hxxps://tileman[.]42web[.]io/?i=1

Analysis

user interaction
yes
max time kernel
65s
max time network
68s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 17:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://tileman.42web.io/?i=1
Sample260910-v4tk8sv1fv

Score

6^/10

discovery

Malware Config

Signatures

Looks up external IP address via web service 1 TTPs 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
112	api.ipify.org
103	api.ipify.org
104	api.ipify.org
106	api.ipify.org

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4652	msedge.exe
7268	chrome.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe

Suspicious use of FindShellTrayWindow 54 IoCs

pid	Process
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 1876 wrote to memory of 4444	1876	msedge.exe	85
PID 1876 wrote to memory of 4652	1876	msedge.exe	86
PID 1876 wrote to memory of 1612	1876	msedge.exe	87
PID 1876 wrote to memory of 1612	1876	msedge.exe	87
PID 1876 wrote to memory of 1612	1876	msedge.exe	87
PID 1876 wrote to memory of 3424	1876	msedge.exe	88
PID 1876 wrote to memory of 3424	1876	msedge.exe	88
PID 1876 wrote to memory of 1008	1876	msedge.exe	90
PID 1876 wrote to memory of 4928	1876	msedge.exe	89
PID 1876 wrote to memory of 1008	1876	msedge.exe	90
PID 1876 wrote to memory of 1008	1876	msedge.exe	90
PID 1876 wrote to memory of 4928	1876	msedge.exe	89
PID 1876 wrote to memory of 4928	1876	msedge.exe	89
PID 1876 wrote to memory of 3856	1876	msedge.exe	91
PID 1876 wrote to memory of 3856	1876	msedge.exe	91
PID 1876 wrote to memory of 3856	1876	msedge.exe	91
PID 1876 wrote to memory of 2744	1876	msedge.exe	92
PID 1876 wrote to memory of 2744	1876	msedge.exe	92
PID 1876 wrote to memory of 2744	1876	msedge.exe	92
PID 1876 wrote to memory of 5032	1876	msedge.exe	96
PID 1876 wrote to memory of 5032	1876	msedge.exe	96
PID 1876 wrote to memory of 5032	1876	msedge.exe	96
PID 1876 wrote to memory of 3928	1876	msedge.exe	98
PID 1876 wrote to memory of 4004	1876	msedge.exe	99
PID 1876 wrote to memory of 3928	1876	msedge.exe	98
PID 1876 wrote to memory of 4004	1876	msedge.exe	99
PID 1876 wrote to memory of 3412	1876	msedge.exe	100
PID 1876 wrote to memory of 3412	1876	msedge.exe	100
PID 1876 wrote to memory of 2756	1876	msedge.exe	101
PID 1876 wrote to memory of 2756	1876	msedge.exe	101
PID 1876 wrote to memory of 1608	1876	msedge.exe	102
PID 1876 wrote to memory of 1608	1876	msedge.exe	102
PID 1876 wrote to memory of 1608	1876	msedge.exe	102
PID 1876 wrote to memory of 3568	1876	msedge.exe	104
PID 1876 wrote to memory of 328	1876	msedge.exe	105
PID 1876 wrote to memory of 4576	1876	msedge.exe	106
PID 1876 wrote to memory of 4576	1876	msedge.exe	106
PID 1876 wrote to memory of 4576	1876	msedge.exe	106

