killmbr | 5e2cd213ff47b7657abd9167c38ffd8b53c13261fe22adddea92b5a2d9e320ad

Analysis

user interaction
yes
max time kernel
421s
max time network
493s
platform
windows11-21h2_x64
resource
win11-20260911-fr
resource tags

arch:x64arch:x86image:win11-20260911-frlocale:fr-fros:windows11-21h2-x64systemwindows
submitted
22/09/2026, 18:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Geometry dash auto speedhack.bat
Size 13KB
Sample260922-wx9vbace39
SHA256 5e2cd213ff47b7657abd9167c38ffd8b53c13261fe22adddea92b5a2d9e320ad
MD5 4e2a7f369378a76d1df4d8c448f712af
SHA1 1192b4d01254a8704e6d6ae17dc2ec28a7ad5a49
SHA512 90e6eedca424e2ee37c78e0c0380db490c049b0378541812734c134510c40c6e4c48c4e213f395339ed99ff337ef087b6056ac5aafb246c1789ca6082dcabd2e
SSDEEP 192:AOyUySl0UaDz2gWsIzlmj+BxZ3yqueWQx0lZicyC8Sh31xcjBzyxwn7AVhllz3:AVODaDSHMql3yqlxy5L1xcjwrlz3
TLSH
T1BB528D3236754E13193326CB5C3AA256BCF4503F761A6E71A4138DFB90AAFD1319EB05
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

bootkit discovery execution killmbr persistence trojan wiper

Malware Config

Signatures

Family: KillMBR
KillMBR is a trojan that attempts to overwrite the Master Boot Record.
wiper trojan killmbr

Detects KillMBR 1 IoCs

resource	yara_rule
behavioral1/files/0x001900000002b53d-181.dat	family_killmbr

Executes dropped EXE 7 IoCs

pid	Process
4340	MEMZ.exe
1548	MEMZ.exe
4596	MEMZ.exe
4812	MEMZ.exe
3564	MEMZ.exe
5064	MEMZ.exe
488	MEMZ.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	MEMZ.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3920	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe

System Time Discovery 1 TTPs 11 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5596	msedge.exe
5932	msedge.exe
4996	msedge.exe
2964	msedge.exe
5436	msedge.exe
3068	msedge.exe
6044	msedge.exe
3448	msedge.exe
4028	msedge.exe
1908	chrome.exe
1756	msedge.exe

Enumerates system info in registry 2 TTPs 33 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 11 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134345749282987746"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 36 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2322150968-3922673059-3248713381-1000\{B56DAD74-86DA-4FD2-B155-1FF8B4E3C0B1}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2322150968-3922673059-3248713381-1000\{34D4605F-5A95-45A5-81FE-5CAA54CD0334}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2322150968-3922673059-3248713381-1000\{435312C8-8F39-4A23-8899-7E67FBBAD86A}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2322150968-3922673059-3248713381-1000\{2DD561C0-494D-4E0B-B37E-C170D990CECB}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2322150968-3922673059-3248713381-1000\{B1C22AAB-DA57-4BF2-B3FA-55C9468B24A1}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2322150968-3922673059-3248713381-1000\{C0DD8009-82FE-4FFF-B000-DCB15DB81A70}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2322150968-3922673059-3248713381-1000\{6A1E9774-A44A-41CC-91C3-2D1024295B7B}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2322150968-3922673059-3248713381-1000\{311280A5-DF27-4CFA-AE53-AC1F01E41B0E}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2322150968-3922673059-3248713381-1000\{133A332B-C751-45C5-9DD3-98473748D53D}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2322150968-3922673059-3248713381-1000\{DADB090E-D196-4C4F-9D2C-AFA580751733}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2322150968-3922673059-3248713381-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2322150968-3922673059-3248713381-1000\{60FDF051-4310-4283-960F-B6733000D1D4}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4596	MEMZ.exe
4812	MEMZ.exe
4596	MEMZ.exe
4812	MEMZ.exe
1548	MEMZ.exe
1548	MEMZ.exe
4596	MEMZ.exe
4596	MEMZ.exe
1548	MEMZ.exe
4812	MEMZ.exe
1548	MEMZ.exe
4812	MEMZ.exe
3564	MEMZ.exe
3564	MEMZ.exe
4596	MEMZ.exe
4596	MEMZ.exe
4812	MEMZ.exe
4812	MEMZ.exe
1548	MEMZ.exe
1548	MEMZ.exe
4596	MEMZ.exe
3564	MEMZ.exe
4596	MEMZ.exe
3564	MEMZ.exe
1548	MEMZ.exe
1548	MEMZ.exe
4812	MEMZ.exe
4812	MEMZ.exe
4596	MEMZ.exe
4812	MEMZ.exe
4812	MEMZ.exe
4596	MEMZ.exe
1548	MEMZ.exe
1548	MEMZ.exe
3564	MEMZ.exe
3564	MEMZ.exe
4596	MEMZ.exe
4596	MEMZ.exe
3564	MEMZ.exe
3564	MEMZ.exe
1548	MEMZ.exe
1548	MEMZ.exe
4812	MEMZ.exe
4812	MEMZ.exe
4596	MEMZ.exe
4596	MEMZ.exe
4812	MEMZ.exe
4812	MEMZ.exe
1548	MEMZ.exe
1548	MEMZ.exe
3564	MEMZ.exe
3564	MEMZ.exe
4596	MEMZ.exe
4596	MEMZ.exe
3564	MEMZ.exe
3564	MEMZ.exe
1548	MEMZ.exe
1548	MEMZ.exe
4812	MEMZ.exe
4812	MEMZ.exe
4596	MEMZ.exe
4596	MEMZ.exe
4812	MEMZ.exe
4812	MEMZ.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 58 IoCs

pid	Process
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
5228	msedge.exe
5228	msedge.exe
5228	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
5344	msedge.exe
5344	msedge.exe
5344	msedge.exe
5344	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
5668	msedge.exe
5668	msedge.exe
5668	msedge.exe
5668	msedge.exe
648	chrome.exe
5668	msedge.exe
5668	msedge.exe
648	chrome.exe
648	chrome.exe
5668	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
648	chrome.exe
648	chrome.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	648	chrome.exe
Token: SeCreatePagefilePrivilege	648	chrome.exe
Token: SeShutdownPrivilege	648	chrome.exe
Token: SeCreatePagefilePrivilege	648	chrome.exe
Token: SeShutdownPrivilege	648	chrome.exe
Token: SeCreatePagefilePrivilege	648	chrome.exe
Token: SeShutdownPrivilege	648	chrome.exe
Token: SeCreatePagefilePrivilege	648	chrome.exe
Token: SeShutdownPrivilege	648	chrome.exe
Token: SeCreatePagefilePrivilege	648	chrome.exe
Token: SeShutdownPrivilege	648	chrome.exe
Token: SeCreatePagefilePrivilege	648	chrome.exe
Token: SeShutdownPrivilege	648	chrome.exe
Token: SeCreatePagefilePrivilege	648	chrome.exe
Token: SeShutdownPrivilege	648	chrome.exe
Token: SeCreatePagefilePrivilege	648	chrome.exe
Token: SeShutdownPrivilege	648	chrome.exe
Token: SeCreatePagefilePrivilege	648	chrome.exe
Token: SeShutdownPrivilege	648	chrome.exe
Token: SeCreatePagefilePrivilege	648	chrome.exe
Token: SeShutdownPrivilege	648	chrome.exe
Token: SeCreatePagefilePrivilege	648	chrome.exe
Token: SeShutdownPrivilege	648	chrome.exe
Token: SeCreatePagefilePrivilege	648	chrome.exe
Token: SeShutdownPrivilege	648	chrome.exe
Token: SeCreatePagefilePrivilege	648	chrome.exe
Token: SeShutdownPrivilege	648	chrome.exe
Token: SeCreatePagefilePrivilege	648	chrome.exe
Token: SeShutdownPrivilege	648	chrome.exe
Token: SeCreatePagefilePrivilege	648	chrome.exe
Token: SeShutdownPrivilege	648	chrome.exe
Token: SeCreatePagefilePrivilege	648	chrome.exe
Token: 33	6112	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	6112	AUDIODG.EXE
Token: SeShutdownPrivilege	648	chrome.exe
Token: SeCreatePagefilePrivilege	648	chrome.exe
Token: SeShutdownPrivilege	648	chrome.exe
Token: SeCreatePagefilePrivilege	648	chrome.exe
Token: SeShutdownPrivilege	648	chrome.exe
Token: SeCreatePagefilePrivilege	648	chrome.exe
Token: SeShutdownPrivilege	648	chrome.exe
Token: SeCreatePagefilePrivilege	648	chrome.exe
Token: SeShutdownPrivilege	648	chrome.exe
Token: SeCreatePagefilePrivilege	648	chrome.exe
Token: SeShutdownPrivilege	648	chrome.exe
Token: SeCreatePagefilePrivilege	648	chrome.exe
Token: SeShutdownPrivilege	648	chrome.exe
Token: SeCreatePagefilePrivilege	648	chrome.exe
Token: SeShutdownPrivilege	648	chrome.exe
Token: SeCreatePagefilePrivilege	648	chrome.exe
Token: SeShutdownPrivilege	648	chrome.exe
Token: SeCreatePagefilePrivilege	648	chrome.exe
Token: SeShutdownPrivilege	648	chrome.exe
Token: SeCreatePagefilePrivilege	648	chrome.exe
Token: SeShutdownPrivilege	648	chrome.exe
Token: SeCreatePagefilePrivilege	648	chrome.exe
Token: SeShutdownPrivilege	648	chrome.exe
Token: SeCreatePagefilePrivilege	648	chrome.exe
Token: SeShutdownPrivilege	648	chrome.exe
Token: SeCreatePagefilePrivilege	648	chrome.exe
Token: SeShutdownPrivilege	648	chrome.exe
Token: SeCreatePagefilePrivilege	648	chrome.exe
Token: SeShutdownPrivilege	648	chrome.exe
Token: SeCreatePagefilePrivilege	648	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4164	msedge.exe
4164	msedge.exe
4500	msedge.exe
4500	msedge.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
5228	msedge.exe
5228	msedge.exe
4892	msedge.exe
4892	msedge.exe
5344	msedge.exe
5344	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
5668	msedge.exe
648	chrome.exe
648	chrome.exe
5668	msedge.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe

Suspicious use of SendNotifyMessage 46 IoCs

pid	Process
648	chrome.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
5012	MiniSearchHost.exe
488	MEMZ.exe
488	MEMZ.exe
488	MEMZ.exe
488	MEMZ.exe
488	MEMZ.exe
488	MEMZ.exe
488	MEMZ.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3920 wrote to memory of 4212	3920	cmd.exe	81
PID 3920 wrote to memory of 4340	3920	cmd.exe	82
PID 4340 wrote to memory of 1548	4340	MEMZ.exe	84
PID 4340 wrote to memory of 4596	4340	MEMZ.exe	85
PID 4340 wrote to memory of 4812	4340	MEMZ.exe	86
PID 4340 wrote to memory of 3564	4340	MEMZ.exe	87
PID 4340 wrote to memory of 5064	4340	MEMZ.exe	88
PID 4340 wrote to memory of 488	4340	MEMZ.exe	89
PID 488 wrote to memory of 4304	488	MEMZ.exe	90
PID 488 wrote to memory of 4052	488	MEMZ.exe	91
PID 4052 wrote to memory of 2180	4052	msedge.exe	92
PID 4052 wrote to memory of 4792	4052	msedge.exe	94
PID 4052 wrote to memory of 4996	4052	msedge.exe	93
PID 4052 wrote to memory of 4792	4052	msedge.exe	94
PID 4052 wrote to memory of 4792	4052	msedge.exe	94
PID 4052 wrote to memory of 3972	4052	msedge.exe	96
PID 4052 wrote to memory of 3972	4052	msedge.exe	96
PID 4052 wrote to memory of 3532	4052	msedge.exe	97
PID 4052 wrote to memory of 3532	4052	msedge.exe	97
PID 4052 wrote to memory of 3532	4052	msedge.exe	97
PID 4052 wrote to memory of 3316	4052	msedge.exe	112
PID 4052 wrote to memory of 3316	4052	msedge.exe	112
PID 4052 wrote to memory of 3316	4052	msedge.exe	112
PID 4052 wrote to memory of 3416	4052	msedge.exe	99
PID 4052 wrote to memory of 3416	4052	msedge.exe	99
PID 4052 wrote to memory of 3416	4052	msedge.exe	99
PID 4052 wrote to memory of 1008	4052	msedge.exe	100
PID 4052 wrote to memory of 3112	4052	msedge.exe	101
PID 4052 wrote to memory of 3720	4052	msedge.exe	102
PID 4052 wrote to memory of 1008	4052	msedge.exe	100
PID 4052 wrote to memory of 1008	4052	msedge.exe	100
PID 4052 wrote to memory of 3112	4052	msedge.exe	101
PID 4052 wrote to memory of 3112	4052	msedge.exe	101
PID 4052 wrote to memory of 3720	4052	msedge.exe	102
PID 4052 wrote to memory of 3720	4052	msedge.exe	102
PID 4052 wrote to memory of 536	4052	msedge.exe	104
PID 4052 wrote to memory of 536	4052	msedge.exe	104
PID 4052 wrote to memory of 4844	4052	msedge.exe	105
PID 4052 wrote to memory of 4844	4052	msedge.exe	105
PID 4052 wrote to memory of 2156	4052	msedge.exe	106
PID 4052 wrote to memory of 2156	4052	msedge.exe	106
PID 4052 wrote to memory of 2156	4052	msedge.exe	106
PID 4052 wrote to memory of 3396	4052	msedge.exe	108
PID 4052 wrote to memory of 3140	4052	msedge.exe	109
PID 4052 wrote to memory of 3396	4052	msedge.exe	108
PID 4052 wrote to memory of 3140	4052	msedge.exe	109
PID 4052 wrote to memory of 2672	4052	msedge.exe	111
PID 4052 wrote to memory of 3316	4052	msedge.exe	112
PID 3316 wrote to memory of 4352	3316	msedge.exe	113
PID 4052 wrote to memory of 4960	4052	msedge.exe	114
PID 4052 wrote to memory of 4960	4052	msedge.exe	114
PID 4052 wrote to memory of 4232	4052	msedge.exe	115
PID 4052 wrote to memory of 4232	4052	msedge.exe	115
PID 4052 wrote to memory of 4348	4052	msedge.exe	116
PID 4052 wrote to memory of 4348	4052	msedge.exe	116
PID 4052 wrote to memory of 5116	4052	msedge.exe	117
PID 4052 wrote to memory of 5116	4052	msedge.exe	117
PID 4052 wrote to memory of 5096	4052	msedge.exe	118
PID 4052 wrote to memory of 5096	4052	msedge.exe	118
PID 488 wrote to memory of 2912	488	MEMZ.exe	120
PID 488 wrote to memory of 4164	488	MEMZ.exe	123
PID 4164 wrote to memory of 3884	4164	msedge.exe	124
PID 4164 wrote to memory of 2964	4164	msedge.exe	125
PID 4164 wrote to memory of 3416	4164	msedge.exe	127

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Geometry dash auto speedhack.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3920
- C:\Windows\system32\cscript.exe
  cscript x.js
  2⤵
  PID:4212
- C:\Users\Admin\AppData\Roaming\MEMZ.exe
  "C:\Users\Admin\AppData\Roaming\MEMZ.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4340
- - C:\Users\Admin\AppData\Roaming\MEMZ.exe
    "C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:1548
- - C:\Users\Admin\AppData\Roaming\MEMZ.exe
    "C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:4596
- - C:\Users\Admin\AppData\Roaming\MEMZ.exe
    "C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:4812
- - C:\Users\Admin\AppData\Roaming\MEMZ.exe
    "C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:3564
- - C:\Users\Admin\AppData\Roaming\MEMZ.exe
    "C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    PID:5064
- - C:\Users\Admin\AppData\Roaming\MEMZ.exe
    "C:\Users\Admin\AppData\Roaming\MEMZ.exe" /main
    3⤵
    - Executes dropped EXE
    - Writes to the Master Boot Record (MBR)
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:488
  - - C:\Windows\SysWOW64\notepad.exe
      "C:\Windows\System32\notepad.exe" \note.txt
      4⤵
      System Location Discovery: System Language Discovery
      PID:4304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=batch+virus+download
      4⤵
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:4052
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x334,0x7ffe7998c188,0x7ffe7998c194,0x7ffe7998c1a0
        5⤵
        
        PID:2180
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=fr --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1864,i,11762727084579526415,8206675449230149815,524288 --field-trial-handle=2228,i,13253347874997082794,7826370149351427537,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:4996
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1732,i,1777924977207075184,2635907985561263209,262144 --field-trial-handle=2228,i,13253347874997082794,7826370149351427537,262144 --variations-seed-version --mojo-platform-channel-handle=2224 /prefetch:2
        5⤵
        
        PID:4792
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2216,i,8128551347330014673,9781849892704182272,524288 --field-trial-handle=2228,i,13253347874997082794,7826370149351427537,262144 --variations-seed-version --mojo-platform-channel-handle=3080 /prefetch:13
        5⤵
        
        PID:3972
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3536,i,17075601350312007746,6064066426741414542,2097152 --field-trial-handle=2228,i,13253347874997082794,7826370149351427537,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
        5⤵
        
        PID:3532
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3524,i,15542783191065349529,16796969032479296693,2097152 --field-trial-handle=2228,i,13253347874997082794,7826370149351427537,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
        5⤵
        
        PID:3316
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4204,i,16795324904752648121,5782867104738868144,2097152 --field-trial-handle=2228,i,13253347874997082794,7826370149351427537,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:1
        5⤵
        
        PID:3416
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4184,i,963437283277616867,10693898284188743481,2097152 --field-trial-handle=2228,i,13253347874997082794,7826370149351427537,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:9
        5⤵
        
        PID:1008
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4236,i,4274400253714774592,10399723598932849994,2097152 --field-trial-handle=2228,i,13253347874997082794,7826370149351427537,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:1
        5⤵
        
        PID:3112
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4264,i,3550510168595916964,7372053242471606765,2097152 --field-trial-handle=2228,i,13253347874997082794,7826370149351427537,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:9
        5⤵
        
        PID:3720
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=fr --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4004,i,9867279337938315582,5904871701948304064,524288 --field-trial-handle=2228,i,13253347874997082794,7826370149351427537,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:14
        5⤵
        
        PID:536
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=fr --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3956,i,4172902028490042027,2602576636571264556,524288 --field-trial-handle=2228,i,13253347874997082794,7826370149351427537,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:14
        5⤵
        
        PID:4844
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=4208,i,6310447806525116873,12688670825262319431,2097152 --field-trial-handle=2228,i,13253347874997082794,7826370149351427537,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:1
        5⤵
        
        PID:2156
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=fr --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3656,i,10976972760161334878,11613332559836102200,524288 --field-trial-handle=2228,i,13253347874997082794,7826370149351427537,262144 --variations-seed-version --mojo-platform-channel-handle=3724 /prefetch:14
        5⤵
        
        PID:3396
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=fr --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3732,i,3088202375785995070,1982226857500675764,524288 --field-trial-handle=2228,i,13253347874997082794,7826370149351427537,262144 --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:14
        5⤵
        
        PID:3140
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6048,i,1546005842385216675,2657752365121778861,524288 --field-trial-handle=2228,i,13253347874997082794,7826370149351427537,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:14
        5⤵
        
        PID:4612
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6048,i,1546005842385216675,2657752365121778861,524288 --field-trial-handle=2228,i,13253347874997082794,7826370149351427537,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:14
        5⤵
        
        PID:2672
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6212,i,4980969731186803415,10175992557104242393,524288 --field-trial-handle=2228,i,13253347874997082794,7826370149351427537,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:14
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3316
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1136
        6⤵
        
        PID:4352
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6212,i,9704730334603721318,14807380063453403344,524288 --field-trial-handle=2228,i,13253347874997082794,7826370149351427537,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:14
        5⤵
        
        PID:4960
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6244,i,5180291526702353117,4597614359721057540,524288 --field-trial-handle=2228,i,13253347874997082794,7826370149351427537,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:14
        5⤵
        
        PID:4232
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6656,i,15351322272747721463,17261146110996586340,524288 --field-trial-handle=2228,i,13253347874997082794,7826370149351427537,262144 --variations-seed-version --mojo-platform-channel-handle=6700 /prefetch:14
        5⤵
        
        PID:4348
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6836,i,1712102649575563979,10419126180489102730,524288 --field-trial-handle=2228,i,13253347874997082794,7826370149351427537,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:14
        5⤵
        
        PID:5116
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=fr --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6880,i,8274891822649645853,2257974048183233379,524288 --field-trial-handle=2228,i,13253347874997082794,7826370149351427537,262144 --variations-seed-version --mojo-platform-channel-handle=6864 /prefetch:14
        5⤵
        
        PID:5096
  - - C:\Windows\SysWOW64\explorer.exe
      "C:\Windows\System32\explorer.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:2912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=best+way+to+kill+yourself
      4⤵
      Enumerates system info in registry
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:4164
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e8,0x2ec,0x2f0,0x2e4,0x2dc,0x7ffe7998c188,0x7ffe7998c194,0x7ffe7998c1a0
        5⤵
        
