca0e9236d4e5412bc04de711d91fb8eacc01da5595e7b7c0ba3baa31eb9e524f7770abcd9bc838d728b9d57f2
SSDEEP 768:NFj43owg5QVkKL2BTrQ5F669yrqUjWiIwwxMOJMgr6:/43kpTU5F66INWZTMuMgr6
TLSH
T130135AF158C78976C8AE9783B33E2E829EBCC0A3B4944954B7C9990DCC461BFD747825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 6ee0400a2db3ff2fe371388732bfe56a84ccb7e1eb00840bb72bd1952f4ae394
MD5 7ddce12e2c84e6c08745b56c5e078869
SHA1 665d116cd6c7f59e6117fd3092a03133b139794a
SHA512 91a9ec4c14bffd7506029f52468a075e190f65276f9aad4bbc4e16d1931599e47fd12d2919485aa109160bed16a6a8d74e405fcf037135c9cd1b79a56fa7d9e5
SSDEEP 768:NFHG3owg63JkKL2BTrQ5F669yrqUjWiIwwxMOJ/H5:7G3qpTU5F66INWZTMu/H5
TLSH
T1B91349F198D78976C8AE8743B33D2E829EBCC0A3B4944944B7C9990DCD471BFD64B825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 ca519a3b044ce8e00c0e3f7503498074615d6578d6010e41744ccb71f9f8ad71
MD5 75048b280ae6f3ce9a25735c619ae2b6
SHA1 f195593c83d365a5011a51baf66c616093de0b72
SHA512 d3c3b1bb9a5ce1d5d2d404f39f2b36ed1992e3681398ae087e8a617d03415c87f0aa51f06be6718f8f5b4110cae16c401539d65d3ecf0469eb4e34024bfa60d0
SSDEEP 768:ZFhQ3Jwg28e3TViF669yrqUjWiIwwxMOJMgr6:JQ3KTViF66INWZTMuMgr6
TLSH
T1291328F198D7897BC8EE8783633D6E869ABCC053B5884984B7C95D0DCC861BFD706825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 846bf60ebea8c39d9988498b7aed09339529794a5498f40897ec64b522c99205
MD5 eb6d2f63813571bc7cd0366c582ea658
SHA1 285fdd8935a9012cf43f35842b32e0fe0ffdc708
SHA512 fc68511b4791a5013705fa863fdb7b2e84dbc5b0e70f36115642df8d53c086d74e5e37b9eafc1a1ec2fa9461f7d64c2ac3fc62b3bff3b86999521f081bea77f1
SSDEEP 768:arv+4UNbdl3lPkKL2BVjF669yrqUjWiIwwxMRthUiler:absbX3CpVjF66INWZTMXhUsQ
TLSH
T11F03CF35AC585AB7CDF2D68672433783BFB4109396C50B88CACD670E469B0DD2747A2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 d954a3c945d3a74302acdd7f0fbafaf2924a2e830e79be3845d6295102c20c97
MD5 80acf5c8723017f7fb0f4338c01f4eb8
SHA1 b95f79082a47f5bbcb949560b2c57d909ebddfd0
SHA512 5ae5bfc775ee46ff0c8b0fe8d9a032aa092235853ccdbf9f03c442ac1225b594854505f24ba33b7323ccb7854b0f5a96678617036ea902befdcbd49a7dc821d7
SSDEEP 768:urv+4UNbdl347kKL2BkjF669yrqUjWiIwwxMA6Uiler:ubsbX3npkjF66INWZTMbUsQ
TLSH
T1A703CF30A8685AB7CDF2D686B2533383BF74519392C50F98CACD270E469F0D9274792B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 e7bb42294f9a341b48456e1b8670d15ddb10a461775a4568ffd9cc3a270c1908
MD5 5b617153f0a41785adfefe3ef02c7035
SHA1 449f14efbe8db69913d6c0e4c65fe16814ec9c85
SHA512 0d96574d4130c0952a65316a0375384ed179046f74537682d69165d407ca1041846e92a4f7509e46b16f5e94e5f417194772582a3ff2556b3101d0aa78fedaa6
SSDEEP 768:ta3x1nkKL2B7jF669yrqUjWiIwwxMt6MglJE:ta3op7jF66INWZTMgMglJE