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://tileman.42web.io/?i=1
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ff87066c188,0x7ff87066c194,0x7ff87066c1a0
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1876,i,8540547739792054233,5098988913586086814,524288 --field-trial-handle=2580,i,2491149598489070284,11073296032217458837,262144 --variations-seed-version --mojo-platform-channel-handle=2608 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1692,i,9067188816650161743,6090053237626275469,262144 --field-trial-handle=2580,i,2491149598489070284,11073296032217458837,262144 --variations-seed-version --mojo-platform-channel-handle=2572 /prefetch:2
  2⤵
  PID:1612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2336,i,5380883086958076630,12581074273966240691,524288 --field-trial-handle=2580,i,2491149598489070284,11073296032217458837,262144 --variations-seed-version --mojo-platform-channel-handle=2648 /prefetch:8
  2⤵
  PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,12553746374720255529,13783509925032328065,2097152 --field-trial-handle=2580,i,2491149598489070284,11073296032217458837,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3480,i,18404253725742726875,4331655234672892273,2097152 --field-trial-handle=2580,i,2491149598489070284,11073296032217458837,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:1008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4180,i,8648081615278331978,6046228454019778477,2097152 --field-trial-handle=2580,i,2491149598489070284,11073296032217458837,262144 --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:1
  2⤵
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4328,i,7085420647759915886,8808320635509808291,2097152 --field-trial-handle=2580,i,2491149598489070284,11073296032217458837,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:2
  2⤵
  PID:2744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5104,i,12336834624659320088,14091208186776815835,2097152 --field-trial-handle=2580,i,2491149598489070284,11073296032217458837,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:1
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5332,i,3239784911863653960,7557124738690641053,524288 --field-trial-handle=2580,i,2491149598489070284,11073296032217458837,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:8
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5288,i,14623558499390283760,5797138296744350195,524288 --field-trial-handle=2580,i,2491149598489070284,11073296032217458837,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:8
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,4389886630703409642,9849012081231349352,524288 --field-trial-handle=2580,i,2491149598489070284,11073296032217458837,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:8
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6624,i,14686889449522099824,12675890895830241181,524288 --field-trial-handle=2580,i,2491149598489070284,11073296032217458837,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:8
  2⤵
  PID:2756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6772,i,9941172804426077036,1226257801199012548,2097152 --field-trial-handle=2580,i,2491149598489070284,11073296032217458837,262144 --variations-seed-version --mojo-platform-channel-handle=6828 /prefetch:1
  2⤵
  PID:1608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7240,i,3145553243005889038,17136431449273676426,524288 --field-trial-handle=2580,i,2491149598489070284,11073296032217458837,262144 --variations-seed-version --mojo-platform-channel-handle=7244 /prefetch:8
  2⤵
  PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7356,i,13357289139294000189,8173135574928985184,524288 --field-trial-handle=2580,i,2491149598489070284,11073296032217458837,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:8
  2⤵
  PID:328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=7412,i,5976355193038477727,17502402492840749257,2097152 --field-trial-handle=2580,i,2491149598489070284,11073296032217458837,262144 --variations-seed-version --mojo-platform-channel-handle=7060 /prefetch:1
  2⤵
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=7712,i,4116559548285017352,17457602141819829384,2097152 --field-trial-handle=2580,i,2491149598489070284,11073296032217458837,262144 --variations-seed-version --mojo-platform-channel-handle=7672 /prefetch:1
  2⤵
  PID:928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=7876,i,1397910744703578700,11212271762411718128,2097152 --field-trial-handle=2580,i,2491149598489070284,11073296032217458837,262144 --variations-seed-version --mojo-platform-channel-handle=7904 /prefetch:1
  2⤵
  PID:544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=8036,i,12199225911161370548,3120125986358361240,2097152 --field-trial-handle=2580,i,2491149598489070284,11073296032217458837,262144 --variations-seed-version --mojo-platform-channel-handle=8040 /prefetch:1
  2⤵
  PID:2740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8220,i,4094383957604994677,5802506772496105035,524288 --field-trial-handle=2580,i,2491149598489070284,11073296032217458837,262144 --variations-seed-version --mojo-platform-channel-handle=8224 /prefetch:8
  2⤵
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8268,i,8978222986008072845,18422077548477864243,524288 --field-trial-handle=2580,i,2491149598489070284,11073296032217458837,262144 --variations-seed-version --mojo-platform-channel-handle=8228 /prefetch:8
  2⤵
  PID:1992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=8464,i,13984382856065041004,1387374830547475987,2097152 --field-trial-handle=2580,i,2491149598489070284,11073296032217458837,262144 --variations-seed-version --mojo-platform-channel-handle=8580 /prefetch:1
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8568,i,13499394550585181094,74385039318805443,524288 --field-trial-handle=2580,i,2491149598489070284,11073296032217458837,262144 --variations-seed-version --mojo-platform-channel-handle=8540 /prefetch:8
  2⤵
  PID:5244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=8840,i,10918355024765595869,8376769870168320494,2097152 --field-trial-handle=2580,i,2491149598489070284,11073296032217458837,262144 --variations-seed-version --mojo-platform-channel-handle=8812 /prefetch:1
  2⤵
  PID:5340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=8828,i,15345544888826359629,6572088181922417879,2097152 --field-trial-handle=2580,i,2491149598489070284,11073296032217458837,262144 --variations-seed-version --mojo-platform-channel-handle=8804 /prefetch:1
  2⤵
  PID:5348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=8816,i,1832024604065415697,14657581195857860365,2097152 --field-trial-handle=2580,i,2491149598489070284,11073296032217458837,262144 --variations-seed-version --mojo-platform-channel-handle=8880 /prefetch:1
  2⤵
  PID:5356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=8772,i,5710412345701902828,14289902682085280121,2097152 --field-trial-handle=2580,i,2491149598489070284,11073296032217458837,262144 --variations-seed-version --mojo-platform-channel-handle=8780 /prefetch:1
  2⤵
  PID:5364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=9484,i,10751933923283081907,17748575566173469694,2097152 --field-trial-handle=2580,i,2491149598489070284,11073296032217458837,262144 --variations-seed-version --mojo-platform-channel-handle=9524 /prefetch:1
  2⤵
  PID:5564
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4336,i,134110838029323807,7375483792254577238,524288 --field-trial-handle=2580,i,2491149598489070284,11073296032217458837,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:8
  2⤵
  PID:5456
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4336,i,134110838029323807,7375483792254577238,524288 --field-trial-handle=2580,i,2491149598489070284,11073296032217458837,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:8
  2⤵
  PID:5300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=5104,i,17540607244095839966,17175359840087194273,2097152 --field-trial-handle=2580,i,2491149598489070284,11073296032217458837,262144 --variations-seed-version --mojo-platform-channel-handle=10032 /prefetch:1
  2⤵
  PID:5792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=9708,i,3843817357699162639,18120860238984608906,2097152 --field-trial-handle=2580,i,2491149598489070284,11073296032217458837,262144 --variations-seed-version --mojo-platform-channel-handle=9720 /prefetch:1
  2⤵
  PID:5996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=7416,i,9922068519495192927,6527868619334646460,2097152 --field-trial-handle=2580,i,2491149598489070284,11073296032217458837,262144 --variations-seed-version --mojo-platform-channel-handle=7412 /prefetch:1
  2⤵
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3696,i,976602825679540345,13743885609530424692,524288 --field-trial-handle=2580,i,2491149598489070284,11073296032217458837,262144 --variations-seed-version --mojo-platform-channel-handle=9300 /prefetch:8
  2⤵
  PID:5756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=10004,i,12161263964274466487,16287694014467565767,524288 --field-trial-handle=2580,i,2491149598489070284,11073296032217458837,262144 --variations-seed-version --mojo-platform-channel-handle=8392 /prefetch:8
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7328,i,5369128127397267287,13509082720170672667,524288 --field-trial-handle=2580,i,2491149598489070284,11073296032217458837,262144 --variations-seed-version --mojo-platform-channel-handle=8436 /prefetch:8
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9336,i,4127012427577767900,99469238192450251,524288 --field-trial-handle=2580,i,2491149598489070284,11073296032217458837,262144 --variations-seed-version --mojo-platform-channel-handle=8764 /prefetch:8
  2⤵
  PID:5276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8768,i,2960796420452757249,15810821749770158451,524288 --field-trial-handle=2580,i,2491149598489070284,11073296032217458837,262144 --variations-seed-version --mojo-platform-channel-handle=8756 /prefetch:8
  2⤵
  PID:5288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8428,i,11801665596344694126,2107309408273406525,524288 --field-trial-handle=2580,i,2491149598489070284,11073296032217458837,262144 --variations-seed-version --mojo-platform-channel-handle=10100 /prefetch:8
  2⤵
  PID:5304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8492,i,10739277130054277142,3603610644639499762,524288 --field-trial-handle=2580,i,2491149598489070284,11073296032217458837,262144 --variations-seed-version --mojo-platform-channel-handle=10120 /prefetch:8
  2⤵
  PID:5496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9324,i,9260363773799399478,6606792082576668923,524288 --field-trial-handle=2580,i,2491149598489070284,11073296032217458837,262144 --variations-seed-version --mojo-platform-channel-handle=10192 /prefetch:8
  2⤵
  PID:3340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8028,i,17167335699496864296,15664682923910119574,524288 --field-trial-handle=2580,i,2491149598489070284,11073296032217458837,262144 --variations-seed-version --mojo-platform-channel-handle=8196 /prefetch:8
  2⤵
  PID:572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9640,i,13942019808540429892,6849651261583736750,524288 --field-trial-handle=2580,i,2491149598489070284,11073296032217458837,262144 --variations-seed-version --mojo-platform-channel-handle=8396 /prefetch:8
  2⤵
  PID:5752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8376,i,14804084075080945048,14456291004608497471,524288 --field-trial-handle=2580,i,2491149598489070284,11073296032217458837,262144 --variations-seed-version --mojo-platform-channel-handle=8380 /prefetch:8
  2⤵
  PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9764,i,7416203497133216345,12977103433315688107,524288 --field-trial-handle=2580,i,2491149598489070284,11073296032217458837,262144 --variations-seed-version --mojo-platform-channel-handle=9628 /prefetch:8
  2⤵
  PID:6076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9444,i,3523803680263517678,13637105981259783565,524288 --field-trial-handle=2580,i,2491149598489070284,11073296032217458837,262144 --variations-seed-version --mojo-platform-channel-handle=9468 /prefetch:8
  2⤵
  PID:5564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9304,i,8232595503909431079,232124690541455677,524288 --field-trial-handle=2580,i,2491149598489070284,11073296032217458837,262144 --variations-seed-version --mojo-platform-channel-handle=10276 /prefetch:8
  2⤵
  PID:6020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=10456,i,10967263785061146295,6183447916370763794,2097152 --field-trial-handle=2580,i,2491149598489070284,11073296032217458837,262144 --variations-seed-version --mojo-platform-channel-handle=10436 /prefetch:1
  2⤵
  PID:6492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=10388,i,4102288738026973218,2595433694657898106,524288 --field-trial-handle=2580,i,2491149598489070284,11073296032217458837,262144 --variations-seed-version --mojo-platform-channel-handle=10484 /prefetch:8
  2⤵
  PID:6516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=10696,i,2089585574131635323,8511951225278999858,2097152 --field-trial-handle=2580,i,2491149598489070284,11073296032217458837,262144 --variations-seed-version --mojo-platform-channel-handle=10796 /prefetch:1
  2⤵
  PID:6704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=10920,i,14221517489962917677,15923613357393491752,524288 --field-trial-handle=2580,i,2491149598489070284,11073296032217458837,262144 --variations-seed-version --mojo-platform-channel-handle=10840 /prefetch:8
  2⤵
  PID:6732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=10812,i,9364529160163792526,16549853314631122126,2097152 --field-trial-handle=2580,i,2491149598489070284,11073296032217458837,262144 --variations-seed-version --mojo-platform-channel-handle=10780 /prefetch:1
  2⤵
  PID:6380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=10772,i,9839936616700227735,15222178796271400979,524288 --field-trial-handle=2580,i,2491149598489070284,11073296032217458837,262144 --variations-seed-version --mojo-platform-channel-handle=11016 /prefetch:8
  2⤵
  PID:6420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=10608,i,15618557354803919926,5104122464113033593,524288 --field-trial-handle=2580,i,2491149598489070284,11073296032217458837,262144 --variations-seed-version --mojo-platform-channel-handle=10968 /prefetch:8
  2⤵
  PID:6432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --metrics-shmem-handle=2112,i,2234389482046301906,8802820757314034743,2097152 --field-trial-handle=2580,i,2491149598489070284,11073296032217458837,262144 --variations-seed-version --mojo-platform-channel-handle=10988 /prefetch:1
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --always-read-main-dll --metrics-shmem-handle=11244,i,16394393489091117524,13906682346880087674,2097152 --field-trial-handle=2580,i,2491149598489070284,11073296032217458837,262144 --variations-seed-version --mojo-platform-channel-handle=11268 /prefetch:1
  2⤵
  PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=11400,i,12662339372189608904,7653015908828119786,524288 --field-trial-handle=2580,i,2491149598489070284,11073296032217458837,262144 --variations-seed-version --mojo-platform-channel-handle=11312 /prefetch:8
  2⤵
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=11480,i,7363816825133577579,12136484775321971523,524288 --field-trial-handle=2580,i,2491149598489070284,11073296032217458837,262144 --variations-seed-version --mojo-platform-channel-handle=11404 /prefetch:8
  2⤵
  PID:5456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=11524,i,12312274688469405638,17154809854809419152,524288 --field-trial-handle=2580,i,2491149598489070284,11073296032217458837,262144 --variations-seed-version --mojo-platform-channel-handle=11532 /prefetch:8
  2⤵
  PID:7184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=11160,i,5559712986260371359,11454102375275048839,524288 --field-trial-handle=2580,i,2491149598489070284,11073296032217458837,262144 --variations-seed-version --mojo-platform-channel-handle=11464 /prefetch:8
  2⤵
  PID:7344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=11476,i,16092974347757903970,4623842243135024152,524288 --field-trial-handle=2580,i,2491149598489070284,11073296032217458837,262144 --variations-seed-version --mojo-platform-channel-handle=11764 /prefetch:8
  2⤵
  PID:7876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --always-read-main-dll --metrics-shmem-handle=11884,i,16536591475506723420,15430026682927134625,2097152 --field-trial-handle=2580,i,2491149598489070284,11073296032217458837,262144 --variations-seed-version --mojo-platform-channel-handle=11896 /prefetch:1
  2⤵
  PID:8012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=11844,i,71724174263416598,17782122667013162704,524288 --field-trial-handle=2580,i,2491149598489070284,11073296032217458837,262144 --variations-seed-version --mojo-platform-channel-handle=12052 /prefetch:8
  2⤵
  PID:7132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3756,i,1893139049881631483,375014359753370435,524288 --field-trial-handle=2580,i,2491149598489070284,11073296032217458837,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:8
  2⤵
  PID:7180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --always-read-main-dll --metrics-shmem-handle=4392,i,14593327691129914180,2161479225940239914,2097152 --field-trial-handle=2580,i,2491149598489070284,11073296032217458837,262144 --variations-seed-version --mojo-platform-channel-handle=12204 /prefetch:1
  2⤵
  PID:1652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --always-read-main-dll --metrics-shmem-handle=8508,i,17453126324087419549,11985545736807660012,2097152 --field-trial-handle=2580,i,2491149598489070284,11073296032217458837,262144 --variations-seed-version --mojo-platform-channel-handle=9620 /prefetch:1
  2⤵
  PID:5480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7928,i,15178332453553704465,16597801520309170613,524288 --field-trial-handle=2580,i,2491149598489070284,11073296032217458837,262144 --variations-seed-version --mojo-platform-channel-handle=7932 /prefetch:8
  2⤵
  PID:6192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9736,i,13290639095599858210,340998173758036288,524288 --field-trial-handle=2580,i,2491149598489070284,11073296032217458837,262144 --variations-seed-version --mojo-platform-channel-handle=10876 /prefetch:8
  2⤵
  PID:8144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=84 --always-read-main-dll --metrics-shmem-handle=8380,i,4138642590174507805,6963994555411835797,2097152 --field-trial-handle=2580,i,2491149598489070284,11073296032217458837,262144 --variations-seed-version --mojo-platform-channel-handle=10484 /prefetch:1
  2⤵
  PID:6744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=13180,i,9094464964588599147,8644514700290681439,524288 --field-trial-handle=2580,i,2491149598489070284,11073296032217458837,262144 --variations-seed-version --mojo-platform-channel-handle=7312 /prefetch:8
  2⤵
  PID:6736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9320,i,11743509789903302408,17546282150774395400,524288 --field-trial-handle=2580,i,2491149598489070284,11073296032217458837,262144 --variations-seed-version --mojo-platform-channel-handle=10940 /prefetch:8
  2⤵
  PID:6328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=10736,i,13039197396668191214,5909143814806896209,524288 --field-trial-handle=2580,i,2491149598489070284,11073296032217458837,262144 --variations-seed-version --mojo-platform-channel-handle=1248 /prefetch:8
  2⤵
  PID:7092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=13232,i,9500104948022245558,5020479095342511496,524288 --field-trial-handle=2580,i,2491149598489070284,11073296032217458837,262144 --variations-seed-version --mojo-platform-channel-handle=13228 /prefetch:8
  2⤵
  PID:7128