        PID:3884
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=fr --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1776,i,12983569495419691924,12069857685496438452,524288 --field-trial-handle=2172,i,1835869452777621889,151918937142447615,262144 --variations-seed-version --mojo-platform-channel-handle=2200 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:2964
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1620,i,8288296457787866467,2449942160948450004,262144 --field-trial-handle=2172,i,1835869452777621889,151918937142447615,262144 --variations-seed-version --mojo-platform-channel-handle=2160 /prefetch:2
        5⤵
        
        PID:3108
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2432,i,3275728110727594115,17406935880613114454,524288 --field-trial-handle=2172,i,1835869452777621889,151918937142447615,262144 --variations-seed-version --mojo-platform-channel-handle=2428 /prefetch:13
        5⤵
        
        PID:3416
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,3027113313603461447,11091636602366334728,2097152 --field-trial-handle=2172,i,1835869452777621889,151918937142447615,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
        5⤵
        
        PID:1420
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3424,i,9518915650034166169,6939514521526171123,2097152 --field-trial-handle=2172,i,1835869452777621889,151918937142447615,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
        5⤵
        
        PID:1632
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4856,i,13216808886463885889,7804180926824691658,2097152 --field-trial-handle=2172,i,1835869452777621889,151918937142447615,262144 --variations-seed-version --mojo-platform-channel-handle=4884 /prefetch:1
        5⤵
        
        PID:2912
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
        5⤵
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        
        PID:4500
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2fc,0x7ffe7998c188,0x7ffe7998c194,0x7ffe7998c1a0
        6⤵
        
        PID:2096
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=fr --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1728,i,6821879180220993826,5877295927083214841,524288 --field-trial-handle=2104,i,6790243852029783092,16222234728805912759,262144 --variations-seed-version --mojo-platform-channel-handle=2132 /prefetch:11
        6⤵
        System Time Discovery
        
        PID:4028
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1556,i,14980610442742594543,17106241418444695936,262144 --field-trial-handle=2104,i,6790243852029783092,16222234728805912759,262144 --variations-seed-version --mojo-platform-channel-handle=2100 /prefetch:2
        6⤵
        
        PID:2132
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2368,i,3986636417518366614,1325290882741140279,524288 --field-trial-handle=2104,i,6790243852029783092,16222234728805912759,262144 --variations-seed-version --mojo-platform-channel-handle=2552 /prefetch:13
        6⤵
        
        PID:2148
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4532,i,8677417614280017473,5033165650724550467,524288 --field-trial-handle=2104,i,6790243852029783092,16222234728805912759,262144 --variations-seed-version --mojo-platform-channel-handle=4576 /prefetch:14
        6⤵
        
        PID:4560
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4532,i,8677417614280017473,5033165650724550467,524288 --field-trial-handle=2104,i,6790243852029783092,16222234728805912759,262144 --variations-seed-version --mojo-platform-channel-handle=4576 /prefetch:14
        6⤵
        
        PID:232
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4972,i,6075230699467987084,7174659019395727309,2097152 --field-trial-handle=2104,i,6790243852029783092,16222234728805912759,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:1
        6⤵
        
        PID:1752
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=4980,i,8737014588144448731,10863112292569049998,2097152 --field-trial-handle=2104,i,6790243852029783092,16222234728805912759,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:1
        6⤵
        
        PID:3148
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=fr --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5512,i,14412667763432595302,14291673591217181091,524288 --field-trial-handle=2104,i,6790243852029783092,16222234728805912759,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:14
        6⤵
        
        PID:3444
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=fr --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5516,i,14769472129674045892,1914345612741685445,524288 --field-trial-handle=2104,i,6790243852029783092,16222234728805912759,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:14
        6⤵
        
        PID:1392
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5952,i,9022020021024236009,11203895790555354148,2097152 --field-trial-handle=2104,i,6790243852029783092,16222234728805912759,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:1
        6⤵
        
        PID:4276
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
        6⤵
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        
        PID:5228
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x24c,0x7ffe7998c188,0x7ffe7998c194,0x7ffe7998c1a0
        7⤵
        
        PID:5252
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=fr --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1820,i,18285786385139925290,17299107058183165765,524288 --field-trial-handle=2272,i,13196334208107926581,6539209848885540318,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:11
        7⤵
        System Time Discovery
        
        PID:5436
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1624,i,9559178537508026982,14906874052486000795,262144 --field-trial-handle=2272,i,13196334208107926581,6539209848885540318,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:2
        7⤵
        
        PID:5444
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2376,i,8340844572241006289,4890097263046112221,524288 --field-trial-handle=2272,i,13196334208107926581,6539209848885540318,262144 --variations-seed-version --mojo-platform-channel-handle=2920 /prefetch:13
        7⤵
        
        PID:5512
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4484,i,8126375453850984105,16295759176944996659,524288 --field-trial-handle=2272,i,13196334208107926581,6539209848885540318,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:14
        7⤵
        
        PID:5872
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4484,i,8126375453850984105,16295759176944996659,524288 --field-trial-handle=2272,i,13196334208107926581,6539209848885540318,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:14
        7⤵
        
        PID:5880
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=5036,i,15999139257910652207,3583273428432249207,2097152 --field-trial-handle=2272,i,13196334208107926581,6539209848885540318,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:1
        7⤵
        
        PID:5024
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5012,i,4140383475657023110,5455552755436124919,2097152 --field-trial-handle=2272,i,13196334208107926581,6539209848885540318,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:1
        7⤵
        
        PID:3700
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=fr --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5536,i,12453703226903297802,2940708382142542253,524288 --field-trial-handle=2272,i,13196334208107926581,6539209848885540318,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:14
        7⤵
        
        PID:1680
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=fr --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5516,i,7143820682974051996,175648703765420690,524288 --field-trial-handle=2272,i,13196334208107926581,6539209848885540318,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:14
        7⤵
        
        PID:5484
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5952,i,15877845437215565997,3166379428394494471,2097152 --field-trial-handle=2272,i,13196334208107926581,6539209848885540318,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:1
        7⤵
        
        PID:5844
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
        7⤵
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        
        PID:4892
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2ac,0x7ffe7998c188,0x7ffe7998c194,0x7ffe7998c1a0
        8⤵
        
        PID:5848
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1528,i,10177444331491415868,12119018056565472623,262144 --field-trial-handle=3356,i,10773439438573513366,11339228284029953173,262144 --variations-seed-version --mojo-platform-channel-handle=3372 /prefetch:2
        8⤵
        
        PID:2556
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=fr --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1704,i,3499585278993406944,16905041359948293347,524288 --field-trial-handle=3356,i,10773439438573513366,11339228284029953173,262144 --variations-seed-version --mojo-platform-channel-handle=3412 /prefetch:11
        8⤵
        System Time Discovery
        
        PID:3068
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2348,i,10701504676151939839,5518202024231703657,524288 --field-trial-handle=3356,i,10773439438573513366,11339228284029953173,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:13
        8⤵
        
        PID:5028
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4508,i,18239880884490539283,13631020418470109463,524288 --field-trial-handle=3356,i,10773439438573513366,11339228284029953173,262144 --variations-seed-version --mojo-platform-channel-handle=4524 /prefetch:14
        8⤵
        
        PID:1248
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4508,i,18239880884490539283,13631020418470109463,524288 --field-trial-handle=3356,i,10773439438573513366,11339228284029953173,262144 --variations-seed-version --mojo-platform-channel-handle=4524 /prefetch:14
        8⤵
        
        PID:5872
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4940,i,8864057001463394002,9364907042437227521,2097152 --field-trial-handle=3356,i,10773439438573513366,11339228284029953173,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:1
        8⤵
        
        PID:5432
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=4936,i,848007895682747277,8749976244899168146,2097152 --field-trial-handle=3356,i,10773439438573513366,11339228284029953173,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:1
        8⤵
        
        PID:2908
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=fr --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5480,i,17982902883300776041,505580272543183738,524288 --field-trial-handle=3356,i,10773439438573513366,11339228284029953173,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:14
        8⤵
        
        PID:5372
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=fr --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5484,i,2705685632046212918,8005060361959619970,524288 --field-trial-handle=3356,i,10773439438573513366,11339228284029953173,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:14
        8⤵
        
        PID:5348
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5900,i,10385780195386083656,2643221871018195965,2097152 --field-trial-handle=3356,i,10773439438573513366,11339228284029953173,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:1
        8⤵
        
        PID:1756
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5056,i,15473352462338858869,15109034600422441417,2097152 --field-trial-handle=3356,i,10773439438573513366,11339228284029953173,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:1
        8⤵
        
        PID:2996
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
        8⤵
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        
        PID:5344
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x240,0x244,0x248,0x23c,0x220,0x7ffe7998c188,0x7ffe7998c194,0x7ffe7998c1a0
        9⤵
        
        PID:5232
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=fr --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1816,i,8630267804431396396,11306771308714088820,524288 --field-trial-handle=2208,i,5724068049974608243,10702100240511826756,262144 --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:11
        9⤵
        System Time Discovery
        
        PID:1756
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1620,i,851081559742209642,1409454301351293188,262144 --field-trial-handle=2208,i,5724068049974608243,10702100240511826756,262144 --variations-seed-version --mojo-platform-channel-handle=2204 /prefetch:2
        9⤵
        
        PID:988
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2336,i,1964612843910267700,8451519140490709802,524288 --field-trial-handle=2208,i,5724068049974608243,10702100240511826756,262144 --variations-seed-version --mojo-platform-channel-handle=2852 /prefetch:13
        9⤵
        
        PID:5772
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4472,i,3683721377772769406,369964706254639562,524288 --field-trial-handle=2208,i,5724068049974608243,10702100240511826756,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:14
        9⤵
        
        PID:5640
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4472,i,3683721377772769406,369964706254639562,524288 --field-trial-handle=2208,i,5724068049974608243,10702100240511826756,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:14
        9⤵
        
        PID:5804
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4888,i,4316309555873550992,2250638013585013213,2097152 --field-trial-handle=2208,i,5724068049974608243,10702100240511826756,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:1
        9⤵
        
        PID:5988
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=4904,i,8523390692745778200,8111256093019070750,2097152 --field-trial-handle=2208,i,5724068049974608243,10702100240511826756,262144 --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:1
        9⤵
        
        PID:6012
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=fr --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5456,i,958076823430195965,2777679724613665284,524288 --field-trial-handle=2208,i,5724068049974608243,10702100240511826756,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:14
        9⤵
        
        PID:5628
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=fr --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5432,i,12690225161474111287,10830981918094645291,524288 --field-trial-handle=2208,i,5724068049974608243,10702100240511826756,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:14
        9⤵
        
        PID:2704
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5876,i,15502038481965122835,16038234024853450857,2097152 --field-trial-handle=2208,i,5724068049974608243,10702100240511826756,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:1
        9⤵
        
        PID:4664
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=6016,i,15356615314620515285,7670741257277773685,2097152 --field-trial-handle=2208,i,5724068049974608243,10702100240511826756,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:1
        9⤵
        
        PID:5868
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
        9⤵
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:1912
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x250,0x7ffe7998c188,0x7ffe7998c194,0x7ffe7998c1a0
        10⤵
        
        PID:6032
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1756,i,2033903074502726143,11797895779444703482,262144 --field-trial-handle=1984,i,16494649521968862350,13722039624521092888,262144 --variations-seed-version --mojo-platform-channel-handle=1972 /prefetch:2
        10⤵
        
        PID:5532
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2248,i,11076665997544535102,7724085926728366964,524288 --field-trial-handle=1984,i,16494649521968862350,13722039624521092888,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:11
        10⤵
        System Time Discovery
        
        PID:5596
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2500,i,323006023613341046,13667852211190970178,524288 --field-trial-handle=1984,i,16494649521968862350,13722039624521092888,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:13
        10⤵
        
        PID:3456
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4516,i,9846761735101120495,11291406157271971347,524288 --field-trial-handle=1984,i,16494649521968862350,13722039624521092888,262144 --variations-seed-version --mojo-platform-channel-handle=4532 /prefetch:14
        10⤵
        
        PID:1652
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4516,i,9846761735101120495,11291406157271971347,524288 --field-trial-handle=1984,i,16494649521968862350,13722039624521092888,262144 --variations-seed-version --mojo-platform-channel-handle=4532 /prefetch:14
        10⤵
        
        PID:5796
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4940,i,5864989251483151020,9974705238093359999,2097152 --field-trial-handle=1984,i,16494649521968862350,13722039624521092888,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:1
        10⤵
        
        PID:4368
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=4944,i,13530915674535868495,13150214689924055282,2097152 --field-trial-handle=1984,i,16494649521968862350,13722039624521092888,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:1
        10⤵
        
        PID:988
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=fr --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5512,i,7898839834468273069,3413382456208267299,524288 --field-trial-handle=1984,i,16494649521968862350,13722039624521092888,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:14
        10⤵
        
        PID:4636
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=fr --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5516,i,2846188941271649296,1178871095001340246,524288 --field-trial-handle=1984,i,16494649521968862350,13722039624521092888,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:14
        10⤵
        
        PID:4240
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5720,i,18102944972869411208,2699258724596882237,2097152 --field-trial-handle=1984,i,16494649521968862350,13722039624521092888,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:1
        10⤵
        
        PID:5240
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5300,i,12677706271091681634,5930035969076650182,2097152 --field-trial-handle=1984,i,16494649521968862350,13722039624521092888,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:1
        10⤵
        
        PID:4908
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6124,i,15462117639819002425,3079824786348460384,524288 --field-trial-handle=1984,i,16494649521968862350,13722039624521092888,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:14
        10⤵
        Modifies registry class
        
        PID:1568
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=fr --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6120,i,14679496858438244898,12168733270927923996,524288 --field-trial-handle=1984,i,16494649521968862350,13722039624521092888,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:12
        10⤵
        
        PID:5024
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=fr --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6580,i,14456895045383859815,17464662782945872675,524288 --field-trial-handle=1984,i,16494649521968862350,13722039624521092888,262144 --variations-seed-version --mojo-platform-channel-handle=6596 /prefetch:14
        10⤵
        
        PID:4156
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=fr --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,1045583660749385231,10833627832752083894,524288 --field-trial-handle=1984,i,16494649521968862350,13722039624521092888,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:14
        10⤵
        
        PID:1164
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=fr --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6584,i,22020787395884663,11271150973351188448,524288 --field-trial-handle=1984,i,16494649521968862350,13722039624521092888,262144 --variations-seed-version --mojo-platform-channel-handle=6632 /prefetch:14
        10⤵
        
        PID:5704
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=3340,i,8427868896471437364,8531934133488318752,2097152 --field-trial-handle=1984,i,16494649521968862350,13722039624521092888,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:1
        10⤵
        
        PID:3268
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6516,i,9243399257341285937,7070224801203247101,2097152 --field-trial-handle=1984,i,16494649521968862350,13722039624521092888,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:1
        10⤵
        
        PID:6024
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6720,i,5380899015341818512,17738369458539269497,2097152 --field-trial-handle=1984,i,16494649521968862350,13722039624521092888,262144 --variations-seed-version --mojo-platform-channel-handle=6724 /prefetch:1
        10⤵
        
        PID:3992
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
        10⤵
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        
        PID:5668
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x250,0x7ffe7998c188,0x7ffe7998c194,0x7ffe7998c1a0
        11⤵
        
        PID:5832
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=fr --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1884,i,17378408485667208539,2419321995697642203,524288 --field-trial-handle=2332,i,18279088716246385606,2720801471006491863,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:11
        11⤵
        System Time Discovery
        
        PID:6044
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1764,i,16712045774327374174,11821860347307246787,262144 --field-trial-handle=2332,i,18279088716246385606,2720801471006491863,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:2
        11⤵
        
        PID:4112
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2372,i,5745135366467385958,1910687120034849960,524288 --field-trial-handle=2332,i,18279088716246385606,2720801471006491863,262144 --variations-seed-version --mojo-platform-channel-handle=3376 /prefetch:13
        11⤵
        
        PID:2908
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4444,i,9997925159734804737,16419271024672539338,524288 --field-trial-handle=2332,i,18279088716246385606,2720801471006491863,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:14
        11⤵
        
        PID:3380
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4444,i,9997925159734804737,16419271024672539338,524288 --field-trial-handle=2332,i,18279088716246385606,2720801471006491863,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:14
        11⤵
        
        PID:5708
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4904,i,1218188767903753266,704092207726745366,2097152 --field-trial-handle=2332,i,18279088716246385606,2720801471006491863,262144 --variations-seed-version --mojo-platform-channel-handle=4972 /prefetch:1
        11⤵
        
        PID:2860
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=4908,i,13771289451751625349,501925538460508563,2097152 --field-trial-handle=2332,i,18279088716246385606,2720801471006491863,262144 --variations-seed-version --mojo-platform-channel-handle=4976 /prefetch:1
        11⤵
        
        PID:3224
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=fr --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5504,i,10219122980327529272,9944918517956830556,524288 --field-trial-handle=2332,i,18279088716246385606,2720801471006491863,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:14
        11⤵
        
        PID:5400
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=fr --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5512,i,2836894288920373281,14807357654260447628,524288 --field-trial-handle=2332,i,18279088716246385606,2720801471006491863,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:14
        11⤵
        
        PID:5632
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5884,i,1340949110703148790,11929942397323292995,2097152 --field-trial-handle=2332,i,18279088716246385606,2720801471006491863,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:1
        11⤵
        
        PID:5992
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5032,i,16735902528264442489,4171204065168360870,2097152 --field-trial-handle=2332,i,18279088716246385606,2720801471006491863,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:1
        11⤵
        
        PID:4244
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=fr --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5984,i,17882538898920176854,9107867410762117855,524288 --field-trial-handle=2332,i,18279088716246385606,2720801471006491863,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:14
        11⤵
        
        PID:6024
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=fr --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5972,i,9287662213159109589,8132564933194419403,524288 --field-trial-handle=2332,i,18279088716246385606,2720801471006491863,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:14
        11⤵
        
        PID:4436
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=fr --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5976,i,10838532535819079230,1562358875360436696,524288 --field-trial-handle=2332,i,18279088716246385606,2720801471006491863,262144 --variations-seed-version --mojo-platform-channel-handle=5016 /prefetch:14
        11⤵
        
        PID:4788
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5560,i,12111847543168541121,15489141816567338956,2097152 --field-trial-handle=2332,i,18279088716246385606,2720801471006491863,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:1
        11⤵
        
        PID:6640
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6252,i,16356402876496571414,14416166050827928328,2097152 --field-trial-handle=2332,i,18279088716246385606,2720801471006491863,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:1
        11⤵
        
        PID:6720
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6392,i,15089640521155210765,10701137688762881207,2097152 --field-trial-handle=2332,i,18279088716246385606,2720801471006491863,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:1
        11⤵
        
        PID:3068
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
        11⤵
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of SendNotifyMessage
        
        PID:2336
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x250,0x7ffe7998c188,0x7ffe7998c194,0x7ffe7998c1a0
        12⤵
        
        PID:996
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=fr --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1752,i,11096963418355167126,14370306877566702664,524288 --field-trial-handle=2204,i,15681148793965066164,5365301242774195125,262144 --variations-seed-version --mojo-platform-channel-handle=2736 /prefetch:11
        12⤵
        System Time Discovery
        
        PID:3448
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,12699780443295853097,9750507672738824905,262144 --field-trial-handle=2204,i,15681148793965066164,5365301242774195125,262144 --variations-seed-version --mojo-platform-channel-handle=2200 /prefetch:2
        12⤵
        
        PID:6308
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2224,i,6846114105471597204,17709026823567489227,524288 --field-trial-handle=2204,i,15681148793965066164,5365301242774195125,262144 --variations-seed-version --mojo-platform-channel-handle=2724 /prefetch:13
        12⤵
        
        PID:6428
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4452,i,1633598768749407787,458301231725599210,524288 --field-trial-handle=2204,i,15681148793965066164,5365301242774195125,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:14
        12⤵
        
        PID:5640
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4452,i,1633598768749407787,458301231725599210,524288 --field-trial-handle=2204,i,15681148793965066164,5365301242774195125,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:14
        12⤵
        
        PID:1872
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=4960,i,6767709353800504527,1951982868869246074,2097152 --field-trial-handle=2204,i,15681148793965066164,5365301242774195125,262144 --variations-seed-version --mojo-platform-channel-handle=4964 /prefetch:1
        12⤵
        
        PID:6724
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4952,i,11897599270096659796,9491663073099274526,2097152 --field-trial-handle=2204,i,15681148793965066164,5365301242774195125,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:1
        12⤵
        
        PID:6740
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=fr --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5164,i,10347888608903643304,9131031480863031471,524288 --field-trial-handle=2204,i,15681148793965066164,5365301242774195125,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:14
        12⤵
        
        PID:1708
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=fr --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5480,i,18274326137831772814,15482218302799046944,524288 --field-trial-handle=2204,i,15681148793965066164,5365301242774195125,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:14
        12⤵
        
        PID:4388
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5828,i,14555823845772292029,12506603542407053792,2097152 --field-trial-handle=2204,i,15681148793965066164,5365301242774195125,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:1
        12⤵
        
        PID:4344
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5044,i,6444831780221541159,4817905894217126481,2097152 --field-trial-handle=2204,i,15681148793965066164,5365301242774195125,262144 --variations-seed-version --mojo-platform-channel-handle=5052 /prefetch:1
        12⤵
        