TLSH
T1C7F2B070ACA459B7C8F7D781B31233C6EFB08193D6C84E8886DDA70E069B5DD134782A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 58d0564d2e7d38e9a92f6adcd873adf903cb82adc21059b444372a9026f51d74
MD5 b94f07c79ca0d8c8cdcb9a00d07fa08c
SHA1 ba6a50a0eccec137b5be1e5223c94b1fba8c36d9
SHA512 9138f8059bb260f772f6259ecc0e4bc593085d57775f6e5a6e255e4109bf0c00daec82b95995a4b92d782a8772aa4f951eb3220ea6236f1b2ce9c93520b88b73
SSDEEP 768:Xa3dNkKL2B7jF669yrqUjWiIwwxMt6MglJE:Xa38p7jF66INWZTMgMglJE
TLSH
T137F2AF70ACA459B7C8F7D781B21233C6EFB08193D6C84F9886DDA70E069B5DD134782A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 2af3e1a0b5e59b5b5f14e20827b6a18962ee57d7db026c7c8eb96ac6f5c299e3
MD5 96c81191b142fcb1c9e1529a09616823
SHA1 eccac6dd2376b5f84ac99d24c66e7d50e3ea877a
SHA512 8a595b6db67df20a1a19f944ac23b047a9163d5a2db2ee5e8a54a52593fe7d26d8a694cef9775ab0b57409e57cdc93219a2a2a93d4613b3f133df70ab895c6c3
TLSH
T1CAE00112920020ABD038033000C39F202DB280244293A1845B30027C2C313043A20981
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 3f73feca5e85af1a125e559ecaaa9090b74df477720a988454754bb7a981cff0
MD5 926ac131a957a30c347153e46c5a11c4
SHA1 c0afec611475503a9d2496e7c5a55a1d206890d4
SHA512 401b51653d7a023a9ec80218cd87fa881cf4ad9ab0796b9ac88d53b5a459396c36297721ffb5af0ed48407546628a0eaaa6b3dbec15536eb85dab857e8dd1c3c
TLSH
T1ABE00452D30120BBD438433544C3AF203EB2A03442E7A2866B34027C2D363493E30A91
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 36917ef97f251f462fbcc60ac1298f502d8ccecdc3342b1ae572a1d24ce7378f
MD5 149a9b1c502beb101f9ca64c7de5fd80
SHA1 7ec39e793a75e05ea70fa4924a9ccc93692e1955
SHA512 d0ef6b81ef61a085458b600af554894ec9e2d11102224712afd56b7bb2a76dac69a34afd094065be1c2eb74988125e652651f93277083c63abd3f6b3978ce1bc
TLSH
T167E0C516D351217AD06C433480935F207BB2D07103D65387AB36053C6D727093E71ED1
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 c75a782c2fd23d781fd8e3573699444904d3b751576cc03518374592fb3992c1
MD5 23e32db796cb6312c8f1d386f207ef8c
SHA1 3aa7d811200db4d495e821f61eec44d23cd9407d
SHA512 dfc7ab1c91802107dabb2a3de0f3bb378b7eb7f16c05e6434290738b1f7864d8820702c0349bccaf634cbe517c981ff44e59360f181d18372cfdf824e99f0db5
TLSH
T14BE00042D30120BBD438133540D3AF203FB2E03443EBA3866B25127C2E763493E70A91
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 ff4ad5a6d0e8331fd59cc1dd1616c633e5efcca915845e7661f560412b143710
MD5 4f74e93b7c441f9ec57ad384e31b46c1
SHA1 3526ae1665f8ad50cac40b17cdf4e0dac94c0c79
SHA512 963668a44cb256ee30ea0ffb6fee7c39993633e1d5b14178a46799fc0a836107ca33cc31c677f036e5248d103c1aae3cc2d1d64a958cb6a7f8ace14b37889213
TLSH