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1768

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2c8 0x154
1⤵
PID:1408

C:\Windows\System32\CredentialUIBroker.exe
"C:\Windows\System32\CredentialUIBroker.exe" NonAppContainer -Embedding
1⤵
PID:4672

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
PID:5648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff87087c728,0x7ff87087c734,0x7ff87087c740
  2⤵
  PID:1816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1700,i,7614656885243615973,17894151485523581881,262144 --field-trial-handle=2532,i,15501899563972078760,18292190530730997377,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2524 /prefetch:2
  2⤵
  PID:7272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1808,i,7168697044620008961,11981873581832396511,524288 --field-trial-handle=2532,i,15501899563972078760,18292190530730997377,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2560 /prefetch:3
  2⤵
  - System Time Discovery
  PID:7268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=2024,i,9237314996636416899,13213729019527290721,524288 --field-trial-handle=2532,i,15501899563972078760,18292190530730997377,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2588 /prefetch:8
  2⤵
  PID:7284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3196,i,3871269671571406468,1453273840161472526,2097152 --field-trial-handle=2532,i,15501899563972078760,18292190530730997377,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:7612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3200,i,1543907805468113208,8760144920160564499,2097152 --field-trial-handle=2532,i,15501899563972078760,18292190530730997377,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:7624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4216,i,14162642902081516715,18442270672705959214,2097152 --field-trial-handle=2532,i,15501899563972078760,18292190530730997377,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4232 /prefetch:2
  2⤵
  PID:7768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4560,i,860030017448460307,15421312455238190755,2097152 --field-trial-handle=2532,i,15501899563972078760,18292190530730997377,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4588 /prefetch:1
  2⤵
  PID:8120