        PID:6624
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5848,i,6457787181068277287,15793051598244320150,2097152 --field-trial-handle=2204,i,15681148793965066164,5365301242774195125,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:1
        12⤵
        
        PID:2708
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=fr --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5380,i,7058340651847715567,7402717346631741421,524288 --field-trial-handle=2204,i,15681148793965066164,5365301242774195125,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:14
        12⤵
        
        PID:6948
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=fr --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5400,i,12587297965791323131,1789509020346535252,524288 --field-trial-handle=2204,i,15681148793965066164,5365301242774195125,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:14
        12⤵
        
        PID:5948
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=fr --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5388,i,11636039098504074016,17729933510000165507,524288 --field-trial-handle=2204,i,15681148793965066164,5365301242774195125,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:14
        12⤵
        
        PID:4992
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6108,i,18318208987876944954,480827591301945514,2097152 --field-trial-handle=2204,i,15681148793965066164,5365301242774195125,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:1
        12⤵
        
        PID:6188
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6340,i,135751017710579150,14346572554423321756,2097152 --field-trial-handle=2204,i,15681148793965066164,5365301242774195125,262144 --variations-seed-version --mojo-platform-channel-handle=2016 /prefetch:1
        12⤵
        
        PID:560
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5444,i,2513306030001000922,3341604534133927335,2097152 --field-trial-handle=2204,i,15681148793965066164,5365301242774195125,262144 --variations-seed-version --mojo-platform-channel-handle=4972 /prefetch:1
        12⤵
        
        PID:4636
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5584,i,976284666970139144,4190155041820575300,524288 --field-trial-handle=2204,i,15681148793965066164,5365301242774195125,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:14
        12⤵
        Modifies registry class
        
        PID:6748
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=fr --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3236,i,5948377282988528638,12902757182668145273,524288 --field-trial-handle=2204,i,15681148793965066164,5365301242774195125,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:12
        12⤵
        
        PID:5684
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
        12⤵
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of SendNotifyMessage
        
        PID:5996
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f0,0x7ffe7998c188,0x7ffe7998c194,0x7ffe7998c1a0
        13⤵
        
        PID:3792
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=fr --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1640,i,4551294785974268648,4729984746094849144,524288 --field-trial-handle=2252,i,5982718395765373220,14651236255184611845,262144 --variations-seed-version --mojo-platform-channel-handle=2428 /prefetch:11
        13⤵
        System Time Discovery
        
        PID:5932
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1520,i,3581493038172266877,14194363575526342432,262144 --field-trial-handle=2252,i,5982718395765373220,14651236255184611845,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:2
        13⤵
        
        PID:6948
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2212,i,6045473066361567474,15585283477574720948,524288 --field-trial-handle=2252,i,5982718395765373220,14651236255184611845,262144 --variations-seed-version --mojo-platform-channel-handle=3364 /prefetch:13
        13⤵
        
        PID:6400
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4468,i,9987669886561445458,8681825113157131896,524288 --field-trial-handle=2252,i,5982718395765373220,14651236255184611845,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:14
        13⤵
        
        PID:6328
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4468,i,9987669886561445458,8681825113157131896,524288 --field-trial-handle=2252,i,5982718395765373220,14651236255184611845,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:14
        13⤵
        
        PID:4436
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4956,i,12730520564350418109,6323496202422332664,2097152 --field-trial-handle=2252,i,5982718395765373220,14651236255184611845,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:1
        13⤵
        
        PID:6608
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=4960,i,3921749509545884307,4842165045802626449,2097152 --field-trial-handle=2252,i,5982718395765373220,14651236255184611845,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:1
        13⤵
        
        PID:1372
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=fr --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5504,i,479958116773317538,16833225157825469439,524288 --field-trial-handle=2252,i,5982718395765373220,14651236255184611845,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:14
        13⤵
        
        PID:6372
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=fr --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5532,i,14911142114168406221,17031694243929517588,524288 --field-trial-handle=2252,i,5982718395765373220,14651236255184611845,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:14
        13⤵
        
        PID:5976
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5796,i,4849199844764533498,17831968042152926689,2097152 --field-trial-handle=2252,i,5982718395765373220,14651236255184611845,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:1
        13⤵
        
        PID:5136
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=6136,i,1141835007118064140,6522574102766207297,2097152 --field-trial-handle=2252,i,5982718395765373220,14651236255184611845,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:1
        13⤵
        
        PID:2932
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6432,i,7822468254809388919,2769384117294164953,2097152 --field-trial-handle=2252,i,5982718395765373220,14651236255184611845,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:1
        13⤵
        
        PID:6488
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6300,i,16146361300843480607,10172700312672594202,2097152 --field-trial-handle=2252,i,5982718395765373220,14651236255184611845,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:1
        13⤵
        
        PID:6044
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4544,i,675275382525992490,1066880277166850632,2097152 --field-trial-handle=2252,i,5982718395765373220,14651236255184611845,262144 --variations-seed-version --mojo-platform-channel-handle=6704 /prefetch:1
        13⤵
        
        PID:6720
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=fr --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6764,i,8910032563135295157,11696438434181654053,524288 --field-trial-handle=2252,i,5982718395765373220,14651236255184611845,262144 --variations-seed-version --mojo-platform-channel-handle=6832 /prefetch:14
        13⤵
        
        PID:4756
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=fr --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6748,i,3759152003285845728,10867986400629730281,524288 --field-trial-handle=2252,i,5982718395765373220,14651236255184611845,262144 --variations-seed-version --mojo-platform-channel-handle=6868 /prefetch:14
        13⤵
        
        PID:5944
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=fr --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6740,i,5527945458665838420,5391524224802494877,524288 --field-trial-handle=2252,i,5982718395765373220,14651236255184611845,262144 --variations-seed-version --mojo-platform-channel-handle=6776 /prefetch:14
        13⤵
        
        PID:3684
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6592,i,8937754671357439683,15179393924301212283,2097152 --field-trial-handle=2252,i,5982718395765373220,14651236255184611845,262144 --variations-seed-version --mojo-platform-channel-handle=6680 /prefetch:1
        13⤵
        
        PID:5380
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6492,i,5384770159980683154,10044974857675809529,524288 --field-trial-handle=2252,i,5982718395765373220,14651236255184611845,262144 --variations-seed-version --mojo-platform-channel-handle=6832 /prefetch:14
        13⤵
        
        PID:5716
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=fr --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6716,i,5936318779270420901,16778130705273214229,524288 --field-trial-handle=2252,i,5982718395765373220,14651236255184611845,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:12
        13⤵
        
        PID:4744
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6136,i,4260638336286103462,16038956015891268193,2097152 --field-trial-handle=2252,i,5982718395765373220,14651236255184611845,262144 --variations-seed-version --mojo-platform-channel-handle=6700 /prefetch:1
        13⤵
        
        PID:5296
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=4544,i,16916397001596497704,4380616004195378170,2097152 --field-trial-handle=2252,i,5982718395765373220,14651236255184611845,262144 --variations-seed-version --mojo-platform-channel-handle=6648 /prefetch:1
        13⤵
        
        PID:2172
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=4536,i,14872800107383116730,5572431008603787563,2097152 --field-trial-handle=2252,i,5982718395765373220,14651236255184611845,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:1
        13⤵
        
        PID:6320
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7156,i,13649377689934074132,9494897223408674608,2097152 --field-trial-handle=2252,i,5982718395765373220,14651236255184611845,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:1
        13⤵
        
        PID:4436
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6996,i,14159891642303000211,6488372405539962307,2097152 --field-trial-handle=2252,i,5982718395765373220,14651236255184611845,262144 --variations-seed-version --mojo-platform-channel-handle=6600 /prefetch:1
        13⤵
        
        PID:3120
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7204,i,6139185355551768131,5896971102060535048,2097152 --field-trial-handle=2252,i,5982718395765373220,14651236255184611845,262144 --variations-seed-version --mojo-platform-channel-handle=7064 /prefetch:1
        13⤵
        
        PID:5692
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=fr --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7092,i,7819670533497682626,5087022998582099362,524288 --field-trial-handle=2252,i,5982718395765373220,14651236255184611845,262144 --variations-seed-version --mojo-platform-channel-handle=7008 /prefetch:14
        13⤵
        
        PID:6412
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=fr --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7252,i,13788453586051445787,13504794438239004338,524288 --field-trial-handle=2252,i,5982718395765373220,14651236255184611845,262144 --variations-seed-version --mojo-platform-channel-handle=7364 /prefetch:14
        13⤵
        
        PID:4408
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=7524,i,8221370835582860928,3179933222216061483,2097152 --field-trial-handle=2252,i,5982718395765373220,14651236255184611845,262144 --variations-seed-version --mojo-platform-channel-handle=7540 /prefetch:1
        13⤵
        
        PID:6356
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=7088,i,15054612771656518971,3135551577985510261,2097152 --field-trial-handle=2252,i,5982718395765373220,14651236255184611845,262144 --variations-seed-version --mojo-platform-channel-handle=6660 /prefetch:1
        13⤵
        
        PID:7628
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=7184,i,10951639124662683464,2786737792110751546,2097152 --field-trial-handle=2252,i,5982718395765373220,14651236255184611845,262144 --variations-seed-version --mojo-platform-channel-handle=7744 /prefetch:1
        13⤵
        
        PID:7268
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=7772,i,13081410030103343324,1699243146145658268,2097152 --field-trial-handle=2252,i,5982718395765373220,14651236255184611845,262144 --variations-seed-version --mojo-platform-channel-handle=8060 /prefetch:1
        13⤵
        
        PID:7472
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=8356,i,596903681804276869,17527384391388092675,2097152 --field-trial-handle=2252,i,5982718395765373220,14651236255184611845,262144 --variations-seed-version --mojo-platform-channel-handle=8360 /prefetch:1
        13⤵
        
        PID:7728
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=what+happens+if+you+delete+system32
      4⤵
      PID:2212
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=minecraft+hax+download+no+virus
      4⤵
      PID:2148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://play.clubpenguin.com/
      4⤵
      PID:4240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=best+way+to+kill+yourself
      4⤵
      PID:5616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+2+buy+weed
      4⤵
      PID:1568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=best+way+to+kill+yourself
      4⤵
      PID:4664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=what+happens+if+you+delete+system32
      4⤵
      PID:5864
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=half+life+3+release+date
      4⤵
      PID:6620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://play.clubpenguin.com/
      4⤵
      PID:6180
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=bonzi+buddy+download+free
      4⤵
      PID:6160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=montage+parody+making+program+2016
      4⤵
      PID:6284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+to+get+money
      4⤵
      PID:4744
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=g3t+r3kt
      4⤵
      PID:5948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=minecraft+hax+download+no+virus
      4⤵
      PID:5948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=internet+explorer+is+the+best+browser
      4⤵
      PID:7300

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5012

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4368

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3208

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1476

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:796

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1708

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5532

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ffe68d0c728,0x7ffe68d0c734,0x7ffe68d0c740
  2⤵
  PID:4960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1588,i,4193836216740893124,2546379279025237143,262144 --field-trial-handle=1876,i,802062572810749735,4185225983989696836,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1872 /prefetch:2
  2⤵
  PID:4412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1460,i,13476154477098124071,420355569064277272,524288 --field-trial-handle=1876,i,802062572810749735,4185225983989696836,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2252 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2376,i,3243896539726018444,7196060246369489741,524288 --field-trial-handle=1876,i,802062572810749735,4185225983989696836,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2388 /prefetch:13
  2⤵
  PID:2068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3208,i,2812485011217089793,15806004979010041380,2097152 --field-trial-handle=1876,i,802062572810749735,4185225983989696836,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:1480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3216,i,7913999661596260876,15961693616749817140,2097152 --field-trial-handle=1876,i,802062572810749735,4185225983989696836,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:4216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4592,i,778842478725658292,8070377736152507707,2097152 --field-trial-handle=1876,i,802062572810749735,4185225983989696836,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4556 /prefetch:1
  2⤵
  PID:3400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5344,i,15689975809938630683,3744080612086809316,524288 --field-trial-handle=1876,i,802062572810749735,4185225983989696836,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5348 /prefetch:14
  2⤵
  PID:3720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5372,i,13447746608617452695,9156325605737181347,2097152 --field-trial-handle=1876,i,802062572810749735,4185225983989696836,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5612 /prefetch:1
  2⤵
  PID:1876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=fr --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3488,i,5270970215357123087,15953594434067525624,524288 --field-trial-handle=1876,i,802062572810749735,4185225983989696836,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3492 /prefetch:14
  2⤵
  PID:6008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=fr --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3476,i,17546573962098339038,13596055375777158526,524288 --field-trial-handle=1876,i,802062572810749735,4185225983989696836,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5776 /prefetch:14
  2⤵
  PID:4248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=fr --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3684,i,7175687480212857519,6797650016028277247,524288 --field-trial-handle=1876,i,802062572810749735,4185225983989696836,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4588 /prefetch:14
  2⤵
  PID:2900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3644,i,18402780740283126968,6348691204271311797,262144 --field-trial-handle=1876,i,802062572810749735,4185225983989696836,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5532 /prefetch:10
  2⤵
  PID:3224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5636,i,5683007654837454853,5105699785226072499,2097152 --field-trial-handle=1876,i,802062572810749735,4185225983989696836,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5436 /prefetch:1
  2⤵
  PID:6860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5692,i,4917769110864431448,2752673825996560972,2097152 --field-trial-handle=1876,i,802062572810749735,4185225983989696836,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5348 /prefetch:1
  2⤵
  PID:6856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=3496,i,3959589858880134311,6486126447536393093,2097152 --field-trial-handle=1876,i,802062572810749735,4185225983989696836,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5372 /prefetch:1
  2⤵
  PID:1328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=3616,i,5547344674299113515,17630939196034978193,2097152 --field-trial-handle=1876,i,802062572810749735,4185225983989696836,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5756 /prefetch:1
  2⤵
  PID:3440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5748,i,2737269458427377369,16030585207857924454,2097152 --field-trial-handle=1876,i,802062572810749735,4185225983989696836,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3912 /prefetch:1
  2⤵
  PID:5368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=fr --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5708,i,5044314255007805666,7800699122779118758,524288 --field-trial-handle=1876,i,802062572810749735,4185225983989696836,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4408 /prefetch:14
  2⤵
  PID:1212

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1856

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5504

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E0 0x00000000000004C8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:6112

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4436

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4328

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4160

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5996

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4796

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4756

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Windows Command Shell

T1059.003

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 8656b92d09c0ee774d47e4faf1126293c98070acca6abee513e1c6ba9232cdbd
MD5 592f345e8a6da3840f722995bfcc931b
SHA1 ab309449db66216530b8eff3cbfdeda3da8d4ae0
SHA512 a884948ec25edc2670e8c27d277d1457048c645d48601229513ecbba4a858b3e755b1cbdbddae53fb6493ee2be24a3d95f159881eb4fe3e52937dc0442971175
TLSH
T18FF028AADD20AC370DFC0B6920694786F75113173781994F3A3EC20DCFB563B459585C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000005

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000005
Size 73KB
SHA256 77d411acfb2d4b6dca3e2b96c45a80f25d1085f5771b9c8e9ba539c51fa0ac6a
MD5 9cae5a92e86e90911c12431b788995df
SHA1 af7181e76cb3f821ae8662b28a55c9df695d8b67
SHA512 daa805070b382302bf1486aa0ade3ab46e55143aca205a603f08947afd861288c5a10df0e1363021e2d683989d20cf4dab359f21f2e86ad64fcc29528aa886cb
SSDEEP 1536:O7A8Nwz5udpFfsHtDIT4bS7uIwTecZF5rH0VVOPzQh8RnMw:O7Aywz5G/UHiftcj5rHY03X
TLSH
T1E97302642D9DA1B4107AEA3C6CCA3E2205F8F2198555E25A1B1EC47EDF02D916EC683F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000007