T108E0C906A36122ABD028433040936F203BB2D06003E66387AA3A02386D623193EB0AA1
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 2b81efea55bfa001e45f8241c2d40e99ab94904f4ec411e47f4343b1f45e2dac
MD5 c92b82f67e48efe13beed57ed60b10d7
SHA1 effe13ed67562860be6a1146129ef57ff5f30f08
SHA512 da6c272bdd6142225cf6890c751afd93097232f111a5ff5ff6b01588f2d10a77bf790f9ed2e8adbd14331cdd86e67f0c5493dffcbe2ae3cd9c3fcfc63c6b4a76
TLSH
T194E0EC06D36112BBD028433040D36F203BF2D06003E763869A2A02383D623193EB0AA1
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 eedb65937c4be655e8b378250f2b705f3c73fa6892b17724b3fd4b57674e8185
MD5 0c9c83105389d3cd0a62ac70cd1ffdb4
SHA1 229eb74587d45385cf6804c958fdbd8da838151a
SHA512 1be189ce45ff2852ecc47cf023f9eb17dee6c21f5252f608ad051af6be4708f1870986e54e8a777c4cd118494e720a6b60f415230364c2b3b80c1e6892c3b43c
TLSH
T17DE00952D30120ABD438033500C39F203EB2803442D3A2866B30027C2C353453E20A81
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 24ab0017874cb243adc98a6a13b3969d5d45d141005a482395b2bb34d16e68d0
MD5 2e21e0aa3a19a9ebdf7e22b577e5b134
SHA1 fa9ba0b454603378967466bcd5e0856993225f68
SHA512 fb84c264afae4206a18cf31d4c7d2bda758acc89ca81621172a4d85599e21f7b5324247a5dbb3e7c9ce2f8fbc5d42d7cddac5b9d407e2bc360f0ebc88755f003
TLSH
T198E00112920120AFD038033100C39F203EB280244393A1855B30027C2C313043A209C1
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe59e98b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe59e98b.TMP
Size 392B
SHA256 7192afdad162eeefee9e791e2a7599537f7825711bef7f25aa6eb6665ce7a371
MD5 b535ba01afd2ac5adf1a8a1a323b3af5
SHA1 a34822c48a0033fa78ae77f7e1468f310a5d2480
SHA512 967aa058de40443ee1995e4401b03710bca2b72dc9906e0edf776f447d70b37cb8783e87413ad263e33bf943dd345ed3fdd58ff412fcaab8d1298530f7a4068e
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 f110d1cf1fc12a672234e2ed5e95339f4b7d822bd031c9f974995c2f4200c839
MD5 098f2bffdf025d35a9f52c92d01c5d3c
SHA1 c635472e205ff94b948343f98f32b79999f6caf4
SHA512 a4faff3e8cabcf4c27688533bb7a31ebe8a788c12b45987f29a0479c36f2fa20e57a3e93e10ce9d1685c8dd72bfaa007c13ffec39b2b1608a82b493a48c30c52
SSDEEP 3:MsEllllkEthXllkl2zEFlli0I:/M/xT02zX0
TLSH
T1B64404047FC04415C5055130C051C3501370D55515D15F433CD154135CC55400D10C00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 3dc9043838386f5363ac96a01477cf3163b5118b80191576a11b32ce9894314c
MD5 cdddc745a8c954dc438c931889999bdb
SHA1 7908f975b6815460caa2bc3438efbd8fc8d36211
SHA512 3d2d4852aa2ac6cb0b9b6cbca9f04366afd48d362d869be877ef324c16d72ff119b5842891baa2b6b99df2de2db8d3be5c23f0f97f8943bd74195996bcb66a0a
TLSH
T159A02407C473C00FF4144051C45C034114F4C047011DD0115070D33714D40CF03F5C35
MD5 SHA1 SHA512 TLSH