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:7572

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

021a67d6-7cb6-4b02-833e-150f23b7f578.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\021a67d6-7cb6-4b02-833e-150f23b7f578.tmp
Size 414B
SHA256 395dc24e524f42490cb2161fc723eaba4e3b980db0b196ef2f5b0e786bf92bf9
MD5 832c879313a1dadc4b4c410abdf0207c
SHA1 55aa484fa9fa0731aead0dd31bf4e2698c02335d
SHA512 192077e22aa1c73f0a5fd9e506ea41b943d15f14721daf7793ef0ede0ed06d10392fb14a820b0928295f5d8669d3283b50dd29f169cf54d552ce83555e2c5f58
TLSH
T19DE0ABA9C962BC3708F91718A4664705E64013172640984F373C410C4FB473A828681C
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 9b4038349f4befc0dfac3f6710533e15a5c25bb1307cda3e0e21a9ca8650b7ab
MD5 29a79f7608b8997b2df6ebba572af017
SHA1 e9f88efb783adf26453e02e83d6bdfb921fec5ad
SHA512 f4af49bb05c1e6dd394338454b8babc6f25c9baa2f39a4360631c0bc10719473ea93e8e06b35c31c4e9a3f247fdf1ed25e1fd5f5c83dfd037eef3ddb7f719b28
SSDEEP 192:5R0Gx/I5Rjb45svuv7MF+pAPRp2S9HHsb+WNnLk0Fe2PeVGO+Y+VyIsnAUgtaJ:5R0GxERwrgoUX91wo0g2YJ28
TLSH
T17642A66EEE11697B6CDBC219FD62BB53D7F5202121941E80EAFC8A2C15E76CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 16KB
SHA256 2aa03c82b611b3fe6cdaf5fe4d55ec208fa47cbc8eb4b77e72c8c64341a677da
MD5 d210c96fea5205951e7c2614a7381afc
SHA1 557c415e4225993caf8e885048da101e051788af
SHA512 750c85e9610e5a33785bc6cba2d6f2bfcfc88d8faeb9e483f64ebcc7e003bd18e674ff8f85c7d547df2e713fba7b271f291bfd08a30f1084a556b6429ad50502
SSDEEP 384:TRjPq7KxkXqKf/pUZNCgVLH2HfgslT37pLuLcMFgXODPO+ErU3voHGjB22oR0S:TxPq7KxkXqKf/pUZNCgVLH2HfgsV37pb
TLSH
T1577219676C4C8E7B0F94CACCDC167F4FADB5025B65EA886482FA582903D5ADF01061FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 aa66dd592890732feb59eae12f449d704204617e7961255b41659e2b4f1e8c0f
MD5 51d930912feeffc209178ff4be324cc9
SHA1 d6025fb1aa24916c390aac444e5e382bba2e4501
SHA512 d14647fcffde593127ce96168b3815475e56cad3a7c986ad894a6554d1dd162d1e35169d8e45e41dc7273125b20270f638bbe4544d7e265aee76e220158f6a20
SSDEEP 3072:/CGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMM:/1m7Rkm1tYpBeh2BAoM
TLSH
T1A4C312275D75E93758B9BB0EB08E0B1F1EF14AA6D830DA92C8D85B0467F97CC1A05934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 bc1e944c510a6e4abcc4c22ef48fab4374a67449507f5ab8c85a8d87962cca2c
MD5 c1c922347e52ec738da3c0562ce4d5e6
SHA1 a6018e1f1402700bca03be4c696336a8baea911c
SHA512 cf754b404cde8e420d2b713036263cbbc7da3276f21f5394bae2b56a0f5888cca9353354daaddbc01ccf9aa0772cafdaecc521a0dd64326d90c71509808a2a0a
SSDEEP 3072:fbGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMx:fCm7Rkm1tYpBeh2BAox
TLSH
T18EC3122B6D75AD3758B9BB5EB04E0B1F0EF149A7D824DE91C8D45B0823FA7CC0A49934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a31d8d87abf7db54e5af159959ffb39655ef3b9838cf4cf3862ab9032cffa32f
MD5 bf1d07b6014e003b40d614772c316285
SHA1 b83cc0fe9b1c176330f64f0bbec9605df94578b8
SHA512 264b5b82b86b41d6416d85eba302e258bcaf8742440858f1d3f1ce1301a762de80c5af403afa6502341111ee2d8b8fdc034813a33fbdffca1c1bef4af1dff68f
TLSH
T15CD08030FE14F4D6E22711B6551447105E5849E321A38285F1344C1CDDBC445D6D5B97
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 92b83a0e542b7bb3ed324c35b5f2a40c47a6351981065b804e4d9d80ddd6d7ee
MD5 9ea20a12d0c030ae7f84014f382662b7
SHA1 7912569189cf07c1ce092a268e67e9f391b7c8c7
SHA512 39ca414f13163c8479fe7650ae0dd1607b267fe3f319c09aec7bd5f68448e9ac604351069bf6b166b3f897d3afb5d7f35e609b9fc72b9debbcb05bad8fad7d81
TLSH
T132D02B20FF04E002D1072172540047100E0848902093C140E030441CDCEC804D395307
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7d64d2777f444a09968d6c155732e22d743fcf7c319c222bc06f6bb97808e489
MD5 89bc5edb6bd922f1cf8ec5536b066fa6
SHA1 c50aaf0fe1444780bb68ee7ab6e1c7468c2f303e
SHA512 77a1265c1484940562f1514202a0072e343efb323e1dcdb979fc9b7a2c69d85b814c076828b260c0b86a19e482ebb0a2df850f9b7c130a327861a7c56e26cde8
TLSH
T15CD02B20BF04E402D1072172540047100E0848902093C241E030441CCCED844D395307
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7909299f4c51e75a0001702e41f0f72b946a7c66746ea9af12abe4d9dea7bd88
MD5 6a0ecaccbc79dc82cd6402d57dc4a083
SHA1 4b72080c1db98ffc51edc408f9ae5017eef9f8fe
SHA512 672d1e15a11ee7e9ca512af78112f237077d6b2be740fce793345b14d653e5800494f692a5d1eec58614891295263550f467f3f9cd788c551840b5d284b07d78
TLSH
T14CD09720FD08F8E1E1232079021003003E8C08A220538145E020082CCCB8482C2E0AA7
MD5 SHA1 SHA512 TLSH

Submit Download

6500258e-270f-4998-b26c-171c5ac80557.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6500258e-270f-4998-b26c-171c5ac80557.tmp
Size 17KB
SHA256 06869560eced008a33f6fe38cc83fd812d7b214fa4a5a4be88422a5d0ec51648
MD5 231927ad5cbd0f68b04b9fe2015d3c6a
SHA1 e9226f43f62abd52f2de688644a063e8559bb6dc
SHA512 7f41a00752a2df5ab12e9b1aef83fba06620ef955f6653c1bef05fe1beeba0b06bae3cb58f0b1497bd2dd5611eff8a38f3a8c093fcf912ea51bd8285f028eef7
SSDEEP 192:sxZVRYyM/jK1Ml8MWGcBAw/fOskPwVNdpLdPPaWHPMlIXHW6+WNErlXlzPCPVoxn:sxZVWxmAw/fOskPCpHb0lomlUPZZkX
TLSH
T14D72F95266309977CCC7DA09BD31BF93D6F564629A950E889EFCC91C01EA6FD220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000085