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007
Size 345KB
SHA256 af74444f93c1a87703c134e8e3a1762932e8c9ed17b5781360a51435080b8704
MD5 a3b1bd33206689c75f9acfb640a6ef7f
SHA1 88d1a94a23fc0b9702d6857e71038d5c01a0bc27
SHA512 7d2ab5783a9640015ad2215944cf3bff51babf2ca59fa0ee7e2e587c1ef56901b6ddb399c2a435757aa66bd2d5c7933326c606df7942d354ba6493c51c49acfa
SSDEEP 6144:dt6B0ZtO9WZMN5KSdoaPiC1ghYvx4BmlxTbD5FuTbb1cc:dt6B0ZtCWA5KYP8qvx4klZqTec
TLSH
T1927423E3AC113A4A630789E74DC8A1AB7453C5C32A56FF4237467887A6D8D8E365CF13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 840B
SHA256 7de4229e613a152b971004c424ee08b6466e725141fdc6be1279d6f3f4f4abe3
MD5 b977441879c60ee1d6caecfe76758b10
SHA1 d9bb7e5911521285dbcfa6784ab99265e071f08a
SHA512 5670026703aa6c978afee1528a0404c5e615e1329430367c37f9426a3a27fec471afde830cf185ee11c01c978dd03fe859fe38120d12076d6ce52300999951c0
TLSH
T141019E0BB5D19481CF0B3A7D8F948DB134E8290D5581861FD593BD7413D61F5C5839F6
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 ace1ac49fd76a8008b23ed96b3912e53ec08a45bcbbb5ef4c4ca6103af92ffe0
MD5 a8c4e9d82b98f3ee34c05e6ce694ee2e
SHA1 1902798f521966468116881940f8c1470c5342e6
SHA512 ffc604d112a95a40744a656d06432fa63ab8ccf2de70daf67c9735b1d2af427380167b6b30a7ee210848e9917d7ab541c1035089adfae1d8318a06d0d99205a3
TLSH
T1F111481BB4948541CF4B7A7C9BD48DB134E8280E5692CE5BD483BC7822D61F5C3879F6
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 964c89abc97ca36f40ca14598ca633894bcb459a97065aac5fb121cb4a25e31b
MD5 b457b08ee6e498f4933742ecf2c641d0
SHA1 4d944416e1f63952a1cb07cc5e2556151a982fa7
SHA512 0202f81e0cb12a940bd6cfccb109f2c692ebcee1a3baf067be9c4662b75806aca5601efa12617ca85579513dd29739ecd58eb555d2f9d8e3a0637b4fa9417d98
TLSH
T166C02B0E1006D004C320137C1806CE063840391C00518251D743F0248423251C051251
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 1d8cf636d617736aca950525bc5db3dad64b01541bb907c4eb951aaf86139372
MD5 250d8d04f41bec956fcfa9d674a74f44
SHA1 f5973a80cb6b009765d1f8cadff24068a901841b
SHA512 4a0d6db836c540816af1663000b2c0c332bff14f6e10e9444ea08f2353ae586dca23cfb4a118f3c45e296009c7a0ba913c18d5e1d95d9d3ceba05b28b32c78f7
SSDEEP 192:D6ypIlK6F/QRzJ06Dk8j1BgBaPiIUvjfPONPj5VkjhNTcIseBSez:D6ypIlK6F/QRzJ06Dk8j1BgBaqIU7f22
TLSH
T1CD0290F7C3D8C62DD91156F49B256F1FCE2E0A28422D3C26C8D8AE5B93E14B1E25174E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 bf16b011c1616cd5b4d8b33543bef31f91bf657d000ef0418570a00435eaad1a
MD5 49bbd220cbd5af73c7988b6d0149b981
SHA1 656496888b56e4bf6beb7468cbb7ff0e6c77695f
SHA512 3b71430c4441e4a974b55efa2e50c08b0a3dd94dc38bb85eb0fed0b74ae64c19c270ec3e202052bcd00709d8dcf77ec01a0a9a693b0a5036806cf1b4ee0ba523
SSDEEP 48:YALlh4qnquq5hSghUhXsWRs8foKsjXLsVfshfosVKsNqzsMts8cs4+sGqsHla:D6ypIlKtDkEYfFfs/U4ZE
TLSH
T130919EF7C3D8C62DC80156F49B25AE1FCE6D0A28522D3C66C8D8AE5B93E2472D21175E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 a0194a7b49ad0b7ff5b197e5a532c9022250c8f6fb52e013702c052a1398e763
MD5 6da38aa5f5142a7b3f3486896665b2a2
SHA1 b575cfa7965baa5a0aa6f8bdb2e01d5e3b6d770a
SHA512 a2ea5fc71574dd8c649f67b100f1e2eabe0ba31bc88b9c699db445398d939d61c2d5b70de16259534c9736d464b59be515374af28d5dd74e4ad1b0b9956c46a2
SSDEEP 192:D6ypIlK6F/QRzJ06Dk8wB1BgBaPiIUvjfPONPj5VkjhNVy32:D6ypIlK6F/QRzJ06Dk8wB1BgBaqIU7fn
TLSH
T1F0F1B0F7C3D8C52DC91156F49B25AF1FCE2E0A28422C3C26C8D8AE5B93E14B1E25574E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 ba2c6a2ece03d15161c0eb83671e944392975b359df724d99666c1a6f5cbca31
MD5 3e912bff8dd4adec9c7d692a39c6ae29
SHA1 db26efeaabce780c0a2272b406f8d3f47a3fea9b
SHA512 bd913cf55f11e4b0db64e49f2180288aa89fb9581489eb89f2c84753e25d921e1257020e62beca1fdaaf50dbec46bc05a201a73d9f415c711ec7dea1e291e228
TLSH
T14D818FF7C3D8C62DD80156F49B25AE1FCE6D0A38522D3C66C8D8AE5B53E2472D21075E
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 e0407ae838fa6b0120b33a1525632843f9adc7f87eb3796298cb1301f15ab005
MD5 cdafc601c3d11b4ccf9f2e7d4f17bc96
SHA1 bede995e4bbe3196485389926fa834c007b3d6ed
SHA512 161bb3a6630ebcb1939893be674c99d05cf46f76547d531348aa95c50e5cf7c5b94f7e403c18a31adc7f1c42b5e2cb7d07d50e9b91477156e58949aca872f88e
SSDEEP 192:zR1F7E4v74pAPRp2793Hsb+WNnkMd50eUF23VyIsnAUgtaJ:zR1FIkUUXMxwHdeC8
TLSH
T1A632A52DAD10B93BACEBC65AF965BB53E7F5102120942E84EAFCC93C15E75CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 7208791b35614864adaaef4c34dd650bfd573f0e1ce350f913ef6517bdfb3fd7
MD5 0ede5f63fac5dc136c69b603545f9257
SHA1 362776a170479f6ec1cd06a9eb865f9c8addd178
SHA512 7534f77b52d32973d727947e56a04b73b74b1bd6b2108f7ff647edd2b876cf967a09ef5653b356914847994276f411f5a3b5e8d156b209633298ec742a45742a
SSDEEP 192:ARKcBzF7ETv74pWPRpc4DR93Hsb+WNSr/EKKhUm0eUF2UVyIsnAUgv7aJ:ARKmzFIrUmXpxwDlU1tvO
TLSH
T14652B52EAD10793BACE7C61AF961BF57E3F5102121942E84E6FC893D14EB6CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 e9a02a3c3dbd2673f1fa918809f3324927dbd38492913a12228b324c4cdeeb61
MD5 e31ccd2b4dc034f2a446944c66fa8eb4
SHA1 aa5b9659b4c639e1e6dc6a7db1afebf691f20e20
SHA512 9c12d67919339a67c232bb06132036f33e1d34c6b8b9abe26aa9266ecc7177d48dd665434dd84ada753e14bb2042b9ff2003b442f8eb98a7b0ab551deb877190
SSDEEP 192:zR1F7E4v74pWPRpc4j193Hsb+WNnkM72TgB0eUF2UVyIsnAUgraJ:zR1FIkUmXtxwHqgWte
TLSH
T1D542A52EAD10793BACE7C65AF965BF57E3F5106120942E84E6FC893D14EB6CC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 f494ad743eda04a12357fecf7a42aea8a67ac8b0d470c70fb07df77e12c8470b
MD5 8b6f305242aa48c860a438e5b2997b47
SHA1 871e3d0b390f1f60b471a67af36393994adf5d9d
SHA512 5832383850b612448f6ecb2566b37c4a0b562bb864275f692c45f888e64c85bc1f605e8b71983183fa577ecaa488757faa3aef8926e827ca130d56dc9bddeb0b
SSDEEP 192:zR1F7ETv74pWPRpc4j193Hsb+WNnkM77Yy60eUF2UVyIsnAUgraJ:zR1FIrUmXtxwHIypte
TLSH
T10D42B52EAD10797BACE7C65AF961BF57E2F5106220942E84E6FCC93D14EB5CC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 9598efda65ae8fdf4cc869e3fb1ada905e6ac52c197a54a4df4d83881a046b74
MD5 6a6765e83f0402532ba123ca80548601
SHA1 fde589b4fe87d1cf85f69d7afd1c1a01e98bca7a
SHA512 e3070f0776261079244d2a751d73bb7ad8304311f4873ef0bf064254b9de1d020330f27e51a6fc957707eb5896d469b1425dff5768451ad832a89acbff75814a
SSDEEP 192:zRpcBzF7ETv74pWPRpc4Dh293Hsb+WNnkM7KhUn0eUF2UVyIsnAUgv7aJ:zRpmzFIrUmXkxwHIUMtvO
TLSH
T12E42B62EAD10793BACEBC65AF961BF57E2F5102221942E84E6FC893D14E75CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 52542a1a3fd2f02a0e6148f1a0cebcd3e2611d1d707fc485942b366d1fe23dd7
MD5 660197e0d67bd0cbf2f2d68ca49a71cc
SHA1 d966aa152d2160070e5c844f12c1c5c169eb2fc4
SHA512 1e2954caa6322e93c1bca7897a1a732755eacb96c12ad41eb4035f46b9ef5a65f3c0648e460df5f9758fc8601a93f852e4255e8e82d179c0d51aae447a6dfdbb
SSDEEP 192:9RpcBzF4ETv74pWPRpc4DR93Hsb+WNmi74hKhU+0eUF2UVyIsnAUgv7aJ:9RpmzFlrUmXpxwquU9tvO
TLSH
T13A52B72EAD10793BACE7C61AF961BF57E3F5102221942E84E6FC893D14EB5CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 2f565cab61adc82a8c8e1635305d129684553729b87f6e11ca5a6beab88065c8
MD5 8867563c33a2b8bc83bd2e35d0ef65dd
SHA1 3563bc821d885a72d384c25d8e1a97570b5ec14c
SHA512 1364a295d889465df08630ed38c14b0497b801f592c1602cd4258bfabbf7ab0c101ea65d96d15054484a5b92b73008ee2c1394f1d2a1bfcb068e9f7212ae29e3
SSDEEP 192:9RpcBzF4TTv74hWPRpc4DR93Hsb+WNmiPgSjKhUy0eUF2UVyIsnAUgv7aJ:9RpmzFGrUuXpxwqzURtvO
TLSH
T14652B62EAD10793BACE7C61AF961BF57E3F5102221942E84E6FC893D14EB5CD221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 7d14f76d8fec25344a865035fd94ba8060b231622f53f526aa13b90a5fb9c538
MD5 e0913eabda6d9ffc8bee778fca27e39b
SHA1 cb3b0a7179f50c4f674899d99771c440f464382b
SHA512 0b54164bd9bdb6a99b94d787b7e729678103b664139567d1eeb2bf09b54cf93e6c92b8b26510474e0a446616fa1bd641cbc16bc4876af2633efa497120991616
SSDEEP 384:k6jA/7KxkXqKf/pUZNCgVLH2HfgsleLXODAj+ErU3lMHoCUbqTi8:kqA/7KxkXqKf/pUZNCgVLH2HfgsoTOsx
TLSH
T1EC520867688C9A3F0FD8D94CDC26BF4FACF602566168482453FA9C1803E5BDB114A2F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 112bac180e1859592fcff1ff7f124a1f3816f3ab74a210dc157744feb568f7c8
MD5 c47e520b8bcfbbf2adc72c5488ec0294
SHA1 851f2852a043fe27683f97023614e4c0c85538a8
SHA512 f2e7d04fc8aba7d6603c1c1aa3a295a452c23e177c943043891deefddf8ff64aec51c3bb5d5c69fd6ba7070c47781483bd2918c0ca171ffe6f387457ea2a4f86
TLSH
T141B002D9514E7E07DE54BB7C93D168E437F72E6C2353451744F264FA85232439361341
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 ac9439ff63aef287b67e0ad4fb88de7be7c4b2108ba88d8db9b94c9b290e8f09
MD5 515909746c24f2a874631ce45bab0b47
SHA1 07c3aa5f8cad1f2e84589a0580ffd48c863bc2f2
SHA512 c577f6baed9ed3b340030a352a8b78725a0c91ab1e7da066884fa6c3037e08be08d744fa54609f39b5d84b3bdae2fcecaca55a57666ac0cb8ae6144c12f9e33d
SSDEEP 3072:4NKif3RLelUpM3AjGFIuj3Oj+AeiMHXHkm+q4E2ksAzexY:TzAMQjmvaFezXEmLOMzexY
TLSH
T19ED312B4657EDCAEE334E51EF9D95B463DE165E724D453EE3880A2CE88B37E801C0590
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 262KB
SHA256 78db03c1d1826f0a19158a60db86c9da4a0340d41f422f3137697d92921c2c07
MD5 abb6dccdd32b589a129200434ea074e9
SHA1 a1626f630508f1a3e3917b268eb48355e3f7893f
SHA512 cd659d0fafb4e788b8c3adc7f5f9f95af288b4fc513bb8095d560e667d3443cd9cd1913ee4190014c105e1a1d1d24da54fe519a99e1fc9f32c092472ff2871b3
SSDEEP 6144:Y1w1BlfCGz1AMqEiRSM33uVzAMQjmvaFezXEmLOMzexL:7BfzcRJ3uJn2FezpOxxL
TLSH
T1F24413F03FB8CDBED3309A1EE4355A063CF1ABE35095D59D7441B6CE89EB7A90682160
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 262KB
SHA256 f36c3a5e71c1064da40ffa1b5a27628e2bb431087ebebb3c234fb0d0b56e8a26
MD5 e8d4440ece7cc166f7a27ec55d3ebccc
SHA1 abe009a6321bc3193e7417c436b76ad1af6e824e
SHA512 44ae4bbd6d29cd3af4346884803fd4ee22a3f0440a33db40ed476d1f65a7046f1ad5c3b6a47a4966bfe37bf31d302ce83668fdf49b487440e48300664d4003e4
SSDEEP 6144:oOw1BlfCGz1AMqEiRSM33uVzAMQjmvaFezXEmLOMzexL:KBfzcRJ3uJn2FezpOxxL
TLSH
T1544413F07FBCCDBED3309A1EE4355A063CF1AAE35095D59D7441B6CE89AB7A80682160
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 261KB
SHA256 edbb47b57b9451f4dfc80dc57521313564df252a1b2e38e50406d1747c413a68
MD5 b4677eba27b8396cca2cad32ed1fe5b8
SHA1 878ed477320bee2d94f30f92481f56921fe76ec1
SHA512 2ac77feee1b0037bfebd0054335593f0679e3172da37052ce3a1cd3d54ade6eb0ade64ebb8410cb127dda97e52776d3b8c744eb7dc3f55be98fb1d327475fa14
SSDEEP 6144:I/w1BlfCGz1AMqEiRSM33uVzAMQjmvaFezXEmLOMzexL:IIBfzcRJ3uJn2FezpOxxL
TLSH
T18B4413F07FBCCEBED330971AE4764A063CB299E3109596997441F6CE49E77A90282560
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 261KB
SHA256 522dfa28490d613548b0b9fa909c4e7e566fbeea524f3ce51111c5c4966455ba
MD5 c575891142c233e4b73de3eb6f689ec0
SHA1 2a9113be43543cc6fb8a3f998893fb1cb83ef332
SHA512 4ceb12c836d28fa575dd82f12ac4ce1742cd43c514ed674914d0b8768e6f94c97ab4a43fcb1d50f515925e27843a722abd6e5a0fd1f24b75ae76bd9f4b7675bf
SSDEEP 6144:3/w1BlfCGz1AMqEiRSM33uVzAMQjmvaFezXEmLOMzexL:3IBfzcRJ3uJn2FezpOxxL
TLSH
T1E44413F07FBCCEBED330971AE4764A0A3CB299F3109596997441F6CE49E77A90282560
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 262KB
SHA256 e23dc77caff632bb741f60b9e8ba2597bcda8e286d44e1a0c8f1eb75480e73ba
MD5 70dbf2a36c8651514b4d5684a75b5292
SHA1 d3933127a0ad5848db894c49465e8eb9987d3adf
SHA512 42943c0a00f582263c4f83e8ea53e937bfafcceb5f0b2cda2febfb4adfd115364b3722a04908545c3c796964f802c3138d64b59e14995ccd572e11020732dd98
SSDEEP 6144:EOw1BlfCGz1AMqEiRSM33uVzAMQjmvaFezXEmLOMzexL:mBfzcRJ3uJn2FezpOxxL
TLSH
T1934423F03FB8CDBED3309B1EE4355A063CF1AAE35095D59C7441B6CE89AB7A80682160
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 b2d86bb9635e04c694403b46b456ec83da9c370d96a21b15fedba9be06b8e402
MD5 4e53b8aef808dccc6661e3fb447c2054
SHA1 acccfaf681928a627e8dfa4800d80e4660d2ef04
SHA512 13032d466f22156730bff2ac4de38d89c66d27f0adbccfa995aadd43d09216e0aded976b46c0418706370333080baf61ca1adc51bd2e043c578c3b251ad07d2d
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P74:fwUQC5VwBIiElEd2K57P74
TLSH
T195B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 1024KB
SHA256 1c02e2feba3b2af3c045d1ed01f8a67e0923f7e357b32c434e567eef6aac4138
MD5 f05b0294ae4949feed0706bc80fa6418
SHA1 346bb7d2d99251c193652ad4ae7ef2964565b98d
SHA512 348366e162f3a037e74d0e9ff422ba7ca3e14c2b170f50bab2a4b88b29a572028e56965c332bc63cbe89de1a3467c215893ecf3cac514d786ec7ea30c08bcc05
SSDEEP 12:bHiUXhV0xosfxCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:blRqxosfxWMk8xVZ4YWI30otWn
TLSH
T139257D85B34494FFC8C35A7189BD17903774F6DE5F42835B6A377A0E2E671D44B48220
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e660cbc769622e92ff519def2c2d7e6ae3a863d2d4495bd966ae7fa1e49cbc9b
MD5 29e1955bbc4364d5a795a2bcb66fe42a
SHA1 23bb5f55e2d8f4503610648daae89a650f7cf9b6
SHA512 ae8a8395c6433d7e5f42a05e5b4e15839d67daff168b07ac8c48d2cbbd11097616443058864618a755319fd08436198d900a6c24bad355fc6ce4e2d2dfa27bf6
TLSH
T146D0C08CF7109F50F003D438413DA60B3299D141DC030418A8C1235104C3D030065128
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 990d4b07fc1a6a6bc3ddab3e9bd68bdb06b544c0248047bfd72666e28cf4957c
MD5 eb525de86ae3db8699c14b441aaf6ba5
SHA1 51c87ab6fe4a2d548ccfb01001a3fc19e1133b5e
SHA512 1a3b1156a52a4399ef534b21b60d54440db3993579398804646737179478b46094030a83293cf853655e0d35b231b1a1745f4c19d66f3e8c2b3489719c076571
TLSH
T1C0D0C08CF7009F50F003D434413CA60B32A9D141EC030418A8C1234104C3D03006613C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ed0dc4cf90c8ab4f83da8e15208315da9bcf458489749140764297b296348a39
MD5 062e895d0c5c39e63385e7698f5bc4eb
SHA1 917dc3d8459dab067229704224382778d243a03c
SHA512 76ee512ac37e6c6121b108663c9cff86f02c5827dae7c4e72d4d13530d7ed6e986e0a7a1bdc4ff6621cb783530bf8ca2d230cdf67414d3a0987aa78087af3f48
TLSH
T189D0C08CF7009F50F013D434413CA61B3299D141DC030418A8C1134104C3D030165168
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2fc424e61288f0e156aa6d75df541f5fdb526ecd6de5e04ab79275293bb72618
MD5 4173bdc91bd85737d8726e0382d05402
SHA1 a901a8721c0ed9aae55d498f93a0d3816413b031
SHA512 9840e145a8d7b8a811c13cdaebcf8b2855b209444b008462f20ac69887750df31173bb1a22cedd6c7a9e5645a218573750cb939d9be1dd56a51fd39519773adb
TLSH
T160D0C08CF7009F60F003D434413CA60B33A9E141DC070818B8C5134108C3D030065228
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6286f37bc2b38dc441bc3c38ce0752bf4b7cb1f25af201da5813e3285cf01ef8
MD5 7a6009b48e09fdfec14739c3c84aabf8
SHA1 55e75e08f4dff3d8eeeb54dbbeba186ac6abdd63
SHA512 947fd8d775cf50613b4149dd7b9fce80fd2f7002651653145f1b5269cb531ab51ef57791b5ae5fee283750c7081a8c05b631f146f230a9c6fdafa5a1d7fd5adf
TLSH
T1B8D02B5CF9956E40F402E5340039B24331889081DC030005C8C0032244C3643046613A
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a6981c64661d8597c6e2f0743e95f36b88247e0e85475f4f252c0d2d9e50034e
MD5 be041f117089a511ffbc3515135cf8f0
SHA1 88a482ac154864792c381322df43fac536b43804
SHA512 4524ca29190ed2ac37e284d636f468e56f3dfe4eaa264701b43314cde21f18e42816ab474754ea4751bdaf43e2b62c7cdf7d3e9e494783562a494ee3775b5f83
TLSH
T134D0C08CFB009F50F003D434413CA60B33A9D141DC030418A8C1135104C3D030465128
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 451e8cceeda1b45f932a10154910f7f4081ad392264bd4ae26b94f339c879353
MD5 982e9b64e35f40f5668761e46eb86a53
SHA1 59f45374f4fc5ab9f54764676dcb82f0a777d61e
SHA512 8e7036265693db34a3209fabb2b4ac600a89af8bc3b17926cd3f522a0ecdfc7f311c8abdbb04345976247d0115a9993732899c1320b0bef96cb693344f3c1adc
TLSH
T1EAD02B5CF9556E40F002E534003AB24331889081DC030004C8C0032254C3603046613A
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2d03753aa17465e50157b096f35eb5fd973a4e84e1cffe89f23e2704abceb9b2
MD5 044bc7a6ca6aee3df01a68d0cc541c25
SHA1 d1660415e868eed81a7f12281bff3329c05253de
SHA512 e62bdfa4de4d54df6b2ac9aa3c24fd052a04cb06c413da8f91b24e8b9ea1e4f016a67da3ecf8483fe55503230289af051c447c73cd8d9cd1261e7c88e2a593cb
TLSH
T15CD0C08CF704AF50F013D434413CA60B3299D541DC030418A8C1134104C3D030065128
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 78fb1a3d135a13bd76105979842c4e8ebe183e11fec8c43ece02366b9c2e28e2
MD5 fcb2de5aab84abc28b64e3abd4737679
SHA1 3b8e0e1181b7e331ef100a774c11da79d89061f8
SHA512 3cf6f3fd8b74e1450922243dd38538f2416d9519e7349486f937ccd1c35a08d39225c54018eaf8cdf8e89e12de0ce4ec2d8c6ac8a4c81bd87554f7ca7c9cde92
TLSH
T1FAD0C08CF7009F50F003D434413CA60B3299D142DC03041CA8C1134124C3D230065128
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 74ee5d58aa6759579fe52c6dcb9b89d95f42a6ffe00ef0c3216c2df3f7d19a9a
MD5 8a0bd7ced65f3146a5f6c66271f5998b
SHA1 88111858aef4e61500dd3f20fe25eb4e5742d913
SHA512 0cd9be98b37690b4c17c65b1b189115d2691a75b5112ac23c7b45a98f35150a65b9c0685a06e4610418018918f0e9b55ba6ae677a1e009502acf6fd8b69e08a4
TLSH
T178D0C08CF7009F50F403D434413CA61B3299D181DC030418A8C1134104C3D03006512C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 098511d38478d412060b248119e3563a96aa44aa58e75a667ddace41f53f42e5
MD5 395498c0e3fd7b4b9825ea8af28be6fc
SHA1 4c602963db7d934c14c14f16632a5898dac97890
SHA512 9e5e04e11eebec5e0ffde7fa49ef5856629a7f8efb92325e7e3dedb02e8df33bfb2e7dde48a66c29cf90e363228f6d47f837e655df3ff2c550b65eb56f78aa0b
TLSH
T136D0C01CEC347FD0F022A13C01397102318C50C3DE430009D580021288D214308A2AB9
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f2982b647604db60428ab3e41d44d62595ef48983b5b8264148ff1b6b2abe4df
MD5 8182d2a53adf1e2fbbb66e260d7ae6fb
SHA1 e2deb41254384192a87d2d50a8c31505776137e9
SHA512 a9ae4c7a49b827f4c5617d13e67f50f2c3a40381552c782b0adbf7d44067b9c3da447ade32d2eb41d1e306333ddcebe4d41a0549075a8f422f3575e13b9f9d90
TLSH
T13BD0C08CF7009F50F003D434413DA60B3299D141DC030418A8C1134114C3D030065128
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7140029fed3ffdb8ebbd911f8023b3af0e92a4d74b174782b17f4d1d5336a9db
MD5 4c657fa1fb97d3d9a374fcbffae2c8be
SHA1 4e238ab5774ec69ca8d066e6a7882e7940c85552
SHA512 d3332f6f877292a57f638968b51b93bb3b919244e216c02447b27168043800e64e323798b79815624662a8ad7fb285f8a0b4d107a44825d8eb28dfbf8d6eea40
TLSH
T1C0D0C08CFB00DF50F003D434813CA60B3299D181DC030418A8C5134104C3D0300A5128
MD5 SHA1 SHA512 TLSH