Submit Download

a2e0634e-e4aa-40fe-a000-6c803d40ae84.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a2e0634e-e4aa-40fe-a000-6c803d40ae84.tmp
Size 392B
SHA256 957902e7fd87179438859011fb0e01fdad2f5f66b90eb40753a763a5bb519e80
MD5 8ee0e081dc2d9e15d99eb79af2fa0e4d
SHA1 5cb1a40f3995f4ba918519a189aa110767d19f03
SHA512 5e37b4aada50dfe4ea1eae39ec85fb89a37e5231b8af3d6e76782ec03bd509ebd21a421918157a0bc3e95f056ea7447d2f0a8fe2daa98a5ae596e8e262b2d2fa
TLSH
T19AE0C916A36122BAD468433080936F203BB2D06003D66387AB3A02386D727093EB0EA1
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

802893d1-cd7e-49f6-b923-7fc0ac312914.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\802893d1-cd7e-49f6-b923-7fc0ac312914.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

7b7e0b60-a215-42a8-8535-0ea3690e2c79.tmp

Path C:\Users\Admin\AppData\Local\Temp\7b7e0b60-a215-42a8-8535-0ea3690e2c79.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2728_1905278902\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Set-up.msi

Path C:\Users\Admin\Desktop\Set-up.msi
Size 3.7MB
SHA256 61437ea1f762189a2c13f5d713b02bbca9a8bd18e8850dc828b871e19db5fb18
MD5 bd9b125facb77975e1f6aedb6d16da7d
SHA1 e09783a7d8be64bcf7ffe667bbc251555c2c0ec4
SHA512 f454260f56f8e6f7ab57b32bc34962245062156effb8102ba76a75c4594b300aba630fed5e8cbadd6fc66696a36c31c42ac39731a7911d4052375df8aa4051dc
SSDEEP 49152:hlm387Dss7/0a89lOeLnTdd3o8pCU4OsaRz8bSZIcwSkl1qBQH8GRYiRH3AUqFZm:rboYe3dhZCU4iRz8ugC6H1RYid3AU4I
TLSH
T194062317B3A511FAE1B3413488521686EBB67C2947709B8F136073B96F336D09D3EB92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SETUP_INSTALLER_(PASS=2113).zip

Path C:\Users\Admin\Downloads\SETUP_INSTALLER_(PASS=2113).zip
Size 38.4MB
SHA256 a1d91cccc43986e837a0e8d9080c953fe20b739e3968991857a09ef66ac6cfe4
MD5 c6217a18fa17641ef8ec93ca6d25050d
SHA1 207cb5ff84b05d010e7ff89edc6c6c6a89920347
SHA512 dcadcbfa03ef0eb63c0e675b414ceb72d0255c5d711bfc73d4058a559f61f8cc3d9c94ca4f9c551ce6d31eb9d8b8561ed4adf093577ffd2296e8c6efcb1d58dc
SSDEEP 786432:WemN64ejw2OLdTZ6t9lEzE1qYA3vFbPRwhEpa9WBAm0iC9fZLW21VdW:IN64eM2OLdTZoSwqnPH04BAmrkZLW21e
TLSH
T10E9733DF59D95E8172510D96B4A7C8AC9F585A067C1F80E6E0EB8B2CECCAC34305FB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Public\.ff_tmp\prefs.js
Size 1KB
SHA256 5699d289db6c14c5b4992450d2657bc8d64b7ae586d9713b7fc4c0482c822b21
MD5 dd2337cfd4ddc49264565b81e50aa9ff
SHA1 5d5c6f3c3bed94a9d0a33021bf1e3e545fa01135
SHA512 22d6b0264b657b6a8dd76469eb630c4b0543f7ab02bebf40e5e248c7efea1445af3b80399866bce539e263d7350fa1641a220adbf79c817da6a0437d877ebc06
TLSH
T15131DCE61946CF6FA1B936ACBC5945A0D7B34176B67F9C9220F880854018F3412FA9E7
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Public\.ff_tmp\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 48KB
SHA256 25b576ce9e1b26aca68995b9cf431f4c328fd76fb3b816051db1b15f3cb3665f
MD5 ba90164dcbe7acfed52e249a4fe7cb4c
SHA1 f35bb05407880f01bf6ba809717b8257313fb8fd
SHA512 3fd212da66995cef3634d13f9c35b1f8d17d8812f38a841ae57a383da81990262ae302395ca3e3605ce930922f74f3e6566192102a8e966af965d8abcf21b316
SSDEEP 96:Oa16S6CKnqlizbxV+2xVeU7X2B0cZMNXCL23Cfi2f6E2A/2g42cRCH2ZC0H7mh9:Oa16S6CdFAWlyh44CfiaR/skL0H7
TLSH
T16223448D3A33AD50CB69F0B8639145AA584FB1DD0030278965D9DF8C842B1ABED1FBF5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI85F5.tmp

Path C:\Windows\Installer\MSI85F5.tmp
Size 3.3MB
SHA256 fda32da9df7f9bec6dd8e3a3b08b656d23122455289e5a378b78d776d7cca162
MD5 a150107639f3d565cb851f391082eb1b
SHA1 94c3bfdee52a166b8bc4426239a3b7294e7839a9
SHA512 2e6156bbb0fc58a6ab2cb07d4910ef74259d72b2001bc3f0cc426f93d3538a1a24212d6e129ce524a8ecb284b4090795ea6da477beb61a511995b479da85dba0
SSDEEP 49152:m7/0a89lOeLnTdd3o8pCU4OsaRz8bSZIcwSkl1qBQH8GRYiRH3AUqFZdSj:moYe3dhZCU4iRz8ugC6H1RYid3AU4I
TLSH
T101F53357B6E210F9E0B7557888505946E7B5786BAB70DB8F536002BA6F236C0CC3EF42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIBA55.tmp