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000085
Size 19KB
SHA256 2ce924388f1f8524daed50e7d6724c56f0c135fec9e4c2033389a8ff0b1e4b74
MD5 f0934c933597133e6563121a37e102b6
SHA1 77b50b1f928e9369e4266868529d622bed7d1966
SHA512 920a3f63c19f245a0c0915dadbb7424c2ac9de46356501aaa3ea390d764ad95c5a4668d58809b6bc6c5d167c2d9f1e866d2f3f708948c7c87c72310987058784
SSDEEP 384:410tELA1kvzmbKH+u9JUZgguhs4z1sUAL3fPLT5dcmmNdJ4iiVxJ+65:0pA4+p6JU+1/zpALvPLT5yPxyP5
TLSH
T17192F1137E0A83ECC7D5B778838F49D70056A2CA98F19A6D045EEF74BDF7B00516AA02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000086

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000086
Size 68KB
SHA256 f88c52373d5ef75c8278d6d7419cd5ae9a78874c3983337cfbba7ada0091d623
MD5 799c8d8e07696d69c53de92ea8bfc977
SHA1 b038bb4d6b60c749cf3bbe3b19a92e972c7c7bc8
SHA512 b36116c89d46675db9feacd383f415271810ced971cbb99c089e04223db9c6008b090f87ddbf032a4019899a77ddcc46bef570b9de971a8b57a844136ded7077
SSDEEP 1536:/igde2k9KxjHAV05wAEHH7t0eEvuY//15oYFNqY7IdUA+ue:3eT9KJe9A07DEb15A9dUqe
TLSH
T1E86302B114F7A0F33E989DCA48DCD9B02CB81F3EDD096575E66E1C586A18EC4342714E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000087

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000087
Size 181KB
SHA256 080c072bfd77e440481d2eaeeba911aab1786f87ba753c26be696f17ff1b8081
MD5 efa39200418625168cdd88b642ba8b99
SHA1 6890274f0f04bdc43a8b463f9c8b273e7c28b6a2
SHA512 55a70f9e674cef76690f760e5f172daab68ea30800c8692aa1cbf44ff73d734e78166b0ba876ca8526ed9772222e524bdee7e28076a278e98d64dfa3e675a93d
SSDEEP 3072:95C6hI0fdLpL6scpi6+l5igYxqJPNSXN19vjBbpp1wYt5Cvs/QaLX:95C6htfdFjcuHakuBbpp1qvs/z
TLSH
T1920412C4FDAC2B05D11572B4495F9EECA023DB58C22B6F40D4A57AAB1B948F51B3FC82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000088

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000088
Size 69KB
SHA256 40c2b1e5ac485e81e0194092c134a1b4e400a74e59e7780e0fd2fe5f650a194f
MD5 3ea2549fe9a928191bebb14407d6cdf8
SHA1 d88dd74791732f836bd1db3dc4e07f35131a595a
SHA512 5b0bb625869c2212643e69c3a0e984b1a421196f76f369b5c04bf1ae984763719cbdc6aa26b37c4fbe5eaf2078e78aa1b2afa9e26e40c85e053a7943cd297d90
SSDEEP 1536:v0hdWcp/0nvD9hywdkz37br+Hs+xmlpPrrYUFizzAt+YSX1LUTT64V:v0fpMn3ywdk7bSHvxm/rrxiz/Yg1LubV
TLSH
T14F63028E68C999B4847FA6A3CC0B1C8EB923524455D161D5EF7CFCF435688407AEE339
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000093

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000093
Size 60KB
SHA256 a221cbf72963df1c02c8bc202b159379f26e3d0d06225a5933209e745040e35b
MD5 b90c0e06b88c09158b13db21c7fc9ef7
SHA1 a4b968f5abcd2addd2d8f2d3e6fc01f4127c95a3
SHA512 430aadb5315738f414c2d4ca0d9e2be42f5242a3b28765993602aed4b34e334d854a88a051e6519877b7ffd8a5bf4ee7276885d6daec541826dba878f8c07f2e
SSDEEP 1536:iw916VqIkIFHzR32SF2Sjm+KW3IS7uchJEsZP8:nngaGzR32ceS7uchJ1ZP8
TLSH
T18C530227CA3085D2572D05004B9EF35A1A6079FDEA09CD7E920157F772ACAACFE20E21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000094

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000094
Size 68KB
SHA256 fc70b88dddb2da85326b7ff7e1fa801f0099e5c0d3a85863afd2737af9b199a2
MD5 cb3d1e69fbf9c94b15e92f2fa26892f0
SHA1 b8e5aff1547d49a1285e2e0c4cb43dcd9993f468
SHA512 0f890af69b223aaec8bbc753bbc626f6cf0e0660182e38871a03337f1eec7be6b47cb9d5034a3cb8c226feb6cd964d396f56fecf07257f3cbc13de642c175ac2
SSDEEP 1536:1RrPSv8UR94fNhLVxko8PojNVcL7tk9/yGeJ3GI:PPZGefNhLVxko8MrcL7fJWI
TLSH
T16E63026A7FAAA437FB2C87016FF23034D1F8FD579034042826515BB5A4578E92326F99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000095

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000095
Size 19KB
SHA256 c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f
MD5 2e86a72f4e82614cd4842950d2e0a716
SHA1 d7b4ee0c9af735d098bff474632fc2c0113e0b9c
SHA512 7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1
SSDEEP 384:eV4Eqc1qgk/XDVGi8m7JEM9TUKPqivdjfommfP974oNF38:eV9qlxhVEM9UKPpMV74kFM
TLSH
T1D692D043765579E9AF1280C82397E6A4EAAD9A88D6C0FD0950F56CBECF708D32261825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000096

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000096
Size 63KB
SHA256 caecff4179910ce0ff470f9fa9eb4349e8fb717fa1432cf19987450a4e1ef4a5
MD5 226541550a51911c375216f718493f65
SHA1 f6e608468401f9384cabdef45ca19e2afacc84bd
SHA512 2947b309f15e0e321beb9506861883fde8391c6f6140178c7e6ee7750d6418266360c335477cae0b067a6a6d86935ec5f7acdfdacc9edffa8b04ec71be210516
SSDEEP 1536:tLQFdWY1+jAIuhc5s3JBP2ffX195jJqu1H5g60:qFdv+jA/cizOfTdRJ260
TLSH
T10E5302D829DC2DF4466490C19420E379C6FACED8E4485B6F5B2A2E0DF78DD7527C7242
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000097

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000097
Size 43KB
SHA256 14ef713f8c26bb48eb58aee7291d24bfec7fe04461af055f0c9ad63a298c5a93
MD5 e7f31b312430a58beebf02569971cecc
SHA1 6a36445d1f2bd9ded564f13fb047b896f1ada7db
SHA512 f069e3981fc381c27bb2f3c1a36251142fce8661d614f92058b9418def9a950323957fc9df7453bb671b7639869542656cce9df96e0b45e6e12a6637ebc6e1d8
SSDEEP 768:3CZ1Qapm3DP4Q8Ag1BGBa0p/PE+4dxquLkDOBFwQ4aUjnlxGR/Yy:SZ6a43DP4RbGBa0VPE+pWkDOBFwQAjne
TLSH
T154130200E0F0CE82941B5C8A0D78948A7B210AD49EB5737486E8DFF7C51BDB8C6DB05B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