Submit Download

001c7109-6a94-4a4c-ae95-fe69f0a4c20d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\001c7109-6a94-4a4c-ae95-fe69f0a4c20d.tmp
Size 414B
SHA256 b3967061bcb4071c882167c513725b224647238c7c8325b70796c4c9fbe431c2
MD5 16eef4542370e0799ed2249b89173023
SHA1 5a81039ed76630a3dbea6af9c36d0163fb6c6230
SHA512 91245a627314904d681b16278cda3f6488649b46f36855560b2c3a17365f6137c21de5946a6f5a1763c112f7c13c3bce39622b5246fa0c1e4720f2b19460e546
TLSH
T110E02BAECA61AC3B0DFD1B5C10554A45E71023672B90850F3A3C830D4FB4A3B82C6D9C
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00008d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008d
Size 438KB
SHA256 f0dc9777c553f4539df6e16b7422d364934d6d1827b577f9f4fcc1882479d907
MD5 e6bfbe0cb49a0eef47ca1d14ef005e6e
SHA1 2142dba05ae1c54c61ffceb32faaa0ddd278a98f
SHA512 43f03ffca0fd74812487b9dceeeebbbdef1353638c5966b1a3ef8fd6d978115a927cfbcf222a8108afdf08d8471efb105bfd935d76014b96786bd91c84a35e33
SSDEEP 12288:fiEw7v4qKNj+YOsg7wBtEwn7jASe9gPGf5WkyTv:fGGNjjxg2tEOASCIm5UL
TLSH
T1079423DEFA60DB4D510B5808B839E24C55DDC492DA06A2876522ECC754371DFAC8BBFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a6

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a6
Size 59KB
SHA256 50687c4334ed79806f7414c03e5175c6d90e23f87a4f37021a0eb3a211269992
MD5 cb83954072b6ee4b9489149cdba2d929
SHA1 b8beba97c668e14fcd3272bc7aaa281c640ecc0d
SHA512 9d2ddaa7d9059a53072ad1d9cf3e579d5b60107cdf9726a53a36ff100e9511a19e6e1e6c7b53bdde26909f98a1e008477059c3f3a8d9138c6a3e30dfeeae4dc9
SSDEEP 1536:i0bQVVbi/LeN+o81ENzvAUAF6Q7HWnMGDD:kVbmCNky/bQ7o9P
TLSH
T108430229AD6059B2820FA718C78D5B30EDE4B173B835282EA50B536A9F631FC4DFCD45
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a7

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a7
Size 59KB
SHA256 cb2693e5d4736dd2f4fe6441d427f21ce16049e31ef2f4b6e580f987a5dd3185
MD5 527bb8f60edd153e53250f85936f3d94
SHA1 974ff05e7fe9dc6fb7eece73404c00c1d458114e
SHA512 cd74530fafb18bb122761e6480698a838921d488b459cdd0068ae9506149df215b38341aef25a91c0ee7cc2dd0b413392d018d5cd5c7f5f8ce95a574de643d39
SSDEEP 1536:eujE2DjQSkn7RRb6o+p6ZhVwLI6tw9QxzxwJZI/U6:S2Dfkn7PHfLV+I6twqzCH6
TLSH
T10E530211A801B58AC60C6154FB742AE66FE830EC6965D8725D6143EC3FF12F3D9CB543
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000af

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000af
Size 68KB
SHA256 056c9d5f9f4ea94f744ef8b5f0d33be1ff73dc87e3064474ee2950f153fd837f
MD5 18a9cd64a6d3e46ddc0e2d69fa0c5dfe
SHA1 ea533bc18262e138ead07de53a891c097d1d359f
SHA512 92f70831ebaf78275d0c265b671bb6fd94e9e6c2eec7cf85004b879c74ec3c1b13c339024172915db51e499272dfb3db27141b21e4598dd8885005a7fd760ca2
SSDEEP 1536:ON2z+MFMe0EwaFsNupauYkLLDpRYmWrUZrEi+gDC/QxLox31/PGRzDDTHr4:y+ee0E9FboSfDpRfWrkt+iPoy7rs
TLSH
T1EE6301FE8BBA093629D99CF095B774467E8231DAF43C103A1CA4D2B55F6B6041DCEB42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000c4

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c4
Size 116KB
SHA256 7b75fffd27b02e9e7f087bbdc5b907819c75312528e92bde7cb7a250384f95b3
MD5 f1a3e8d3605c8399de568558fb89a15c
SHA1 3bed9476633188b724f616bd7e268ae91da94f6c
SHA512 d2fd5c82caa6cc0545ceb93e5a288954f8e98d0f77edbccf8b42f90b202c9c0c6052e6378585e8bc3167c40e251eabfb2dbb3e33b35249e5b9f5c64f9bed769c
SSDEEP 3072:vDI1+1jysuILQgHKmQXkhwANniS0Sj62P7aq5:c1KjysPLQCwAR9P7X5
TLSH
T179C3121E1B3F8939FEEEA0B06FB54188436E91886CE64C221D636E5B2DE5735CC15B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000e2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000e2
Size 69KB
SHA256 dea1b2bdba13bf2459f0c760852c9e3e5723e2c4e38068d909dc11e8520f2de6
MD5 e9bee9cf525aafd2cc5dfc33caafc51a
SHA1 8f5d6f95c1bd95fbe9d509ec856dfc0402f603c4
SHA512 c182302697c2eff775fc96b6124970f30f59e2a087f511e80bcbbca9a70afba0aced1a12133cd4edbeefe72af3ae0b3add6d671b7b8938175edeca8dd8e6367f
SSDEEP 1536:z2GoDVuGx8Huj02OHag9DgmKjWb/OWoimpQMXLg2LtuA:zSDVuGx8zZJsWjvmplkatN
TLSH
T10B63028D1DFD2471AE9A84884977AE9383F63B0CD1025955CE70A4B34D67C6F2AC893B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 71abd990beb08ff89ae508e01b48d20d6429a078235e7873d8839fd92cf82022
MD5 f187d1f7fccdd1249e70983c1d2ace4c
SHA1 29abc5aa81e002dff6cacce915ea800b0fc863af
SHA512 865a14684e00e7cad09e16a20695f74cdb315a4c326baf5d0a3d7c26bbdb56904e376471b4e0f1733977ea4ecaac03995e5cd2de27390f381904194cf5cdc635
TLSH
T1A48170A0194842B5DB9E2D7C99E949C63FFCBEA973833D02F244F476966FF161836840
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 b4a68bc34734d288216bcb4c9f65e43e29b38bb3f1db3f9b13a737a0066f2070
MD5 b5970c8dc236134f0a5d601360231199
SHA1 45977c251c989bd84b7b07968a8b990e9b590be6
SHA512 cbb94707a69fb51ce428a0ca885bb751a5c8a0887d7395937ac290f145e075d527e2120d2e91e4f2fe0694acbb75c094c863aeaeee9792f73dd5e4451f7e1efb
SSDEEP 96:8jQ8cmAzdm9R1d/A28YS3SM+t3aapxEpX:KZridm9RLoZYsS/qfV
TLSH
T1FA917160290841B1DB8D2C7CA9E94DC73FEC7AAA73473902F250F87555AFF6A0836940
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 74dd94cc9f71f9b31a06a7a91e4d6f2225e397ffa9ce504cf3c7f86c899acc9a
MD5 7132f5074f8c6d657b4061ba13937a3d
SHA1 95d2bf05a44fb9983c406ed9041a404504ec5e4f
SHA512 f26520eb6a88bdb03a3f48200c018308e9564aa9daaa869809fabcaff5aece056ca24b3095679c4cc6bcab497c874b90e09f39ac9907725093d6e1475e7d2a75
SSDEEP 96:lSJqyKLzA1BxEKdhXqyK+XDlFimRUroNT73qD:lSclYhXqyRFim2roNX3A
TLSH
T1DBA18160190841B9D78E3C7D98E80CD63BEC7AAE7347B902F240F47465AFF6A0433940
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 60ada2033843dae4f056a1b63ada350f021f8574fe5fe1dfce2e6fa461cef2b5
MD5 19da09b529cda8376e446ab1c0b58cae
SHA1 9305cd52006d151be269d2cc4d9492f66a1ecfe8
SHA512 5817dd91a774185cd5cf5b51ffcd4e305c67b1005cb6656433a42e107b1174dd320b99db10b871c5e612590af623051d8d332abe52f33fc8443f87d92407ad86
SSDEEP 96:PC4zz+BUDKNTar48zKkpYVGEXwj98TqHxiV5uvz0g:Pb3QUOVar1KksGEXAHUVk7z
TLSH
T1B4B1A560294841B5D78E7C7C58E90DC63FBE7AAD730B7A05F220F87855AFF6A0532941
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 76d30727b77aaa56b554460b8e0d7939adf2a1fce3f536a38481fd1e3a44204c
MD5 73d339706a94bf4fdb6519a3659363d2
SHA1 3232f835e6d5e402d4c43cf9ba82ba3ab9e87fe1
SHA512 0be3f842182ffc577931eea339b4e69a7de5cf6992b527af9c5d91343797f5735f9a1d7c98b7c90fdebab6fa0dac9f4319b736047d0d5f6cc56f870b4a355e40
SSDEEP 96:wdmi8uU1uuTO2TlNgTqv0TzHYzr3sTCDjMFp3CU/9W8NVEq:CeuEDTO2mbfHar3Ik7+9Wvq
TLSH
T167C1FDA0284941B6D79E7D7C59E85CD63BEC7A9E730BB901F200FCB495AFF260632940
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 f2a977a799fa588f9703568548a5205cf04eff24e47f02ed958f81d1757aeca4
MD5 29b9aa408daf8aa7ac29e74ce8dfe6e4
SHA1 4372860ac337bc41e70d24b4f1c6a419a3f7a779
SHA512 d1459b5f9af843b5418d3fd8ee1716ada490f599dd651ad02ee830a28fe34d6d2e69095fd4b6844a7fbe96e535f1360568bdfdffc6fb8356a12b515db1e37629
SSDEEP 96:JcAC0NK/3L0MhtBVX1n0h2h+z6BYljBIjAt6PqpmdGg2xj:JcaQL04bXtLhg6udijAIMj
TLSH
T198B1DA64699841B9D78D7D7D98E80CCA3FED7A9E73077A01F210F87559AFF1A0432940
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 73491c9775f0d6b42ac8c6a0fc4dd367d36468896f08772dbe95132b4f011880
MD5 5f71f592ec4a559eaf518e1fadcf21d6
SHA1 795c5b2e449590f33174df8a8aedbc1552119470
SHA512 06026d5dc549008b81a537c36c89af8856efbbdffdc8538806fb911aa9d56dc87795e24eee4f174a21a98bfe7fc0e661252742d4df55c5e3eb3ed666b2a33cb8
SSDEEP 96:wlW0Mazr9zuIEsdDLZTNIxyXKnqwRVl4d:wE0TzVuIEst1TuBn56d
TLSH
T1E5918360294841B1D78D2D7CA9E90DC73FEC7AAA73473902F250F87555AFF6A0837940
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 79405b9ce2d6ba82fd3bf7c9e466d978988dcba931520323d2336bf25ba90b01
MD5 85d7f26ddbb39897925a0d12254d7274
SHA1 fe187a27c7fec39f371397c04111e9d1647f0de3
SHA512 17e050be2883c45822eb20c04e40ff17c422a6a670dfdf3b1b424c278010f3e6b7625f8515f2fdcc3cac241becec18150e3bade06596ac9b4787afa63b517cfe
SSDEEP 96:RcAC5bQkb0i1H8Tlx1ntRnkuz637jBWBnAt6Pap3P7MgEge:RcXBb0ccnt/kw63X8BnAVNJe
TLSH
T18AC1E8A0284941B5D79E3D7C59A84CC73FED7AAE734B7901F210F87465AFF6A0832940
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 c146cd76f222d51037d245d962e4c3791e0730ec9174f903d9c1605fc07c2795
MD5 875c002133cb0e4b774b765bc6a4f314
SHA1 3d23a1a0a28f3a0ff80019eb9fa9442b4019d140
SHA512 3bc12b41e0149f5847cb8ff10c7a1fb6218d9aaec70cc018058d359c387963a5dd8e55f53f4fa9d2e58bed64c7b20f3037f4419a0e4f6e2c7993a9f746f08f8f
TLSH
T145817FA0190842B5DB9E2D7C89E948C63FFC7EA973833912F240F476967FF121832800
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a5e6d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a5e6d.TMP
Size 3KB
SHA256 9fae1bf7fc275f516a57d71f945b59a7eb86296d146e7977c78d0e951dfc319a
MD5 b0715210ec5b0938d8ba18b661d908b1
SHA1 5861e6eaa9cd07ff066ab4de75cb510c134c7db3
SHA512 527367767629cbdd997e5528f7ea86f2905cf352fd335f1cd05bf31b63c2ba499915ae89c40f58d1a8b284d4401a0318843e030e8abf8a182fb31104828bc089
TLSH
T132615CA41A4881B5D79E0DB896E501CB3FBCBA8073833D51F654F8B8643FF562872841
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 319B
SHA256 1bca5376746bdf5cfd007fdecb8f94d77b4f403f35441fe2cbaf958a06e4d95a
MD5 88cea0f414b117764945e96cc16e1c0d
SHA1 072d0a23d3839727f54512ab1871e8cf54e10290
SHA512 ab3809bc789f38f3a447d02405b5b3655e396574c7969b7b9364d222e8d4a73166b251777c9c07adc4c1a0c64848d8444c2bc66d126e42bc5d93b5ce591692e1
TLSH
T142E0869845D9C16E906E7897826C6B0892D2354AA7CC3F822F0ECC406645656F696385
MD5 SHA1 SHA512 TLSH

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.110.1_1\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

computed_hashes.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_1\_metadata\computed_hashes.json
Size 429B
SHA256 b829b0df7e3f2391bfba70090eb4ce2ba6a978ccd665eebf1073849bdd4b8fb9
MD5 5d1d9020ccefd76ca661902e0c229087
SHA1 dcf2aa4a1c626ec7ffd9abd284d29b269d78fcb6
SHA512 5f6e72720e64a7ac19f191f0179992745d5136d41dcdc13c5c3c2e35a71eb227570bd47c7b376658ef670b75929abeebd8ef470d1e24b595a11d320ec1479e3c
TLSH
T10AE055170A1A50B79BB8DB90EE525CA2E8A0A6B1C50438D63E608234B68A11F738347D
MD5 SHA1 SHA512 TLSH

Submit Download

verified_contents.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_1\_metadata\verified_contents.json
Size 1KB
SHA256 d23b2ba94ba22bbb681e6362ae5870acd8a3280fa9e7241b86a9e12982968947
MD5 738e757b92939b24cdbbd0efc2601315
SHA1 77058cbafa625aafbea867052136c11ad3332143
SHA512 dca3e12dd5a9f1802db6d11b009fce2b787e79b9f730094367c9f26d1d87af1ea072ff5b10888648fb1231dd83475cf45594bb0c9915b655ee363a3127a5ffc2
TLSH
T12B317466C8683D56267A63348E2D0602EB57C2BB0050640EB5AC558D4F7115FE242FAF
MD5 SHA1 SHA512 TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_1\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 24KB
SHA256 b3c14e1330b6a270138dd45d8c13c25198586bb3e8a04c439ad13337941d9c43
MD5 b52b6de9eb9b8c2bd55fff159ad57bca
SHA1 70bef685a3301613138da55bf032a053464bee3d
SHA512 c2a3abd4fe28a8db12ce0c83d9e0a0e4d837a5f3272cb4897734454a2691cb09bc5cef23573b280c58df3e5d411ab592221bdcb1e5aa35003946fa38753f7eb2
SSDEEP 48:IzBmw6QU1Pz45HihQepPoR8/ZadHetKpfpkAAXsqY2jEUEXhmGv12mT8p:UBCxwHdepQRIadHetKUAEYOPA1Q
TLSH
T106B2F79F3F747813EFD958B9302A6474DE7BD21E2E99CC953C644C216CF8D01A0265AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 204KB
SHA256 5803093b48f27742ee46870a11c7848ce9322a3cc41475e9cdb01532c4748330
MD5 283eb472f42a1c4093b271eb1da95509
SHA1 519a9290bae3d30dce267b071cf48d30e2d79c24
SHA512 555592a503753580f510bd1c037e7ef6154d92c2ada4811c7fb3c94dd5a87fd39905070a44594653adbc8e33d19092b41c4c9223633e9d6f304cbdf19ecfe7a0
SSDEEP 192:14Gmaw0+G83uxXBBK31GkSJDR8XTEJH7DNspUy:eAwa83uFBBQ1GkSpo67DNspUy
TLSH
T16514895F7F703212CDBDC03669E694A75DAEF07F8B526789B8600860CEE3A52505C4BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