Path C:\Windows\Installer\MSIBA55.tmp
Size 322KB
SHA256 bbb8e168109526a7ce9dd4785044184cd6e5fa9803285ce156a04874219fd442
MD5 e0369759e6cbe9eed309e3bfc7c7b8be
SHA1 b2514f3eb01b4a7d7e0b68db1b6e27baddcba219
SHA512 91a5d1b54e55c40817094fb4928ad8a620f1de8dd74ea5f90ed4498af22c08a55656a35c52d8685f38fae5decf65fc43921ba4460df979188f60aa6ed92a1022
SSDEEP 6144:YzU4EEV98+CWBN1P+sbpJeZz5cYSAdtcHWEFV/YqcDlB:Yw43VJCWBNzbY7dKF9cDlB
TLSH
T1E164D00BB3E510F9E1779139C8A11506E7B374261760AFAF03E007B5AE27AD15D3EB62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 53951b14c23b990974316b65952626e56d25db5c1c7645279d2db6ecd47a058c
MD5 39dcd9033f04217962467e11c6e426c2
SHA1 3e0c72c6f1d7d9ce4a62e80214c93ede0e526bbc
SHA512 d71fd98e7764ffe477dfe3d2ada6bba94e83a082d148f2e326ee8ba8c52d84e473bb38d9b1dc1fa1ea186a965a8550cfc52bc03e9f168437b25e345490c46835
SSDEEP 24576:rFo3DMP2doO/vvTL/yQAQiFAvLeqrLXzU9WCtNuYm1ua5nxg8IhWwpKx0uO:kHc
TLSH
T1E157A52476F92200E7B79E3CA8F06A238D397D579C15DE8D45421B4E0922F71E872F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{0d1d075d-2fb7-4a9d-9ed6-ef4437200d44}_OnDiskSnapshotProp

Path \??\Volume{5d76dc85-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{0d1d075d-2fb7-4a9d-9ed6-ef4437200d44}_OnDiskSnapshotProp
Size 6KB
SHA256 c617dd3e31ba3a75f5869b2a746c7e0eb33be9860e0f95871398c05b8b0a8751
MD5 9f728f4f30facc5d4b4c620628fc855b
SHA1 0865d0a408f679f5a8a05244f1243a2f080ed698
SHA512 a655fb616b131401e49474adb9366a4bcd28cd500411e764faac02641eec8324c93ae3f507753980d30c05ce42b88df3391f82cb3083a2617b2c26531ef97da0
SSDEEP 96:FNYFM0wvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:kFCb++uVm
TLSH
T175D187085AF54711E2B3AB3128F14557A877B911EF33CB8E0198238E6631A10F975F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/684-1862-0x000001CCFE750000-0x000001CCFE751000-memory.dmp

Download

memory/684-1855-0x0000000140000000-0x00000001402A2000-memory.dmp

Download

memory/684-2032-0x0000000140000000-0x00000001402A2000-memory.dmp

Download

memory/684-1854-0x000001CCFE740000-0x000001CCFE741000-memory.dmp

Download

memory/684-1864-0x0000000140000000-0x00000001402A2000-memory.dmp

Download

memory/684-1863-0x0000000140000000-0x00000001402A2000-memory.dmp

Download

memory/1884-2140-0x0000000140000000-0x0000000140047000-memory.dmp

Download

memory/3120-5639-0x00000000017C0000-0x00000000017EE000-memory.dmp

Download

memory/3120-5688-0x00000000017C0000-0x00000000017EE000-memory.dmp

Download

memory/3120-5681-0x00000000017C0000-0x00000000017EE000-memory.dmp

Download

memory/3120-5674-0x00000000017C0000-0x00000000017EE000-memory.dmp

Download

memory/3120-5660-0x00000000017C0000-0x00000000017EE000-memory.dmp

Download

memory/3120-5632-0x00000000017C0000-0x00000000017EE000-memory.dmp

Download

memory/3120-5653-0x00000000017C0000-0x00000000017EE000-memory.dmp

Download

memory/3120-5646-0x00000000017C0000-0x00000000017EE000-memory.dmp

Download

memory/3120-5597-0x00000000017C0000-0x00000000017EE000-memory.dmp

Download

memory/3120-5590-0x00000000017C0000-0x00000000017EE000-memory.dmp

Download

memory/3120-5569-0x000000007F6D0000-0x000000007F6D1000-memory.dmp

Download

memory/3120-5581-0x00000000017C0000-0x00000000017EE000-memory.dmp

Download

memory/3120-5570-0x000000007F6D0000-0x000000007F6D1000-memory.dmp

Download

memory/3120-5695-0x00000000017C0000-0x00000000017EE000-memory.dmp

Download

memory/3120-5702-0x00000000017C0000-0x00000000017EE000-memory.dmp

Download

memory/3120-5709-0x00000000017C0000-0x00000000017EE000-memory.dmp

Download

memory/3120-5911-0x000000007F870000-0x000000007F876000-memory.dmp

Download

memory/3120-5924-0x000000007F890000-0x000000007F891000-memory.dmp

Download

memory/3120-5926-0x0000000001520000-0x0000000001526000-memory.dmp

Download

memory/3120-5934-0x00000000018A0000-0x00000000018A1000-memory.dmp

Download

memory/3120-5933-0x00000000018A0000-0x00000000018A1000-memory.dmp

Download

memory/3120-5932-0x00000000018A0000-0x00000000018A1000-memory.dmp

Download

memory/3120-5931-0x00000000018A0000-0x00000000018A1000-memory.dmp

Download

memory/3120-5930-0x00000000018A0000-0x00000000018A1000-memory.dmp

Download

memory/3120-5929-0x00000000018A0000-0x00000000018A1000-memory.dmp

Download

memory/3120-5928-0x00000000018A0000-0x00000000018A1000-memory.dmp

Download

memory/3120-5925-0x0000000001890000-0x0000000001893000-memory.dmp

Download

memory/3120-5716-0x00000000017C0000-0x00000000017EE000-memory.dmp

Download

memory/3120-5730-0x00000000017C0000-0x00000000017EE000-memory.dmp

Download

memory/3120-5737-0x00000000017C0000-0x00000000017EE000-memory.dmp

Download

memory/3120-5744-0x00000000017C0000-0x00000000017EE000-memory.dmp

Download

memory/3120-5751-0x00000000017C0000-0x00000000017EE000-memory.dmp

Download

memory/3120-5758-0x00000000017C0000-0x00000000017EE000-memory.dmp

Download

memory/3120-5765-0x00000000017C0000-0x00000000017EE000-memory.dmp

Download

memory/3120-5772-0x00000000017C0000-0x00000000017EE000-memory.dmp

Download

memory/3120-5783-0x00000000017C0000-0x00000000017EE000-memory.dmp

Download

memory/3120-5790-0x00000000017C0000-0x00000000017EE000-memory.dmp

Download

memory/3120-5797-0x00000000017C0000-0x00000000017EE000-memory.dmp

Download

memory/3120-5802-0x00000000017C0000-0x00000000017EE000-memory.dmp

Download

memory/3120-5723-0x00000000017C0000-0x00000000017EE000-memory.dmp

Download

memory/3120-5667-0x00000000017C0000-0x00000000017EE000-memory.dmp

Download

memory/3120-5604-0x00000000017C0000-0x00000000017EE000-memory.dmp

Download

memory/3120-5611-0x00000000017C0000-0x00000000017EE000-memory.dmp

Download

memory/3120-5618-0x00000000017C0000-0x00000000017EE000-memory.dmp

Download

memory/3120-5625-0x00000000017C0000-0x00000000017EE000-memory.dmp

Download

memory/3120-5572-0x000000007F6D0000-0x000000007F6D1000-memory.dmp

Download

memory/3120-5583-0x000000007F6D0000-0x000000007F6D1000-memory.dmp

Download

memory/3120-5575-0x000000007F6D0000-0x000000007F6D1000-memory.dmp

Download

memory/3120-5578-0x000000007F6D0000-0x000000007F6D1000-memory.dmp

Download

memory/3120-4606-0x000000007F6D0000-0x000000007F6D1000-memory.dmp

Download

memory/3120-4589-0x000000007F6D0000-0x000000007F6D1000-memory.dmp

Download

memory/3120-4587-0x000000007F6D0000-0x000000007F6D1000-memory.dmp

Download

memory/3120-4592-0x000000007F6D0000-0x000000007F6D1000-memory.dmp

Download

memory/3120-4594-0x000000007F6D0000-0x000000007F6D1000-memory.dmp

Download

memory/3120-4598-0x000000007F6D0000-0x000000007F6D1000-memory.dmp

Download

memory/3120-4590-0x000000007F6D0000-0x000000007F6D1000-memory.dmp

Download

memory/3120-4584-0x000000007F6D0000-0x000000007F6D1000-memory.dmp

Download