25c383a90edcb4a4_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\25c383a90edcb4a4_0
Size 55KB
SHA256 a4564b114c7b90a718200f62f541510653d1d48d53d84846b448cf908d07ad49
MD5 e62cffa7d1db1afb44f9b35057fc5787
SHA1 3eb624f9d8a90649569242625ffa92108012907b
SHA512 02028114d0b67d2fa3d3d7a3ef9ccd5937bd3fa4fc3f480325d7af18dbd0246afba62646f5d5741bbf295f629b3f025b547b6b2fdff56eac55d3fae65b462b47
SSDEEP 1536:5UD8mbeQiC3baXJTOElFxrwSR8I1YvYxwJ1VrhAtG:GdeQlYdHlHwSR8Ic1
TLSH
T1DE434A120B106A5BCD6747F45193C62B77764A593E93D72A6AF173323CA23E39ACE103
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4aa0de0dc0ca12a3_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\4aa0de0dc0ca12a3_0
Size 237B
SHA256 b297872b76b396bdc1e4bb05b68a769d95a81da454b2cb1c78c8f277d4d61736
MD5 f11a207208b67bd61f8edc60ff5d75ad
SHA1 28d4cfc7edde4b50d846b5b5f49042643cba4613
SHA512 3369a0f53dba61c96e620b7d03a0cc53f7637ebfaf2b96ba4e5045dc8bc9fda87d92159c4073f4b1756646c0b56ef91b08138c778455219d9c5fd380604ecc64
TLSH
T177D0A7AF38344A9CE92C68B0DDBB028FA7035078559860108879E0B50D91831C45515C
MD5 SHA1 SHA512 TLSH

Submit Download

7556c71b052a0ef5_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\7556c71b052a0ef5_0
Size 48KB
SHA256 d46645edccb9e636acad4953f33550742e426929c748423b3ad5043bb4af046d
MD5 743124c9c61c3237dcbe0135069b4205
SHA1 842ed18dbcde1d875950bea010c2031571a679c7
SHA512 eaec15d5d6b6ca85f7bc4ce196641094d5cbaa1c808f2443f00001f596327c8994c1ff6960c65ecf9f89e0e68a1ba24b27b3d5b29cd7f6bb1feb01ddf6a96255
SSDEEP 768:ToKjn1JlwTH/xgRSOF8nXhL9t1SqAfYoMCDGVM71cK:TZjn1JlwaSLXsqOTPKM
TLSH
T15A2395159B90ED29CB7627F44263C963B33255883FC7D71B32E8B33A2C452D14F9A94A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7a81808f73239375_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\7a81808f73239375_0
Size 2KB
SHA256 389cb524b4d8761f0a5f21b55324da92062b608417b01a5cc513d928a6831b54
MD5 d7744cea24b97cb290b450daa2c6651b
SHA1 62c22d9870c2138ffa094d66ee7a537180f8345b
SHA512 2288e60655dc51d77d0d9488754d92dd0e1f2ba3107b7a9bb2c83b3b2b86633b9b9a24298fe49f17ed80fdd4fa1beddebc78c9e5bec6c739cfac160562371abb
TLSH
T1B6413C7FD22A281DF971A6F4346E1A5AD128C9BCC687F11EC8C41DA1A8FF26313A5174
MD5 SHA1 SHA512 TLSH

Submit Download

ad7d462d682832a8_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\ad7d462d682832a8_0
Size 21KB
SHA256 c61be7f3e93614cf0bfa492571b5d515b3ff30a8e690811736d952399e1f52b1
MD5 4012ae2fa6c051be3a5ef5f43928c381
SHA1 81a2dcaad0a1ab53f5b02db6afe0cddbb910c0b5
SHA512 a0932ede393e2ebf4093b994df2e521220dbd3cae22688d957cf49ab3077ec63c84d34b99545d9fded5426b4ee04e94b264d08302c0abfc8fe24859ae6415d69
SSDEEP 384:UVJAJklDlOHLw5zzX/IETsnCJClNTsS2FfJZDxoYvs8GIdOqo:UECVlOHc5zzaDtUoYvs8rO
TLSH
T14CA253D1EBA0FAD5CBB313F402528A627732459C2DD39B2361F8B6353C9A0F15E95C4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c8d7892db3ef89b4_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\c8d7892db3ef89b4_0
Size 237B
SHA256 6cb15ff6974b90e2f30abddee110bdda51591e1a0c89265a564d8d03c13d1036
MD5 a8ce3729848878c5d09012253f477f58
SHA1 9204a8dc45209937955f896f8293b67e5d9df1a3
SHA512 2433dc79728a6b4354056457cdb3f6599f674cc3f2de0adaa3f0fab5015cd68036caa8c05f0d9cd087e54eece748b48bc00e0e1ec9e5256456c379082d9e6357
TLSH
T106D0A7AF799A0414DD5946F9D76B6986CA21C02D248E91518025A1B6664B5706610458
MD5 SHA1 SHA512 TLSH