374c0646-e78f-4138-be9e-ac3d1bfc06f9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\374c0646-e78f-4138-be9e-ac3d1bfc06f9.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 cdfcda740a6ead7a884035cd160ee26d095b008dd92daaad83bf0566f7d0ee15
MD5 6f98180f97f5da3655a34c5ce3a599e5
SHA1 01e6b61cc0159303ed41c89872364a5e8ff63b4e
SHA512 d3f326dec27b25351e5fb239d9212e7fc5e37e942e1165151ffcc740235bcf0f59270f8b2bc068e8ce41dce19db072d1def24ebaae36bec5d52fb38cdf0456f7
SSDEEP 48:YALlmSmsMRspfoKsoZsFesXgmgwEscMP5s/CKsQ/WP0EsZfusjrstfuzsptsGyso:Dm+L2liwQMPUdWP0lfRQfFp5fI
TLSH
T12A8158F7C3E8953ECD5156F8AB252B1BCE5D0918422C3E1BC8D99E2B93E2CB1E14055E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 12KB
SHA256 12258ea39231efc2b3b672f071339e184427b17d7958597b8a1ac83d3ec6f8df
MD5 f555e7b2306a4dbe7cb551d641768464
SHA1 04104a18f476e9fde636ce0c973df7fab60c0305
SHA512 43c0bbee7e52092f2ad0b0c19badc84940ed08f47455b5dbce75d1e4e360715c49bba2051cd2ce78417e1c6ee690f7f165146c1cf0040f99e58d75d665a9610d
SSDEEP 384:DRrVfRoNJvKJAyPKW/YjMxmO+L4iNnDs/n80VRhD+KOQ+M3nHnQOnmX6VoFMCh+L:6o2w/l1TXHvNPl
TLSH
T1A942CDF7C3D8862DDC5156F49B253B1FCE6E0D2842283E2BC9DA9E4B93D2871D24464E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 aae535299e2f14c4cfca06c120cd5cdb349ae35665eca28778083819515c6a99
MD5 3e477180bda05c013080a282caf315ed
SHA1 9a50b9db9125acb43f0f063c6ce723f1579ac77a
SHA512 f6cb081dce53facb1f3fd0bebba8e804e2147ba978ea4fec09f9f8e5930c2725cffb817fee63c4e6239f10646d9256972bedb3050c41237c86ef60216f285fcf
TLSH
T1238178F7C7D8992ECC5156F8AB252B1BCE1D0918422C3E0BD8E99E1B93E2CB1D14054E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 b84d8672b1d6522102d4775713403bd9a667b7c499aaec4f8cfffbb61038a0c2
MD5 f7ae13a4194ba7935064054043556f23
SHA1 0fff87c9c4f4561a8967e85f90b3edd16ff94c34
SHA512 304c3fbd8e74debfb66ed814582867a357ca304308bea904a89c624c18781df49472b0f2d1a1650fc95ade3410fe5a06115e7cc445b831e0f1928916235c98c7
SSDEEP 48:YALlmSmsMRspfoKsoZsFesXgmzscMP5sQ/VsZfusjrstfuzsptsGysPfssAC7P0B:Dm+L2l7MPRefRQfFp5f8GP0BwQ
TLSH
T1BA8158F7C3E8952ECC5156F8AB252F1BCE1D0918422C3E1BC8D99E1B93E2CB1E14055E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 d4c520673216659519eccdde0a232560fbbc1188f29de85b53220570e614f056
MD5 ea2fa758136cba0e5166d7105901b3ff
SHA1 2bfecbee32e751f85cc88be24b39d56b10b345a6
SHA512 8f7a719767a80743c7c77bd0f5c36ca82be4cf43af9cc610e1d2ed30a33e0369d7a36bd0d07e4e5e81d7f8a25127e1765f4f981c0e990ccce7bc976277ce45c2
SSDEEP 48:YALlmSmsMRspfoKsoZsFesXgmzsNC7P0Es6WwEsZfuscuzsjrstssTtscMP5s3La:Dm+L2lKGP0uWwlfePUXXMP8u
TLSH
T1768169F7C3E8953DCC5156F8AB252B1BCE1D0928421C3E1BC4D99E2BA3E2CB1E14055E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 ca01bc5d15f8aeb6e4e53c9827c411e669892655de969329ef3151a6b88b25e2
MD5 f0ff20e24281dc164165cfe753529406
SHA1 05265d73b5ff0eb890da535c39e782bba5b115da
SHA512 ed22ecfba89e47bad5b08dac6e3d01ceb95426db6abb5c0180232dcf4f62e2ab9db71f865c61bd97f9512cb9e5ff1832cbc4ac2d833f68164ae24977461e3dac
SSDEEP 48:YALlmSmsMRspfoKsoZsFesXgmzswCKsKMPiwBP0EsviVsZfusdrsMtseuzsXss3u:Dm+L2lfxMPiwBP0Dief3h5jDu
TLSH
T1AA8149F7C7E8952DCD5196F8AB252B1BCE5D0918421C3E1BC4D99E1B93E2CB1D14054F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 2d4a3c5bb9d31ef16cbff78183f0795997df2109d772915e28e09b70eb16bcfa
MD5 6e9bb39227932147c7a33466d174eac1
SHA1 722d43ddd7e03415bd6d590120983b3aec0d40e2
SHA512 3174e8014e89f191e5029b58f69c2d0825eb989030047ab8d71253f70d24e12ca1b8e18221583c04b50a2f9cd3f05a1a75b7e6c48b03a7931af6ca94aab919f6
SSDEEP 192:D38WCYOvuJMJhA+L4NGI5efiVXhMhDPGaMQPiyUnGMPau:D38WCYOvuJohA+L4NGI52iVXhMhD+zQQ
TLSH
T1BEE1A9F7C3D8962ECC5156F49B263B1FCE2E0918421C3E1BD8DA9E1B93D28B1D14564E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 5c44bffe97b729f4e14a9492ae009ac9793a85b970221fa389d11bb988d2a8ef
MD5 a3d1a278235cc4de16dd36ce11dd0d96
SHA1 5cdc6d5b9d520b7ea26267205c383215aa8f62b8
SHA512 d7bd894741d29a8b080712eca8bb944db9ab9a37bcadc2c9f4eed0fb080edca57f11d0cb462361c6ceb31a9a8d651a9d9d560ee3792f88e0c52dabd2bd3d2fb9
SSDEEP 192:D38WCYOvuJMJhJd+L4mGI1efegQhDPGaAQPGnon4nVno4yMPa/u:D38WCYOvuJohJd+L4mGI12egQhD+XQOv
TLSH
T1BEF1AEF7C7D8952DCC5156F4AB263B2FCE2E0928421C3E1BC4DA9E1B93E28B1E14455E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 c7a624fcbe77cae5ffc78c0335634fb33faa42a7e52fb0490c4e0f2a764c9b07
MD5 a7052b0db101b1b8c016f69c3dfb10b8
SHA1 7a2f389e8ee2dbba2e30518f13643aefaf439b11
SHA512 0456b064cec613429930845c92800ac548956662d14a9946a38dd2af405795fbacc9804968c81bdb260bf727df80a68b2b12122f970cc11cd17785567c1df8db
SSDEEP 192:D38WCYOvuJMJhA+L4wGKWvcfp5FwDPHLRatQPAMPdu:D38WCYOvuJohA+L4wGKWvwp5FwDfLROZ
TLSH
T141D1CDF7C3D8962ECC5156F4A7263B1FCE2E0928421C3E1BD4D99E1B93D28B1D14564E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 48ab51a985f2628903b1461eb6b55e358a5ccf6dbc2092b978c7a75eed0f7099
MD5 76146dbdc2a16a02facc0d0235e15ba2
SHA1 1296a2af1b8fe3c3e807beda40c116d531378593
SHA512 7e888b4e450011c29a00d01b4064d2646be5c321af964a518dd93311e52a4cc03694e0cf003d36899fd3d7346bb93017b671623d89b2fdf05d3685acbc5d1131
SSDEEP 48:YALlmSmsMRspfoKsoZsXgmzsQ/VsYbC7P0EsZfXwEs2uzshss2ts/MP5s2DP5sC0:Dm+L4RhGP0lfXw6lS4MPtDPFFQPdEu
TLSH
T17D9158F7C3E8952DCD5156F8AB252B1BCE1D0928422C3E1BC9D99E1B93E2CB1E24055F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 356B
SHA256 e6319f1b265a1149ab556bd7a5ab90d1093a5cf9468c4710405c0c6cbfadc2ae
MD5 c9fe85ca063422172196e8a7a9733a61
SHA1 e5ab73944bf3871d2ea418e91f4f508c39c86c6f
SHA512 04accac71d16d77fc843da906c5ef93d00927dbda884ef3918855dad1cdbe121782b182de4f2305d25cf865797f50d9ff688a110dd46afec5b6d54a06edc761f
TLSH
T1CDE068E76A5C6433006D42A62F00304956BBB834051254F0CF9A807C90C50FA0302052
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 356B
SHA256 54a824c56b1529b80d1e74d658a87c8daff6937c7c63fdbc99a6e4e9fd51a67c
MD5 22ed6c30c6b00b986d6f2e879e1d0a7f
SHA1 fad848f9116ab0f76c295ea904c77b3a2bbbd255
SHA512 eea41e32288eccfe9622cac5125743f13fe2919a4c7557ffcf3fd1853e79680ab7e4fd29711629c17de4a12dfcdc99e559ad5e2788bc0a718a07e09c400d3de8
TLSH
T125E0C6DB9A6D7423907C8B266D14B4482AF7BC340002A0F8CA8F80FD90800FA1347013
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 356B
SHA256 dfe9ee8d0c27402a5a4668d48d1d1bae85e298f1a46ce8fcf0deea10c7fbea81
MD5 fc553235b2bcf5470679ce6376998a19
SHA1 0dd8f55e370931c52308cf20f9945ac24cac7731
SHA512 a2caa109c6fc25363fc58f7edfdb8a51b0c227013f6bbeb40469c332ad251d34e1aa71ae1db0daeb473bad68ef2b0f92a43d5634f9efc26e754212061753c160
TLSH
T159E020DB666E78A3547DC7672E0474452AFBB476054254F1CA4E817DB1C54F71702093
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 356B
SHA256 8fc723acef8c3f2ec5c20c09ea65c0c1fcf1f45e042ec1fb46d20e812461fe91
MD5 523d6d40a903d7423ea574e75a81e3e2
SHA1 d1a308065bd3be29656bab2796fd042cd1919032
SHA512 3a37388e892500d1ece47cce2264f1c056607d74e8650a1683d5e1b0e4212156e8d1e4db9738a1973d564d03317cf98af8c6a5b95220373428f872d5c3d489e5
TLSH
T1E6E0DFEB8A6DA463503D86663D44B44526B3B8394242A4F0CE8A81BD90814FB5743053
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 356B
SHA256 2b7d37f4456fa6df3b6e5c2e3ca732325a00669d4edabffc572bbe3ccab79df7
MD5 59a9d83427f70dbc70f738d2f1db97f4
SHA1 647e4e25a9ded75baad61e37e4b30cd4e5a6d342
SHA512 66bd2068058f0d5af0070d68ea687f4af214a7764af6af13f9e4f38a022acc28ee534b68c2212fc5140415f36dbb76b3e831af798c7cefd2a10f64ae59fadf1d
TLSH
T169E020E797BE7427103E466B2E0A74555EB7B435054370F4CF5A813DA0C65F72603013
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 356B
SHA256 4256528751ae9de3e2329e03be739e64f37dcb7fc89968d522ff5c2e405629f4
MD5 dd91a79c7fd4f5bc222fbabbff3e47b9
SHA1 939f365dd2197fbf00b43d787ff4d81a6730fd93
SHA512 45f534a8370bd38b07d6b5b9f7591415a8f6156bbfccd752c1b9ff851d43d9d834d9d55034b0849171f021236b67583613b38701a59c94410e411c162d316813
TLSH
T16FE020D786AD7863503E066E2945748A27B77435454290F5CE9E413DE0C34E72702032
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 356B
SHA256 7581831539857cd44957c5e63f3c06c1747c38b1644cafa82d882919278160ab
MD5 4941df23dbf69adb36770bf3c138903a
SHA1 59abfe6c886e2792b95f348aab6003dd5149a5cc
SHA512 86bd0d58ceac8104941671a4fff0fb21cd04964383f50a8705f9e2b65b765689c50d89feae0944dff2b5ebd93f5fccbde59188d2a3f97cc260e9e1dcf82ee655
TLSH
T10DE026DF4AAD7437207D8F262D05B8855AF3B43A0543A0F0DA4E817DE0868F61602422
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Platform Notifications\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 87661cbb80b6e3598478a490a11ee7bae77551a245726c6fe6406bed861a3a60
MD5 56fb2283de4ab2a68074797e4fe1dda3
SHA1 f9d7b04e98ab7c004dc5d43275aa81ecec1d8028
SHA512 7e946ec3db0a7dd82dd230f3377e8fc6f08049ac6cc587f425cde912cb1fbead5925ae90ecd240a18e584a351e35a00aea24c6cd179237fc2627824d60fd0ec4
SSDEEP 384:sxZs4O/fBsyZWWvXZ1foE/zFj2G/bEZyCQze8VDO:s04O/fp0YXZj/zp/b8yzRVK
TLSH
T18E52FB15AD28987F8CC7D619FA55BF53E2F9503291C45E49A7FC8A2C05EB6DD220340F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 1a5220d656cc9369675b48884cae37eeee044a30dae46159866822cce02ab741
MD5 2600574070384fcee0fc5b7c1a286c35
SHA1 606c0e057e37cc7274c5525e4cfefbe3e947232a
SHA512 01581a32df1101ca02c0b6c76492c89a90656fe80d7b74a556469af4be18a21ea0ab22f6c4a233a6145a2a28cd97f92abd18af669133971d944a613c774b995b
SSDEEP 384:sxZs0O/fBsjWvXZ1foE/zFs2N/ejrbyCQde8VIO:s00O/fCYXZj/zN/ejydRVJ
TLSH
T1E252C919AD24987F8CC7DA19FA55BF63E2F9503291C15E49A7FC8A2C01EB6DD220340F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 b24ad3c0581ae396a1e3cd55f8247ce9a7add356100793b242a2733d5244ec53
MD5 4140696431e2e3b51480cd844a00fd18
SHA1 2716187d126471ee8509d7657143bd608ea9ab2f
SHA512 bf7e51a2c74516c7da2856b6a151f1bb5d3310fe35e3d430b49265ceff08f06839e096d7a4585b4ebbb5b01506c4c949e9e011b9799ec15742b0e7a3dbfb8a88
SSDEEP 384:sxZsMO/fBslWvXZ1foE/zFG2//bRZyCQDe8VqO:s0MO/fcYXZj/zx/bHyDRVb
TLSH
T16B42EA15AD28987B8CC7D619FA15BF13D6F9503691D41E49EBFC8A2C05EB6DD220380F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 2911bb04dcf3be01585c979e510ca78623ce97c542a6d01512d30ccde046b431
MD5 d72a32804773d3aedfeefe35916562c4
SHA1 cdd670be7e7277f0be9818509a3b94da675e5f25
SHA512 b787fd47ed1258c294d8a26fa8a7b9ec4b1f2056202c28a7bf87361d02fe83ee4782ff180b9d2310be2ab76541666d8baa9ee858e8ad97565c42269d4ed7155d
SSDEEP 384:sxZsnO/fBsZWvXZ1foE/zFj2Y/eEZyCQae8VAO:s0nO/fwYXZj/zf/e8yaRVB
TLSH
T13152FA19AD24987F8CC7D619FA55BF23E2F9503691C45E49A7FC8A2C01EB6DD220380F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 f6bfb1226b7b0918894b08124316cc7aeec48a95622975b8693fdd63f73d5eb7
MD5 202064241c086a8ee50248f788c4beca
SHA1 db1afe100316bea8bddd785b5b2d08ceafa16b3e
SHA512 b07dec86baa3b74973363dbd2ffae136a6855dadcaf8da809d5491cf3ef77946747afdb7c703a8badd5f2b2ae1831ddd25cae21797a0bb5253484a28127a0472
SSDEEP 384:sxZsAO/fBskWvMc1foE/zFX2m/u7DhyCQmu8V1js7:s0AO/fxYMcj/zZ/u7tymBVy
TLSH
T15E62D819A924987F8CC7D919FA55BF63D3F9503295C15E49A6FC8A2C01EFADE220340F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 14e174426540c0517a9ce6bfc2bdf340b5d0f9c3283eccddf27d6e6a91c41dd0
MD5 be2c9863a64e15e5a510490605f45330
SHA1 5a6e7eac116f5bf0a10570b574064ddb4f9a3328
SHA512 e66563a29e93b5007cfdef6db5dc2ca90cf4e4d4155c7f24ecb99585b721df5e0d93d6db30df46d4705a7962c2f3bc8f15f58a0850019a8b857b129962f01ddd
SSDEEP 384:sxZ7AO/fBskWvMc1foE/zFa2r/ui5hvCQv58V1jsm:sTAO/fxYMcj/z5/u63vyVj
TLSH
T11B72D95AAC24597F8CC7D919FA55BF63D3F9503294C15E49A6FC8A2C01EBADE220340F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 61d471694566dccf770449550cbd144f97eebca09d4c18549131abd49fdc8a48
MD5 f8ca0bd88ca3609c354d1c6917c8740b
SHA1 572e41386e26fa1fd903a37878e691fa232d2e0b
SHA512 89e7606acf13f8a4332ce2f3064c65f9b7acd9de58e7c2a469bf0a18ab7bd228715148b6299bdaeceff48c8cca3a659dfb4ef610c0848ac9d9e53e9ab97f13d1
SSDEEP 192:sxZs2LCO/fBs1WpVWj11dO3Iupu/R/W6+WNTNGQp/Y0GMaT1WIgyJ:sxZsPO/fBs1WvWZ1dsk/bl/5ioO
TLSH
T11D32C815AD28A87B8CC7D21DBA15BF13E6F9503591D51E48EAFC862C05EB6DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 66b9b162bfb4198e79b5a8626bb963ff5587a17c27a4fe32abf7e7ba9d37d7f8
MD5 c3778ae2158aebf59a930f3d3907366b
SHA1 bfdb9c1b250e66e40dfea6ab61d55e351245f577
SHA512 32a5511917874115103ce3dc0bba390a9eccb6efeecf2035ace230402404ec3b9ae7cb34027d53f538cc1bae48151fe727fde02e02270fc07d042bcd6f573185
SSDEEP 384:sxZsWO/fBslWvXZ1foE/zFF2h02/b8q7fyCQIqe88O:s0WO/fcYXZj/zO/bhyjRd
TLSH
T1F442FA15AD28A87B8CC7D319FA15BF13D6F9543691D01E49ABFC862C05EB6DD220380F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 d2cfff265e3bceb8ee5983216bb243af40002d9746ca351304ca29d7e50319a4
MD5 4b46f2cc04dd9631091c91437eeedf9b
SHA1 7c3bfaf4384e30c248307f5dbf2d57cabdfd0a25
SHA512 b4f5f8e4289cfa7b6ee3a80d674c6e1c8f8a6a522aa3209386eac065de7c7aebc238fad9eae8cff2b2b8432b45d9d563e26d2b32d08221091f13b896db109c2b
SSDEEP 384:sxZs4O/fBsCWvXZ1foE/zFj2G/bEZyCQze8VmO:s04O/fLYXZj/zp/b8yzRV3
TLSH
T1F952FB15AD28987B8CC7D619FA15BF13E2F9503691C45E49A7FC8A2C05EB6DD220380F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 e5681f15d9a3c907b0444fd6648473d41884a96c8ae98e5c2344dbd314e2a6db
MD5 c7017594859506b58df63b248d31cbe9
SHA1 dcb1fdc55a1f3353a0d68bd76f8fc5e849cdc91c
SHA512 67e29aeec5ca76455acff31dcb26bb29ccf4c964e76be6ca69b0fb91a69bf8aa16764c3a8caca98f0b5ce67fdd8f6cab7a665f93cca9450c5c44979311788533
SSDEEP 384:sxZs/O/fBsjWvMc1foE/zFy22l/efJyCQVe8VI+k:s0/O/fCYMcj/z4/eRyVRVY
TLSH
T15852D919AD24987B8CC7DA19FA55BF63E2F9503291C15E49A7FC8A2C05EB6DD220340F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 270305050a6ba2457252a23fc180842d95fc2bcbc47a3f64e39787b133436f81
MD5 c0e2953e4cd811e26fba0e2901e9c8a7
SHA1 c5f394a0ee9f7fd51da7329472cc97c96b44224f
SHA512 3cbf602242752d64968af0335eee1379a84df04e42c846892408997b8e436d3d86af2d2f1ca15ae290998a4047cad55f562b27fe09e2a4f13076489f77677766
SSDEEP 384:sxZsp4O/fBsjWvMc1foE/zFy22l/eMEJyCQ3e8V2sk:s0aO/fCYMcj/z4/e7y3RVo
TLSH
T15062D919AD28987F8CC7DA19FA55BF63D3F9503295815E49A7FC8A2C01EB6DD220340F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 140be38c766b47dd7732774d0d1a74537088c7879ce6d2d1d9969c411ca165ef
MD5 49f64f4fc62eef85d05702f1f938b435
SHA1 d8288b15e676cd6b750c61424b81074333f50f37
SHA512 3548c841f3bbdfc0cd6b40da2cfb71e7094d9db3b002b046a0bdfca1a79427291e9fc9a3e3806aed917f5f56cfe4cd780c5fc5dd6b1596716c0b11e3cebc87ec
SSDEEP 384:sxZsp4O/fBspMWvMc1foE/zFy22l/eMEJyCQ3e8VQsk:s0aO/fQMYMcj/z4/e7y3RV2
TLSH
T14E62E819AD28987F8CC7DA19FA55BF63D3F9503295815E49A6FC8A2C01EF6DD220340F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 e4fb0f86fb571d51833fd023d4b3c5cdf166b5e142a9404b2a7ce651fbeb9280
MD5 28643e38afcb01f2b62b62daefbdd48a
SHA1 89da7e62010e8b8c4bb90a1099ce948ed80de934
SHA512 0f240387a5abcd6120485fb93526cbb71a8f671c60737b7cfdadcbafdc93ee2e71946d888277e43324dbae88af459174fdad243454ce84fc1e27ab7890c17f74
SSDEEP 384:sxZsFO/fBspMWvMc1foE/zFa2T/eHhyCQ6e8Vysx+:s0FO/fQMYMcj/zt/eBy6RVB+
TLSH
T1C062C819AD24987F8CC7D919FA55BF63E3F9503295815E49A6FC8A2C01EF6DD220380F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 e2b02f5a818fa42ce8e5b81edbe9363af35aef998926c7fea7920f80d05ff475
MD5 cd22d3757d1b207f5655b404f6f44759
SHA1 a3506b920f99de7e29727ca117ea2a36c53976fd
SHA512 33b92bee7c72f830409bcb43618a9d5d29d115f213b4ebf5ad98c84bc0082196b06e7a010bdd385414c03940077e2518f6bfe5913465eeea9871600f781e9565
SSDEEP 384:sxZsnO/fBsyZWWvXZ1foE/zFj2Y/eEZyCQae8VIO:s0nO/fp0YXZj/zf/e8yaRVJ
TLSH
T14552EB15AD24987F8CC7D619FA55BF23E2F9503691C45E49A7FC8A2C05EB6DD220380F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 8c80de3249eb4f7a3e1589539db2853b3e066a06bb0aea98257714259c0166c7
MD5 91682ced878f5b33d6f76e0f44af9a4f
SHA1 c9e821b3067ea4a0eb3800a99e3fa3a507fd2361
SHA512 9fa6d5b672a02620f4cbbeece668a1c650bc95d7d9484556cbbc4891b44b94f551ca4d49c997abf60d68efbb257e0784b5db3e982d9e726ca6e8518c42f1f862
SSDEEP 384:sxZsFO/fBsQWvMc1foE/zFa2I/iHhyCQxe8VTsx+:s0FO/fNYMcj/zq/iByxRVy+
TLSH
T1A462C819AD24587F8CC7D919FA56BF63E3F9503295815E49A6FC8A2C01EF6DD220380F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 dfd7d29038a8316b29843bb1e18d95fea0c649b922bbffd45933388387cc1cd3
MD5 2d34808568ec58f8f70b458e499e74f1
SHA1 862c0a02ead996d5768939df2f5f321a2a2dea85
SHA512 7e56fb6175d8e78feaf22e0a2c200c5592d433ad8d3a43ab9a42d866e42dedd791025dd4c44d95bd8711d8c5ee3f3e8a90e560bcc1e58276110e669e23966e79
SSDEEP 384:sxZstO/fBskWvMc1foE/zFg2w/u7AhyCQE8V1jsN:s0tO/fxYMcj/zU/u7MyjVI
TLSH
T13262C819A9289C7F8CC7DA19FA55BF62D3F9503295C15E49A6FC8A2C01EB6DD220340F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 9564e038d577a5ea8a7c2b5ead5a70744450c8b9a9a0fbed449a0ae4e297bd14
MD5 fa697fbebd625e1767eaa2978f0501ad
SHA1 acf6f3d0f2427631f02efd85e0c4429af68e9ae2
SHA512 ae4a8e40f13b5c401f6745bea592fc328187090c2206174933131e0f29c1d2fcdfc35b70a01cce9b8376d8f727e4300283c7ec3e2916bc2b3766aea62ef94813
SSDEEP 384:sxZstO/fBsQWvMc1foE/zFX2h/u75hyCQse8V1TsN:s0tO/fNYMcj/ze/u7fysRVA
TLSH
T1FA62C719A9249C7F8CC7DA19FA55BF63D3FD503295815E49A6FC8A2C01EB6DD220340F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 b1f0ca082514bcdf20bc542e1b51beb7c436917d61b0f4d5735098c320c9dcad
MD5 0b8e60a97a92c981f2178088f627198c
SHA1 76b493036ed565bcc41cba4ffa2026fadae0cef9
SHA512 7e11c7d2b0bc8eba2444fb0883c79d2835cafa6e4fe456dbb694c2b48e23140bff00462309e2ae9c0c5e3067b04b555e354db5d84bc70bcd21bd3d856bbcf035
SSDEEP 384:sxZsWO/fBsfWvXZ1foE/zFF2h02/b8q7fyCQIqe8qO:s0WO/fGYXZj/zO/bhyjRb
TLSH
T1DA42EA15AD28A87B8CC7D319BA15BF13D6F95036A1D01E49ABFC862C05EB6DD220380F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 1036309a010c409791dc10eb760d35dda251334677b3301cc29e2af09d442219
MD5 29899fca79dffcd44526079caa79be33
SHA1 1104d1b09ca59a89679b4f130a2ae2aef237575f
SHA512 77e77bbdb0b304b0b2e3859a61b26adf7b50929dbdb742ad97d166ffb5d4bbc472d503f4feb3cbae5794d9eb46cd28a1d7b3b5150888c88dd9406b81a34ae2c4
SSDEEP 384:sxZsMO/fBsCWvXZ1foE/zFG2//bRZyCQDe8VdO:s0MO/fLYXZj/zx/bHyDRVM
TLSH
T1EC42FB15AD28987B8CC7D619FE15BF13D2F9503691C41E49ABFC8A2C05EB6DD220380F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 dde88e90cb055187f73eed89d5a121ee6f7eff16cfda45fe1cee7e1a4538464d
MD5 bc94ac2609451c315c4b149ed0338416
SHA1 ed6eb39980f211314ecf90a5fc733be272130480
SHA512 57cddcc081a05620ae23233e37278e997454cc3f9e38e328998e311613c6e2629f3a71666e7a2e01fa73d445360b4c54fcb5f403afd55d695cf80d505e664616
SSDEEP 384:sxZsWO/fBs2WvXZ1foE/zFF2h02/b8q7fyCQIqe88O:s0WO/fPYXZj/zO/bhyjRd
TLSH
T17A42EA15AD28A87B8CC7D219FA55BF13D6F9503691D41E49EBFC862C05EBADD220380F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 3fa4d40b9c55fbf37e36eb00fc709263e2b9adf03a6664a7bf5d2a46ce3ed3ec
MD5 ecfb5b694aa3dab34c9429bbc08a1b8b
SHA1 01d9f5356fea48724df26322af2b190c35db4288
SHA512 e08a53f94f1a33959e2b80cfcfd2165de7883d8ca1f67240d2415d77a7152a0fa313eab1f930392d34283389bc90cfa68ce8598ac63d3095ee92b4b09e429030
SSDEEP 384:sxZs0O/fBsZWvXZ1foE/zFs2N/ejrbyCQde8VuO:s00O/fwYXZj/zN/ejydRV/
TLSH
T17552C919AD24987F8CC7DA19FA55BF63D2F9503691C05E49A7FC8A2C05EB6DD220340F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 33KB
SHA256 111e89941cd0c18f5b164498cd7d72f94d4611f7cc9d5a3aa0f4c4c86779947e
MD5 3a1bd53c878c84ecccb4d0a5178abfaa
SHA1 f7af7f64d9d5334035d5c48873eff68e361f4e28
SHA512 24d7b1f3b168985d9cb0aad7c684ceca448449442847d42c49ed13e63628021f6c28db7feb904280e2b6585d3b17395c7915925c50c01feea426ae631d5f82b6
SSDEEP 768:kylTj8Gr2lv7pLKL2SmWRm+KQEC8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3SYrxLlL:kylTj8Gr2lpQ2SmWRm+KQECu1jaKSYrv
TLSH
T1F7F20A7F780CCB7E4FC04A9DDD1A7F8B6DA8028B9698894047FE985C02D77EA51160DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 214B
SHA256 f520c095dbad8a40e934d65c6e1f8f4b7cb12ccaccd79735a517a79d5311ff22
MD5 e197e1de9f940253373f239b5a1af116
SHA1 08beb67b06942e458bd3923aac31ff5eb301b3e0
SHA512 e3f18d8a9932e8fa7c0224512c561a49ff3098f4646e78f51cc666f63df41878bb0b64bb7dec987d23eb57d6bbd4844def878add1e19f42e01ec2a57fa27b771
TLSH
T151D022EF0731AA670B30AA8C2438304D921BAE08DCC0C8F04E08F297F0BDA07C00A9A1
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 130B
SHA256 ef465fea44d828c40133708b700e6740e21e0b413c1f04977bfa74dd9bbdfadc
MD5 0c688e8e660eb8e340b1fa7a07180632
SHA1 6fe021e7dc35852600a0e7b92a6ca1f2471dd70e
SHA512 4476316f4155fcc9824eae91a09787b237cce284c779d784c42bab286818f6c9edb456172ab57126990e1c7e627bf5e51793ec68b1e4e63d31a8e64d69636732
TLSH
T129C09BFB1511A7970574AACC2074765D950B9748D8C4CCF45B085557A13D913C446565
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5fe817.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe5fe817.TMP
Size 137B
SHA256 42458c502741389cc2d0c4d81c53f4ffc693703f383f26aa27bd3e07f609a27d
MD5 9d23abf3d16e0bd4d0e4280efc132998
SHA1 59b442c68f22f9996b3f531b11f82639e86dcc46
SHA512 94c476a0a854e0a47979fae1d55f0290a995a04ee910bccac83719902c6a8500fdc5efa5c52bebf0e346b06ed6418249f45c909d00a38578509fc17b8f1b58d4
TLSH
T1E3C09BFB15215797077069CC2074764D951B9E59CCC4CCF49B097547713D913C445575
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 4910252869dae18836f412fdf66d89578acb2d1f610ed9ef2eb869228ae2eade
MD5 45210f9e76f94fd58ae2d0b20a34887b
SHA1 4c467f443f70daf73bf060d22ec75ad38baf18cb
SHA512 7a23567f245f2307ebdfb8edd86b3ffe21acff6632863bd9c4290d8fb9b53222bd53b103465377bee78b6c96577ce764bb3594945068d758e23f609d6f3126fc
TLSH
T13EE0269C89D8C1BE602EB04B026E9B08D2E4F50BD3CC3E823F05DC406542544F293282
MD5 SHA1 SHA512 TLSH