Submit Download

d9766eea060759dd_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d9766eea060759dd_0
Size 45KB
SHA256 b3edcc79cc0c362625bc3fdc87f05ab0abf2d3d2809cb05eb6059300544932e1
MD5 0551f0f2c75ae9f9e9f8f48b710beed7
SHA1 e41a4d826affa1ec4cc9408c31ed5aba92ace7f3
SHA512 7eb0392a79e904e0347ecb17e239f16e0bd06bd35ef7ccddd7f3037f8425a58cb7a44d3eeffb6c874d03c168aa3c39df09e912d402490cff1f9a701e9dd94e42
SSDEEP 768:m97bYsZPQTQSDpUS0fUXOIEzEV6UF4V4aHGqoWFPjU+y:m97bbKUSWUXOIEI34V4aHzoWhU
TLSH
T1A923C41C1711AEC4CA655EF14F96CDA3763109D83CC2A72FD199A636EC192E14F8B84F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 c3239d3b5941fa7f5871b9dce464805c02752853c04adce84c26bb2fad1e5fba
MD5 1b6409ed97d33d5def9c05939ab392cc
SHA1 07d90b9ba8496171bd83c518a40a680a85f219b1
SHA512 79813de0b4aa2fec703dc874d95a450913456103fba23c42eb6105f350d34623013654cbeb6caf7cbed76f43d45aba320dd0a67185e4f4019fa0b5ed3e0ce382
TLSH
T185D02333350171F555DD3EC15065EC4ECB35005489539DD421D05879753245C0527042
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 6515bf3f4eb2689fe6425dadaa42a0635dfc8281e8f2c9f482f636e58c33f262
MD5 b7e42ef90116ca00ed8d90dee9dcfe2a
SHA1 7918d4d7fad2e910a1d564f46c90915d9e79e763
SHA512 11c373ee683c1b81db3527136b7b96b0d09812143a1ace6d3a633b10552901c3abda20fa2e75b87debeafb4b84d80410d3a2609b29110b0516c03e70c9068640
TLSH
T12AD02323354171F655DD3EC19065EC4FC32610984553DDD430D05898553245D0917141
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries~RFe586bb5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe586bb5.TMP
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 78ab12eab54c065dad1a98bb370de64998e095b682c876f2ded03fb4015f620d
MD5 8c4523f96983f5cb54fbf0823e447b27
SHA1 d4de11df97fd272ed7f6019f066b49b40101846c
SHA512 3881336e78952abe36866b03afb274d31e4555383b07b941f646ba53c3848ff4843f1433ec2285f5d8129c1ae4fb48bdb51a4a76f313fba14028691fc2b1f328
SSDEEP 192:sxZCmRYyM/jK1Ml8MqcBAw/fOs40KVLdpTslU/HW6+WNEPRt/Yv4jSkIgrJ:sxZCmWimAw/fOs40AzHbI/jZ9
TLSH
T14742EB517A346977CCDBD209F9517F53D6F54472A2940E94A9FCDA1C04E6AEC2203C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 58187e53e44dd7e4e09af1222c2bb1ec7f144c18b00c4c9e17c1e8fee01b29cb
MD5 ad67c6fc27e02f716e079082e5adad2b
SHA1 1389bf8207b7c42d2ed83ac313ad88279a5337b5
SHA512 89a6595dba601d60a78655b2b0134b6a6bce2176d915b15da48fc0e516d2b782c3f0bb6f23aeabb53b1e101abbd868a3131d415e27863697a99ad4d03f5fae07
SSDEEP 192:sxZsRYyM/jK1Ml8MvEcBAw/fOsk0dVLdpTvPMllIHW6+WNEEuFPRXVYDjLxakjSX:sxZsW0mAw/fOsk0/DHbSV6rZPkX
TLSH
T1AC72D852A6309977CCCBD609BD31BF53D6F554629A950E88AEFCC91C00EA6FC221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 558359821c152794de3658e25d23e239da67aecf410fd621bb73f11b4c97c178
MD5 7aa74871431143caff7b0e649206ff38
SHA1 b95fc8938f735240e7bee33dbb4c45741058c772
SHA512 4beb539d77be778616a1575bb795e9439f08b3b7674b9efdd939410d73a8c139f30ec0b0860b2a9b7c78e0e1f804b08d67901590e5e47da2e29f69d5d53ba4b3
SSDEEP 192:sxZVRYyM/jK1Ml8MvgEcBAw/fOskP2VNdpqPaWvPMlVIHW6+WNEEF5PCPHn9YD4S:sxZVW1mAw/fOskPQGHbY9nZPkX
TLSH
T13F72F85266309977CCCBD609F935BF93D6F554629A950E88AEFCC91C00EA6FC221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 d45a6b0b7fd480fefcfd14fe1f5b0a77e47467c738199f0de0077c3730c8099c
MD5 2c175d51ea0981e5571a72a304a9f11c
SHA1 7b2f1f90daa2a82ad9b63855e2b988fe056278cb
SHA512 c571045f99d86fdc4f5534e0bcd3f47d4df2b11ecb8af939c023d88f7b08532392c4fa75b0ca05212668cbbc823956a4993ae9fbf1b359612267d18f04c51326
SSDEEP 192:sxZVRYyM/jK1Ml8MqcBAw/fOskP2VNdpLdPPaWiPMlj/HW6+WNE8a5PCPZmtYD4W:sxZVWimAw/fOskPQJHb0ttZZkX
TLSH
T1D772F95666309973CCC7DA09F931BF93D6F554629A950E98AEFCC91C01EA6FC220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 a29c3bf08f1f42c4f0ed8dacad7e61de79d94ca050eea3cda80472b61b9f0e9e
MD5 b300617acea6e2b47cf026eee0a9e595
SHA1 7f82eb582ccc088341a86cc3b775421a417082c8
SHA512 6c48184a4c0129de1c582b7e9086667dc410b0b7120a1c421e9dd5e3a0f6c5018a50c9d11cb7ea241a75d550a1303c727bdd4710e1eda82210a95329a4d4b6ed
SSDEEP 768:1JseJ3xWvhfwn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYcLly0ppqroUp:1JseJ3xWvhfwnu1jaVcL88pB6
TLSH
T117E20B2B280CCB7E4F844E6DEC266F966EE801CB57984D5487FA884C03C77EA51275DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 65870a8bf32eb208717f859750bf734a709d99d57ac6349a0bd163aa714f203d
MD5 2861776b294fe4b60053882eaa6b4b39
SHA1 de47e7467641032ab0ebb218c266cb87a6081927
SHA512 c2465001c864fe119b66dbaa2f6e5fe4dc75fb1a2a83b3d496bb94e327821a6ca61ab68bb5c5956bb09a2af3d2d684d76d5ac3e9cd4232efdcc44ec0cc598c28
TLSH
T134A0022AD2544151C06C0270E8591595A62088505285627184E44068E8DF1B04132465
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe587c01.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe587c01.TMP
Size 48B
SHA256 d0c97cfb19e3307afda7e762dfa4dafb52107b9dbee54805566ffd7b5ae62d60
MD5 2ed2b3eaf3dc360c39cca3c270c556a8
SHA1 c86b2428298528c1f3dc23d9b7e4ca6e1ae37a48
SHA512 d7b7679e3e2b8767ed7e11edaba59570f33d1683e6012d260b37e661dcd513863fa340972e7c00143fef7e1068ad9f226aa8968e9d934a658661453eaee50f84
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 5a5f25e1f98d51660caacf280d9c089264f35365d6a917fa669c5397c40399c4
MD5 73076f39021d4cc90e7ba48a699f15ed
SHA1 b54ae0893044b2dd3a625b2553a27d0609e9b0ac
SHA512 0d0273af9d3e25e6e45a8b0494d61cdaa636b26e3139cad1022851da3eb7da5e7ec276ff7389189897fb3b614ff84d25d14c74387b5c209b78321480177dc1cf
SSDEEP 96:KYH+KggmArM/LRZJ2TZy9JL2KhTJV2ljrKFrnW/CKc46O7:49zTFRu
TLSH
T158A16812723A0202387E294DA2D6A63B4F4236A334B4F66F7B7814668D67F151DFC8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 03b679fc500c49dd7eedf1fed3c71150bb142f528a4c347a1d3cbb49cf50c8ea
MD5 cdc98b3561a87e10ac913ea5a2c755b9
SHA1 14ccf8055165bc6493a5ce4d8e8c6f8c2bebc254
SHA512 5bf9a378eed737bb4186a5dcd0f4ad0cbfb89f649a38ed957d126b3e3a5a24655a5a55a947e816305296e8911a4b5d1965d0170d63a87c9a2292e143ad350c36
SSDEEP 192:frsNSUQIfsNyl1NJM7UJ25miU1w3qhMTxQClqyNA801Fq2teW:TsNSUlPNi7IRuAIlv0XteW
TLSH
T1F7423A72BC74ED6AADE7A585F04A33035FB4806B96C85F90EADC2F1D01DB2981307927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 2e8b36292e2b287955219dcb6577a0d0b01aab3f3fb2690bd4e88fce184ad8dd
MD5 a4e4b08ab3d92ab7769f2f80843f17d4
SHA1 569f5cf7435b296669bafde3167f6f2f4c519249
SHA512 41d69d86bcd83b4c4d8ad76630ce06c703df29302e35d6c468b9665fdecc6ecaec3cb65bef37abb37e700f52c289913b24d3006a15da11d973158be57743452a
SSDEEP 192:u0m+xasuheOwQxMvsNS/QIfsNyl1NJM7UJd5miU1wTqAMTxQClqyNz8z1Fq2tvP:YZcIksNS/lPNi7I6gtIlvwXtvP
TLSH
T172726C72AC74DD7AA9E7F541F48933135EF4C06BA6C85F90E6EC2F1D00DA268130A927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 2ffee0a029de6c271a689b8f7d95dfd6133ccbc9004fdfd1c0a4d2909a50a5bd
MD5 8e05066feabb090a039647cac6242cf0
SHA1 32e51b51c5b54c6c49f45f76106069e2bc85ef27
SHA512 a5d4ba88a87cfc0d8a5b3f0ea8a2921b0745b5ac41b8c7817423ace169ac66e52af152a89ae7eff3de3489a705dd3cd1d414bd4b25f573c228b79368f745ebd9
SSDEEP 96:eqONkPQsjpflMoUZre5ih/cIPURHl8h4otop57ODdBjPYvlCr5pgz6qNGemL5XuX:lONP6vMtPQmiUysDThTxQClT847kLU/u
TLSH
T1E402F835AC68AC7BEAA7AD45F48A23172FF0606FA5D05B50EAE82F1C00D765C1307927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 665965efbd252129083e4b97d393461f6eb3d9b09e1a1f0f6ab6487e2e1dd60c
MD5 6602c7eae002fb3399605f148666ed1f
SHA1 b5987172c5a5ba27fc53fba72002802ef83e2bac
SHA512 097a9ac0866c6d80ba9326bb73da682cd0883d7d1af3478e30f6e06522644874cf05eb161c3091f8101cc397290ee6df60b240d04279ae4023b69b0f245521d3
SSDEEP 192:uVm+xasuheOwQxMDsNS+QIfsNyl1NJM7UJD5miU1bvqiMTxQClqyNz8z1Fq2tvP:JZcIEsNS+lPNi7IoBbIlvwXtvP
TLSH
T1B6726D72AC749D7AA9E7F541F48933135EF4C06BA2C85F90E6EC2F1D00DA2681307917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 4bce548d63004663f3e4f8fa08aece15a5b03e37a42305d05b796f5578e17c98
MD5 8ab958a8dc3715966847b6c55ce9200c
SHA1 d12a96d904e42bc69396918196fb22380c0bd7d8
SHA512 b9f474563a61484aa092f5bb365f9bd9047e4bd847c5422accb89f3e6c41928e6771971a1f0cb27897cc9971426ef8858c000ca81922a127509b98c509432899
SSDEEP 192:uVm+xasuheOwQxMKsNS+QIfsNyl1NJM7UJ2F5miU1YNqwMTxQClqyNz8z1Fq2tvP:JZcIVsNS+lPNi7I2SGdIlvwXtvP
TLSH
T13D726B72AC74DD7AA9E7F541F48933135EF4C06BA2C85F90E6EC6F1D00DA268130A927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 6c70f89d210dfef4ac5c33148f1e8cf0a416b173f9ff2596fad75dedfe1f52d1
MD5 680317082194ca3a32afe44574eb0d5f
SHA1 ae87444f874589419fb528973b3f7c32187ceec4
SHA512 cdfba90fea959a700dcaf0d3af958d47c56b4ef65e37477e068f14cb9a6a2670f38ae4b11904a7ddd8f64ce57dd45f4ea1d3d6697a7cdceaf9a2f39a530ae7ce
SSDEEP 192:FONb6vMDPQmiUyYDHhTxQClqyNg80IFq2tU/u:FONb6UDRJHblvFXtU/u
TLSH
T177120A76AC64DC6BAE93A581F08A32571EB0916BEAC49F50EADC2F1C01DB55C1307917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VariationsRuntimeSeedV1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\VariationsRuntimeSeedV1
Size 522B
SHA256 532e27b1c35cecf3833a063deb0a05850d18f45002890d4dd9c69509841b7738
MD5 b809bb2b4dca57c6dcf6e141ab343c71
SHA1 3d858fed3e81f1ca3d3c105aaa579c0359654edf
SHA512 089d37cbd8d0d641052a8ffbbf4ee41489551f876cafb2dec05897f131d309580b9872e3493f6cec359efde76d766ef4a7f8ee86fa084740fbcbd049e7f749e6
TLSH
T177F0051380DA34D2EA6B00A0F1446DD4120FA1FA2919B7746975855681986716144736
MD5 SHA1 SHA512 TLSH