Submit Download

Tabs_13434574930613929

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13434574930613929
Size 2KB
SHA256 a429e40f8f04b45c92ff7431288266282875ca9a170e827def73e020403df7c0
MD5 db51e5838a60bac3936e4d57c888baf5
SHA1 10370c106ef0ddbfec5be1c786cfb4ee866a7def
SHA512 1a427ec3dabb9df8ebe398e6397f1ba1838d70f1d79c15123b816dd7b7dfabbfb20fe48ecf0b1735c81ebbd26eacdbffe167a57d5cb25bb239476b359cdecf23
TLSH
T1A241952BBBF00DE1E0798234A47A2292AC7CFA2F9991CD4F500018555C62E919E30F8B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 62974be004a9212b76c3b126a64114062ce394af5679d9ace71174aa0de7d950
MD5 622cc8729e2d0e5637420523dbbd462b
SHA1 6384c40f166435b10e32732850a259b6c4c88289
SHA512 4b38215442ee0f189ae576cd3a1b2e3047f1d7c34132567e7da73965428d32810deb63df2bf2ae6c8391960b75ba8b39cf842de1bc201fd2fa02db53c5af0deb
TLSH
T1B8A002D002454251D28005F4AB8365C953516B6D470B0A3741A150658DE91964285A00
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 d1c5f629009cdf901e6e1d3911673eaf2387e06aa35453cacd3d334b3506b157
MD5 c0c834324703ae3b7189cca94f71e4ea
SHA1 4fe843e31fa85bd9ad3bfef633c376aedd83f161
SHA512 b0c2c1bdb0123db79ebd79392e404bfd9eb1351e19ef04a29441ddda3dae6420219f8ad28b9116fafc9c7536c4a7d568b8a26007aa49a75d03202bfa28cd2825
TLSH
T165B024CD41001405C1410F7047C105CC13311D1D53074311D0D000FF5CF50C7C300701
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 9f0c67595837761a696b67601c8f42cf6395f3db04f038ea7ebf6c0fcd8e8bbf
MD5 65111c42f61fe8a60eb6eb68d959f655
SHA1 7a047467828698c05948cba1248108fd729d4d97
SHA512 072964f9fb6fae6b8b30ec1995c03e2407225ec47cca682f93f7b071d059b5f3bdc2c0ba9770ba1db630530030a61968ece11ebf5785b2afcf6fa4868561adf1
TLSH
T19DB01258F7004217C5AA0D7581588B40A3B0F1031D8045238C858F758E1C67C3F818C4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 7e11a437a5c14f7984d12469517d2ff62ca5eea8be8d1308075d3a45612282c8
MD5 c9f03e554dae27149643d543802f76b3
SHA1 438368c0df9d32de3e3fe08b6817737874fd406b
SHA512 70f66d6482fd70915cf277a8bc5ccc9ec72aeb4cf52c6d614075709350ed68a811f92239329ae4b86816cb8cd9667aaca8affeb27f6b264bddbb26c5b6c86934
TLSH
T19CE0D8BC59DDC2EF615D60C7432DE70CC1E27512D7CC2A953F09B840730614072432C1
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 72648936a356f79e4ec1d6789a121f2e61eebc9174d711f65e6059a942534eca
MD5 5062c41e5275d5fa57a289c5002477a8
SHA1 26906176fd82b468d40dde346f9864e3863a95b4
SHA512 c135df9fe219d7ae706ee96383dcf8d2c123bfb63abaa4d839be6d7ca69d5353811d2a6f9785871bb50007d1ba7332c78c4feab13039cc76be5afc97fde210de
TLSH
T1BEE086B8C6D9C27E905CB08782ACAB1CC2F0BD0BD7CCBB866B0C5C81B501244B6A7685
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 b3907dea6dbd77b68ec53c802f73b4cc2e18be7c7a52be705395748cd73a5c0b
MD5 190acd26288538901c83852a2db4a9e4
SHA1 25c7cab940c948d1b431b436d238b7fbca77f6de
SHA512 cbfaa1e8e51056a182e639f7f9d53900241aa8b91042bac60d8522f61968db3e082aa752461f9c45ec832eade40cf15a66169cfd57799c77bba9e044dd7131c8
SSDEEP 24:KKmgej7DoKptk9povPIMvkKLHhDNk1RX0SXa5rJX5yX8TgPUTI7KXhy16SmtyJeJ:K0YIDK16cLyB0I7KRy8hmIfK/6I/yFz
TLSH
T14991845071BA02413C7D384883B88A1F7362316334ACEA2B7FBD14969D67E059CFD9DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

load_statistics.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db
Size 112KB
SHA256 2fb2656d8b91bd110f825f0d7afd42217865568c6e30a624a090706a39004892
MD5 f44c40187592e317a37002a2cabdda68
SHA1 7d92aeb64fc2e98ff5bfe62c5a2df03bc72cad0e
SHA512 70b85673b213c7017d41ba4969e4290e3b8c0210a4cc60a75117e0d9d59225ff9f5017cce694796a5bdc5ef486f1150c4ca1d713b9a3171a3e4070c205f2da0b
SSDEEP 768:QUz1kIctaR9RDaIzyXH2WoznJr4mRc1Wjqm0Nte+fi2F43KRLCr7ZGKf34HUyIdY:UArnF+s7t4U5fQA9LDz58
TLSH
T155B3CBF7AC09A1E6CDCDD5B8940BFF4854B306228628D9E5AA7C08D37B78A033D755C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 d461ebd1304f35b60a406d5d7287859bff86e6e4945ded6dc49ee8ee64ed4117
MD5 f6f45100d8f7cfff4e09b83228466cd6
SHA1 7531d5d0384366a860644ac82671db5b4d8b04d0
SHA512 f3a6134f34a009a0d64e6f78b2f08c09f493acb2db528e9a8d0603ddb029d28e7338478901389d693b87f6b6e07a12acfbae507f99536d971ee4688d4dea3cd3
TLSH
T16021F191F331C018E64A827B547A6B191378D8428FB8ED0F587934653EB2F040E4B6E6
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 337B
SHA256 fad33e080d51e06f82a1585a499f9ac44376478cd805551aed8645c9dcc510dd
MD5 64e8dc78d0b7e5c9ac3f9528211020b4
SHA1 8d5c52710214eb32dbd068fbf8d11ee9e5f52598
SHA512 7861cf300350f56748999ea1e4aee72f3894bb71d80bab47c595d38fce7ec618f9872721c7d287c7e79df25b129ebb2c62b324c5107b737a0e7c258f402fc179
TLSH
T1A0E08058E5D5C2DF902C349341ACA788E3923D47EFCC6F452F05CC44B5052457656246
MD5 SHA1 SHA512 TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 41d7425579d647887df4b3dcad99792016f6693f9de05ce3a861a12fcfcbdde4
MD5 dc2dabfd9cbeadca467ec254d1aafed1
SHA1 4a5d38d07a76caa5aebcefc35c08835cd3ca32c1
SHA512 ca1fcd861919d31a9d216a638f4f4da142bc8c2d47a311ba2b69f53a8773e46bbb7b0f3dae3548ed3d391ebb20e5ba1de0b8a986ea1a088835558e6b025bc3db
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/us:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAB
TLSH
T15AA2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5fbd1f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5fbd1f.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser
Size 120B
SHA256 9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4
MD5 a397e5983d4a1619e36143b4d804b870
SHA1 aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4
SHA512 4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816
TLSH
T1E0B012203BF9062CF3F74D00AA73AA3428BFF4080A14811D505102080C33E19C478FA3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 de035dc5017cb5893c0977dfd3160b11d9cdeabcf983e45cd4db56d1410dfff2
MD5 d30292bacd584e78dffbe5d5dc7bbef5
SHA1 550b90a976810f32aa748e0ebdbbdf9dc490688e
SHA512 494d19fb0e47994d97f082cb1cb0889e9f84a21af4ead2d92d3db978d1565ab321badf91be72f4eec9ea62c65ff5c6a0bdafb03f01d4306dcf46ac04e258e402
SSDEEP 384:nMOFPZcIA8NF8TUNTUlIl0iJm0Fv62RxBDf4VS1nbI96sa+VYaGLgL/7Iz4ok:dFHAawgVmyLowI96hgH3D
TLSH
T137D2C5F598D38977D8AE8783A73D6E429EBCC163B5885984B7D85E0DCC821BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 1676f88a4fdd4355160fd9840431fc9b06cabb53406eea79b5db8e7fffee798e
MD5 72ca8a47adb6b9c695ad91e1ef42dd90
SHA1 68166d8b1cc1c070fe267600d1f7859148e3823d
SHA512 e1a2b5e9e31b14b12588c5f3e48ef390276aee025e272d8d458a424e66b733a2d4b4d34c5781cccb29bbece99de9985d6cfc62abac74b662570fa73c1f464f00
SSDEEP 384:nMOFoZcIA8NF8TUNTUlIl0iJm0Fv62RxBDf4VS1nbIW6sa+VYaGLgL/7Iz4ok:dFWAawgVmyLowIW6hgH3D
TLSH
T1CED2C4F598D38977D8AE8783A73D6E429EBCC163B5885984B7D85E0DCC821BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 e94a7b3fd90caf36075b0d58837b836297e48bc02c711608243df64548e21861
MD5 a14359fcf557854a58302c6110ddd22b
SHA1 77d002ec5b27bc80e968c782f0ba7cba4c0e5541
SHA512 1df3fb0690f464c992f1a593dc9033add3cb45323bc164d5c3e61948fa35b1453df9cf9789b0fdfaaa42bd47d7e822437b0f6a7abb2ab9e8fea67b13ba924a8a
SSDEEP 384:z8ZcIh8NWwiJm0Fv69fd5S1nbIxUv0fOzAT4gSsa+VYaG9oe:Gh5mygSIxffOzAT4gShgHS1
TLSH
T1C1B26B3D8C645C3F88BEF709A98E2A234D78517BE2B45A98D7D85B0DC0B5588F70781A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 29630540d4551a59af871df3534fdb284c9ac485a59f0c5df7d95c1736ad8eb7
MD5 19053259048fba171a557624d9d4185f
SHA1 f4e1f7e510ff9cc9d66f62eaa4d06a41b9b55065
SHA512 0990bcbf685f6eddef78a9ad8ce197e28ec7c16c49f294130b9f2b59bb3c22bc580e973463d2c0cb78a5efd890f9d42985017927f4205aec08372109ca1b57a1
SSDEEP 384:nrZcIv8NqTiJm0Fv6wPd5S1nbI9Zlsa+VYaGLgL/7Iz4ok:zvgmyXSI9ZlhgH3D
TLSH
T19A92AE752C74ACB748EBE206FA867B53AFF450B796C81E54D1FD9B1E00C5298130B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 ee58e01266bfbc9a28743590067b92fbd125c65d5536e7fdd1884609edf04262
MD5 c9b089bb2852c8b3942852ca94e80831
SHA1 d8424cad9bd2902c80d2a56f31f3747e0fd9c4d7
SHA512 b2fb0e25d9779da4d80c8c8e5630ef835ccb36e0bb641440a34b5d9fceb4c2d6be5cda7499d63a63ff51f3ac17a5b3d87fb10555703f4616a5a3830ec486be83
SSDEEP 384:nJZcIOj8N70iJm0Fv6n+G25S1nbIw6sa+VYaGLgL/7Iz4ok:Bakmy7GHIw6hgH3D
TLSH
T11E929E752C64ACB748EBE206FA863B43AFF850B796C85E54D0FD9B1F00C5198170B82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 cfc089cfa3179f82b55929ff2d1d9e7d8c1800d79f079a2fc8f00b5fee8abae4
MD5 d4d2b6d2a5cb0058dd20160472ed6ada
SHA1 4c45c125d914a53a77c5bca56526fe5ef634682c
SHA512 83798e10beea48e1b93ff62548834f15a2ef5c6cc47388b8f254767bf9203737369e55cee1e25f1429dfa542752fc2817f79f4b7ce9d15c135b796c4e26f250f
SSDEEP 96:dIqGNkaQsjpfWViu3s5ih/cIPURHl8h4otop5l1J5DTwBUPjvAJHcxGXPa3BFbC7:9GNu6UbxQmiUyjJpo+W9XPa1xr5UFU6
TLSH
T1E602EA35AC787CBB8EF2AE15B48737139EA5102BE9956F84D9EC171D04D768C1307832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 dd1a0c580a558283af9cd3039a4c01459646e39fd9e15e92eb680906c8999ca2
MD5 f5fcbaa2ddf7224f9b6d23a99cd9a90f
SHA1 ce114830f40e63db9960f57a6e10994cedbaa079
SHA512 938de3b59d4f6fcd8d8adf61a2852e3f35b492fed18454c822bd726f909fdc93a72246ae2142766d6a62165c7e53ee714cf1799fa492445655415c96a3eb13b1
SSDEEP 384:z8ZcIh8NWwiJm0Fv69md5S1nbIxUv0fOzAT4gSsa+VYaG9oe:Gh5my1SIxffOzAT4gShgHS1
TLSH
T1B6A26A3D8C645C3F88BEF709A98E2A234D78517BE2B45A98D7D85B0DC0B5588F70781A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 16e08e01dab7e7f23a4f2c8e738ed31b8d3e9a47f27d0915d1c4dddcbfc3483f
MD5 8a3e172f3f99903eba2ddec4e8363390
SHA1 ecd6e5f5094cd142286ef42d27aeda53c3b95bae
SHA512 486dab48449b256d8133240318bce1275e1ece6fb9664475fe245bf69e9141e129f52a9fa31efbf8274abb609b2b4c470dfa804bf8e8f4fc58c1048fa0ee2dcd
SSDEEP 384:zSZcI638N8A5iJm0Fv6gnd5S1nbI+YvSOzAT4/sa+VYaGLgL/7Iz4ok:863dmyXSI+pOzAT4/hgH3D
TLSH
T17AB27C3C5C645C7F48EEF709BA4D2B236DB8517BE2B85958D3D85B0E8075888F70781A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 bb9abbe940ab0546078dc0a7e6ca18e4330d1801241a38c43db9d3a1081bcd0f
MD5 90418cf8bce63ab325281e80477d01cd
SHA1 e7f9d1e00f0f2c04563b182f714ecdce4175f1c4
SHA512 9f996923ba47c6eb6f04e3a829eb4e9d96a18a2e4546d4d283607a762142f19139304c8f4d42f09ef370b4e471c687dd191efef595c850fe77386a40c4edcd7c
SSDEEP 384:nnZcI28Ns5iJm0Fv6nAd5S1nbIapvqd3zAT4Qsa+VYaGLgL/7Iz4ok:P2QmyXSIaElzAT4QhgH3D
TLSH
T143B26D3D5C605CBF48EEF709A60D2A276DB8513BE2B85958D3DC5B0EC079498F30781A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 ae3351ee034f8c5ce925120e4c57af846a408f6444c23a32a0b2782aeb4d615a
MD5 de654120ac5ac4fa8e14020ca1dadadd
SHA1 34542b2f42a5c01c7206be03e090f3bc2bfaf6fc
SHA512 ed78a2c6d22268fb19646e17d3b8ab30671e407c62993ba8f88fcc3dde1115779741bd7cda87ff3d47b9cc4e2bad09f3060131b0e60bf0c2541d504837dc2f86
SSDEEP 384:nJZcIb8N70iJm0Fv6n9R5S1nbIw6sa+VYaGLgL/7Iz4ok:BbkmyI+Iw6hgH3D
TLSH
T12D929D752C64ACB748EBE206FA863B53AFF8507796C85E54D0FD9B1F00C5198170B82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 0b2b71fe7cddaa7220e03365bf26611ab2b61c48d57fa7debe0b80803c667d5f
MD5 881ebd45e34bb308053afc59a30bac49
SHA1 6fea1120ccb65fcaf2779314fe92a1e81fe88a86
SHA512 cc02b26e6db95566be45f68337c6c84d89b144b1b95aab3e05b8718437de83cd76c509e77a8d97050724814c47581b366c9571fa512af5f263a9411003efcbfb
SSDEEP 384:naZcIw8NqZiJm0Fv6HkG25S1nbI7/7ol80bKRKpZdsa+VYaGLgL/7Iz4ok:YwemyDGHI7/UhKRKpZdhgH3D
TLSH
T162B26A7D9C609C7F48EEF308AA4E2A23ADB8517BD6F45958D3E95B0EC076498F703406
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 960bf96e0e83a80dfae1557d54aa1baefabff34fcc8e93175134075726929f00
MD5 4374b609f55a53c9e366a523cd22e7eb
SHA1 acf3ca38a7e95d46463ca224c67fbad9461adccd
SHA512 383340e022847866cbc8c66e0c85cba43974b28067d6e1d4407e3480105a9b58a2881603d198180d6cb52bfe91bae49ba4e58a40f63664a1f51e9fc042fe42f9
SSDEEP 384:nqZcIJ8N/ciJm0Fv6kbqG25S1nbIXuoadwbKRKpCsa+VYaGLgL/7Iz4ok:IJ0mygGHIXWsKRKpChgH3D
TLSH
T12EB26A7D9C609C7F08EEF308AA4E2A23ADB8517BD5B45D58D3E95B0EC076498F703406
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 abbcac944834cb3ebfa51e1269f9ac22bb8e14c39f6a8622383c0ff8d711487a
MD5 2205a4554f90cfbc0371721675d2e98a
SHA1 5748124e8020c97a6b37f9ca0ce276aa122cdf47
SHA512 cdb53424383391c33609064be4f9215b391d2dd4df4488655884b17fbe7e4d7cc14d62c1271f0df31ebd0630ece2bfc34e54e1b54e98bef31699e2e3a1d5a09a
SSDEEP 384:nJZcIH8N/ciJm0Fv6kbxG25S1nbIXMasa+VYaGLgL/7Iz4ok:BH0myTGHIXMahgH3D
TLSH
T1F0929D752C64ACB748EBE206FA863B53AFF890B7D6C85E54D1FD9B1E00C5198170B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 a7d2dbb088d7c56f0ff7010e82812b1e85bf71444bdc3a3385e2456d9cd98414
MD5 ea46f16540216b4ad0bf1f127a3cedb9
SHA1 c44d9ebdfc8998f476687e4c5c739632c97ef8c3
SHA512 0e119e72bc8c724e0ebbd744312dbab3dbbe2b48e5d85711b86283bd682e9762a3be552c55cf78fec96d9bfa4b3324ab81f12c7c23c3f5f82545f7fca5b4a988
SSDEEP 384:nSZcI638N15iJm0Fv6ghd5S1nbI5xsa+VYaGLgL/7Iz4ok:g635myRSI5xhgH3D
TLSH
T1D992AF752C74ACB748FBE20AFA8A3B53AFF45077A6C85E54D1ED9B0E00C5599130B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 a3fc569f7026f122a76239aeb80aaf23f90c52204025fc9f4a78c1b0643bef1e
MD5 f88e6639784b5538c2b2313031d6f45b
SHA1 18239508727f592a7278070301809a6d6e35c98f
SHA512 b2847436f92907af57e76dd0e8c7eaf5dbc8ce7d6c4bb75f017dbc3ce4c15fa16909024b44eb8aa2e470a9e23e442d49b403084d371857c42a103957f390e6d8
SSDEEP 384:naZcIC8N/ZiJm0Fv6RCG25S1nbIvMasa+VYaGLgL/7Iz4ok:YClmydGHIvMahgH3D
TLSH
T142929D752C64ACB748EBE206FA863B43AFF85077D6C85E54D1ED9B1F00C5298170B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 62a8f0ff0064d3d3016866b14c2d35ecb0d560d3d6c7ea46c88bfef4b4e66996
MD5 d128a02785037baeea7e1011b86f7730
SHA1 1fcc15eb1fc212125c542322208380bd4f48febc
SHA512 5f6022ca6a0898efd8d72912f0c8258fe7cbaaeb0abe3286d755c0e374aa8f150aed70dbad34aad54d51b71f2388abb90edb2071146640c4edbf97155aebd022
SSDEEP 384:nVZcIm8NCOiJm0Fv68SG25S1nbI8Fol3lbKRKpysa+VYaGLgL/7Iz4ok:tmpmysGHI8y1KRKpyhgH3D
TLSH
T174B27B7D9C609C7F08EEF308A64E2A23ADB8517BE5F85958D3E85B0EC076498F307406
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 f279a078057ee46f5c8fc9fa9f16ca52397d2abee3eb2af5a857612557e805e9
MD5 4e950d879159749c4936ad4027a48867
SHA1 8d5be56edf8114e702c5d5dc486fc75210eed241
SHA512 826170ca5a2dec08f4d3f5c8777cb1f42c2bd4aac1860d97cd585ca35f2a056c295cd0ef01b9cc27230d7d83b3ad1cda45c3fb4381d2f93de291ab1418fc6a04
SSDEEP 384:nqZcIo8NCciJm0Fv6nbwG25S1nbIbFYsa+VYaGLgL/7Iz4ok:IoXmyPGHIbmhgH3D
TLSH
T1F0928D752C64ACB748E7E20AFA8A3B43AFF49077D6C85E54D1ED9B1F00C5199170B82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 d40926ca3d6f5077b769ce4a201a1abb797674a42cd570b98b59bfbbe4dc44d7
MD5 4ee92785185e1822a250fb02674c6e0e
SHA1 22ed84361a4a8ef4e5583a26cd9d59b198d8df55
SHA512 ba8b7d43e1e89801effe162ec8354f4e765cbbf69d0a7790eff6caa66c0666925f80ab76ef6546addc2ab1c1c0213745a54fd96e9a376ea1fe03815a2dcecc55
SSDEEP 384:n0ZcIR8N5TiJm0Fv6tud5S1nbI6EvD9zzAT4wsa+VYaGLgL/7Iz4ok:yRRmy/SI601zAT4whgH3D
TLSH
T115B26D3D5C645C7F48EEF709A60D2A276DB8913BE2F85994D3DC5B0E80B9498F303916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 c2bfe07d3ce6cefe474144d140b0536dcb289d5c8e5d2c45072275f6895ff0ce
MD5 c4b2297cf5d2a988239b0ae98f444282
SHA1 f520bda16af586643443f913060ba39d53ceda8a
SHA512 a5c95322db30ad9a7a34f98a3a8ea1c1dfdb7bd83508e2cff70a0c846edbe22175f644892236798bcd709db645c5effedcb1ec18eca73b8854e5009c5a2010b9
SSDEEP 384:n6ZcIv8NTTiJm0Fv6Tjd5S1nbIuVvpd3zAT4psa+VYaGLgL/7Iz4ok:4vHmykSIuflzAT4phgH3D
TLSH
T1E9B26D3D5C645C7F48EEF709A60D2A276DB8513BE2B85998D3DC5B0EC0B9498F30381A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6662114aac14fc87f8a2b7fe97721d0d243d6e0d6bae0b1f23fcc697614007bf
MD5 838a97987f2e583544a5f3f64d3324b4
SHA1 4fcdedbdc3c9e877112cb25bf3ec4bb5858b4da0
SHA512 34a096523279df959b6d5606c3ef7ee6943e631a279d5957a1bb5eda93e14ae165370460453cd88907dd8047d93c951d53becb12c1a6899ba7917e69bb016f9e
SSDEEP 192:9GNf6Ub1QmiUy1Oo/W9XPa1n9hI9PKL/qVU6:9GNf6ITW/kS1nbII4U6
TLSH
T11F123C34AC78AC7B5DE7E925F08736638E64217BE985AF44E5ED171D04CB28C170B823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 82abf268d0e169e4f913f3c52600b66d2fb1a89f61d9e300452561439e304b19
MD5 95550680eb1d3734d1b605e278ff569f
SHA1 9a52631bd95f8924cc2938de37542602ad9153e8
SHA512 aa93bf00c4ba52d60a8c7fa601467e7179352810530bc2ab463eed0dcbfb2e09132aa1b0935ae27f4d9dd7f8185b6128e4380fed08db7ef04123bc1cb4aa9c3d
SSDEEP 384:nJZcIm8N70iJm0Fv6xLG25S1nbIw6sa+VYaGLgL/7Iz4ok:BmkmyUGHIw6hgH3D
TLSH
T18C929D756C64ACB748EBE206FA863B43AFF850B7D6C85E54D1FD9B1E00C5198170B82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 74f04669efafdf62c92b9773d81072d36fa912808f84fde2f8c6bd05883756ce
MD5 0ae838c1287943b1cb1437e3195c87f5
SHA1 a9a23758f5a057a723eb96bda0f420bea883b91e
SHA512 00b8f5ef57caa89384974aff8cbc3d572f54404457598d94fadc9c7b5983186542d16f49c12c9605d51c8b73f82064ac26a552c6fdcdd2f9bb9f3119b1d8b8e2
SSDEEP 384:npZcI08Ng5iJm0Fv6afd5S1nbInPvhdkzAT4msa+VYaGLgL/7Iz4ok:h0EmyrSInxGzAT4mhgH3D
TLSH
T120B26D3D9C605C7F48EEF709A64D2A276DB8913BE2B85958D3DC5B0E807949CF30781A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 ad8b75179e61297e78001bd5d1786e782e8b481e0593650434044fc5c0f9b0f8
MD5 c812758d8456ce752235d87295b3812e
SHA1 1e2a5457bd942817a209f65e53e141458cc521e8
SHA512 668e7e1b5619b71bb22f1a0c8736c35684f3b05addf5045e1c5dc3c7aa119ce4d7963d806d6e4da526d7da6263e165fcf452e678e978b52f824243a47efe95b7
TLSH
T149E00100931440ABD028137580C36F647FF6D02002A347475B2015BD6D227443E22BC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 3a7eaa852d14eb2a5331dc27408427420d3bdb56573580c39f376bbf27852e4a
MD5 cd58cded09b1a00c45094d6260ace7fa
SHA1 431b09fc63a13c389a3e308773b0b18e291fd663
SHA512 27368171a04c413b08a5efe5b1b8d34067d3a25b6a98816b623fbe898213464c25610709c79a2c6250e7dd7fa39ad0c34754ae2ff6048a1ff1d80b4ecd8233ca
TLSH
T198E00202171440FBD038077440C3172437B3C03003D343475D1005B44C123801F21EC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 72ca06fafe007f698249d7d9f23f0f672f0ee5ab7e3532716601366fb61ac679
MD5 5ac4f71245960a3c80841bc24966642a
SHA1 9fe594aa0020145fdc5b21abd893753c7c6c24cd
SHA512 42b90b9acbd3e6c2200cd45b3a669d2aa89501810b15f02dcd1a2d82a311e0ffa885afe5594ee10ad57fbce07e5ce93aa41241e3fb5c42e4f7282dac109b63a4
TLSH
T1F7E00201531440FBD038137540C32B6467F7C03002E347475D1015B45C133401F22FC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 e561e8b7232976ff5fc40ec96131710d7e7f567df57b15f10ca4766b1f290945
MD5 1e8be4c1fa615811b51a82be36b0b596
SHA1 229444012cf9d92da978e189d95f993a9e7452ad
SHA512 a80649b320d4ca13115bde7e3a2424635e99249e932dc16c4d96395834b226e8a71e2c97cd923c8a83cdf2fa9491705101a0c5cbb2d19fde7eb3c4157e9912c8
TLSH
T145E00941936440EAD028137580836B646BF6D02502A357475B2019B9AD62B442E22BC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5f8006.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5f8006.TMP
Size 392B
SHA256 c1152019632a5b0b84fc5a062d20c9c564e0e7cb8a01e8a3cb5f5a03018a5f1e
MD5 81d7e76a3a12a240d9d9aa418fc68f7d
SHA1 7df690e7597023dd67f8d3d0da1b7d0e278940fc
SHA512 bbca096e11b26bdfd0609c4a2a80c7f70bf23d413af6b9b4b273363ece90ab04056d2f0e95ff345bb30d25aeb491882f64319f094b58bd0efa476b36876d1dd0
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 85B
SHA256 b26da4f8c7e283aa74386da0229d66af14a37986b8ca828e054fc932f68dd557
MD5 bc6142469cd7dadf107be9ad87ea4753
SHA1 72a9aa05003fab742b0e4dc4c5d9eda6b9f7565c
SHA512 47d1a67a16f5dc6d50556c5296e65918f0a2fcad0e8cee5795b100fe8cd89eaf5e1fd67691e8a57af3677883a5d8f104723b1901d11845b286474c8ac56f6182
TLSH
T1F2A0120384738407E4144051C45C1341287C84570119C0012068931304240CB039643A
MD5 SHA1 SHA512 TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

eab389db-9170-418d-8d76-bb0e189d013b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\eab389db-9170-418d-8d76-bb0e189d013b.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

SearchHoverUnifiedTileModelCache.dat

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
Size 21KB
SHA256 5e3df6812171b8e187dc0bdc5f000b1189be09207636d103794442f9fb17f193
MD5 80f61773843019e282ce005b96941683
SHA1 be6d662498743f49541b580122ba0b7178e0995c
SHA512 0b48b71b25f7ce28ae2871380b802aa20f10f5c6a50d4073f281f76b13e21347054aa22d119211029594fba848b4f3ef396091342d37ebc0df300ea2db296292
SSDEEP 384:eJWJGVca12krtuVm+fglBOVjeQ8RJob7gh6jUjyWE5Plm5r+GDa506rgMcC3IYXX:G+GVcWrEl8RJU7gYjUjylir+GDa506rB
TLSH
T19DA25B743AF41715F3B29F759EF1A95A683AB866AC00DB4D0162028D0977D92CDB0F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchHoverUnifiedTileModelCache.dat

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
Size 20KB
SHA256 f4d3154de71127b501df0572efe9a8a18f5df3a4e5b220c8fed8f8e7e2b019aa
MD5 9a58753a150c8ec9b9bc0bd1ffac3593
SHA1 6eb7e74d55d437aca0fd8a7446b66da97141b274
SHA512 db2a536c612d3c3d6c99d6bbc24109d8eda12443f0848c6d5cfed7007637d00efd5a15522e1852a1ddc0ffabdc300db1f2994e64d5911d24b933d667c98a29e3
SSDEEP 384:/JWJGVca12krtuVm+fglBOVjeQ8RJoH7gh6jUjyWE5Plm5r+GDa506rgMcC3IYXX:h+GVcWrEl8RJI7gYjUjylir+GDa506rB
TLSH
T1E2A24C743AF41755F3B29F759EF1A95A643AB862AC00DB4D0162028D0977D92CDB0F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8d3f15ec-3078-416a-ac83-ae2ff36ed044.tmp

Path C:\Users\Admin\AppData\Local\Temp\8d3f15ec-3078-416a-ac83-ae2ff36ed044.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cba3f20a-d6e9-4ce3-9825-bbacf59f1b5f.tmp

Path C:\Users\Admin\AppData\Local\Temp\cba3f20a-d6e9-4ce3-9825-bbacf59f1b5f.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4052_1880077152\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e673980b-d387-4e75-8a62-dbca094e5191.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4052_765774251\e673980b-d387-4e75-8a62-dbca094e5191.tmp
Size 157KB
SHA256 e03138d37406c2bedec93e5a7c44a457a6b19cf4fee5dfe5a46450fcea1bf85e
MD5 088d09e1a5cd1db2f55a4f5131b75b3b
SHA1 4e017079555c92f2f9419a53ab89aae7c5425550
SHA512 f8e7a1652d20778af9e0aefef0f24bb477260eefd5c6cecd3b4e17276b7d6c8d79554e850b9a9fdd9c65095ae16dad8868df304ee7a057ec7cea5a35b9e526ad
SSDEEP 3072:sA30KAb7L7nAnBPxnb8b4HpQgHY15vClaH4d6r1tx:sAkKAb7L0Qb4HpQgoq8tx
TLSH
T182F3E1AD2FEE891ACD0B50BD3B04B38BC90A8F07820A655F735F8015997475D17A2DFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\x
Size 11KB
SHA256 3c8cea1a86f07b018e637a1ea2649d907573f78c7e4025ef7e514362d09ff6c0
MD5 1882f3dd051e401349f1af58d55b0a37
SHA1 6b0875f9e3164f3a9f21c1ec36748a7243515b47
SHA512 fec96d873997b5c6c82a94f8796c88fc2dd38739277c517b8129277dcbda02576851f1e27bdb2fbb7255281077d5b9ba867f6dfe66bedfc859c59fdd3bbffacf
SSDEEP 192:Ljafl1gt6iUq/l0ZQjGNxYoanyJfjvB0BXmqqTZhXBnaRL9znQ32z8h0:L29mtJUui1any9Bn/RaRL06
TLSH
T12632BF3332B50E131E1037EA9D1BA21B8CF551377B2B1E35D1118EEAA1EED66D283B54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\x
Size 4KB
SHA256 d6a4b048b5f28963aeac2e56db9ceeb4607c068cbe06c041631b9c878964330e
MD5 1c604b4fef887029e9a3fa342fa908fa
SHA1 27bd3753c25ea4ea49c7c7b564a1fd641bd0eb23
SHA512 ff804c5b76e5aeb6efbd6a7650d5614e922ab605a45873aaeec0ae898e1a7275dc4ec862cd0bef20998e1b741b2add2846e4cfa9c0fcaaf197c4c50aa934cdf8
SSDEEP 96:2OfjuOV4dI3CMQYGtWJQsRmWZu2Ik6iUqLplsQuK0sIF2jGo:Ljafl1gt6iUq/l0ZQjGo
TLSH
T13F91AFB295B89D03674133F59D2B345F6CD8A53B7D4596494810CCBA04FFC4A81CAF38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

x.js

Path C:\Users\Admin\AppData\Local\Temp\x.js
Size 448B
SHA256 aa01b8864b43e92077a106ed3d4656a511f3ba1910fba40c78a32ee6a621d596
MD5 8eec8704d2a7bc80b95b7460c06f4854
SHA1 1b34585c1fa7ec0bd0505478ac9dbb8b8d19f326
SHA512 e274b92810e9a30627a65f87448d784967a2fcfbf49858cbe6ccb841f09e0f53fde253ecc1ea0c7de491d8cc56a6cf8c79d1b7c657e72928cfb0479d11035210
TLSH
T148F0DC1CD210E3DD40B3138E2888E6D892872B5D790BF5771554C0CDD027626126EB8B
MD5 SHA1 SHA512 TLSH

Submit Download

z.zip

Path C:\Users\Admin\AppData\Local\Temp\z.zip
Size 8KB
SHA256 44c1857b1c4894b3dfbaccbe04905652e634283dcf6b06c25a74b17021e2a268
MD5 63ee4412b95d7ad64c54b4ba673470a7
SHA1 1cf423c6c2c6299e68e1927305a3057af9b3ce06
SHA512 7ff153826bd5fed0a410f6d15a54787b79eba927d5b573c8a7f23f4ecef7bb223d79fd29fe8c2754fbf5b4c77ab7c41598f2989b6f4c7b2aa2f579ef4af06ee7
SSDEEP 192:egFudZs7gU52m4qi2hvimtucysYSM3lRNm5wy2k89QPaNmCpCfAKgW:SdZs7n52mbFimtuckPXEKyuGSXCfAKx
TLSH
T11402AED2B15ED3C986DAA1BB449D46D221105A2B2F3DA914CF3D83C73C6D3A6744CA1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MEMZ.exe

Path C:\Users\Admin\AppData\Roaming\MEMZ.exe
Size 14KB
SHA256 a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d
MD5 19dbec50735b5f2a72d4199c4e184960
SHA1 6fed7732f7cb6f59743795b2ab154a3676f4c822
SHA512 aa8a6bbb1ec516d5d5acf8be6863a4c6c5d754cee12b3d374c3a6acb393376806edc422f0ffb661c210e5b9485da88521e4a0956a4b7b08a5467cfaacd90591d
SSDEEP 192:sIvxdXSQeWSg9JJS/lcIEiwqZKBkDFR43xWTM3LHn8f26gyr6yfFCj3r:sMVSaSEglcIqq3agmLc+6gyWqFCj
TLSH
T180624BCFBE204417D8F0C57530659234DFBACABA1B968EDF9CF91E529AC4C072823265
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

note.txt

Path C:\note.txt
Size 218B
SHA256 8e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270
MD5 afa6955439b8d516721231029fb9ca1b
SHA1 087a043cc123c0c0df2ffadcf8e71e3ac86bbae9
SHA512 5da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf
TLSH
T1C3D0A719040784251C7052D17145A5A09B70562D77F626EB74DC690C212700F0B37C9A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/232-1150-0x000001A7CAE00000-0x000001A7CB021000-memory.dmp

Download