Submit Download

VariationsSeedV1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\VariationsSeedV1
Size 1KB
SHA256 2167856122119de0ff46cacaf2b6648bbecd7f982f986f736b2384bbd5e7c620
MD5 184aa84e4b307f20fc864635dfa6c228
SHA1 cb38d0d5ee40481407bd3bc94b0e62bc3c7d2202
SHA512 8ecce50b5e185d3b0724a7af6773c06e8d99f45803e228bf6efd31e5984d62db5219b77593aad938bf79bdae002f18f76c64fa708100ee9353df907ebd110ef3
TLSH
T10C31F9AF5065D4E4C739A13C05A9276671A32CCA2490713F14730741AC39BCA9888D7E
MD5 SHA1 SHA512 TLSH

Submit Download

VariationsSeedV1~RFe588316.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\VariationsSeedV1~RFe588316.TMP
Size 584B
SHA256 bffeed825373d8d86a75e3718630ac923518659956cc269fe5eef74ebb1d27c8
MD5 be2cd1e3d69e234ff76b9a04f1569798
SHA1 3ba630572833d34580bb639c3ef84cd30bc0a5c5
SHA512 2950b61e4f767da5772ae805ab64a05f1561bb0d41449caa7bcf3c8de297b858d65f8834312360ae15ff371491ea3eacf6dabf38692dd79543eae1396d6025ef
TLSH
T110F0960AA83203DFE2C5CE370036C59C831069D503019350F8D517804799DEE6DEDAF5
MD5 SHA1 SHA512 TLSH

Submit Download

b76632dd-74bd-4dbc-bdc0-8810c502fa1c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\b76632dd-74bd-4dbc-bdc0-8810c502fa1c.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 e38fd6bfc1567a3583935aa622a38fee74385867bb3bccba98cdd03ca4ac8646
MD5 2b6917d7db298817bf3203f021ea2595
SHA1 3d42428173464a0cc2ef1f8b34cccaa0a2e84f84
SHA512 fb69e0f090a530fb516751ab19bd43767e946c07c1830c5d07ac37b19b5819375749d9f3a0bf0c078303afb18cd56ef5c54dc0cf9e1fab82fd8d693884370bac
TLSH
T10A413A5CA6E91158F3B76F4AABF7A8AD487A78373F06D49E00110E4E4662B44CDB1733
MD5 SHA1 SHA512 TLSH

Submit Download

d959b517-80fd-4312-9fee-a47111dd9efe.tmp

Path C:\Users\Admin\Downloads\d959b517-80fd-4312-9fee-a47111dd9efe.tmp
Size 6.4MB
SHA256 b507a54a20f34e583267d273a8eea6f43baf382391cb989c554e4b4bc346aa84
MD5 c92e61050de52f855062cba91dc47585
SHA1 3f0330ef09b2be666940a7cd06b95734348da5d2
SHA512 8d70e67ddc8c6e6b63eb893f8146ef7c66eaf9289c35a7333f0b2a7b0db96553b007b5eb2dcd61c308b9a6d82683610c681ba85e10b65a313ad9bc3b03dabf78
SSDEEP 196608:G7MsSHuccsZaRFpNxAkWa87iwmv2uaa6EBpSgjt:G7Mss5ZSFmkY6OiSgjt
TLSH
T1E76633EEF602020D5435E9E8725A45466C48C68808FD63FA7573B390C3E66BDF5AF788
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

poop_virus.gif

Path C:\Users\Admin\Downloads\poop_virus.gif
Size 1.1MB
SHA256 2af83b291c7f2b48a6ace50ea8d0a47fce564a1a358be57332438b7742492dd6
MD5 dbc573088d2e736e7f550a6305db3916
SHA1 edbb2ca3bdcdb4f2ea8cb2c2711b1443dfc4caaa
SHA512 c68cc9addb8ca68036980ca913450d0f9a91286ee0d04706f09236f168324e918962bc94a1e4cff5feecad2c4ebe6a698866ebcdfe21fef8893511908f056b2a
SSDEEP 24576:dYt4P5fdn+wUtlgIPsKmTRFH0CDkNeIrGxNkPanim+:HrUtlUKmPUCDgebxN6I+
TLSH
T1394533E6FE2221056651B3372024F35B12AA6B2A4F601A079F87133DEC2F1F4967BD57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads