hxxps://snooka1[.]github[.]io/SaferAnnoyingSite/?

Analysis

user interaction
yes
max time kernel
898s
max time network
761s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/09/2026, 22:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://snooka1.github.io/SaferAnnoyingSite/?
Sample260925-2mwgtsaa85

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2492	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1696934516-3600988056-1840298893-1000\{FE778499-B5F0-4A49-B9BF-E6AF3D1A3B53}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1696934516-3600988056-1840298893-1000\{3AB23B88-AC17-4761-B3F0-8FC1C9CA7118}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
6588	msedge.exe
6588	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 20 IoCs

pid	Process
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1468	CredentialUIBroker.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1888 wrote to memory of 740	1888	msedge.exe	87
PID 1888 wrote to memory of 2492	1888	msedge.exe	88
PID 1888 wrote to memory of 4656	1888	msedge.exe	89
PID 1888 wrote to memory of 4656	1888	msedge.exe	89
PID 1888 wrote to memory of 4656	1888	msedge.exe	89
PID 1888 wrote to memory of 2932	1888	msedge.exe	91
PID 1888 wrote to memory of 2932	1888	msedge.exe	91
PID 1888 wrote to memory of 2880	1888	msedge.exe	92
PID 1888 wrote to memory of 2880	1888	msedge.exe	92
PID 1888 wrote to memory of 4428	1888	msedge.exe	93
PID 1888 wrote to memory of 2880	1888	msedge.exe	92
PID 1888 wrote to memory of 4428	1888	msedge.exe	93
PID 1888 wrote to memory of 4428	1888	msedge.exe	93
PID 1888 wrote to memory of 3972	1888	msedge.exe	94
PID 1888 wrote to memory of 4348	1888	msedge.exe	95
PID 1888 wrote to memory of 3972	1888	msedge.exe	94
PID 1888 wrote to memory of 3972	1888	msedge.exe	94
PID 1888 wrote to memory of 4348	1888	msedge.exe	95
PID 1888 wrote to memory of 4348	1888	msedge.exe	95
PID 1888 wrote to memory of 3452	1888	msedge.exe	99
PID 1888 wrote to memory of 3452	1888	msedge.exe	99
PID 1888 wrote to memory of 4992	1888	msedge.exe	100
PID 1888 wrote to memory of 4992	1888	msedge.exe	100
PID 1888 wrote to memory of 4064	1888	msedge.exe	101
PID 1888 wrote to memory of 4064	1888	msedge.exe	101
PID 1888 wrote to memory of 5044	1888	msedge.exe	102
PID 1888 wrote to memory of 5044	1888	msedge.exe	102
PID 1888 wrote to memory of 5044	1888	msedge.exe	102
PID 1888 wrote to memory of 2892	1888	msedge.exe	103
PID 1888 wrote to memory of 3096	1888	msedge.exe	105
PID 1888 wrote to memory of 2472	1888	msedge.exe	104
PID 1888 wrote to memory of 3096	1888	msedge.exe	105
PID 1888 wrote to memory of 3096	1888	msedge.exe	105
PID 1888 wrote to memory of 2472	1888	msedge.exe	104
PID 1888 wrote to memory of 4904	1888	msedge.exe	107
PID 1888 wrote to memory of 3996	1888	msedge.exe	110
PID 1888 wrote to memory of 3996	1888	msedge.exe	110
PID 1888 wrote to memory of 3996	1888	msedge.exe	110
PID 1888 wrote to memory of 780	1888	msedge.exe	111
PID 1888 wrote to memory of 5128	1888	msedge.exe	112
PID 1888 wrote to memory of 5136	1888	msedge.exe	113
PID 1888 wrote to memory of 5136	1888	msedge.exe	113
PID 1888 wrote to memory of 5136	1888	msedge.exe	113
PID 1888 wrote to memory of 5144	1888	msedge.exe	114
PID 1888 wrote to memory of 5296	1888	msedge.exe	115
PID 1888 wrote to memory of 5296	1888	msedge.exe	115
PID 1888 wrote to memory of 5296	1888	msedge.exe	115
PID 1888 wrote to memory of 5304	1888	msedge.exe	116
PID 1888 wrote to memory of 5304	1888	msedge.exe	116
PID 1888 wrote to memory of 5304	1888	msedge.exe	116
PID 1888 wrote to memory of 5340	1888	msedge.exe	117
PID 1888 wrote to memory of 5340	1888	msedge.exe	117
PID 1888 wrote to memory of 5340	1888	msedge.exe	117
PID 1888 wrote to memory of 5348	1888	msedge.exe	118
PID 1888 wrote to memory of 5388	1888	msedge.exe	119
PID 1888 wrote to memory of 5388	1888	msedge.exe	119
PID 1888 wrote to memory of 5388	1888	msedge.exe	119
PID 1888 wrote to memory of 5396	1888	msedge.exe	120
PID 1888 wrote to memory of 5412	1888	msedge.exe	121
PID 1888 wrote to memory of 5412	1888	msedge.exe	121
PID 1888 wrote to memory of 5412	1888	msedge.exe	121
PID 1888 wrote to memory of 5420	1888	msedge.exe	122
PID 1888 wrote to memory of 5436	1888	msedge.exe	123
PID 1888 wrote to memory of 5436	1888	msedge.exe	123

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://snooka1.github.io/SaferAnnoyingSite/?
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x264,0x7ffbacf6c188,0x7ffbacf6c194,0x7ffbacf6c1a0
  2⤵
  PID:740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2000,i,16277313168773390016,10599526201817541987,524288 --field-trial-handle=2380,i,592931470635436658,17292438552150102729,262144 --variations-seed-version --mojo-platform-channel-handle=2416 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1716,i,1955347889278212799,2731384218348898825,262144 --field-trial-handle=2380,i,592931470635436658,17292438552150102729,262144 --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:2
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2500,i,2761588236505731526,16636948094347767008,524288 --field-trial-handle=2380,i,592931470635436658,17292438552150102729,262144 --variations-seed-version --mojo-platform-channel-handle=2824 /prefetch:8
  2⤵
  PID:2932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,13750925820656588210,13373773920968383319,2097152 --field-trial-handle=2380,i,592931470635436658,17292438552150102729,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,13994648250874060224,3197765382437786121,2097152 --field-trial-handle=2380,i,592931470635436658,17292438552150102729,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4168,i,10488493568203642403,5965082425628243450,2097152 --field-trial-handle=2380,i,592931470635436658,17292438552150102729,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:1
  2⤵
  PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4180,i,853553807347312097,15451558321939488401,2097152 --field-trial-handle=2380,i,592931470635436658,17292438552150102729,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:2
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3412,i,11640795948334998672,10451874737161333732,524288 --field-trial-handle=2380,i,592931470635436658,17292438552150102729,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:8
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5268,i,13665548428422691829,939594011431763699,524288 --field-trial-handle=2380,i,592931470635436658,17292438552150102729,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:8
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5280,i,4763535031861200453,741629613789532443,524288 --field-trial-handle=2380,i,592931470635436658,17292438552150102729,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:8
  2⤵
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6096,i,13930518993071580652,3307114282644977567,2097152 --field-trial-handle=2380,i,592931470635436658,17292438552150102729,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:1
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7028,i,16483507480569553191,1160697787080518334,524288 --field-trial-handle=2380,i,592931470635436658,17292438552150102729,262144 --variations-seed-version --mojo-platform-channel-handle=7020 /prefetch:8
  2⤵
  - Modifies registry class
  PID:2892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7068,i,10048737830548057795,5705803310356691235,524288 --field-trial-handle=2380,i,592931470635436658,17292438552150102729,262144 --variations-seed-version --mojo-platform-channel-handle=6924 /prefetch:8
  2⤵
  PID:2472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=7164,i,6678145381689544648,11706906535861259264,2097152 --field-trial-handle=2380,i,592931470635436658,17292438552150102729,262144 --variations-seed-version --mojo-platform-channel-handle=7184 /prefetch:1
  2⤵
  PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,4567170403136974181,8500326576234361379,524288 --field-trial-handle=2380,i,592931470635436658,17292438552150102729,262144 --variations-seed-version --mojo-platform-channel-handle=7456 /prefetch:8
  2⤵
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=7716,i,14666369391735362041,11998926212778649694,2097152 --field-trial-handle=2380,i,592931470635436658,17292438552150102729,262144 --variations-seed-version --mojo-platform-channel-handle=7724 /prefetch:1
  2⤵
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7764,i,13602002560133465000,12597577476840184485,524288 --field-trial-handle=2380,i,592931470635436658,17292438552150102729,262144 --variations-seed-version --mojo-platform-channel-handle=7772 /prefetch:8
  2⤵
  PID:780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7784,i,3836463483108472034,5810711188889685436,524288 --field-trial-handle=2380,i,592931470635436658,17292438552150102729,262144 --variations-seed-version --mojo-platform-channel-handle=7796 /prefetch:8
  2⤵
  PID:5128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=7776,i,17576340649903234197,9900939992071050906,2097152 --field-trial-handle=2380,i,592931470635436658,17292438552150102729,262144 --variations-seed-version --mojo-platform-channel-handle=7840 /prefetch:1
  2⤵
  PID:5136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7952,i,15209374380323637976,5767178408428508064,524288 --field-trial-handle=2380,i,592931470635436658,17292438552150102729,262144 --variations-seed-version --mojo-platform-channel-handle=7880 /prefetch:8
  2⤵
  PID:5144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=8452,i,8130015818357306689,17827519631692182073,2097152 --field-trial-handle=2380,i,592931470635436658,17292438552150102729,262144 --variations-seed-version --mojo-platform-channel-handle=8320 /prefetch:1
  2⤵
  PID:5296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=8440,i,14796002788356992490,1974079115786872401,2097152 --field-trial-handle=2380,i,592931470635436658,17292438552150102729,262144 --variations-seed-version --mojo-platform-channel-handle=8444 /prefetch:1
  2⤵
  PID:5304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=8492,i,9474086709695006000,5911198572483636316,2097152 --field-trial-handle=2380,i,592931470635436658,17292438552150102729,262144 --variations-seed-version --mojo-platform-channel-handle=8712 /prefetch:1
  2⤵
  PID:5340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8580,i,10844378134811121429,10474493448523111522,524288 --field-trial-handle=2380,i,592931470635436658,17292438552150102729,262144 --variations-seed-version --mojo-platform-channel-handle=8844 /prefetch:8
  2⤵
  PID:5348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=9008,i,17042923426359798062,2874454622504302032,2097152 --field-trial-handle=2380,i,592931470635436658,17292438552150102729,262144 --variations-seed-version --mojo-platform-channel-handle=9060 /prefetch:1
  2⤵
  PID:5388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9188,i,17015719452799969070,13535260321042528530,524288 --field-trial-handle=2380,i,592931470635436658,17292438552150102729,262144 --variations-seed-version --mojo-platform-channel-handle=9224 /prefetch:8
  2⤵
  PID:5396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=9288,i,17130859991896209193,9688212145471972399,2097152 --field-trial-handle=2380,i,592931470635436658,17292438552150102729,262144 --variations-seed-version --mojo-platform-channel-handle=9308 /prefetch:1
  2⤵
  PID:5412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9436,i,12965249589796880674,15142963376557378605,524288 --field-trial-handle=2380,i,592931470635436658,17292438552150102729,262144 --variations-seed-version --mojo-platform-channel-handle=9352 /prefetch:8
  2⤵
  PID:5420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=9512,i,1628549393087445480,5875257706008926430,2097152 --field-trial-handle=2380,i,592931470635436658,17292438552150102729,262144 --variations-seed-version --mojo-platform-channel-handle=9556 /prefetch:1
  2⤵
  PID:5436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9584,i,15549277201130583567,8056604348940340072,524288 --field-trial-handle=2380,i,592931470635436658,17292438552150102729,262144 --variations-seed-version --mojo-platform-channel-handle=9604 /prefetch:8
  2⤵
  PID:5444
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7952,i,7654874167846519439,4402601716854914149,524288 --field-trial-handle=2380,i,592931470635436658,17292438552150102729,262144 --variations-seed-version --mojo-platform-channel-handle=8076 /prefetch:8
  2⤵
  PID:7128
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7952,i,7654874167846519439,4402601716854914149,524288 --field-trial-handle=2380,i,592931470635436658,17292438552150102729,262144 --variations-seed-version --mojo-platform-channel-handle=8076 /prefetch:8
  2⤵
  PID:5924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7804,i,16840945459031460586,17193106544407276110,524288 --field-trial-handle=2380,i,592931470635436658,17292438552150102729,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:8
  2⤵
  PID:5868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4300,i,13475024654606545937,5057840411861932590,524288 --field-trial-handle=2380,i,592931470635436658,17292438552150102729,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:8
  2⤵
  PID:6064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7880,i,2803346840880071585,11722582128712450613,524288 --field-trial-handle=2380,i,592931470635436658,17292438552150102729,262144 --variations-seed-version --mojo-platform-channel-handle=776 /prefetch:8
  2⤵
  PID:5352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4300,i,5958402746076306987,8420206831113385875,524288 --field-trial-handle=2380,i,592931470635436658,17292438552150102729,262144 --variations-seed-version --mojo-platform-channel-handle=7324 /prefetch:8
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3952,i,14856867177610856567,2873049322417422550,524288 --field-trial-handle=2380,i,592931470635436658,17292438552150102729,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:8
  2⤵
  PID:6400
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3952,i,14856867177610856567,2873049322417422550,524288 --field-trial-handle=2380,i,592931470635436658,17292438552150102729,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:8
  2⤵
  PID:5544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5632,i,58175526166267583,11229584029403268522,524288 --field-trial-handle=2380,i,592931470635436658,17292438552150102729,262144 --variations-seed-version --mojo-platform-channel-handle=10188 /prefetch:8
  2⤵
  PID:1904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=10204,i,7475385210366313063,14190624367681354655,2097152 --field-trial-handle=2380,i,592931470635436658,17292438552150102729,262144 --variations-seed-version --mojo-platform-channel-handle=9912 /prefetch:1
  2⤵
  PID:924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7652,i,16814837394693622987,11662230744330476245,524288 --field-trial-handle=2380,i,592931470635436658,17292438552150102729,262144 --variations-seed-version --mojo-platform-channel-handle=7644 /prefetch:8
  2⤵
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5688,i,14399334794819593148,10819722223157597059,262144 --field-trial-handle=2380,i,592931470635436658,17292438552150102729,262144 --variations-seed-version --mojo-platform-channel-handle=7880 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=10200,i,16214967059627225867,16288756113527701961,2097152 --field-trial-handle=2380,i,592931470635436658,17292438552150102729,262144 --variations-seed-version --mojo-platform-channel-handle=9752 /prefetch:1
  2⤵
  PID:6636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=10080,i,3101972505312234991,4698662945952880252,524288 --field-trial-handle=2380,i,592931470635436658,17292438552150102729,262144 --variations-seed-version --mojo-platform-channel-handle=10092 /prefetch:8
  2⤵
  PID:1480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=7584,i,15706819963690088090,2027160052993392457,2097152 --field-trial-handle=2380,i,592931470635436658,17292438552150102729,262144 --variations-seed-version --mojo-platform-channel-handle=9788 /prefetch:1
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=9984,i,7505068256562457590,3645373137452860444,2097152 --field-trial-handle=2380,i,592931470635436658,17292438552150102729,262144 --variations-seed-version --mojo-platform-channel-handle=1056 /prefetch:1
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=5644,i,15112328065936431192,8396747599863287394,2097152 --field-trial-handle=2380,i,592931470635436658,17292438552150102729,262144 --variations-seed-version --mojo-platform-channel-handle=7652 /prefetch:1
  2⤵
  PID:6824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7644,i,17757820031859540397,12416393191059339683,524288 --field-trial-handle=2380,i,592931470635436658,17292438552150102729,262144 --variations-seed-version --mojo-platform-channel-handle=7108 /prefetch:8
  2⤵
  PID:6840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9900,i,13723197148720433931,2656962794468141583,524288 --field-trial-handle=2380,i,592931470635436658,17292438552150102729,262144 --variations-seed-version --mojo-platform-channel-handle=9748 /prefetch:8
  2⤵
  PID:6812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7140,i,13585846054629322088,8916781072055892554,524288 --field-trial-handle=2380,i,592931470635436658,17292438552150102729,262144 --variations-seed-version --mojo-platform-channel-handle=8124 /prefetch:8
  2⤵
  PID:2740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=printing.mojom.PrintCompositor --lang=en-US --service-sandbox-type=print_compositor --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8396,i,8854026275527701592,5957180600805022283,524288 --field-trial-handle=2380,i,592931470635436658,17292438552150102729,262144 --variations-seed-version --mojo-platform-channel-handle=8308 /prefetch:8
  2⤵
  PID:772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=ppapi --lang=en-US --device-scale-factor=1 --ppapi-antialiased-text-enabled=1 --ppapi-subpixel-rendering-setting=1 --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=10708,i,9953629096976136269,2906653689378449075,65536 --field-trial-handle=2380,i,592931470635436658,17292438552150102729,262144 --variations-seed-version --mojo-platform-channel-handle=10712 /prefetch:3
  2⤵
  PID:1960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3732,i,7784595487392337948,11660049879553798389,524288 --field-trial-handle=2380,i,592931470635436658,17292438552150102729,262144 --variations-seed-version --mojo-platform-channel-handle=10344 /prefetch:8
  2⤵
  PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8760,i,2120676884902438602,17791915188629106574,524288 --field-trial-handle=2380,i,592931470635436658,17292438552150102729,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:8
  2⤵
  PID:2544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2040,i,15990725701585917366,11546825401980223560,524288 --field-trial-handle=2380,i,592931470635436658,17292438552150102729,262144 --variations-seed-version --mojo-platform-channel-handle=1308 /prefetch:8
  2⤵
  PID:6688

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2108

C:\Windows\System32\CredentialUIBroker.exe
"C:\Windows\System32\CredentialUIBroker.exe" NonAppContainer -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1468

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x518 0x520
1⤵
PID:1800

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:6728

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5421c8b0bf6e5f37422a05b412b233cde63f1db63aa71d65c91c5b31275595c0
MD5 07f616e3db8597d59ea940f94c1abb0b
SHA1 eedf28342bbff8c4cae798c2980ea6953992f1b2
SHA512 30782b7b7d8c6db47a40bc15f968f35fca7939aaa4b83a8a19c8f5a415c745b54c161abc0037d24bad8ebf15d5deb4134f24e357c1b5869f1598fa22619302be
TLSH
T163D0243C7F114D50D40041710530D50435D3CC1740D015050C354C074C101C11305CD0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 daf8c1243ee20a2e95a6bd65ee87f94e97a213f1bc26473da181514314bf0e5e
MD5 22b29b46992ba3d1fd586e35207b402b
SHA1 03a007676fa49e6e9fbeffbbc2e943124c1b3d3d
SHA512 3634d483353d2e9fb49d846c71c6867053c6a8f1ead10608addea75574d5ce0e36c8de933f71d10bae9682752372e6f7925bbc3c9d982dfe840a9d664f859687
TLSH
T1BDD0243C3F514D50DC0041710530D50435D3CC1740D017070C354C074C101C11305CD0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 90e8eb4a25fbc292684ca53eb5780a75c4f57f829383332d3c5c6fb73e6f9db4
MD5 6f3087f06afe354eec7c88b4128990e7
SHA1 de367b32da0585826008d45de35dc6942d695b6d
SHA512 8f02482c1fe4c0dab05e1412e8af2ed4e6802f5d0a93a15fc65f1a466c510523821467291d327150a2d05447740b8b121f5711c41120097db44ec864177c2611
TLSH
T1F1D09B247A359EE5E414527506745500259789574691164919254C168C741C21745ED5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 e465a7bb2f26fb32b102c635c5b13b019dc5b2d31fcf5c3d847500335a265639
MD5 8259082b3ea5cd4336d2432adfec6fa1
SHA1 40f0ba1226fd6dd25964d9ed523ba807fe865a39
SHA512 a1b9de5797809a0dba60a80bd73dab06b60bc3ed7e514ed8e42768fcc95c5d23b5f5ec3bf3eda906f3d1773ff019f3ea510525b6cf87a1078ff2eab4181845d4
TLSH
T147E0209C05C5C35D7310748F457C970CC3917B5F93CC6AA53B008CC47141844A7815A2
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 59faa83123a529c3d79e428f9948ed51f53e90b05bea5eb9586600e7ea9fdd4f
MD5 d9b30cfadf6d720ff909367e0eb78218
SHA1 001ce332a2b085b8d4651034a339fac929756c64
SHA512 a753687362e51bdb7f7927444b24aec9d9a35234bd32b870beb408a725ebec81a9b7c1e697ad06e9a04b39706cbd49a8488149065ec0866b2051229a460b260f
TLSH
T1E2E080D917D5C3DD7305684F459C4F5C92913B0AD6CCAF5B271488C471C15846B916A9
MD5 SHA1 SHA512 TLSH

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 ef3f1cc7d326c54b2b8cdc3047a8e4182364d9dd843fea2a616c9999c56d3e93
MD5 e293012213b39921b8fc7dce3005fb54
SHA1 071b6f15b396f87d038d557d8aea212b3d258cc8
SHA512 433c7469bf86e2f9470dfc9c62d23db9d903f4b33a14b6a50aff6d3851ff9401a20c171d1004b4fc31e9f5427a5f49a4c02ed09083721e481c1b8f8edb600681
TLSH
T194E02BE9CC719C7709FC0B6950561A46FB85230B3651578F7A3D81098FB87264595C5C
MD5 SHA1 SHA512 TLSH

Submit Download

BrowsingTopicsState~RFe595c8d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState~RFe595c8d.TMP
Size 181B
SHA256 c1fc0c179e2c9658ad2e455063d7de5c26cc5cd3f00691c91cda4acaa1ea5967
MD5 f892830c28ed4952721a65ebd32ce1ec
SHA1 baf267bfb062bc13ecd73642750826ba928a6c81
SHA512 9e5f82a2e16380ddd7472b900b3bd06b0c05996a2785365e182b1fd927632bdb853c6eb1de1b2e1cea507d0e32786f658ef7e5771fbea0d800b2373cab7bfc86
TLSH
T172C022CE88B24A3605BC449840028285F959020A3A18674EB428C103C0AD60056E2C88
MD5 SHA1 SHA512 TLSH

Submit Download

f_000077

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000077
Size 1024KB
SHA256 7e080d6e99c2281dbb6cf48976001e3e7409342d142987b9f369a8b5e88c4238
MD5 457e51aeaed0b8bad8b81f00300d2bbd
SHA1 c2e86671082458550a42b7b7c975f7c3eca820b0
SHA512 425ae5a85fd78903d37a923b7ad5394d0e2ee59138bf5b7bfdefbcc1cd773ea86a3733f7fff795061899e686b2308e03a16991fa3dcdda2247170591affe03c6
SSDEEP 24576:FgCXPbJMMs5Y/3jThBAWHhAeWm9CYX8qS0:WCGMs5Y/3JBrDXPnS0
TLSH
T17325234DBF34A553E0A65339CCDE6736B7218C8446DBE25792486EA269C30FD03E60ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007d
Size 1024KB
SHA256 e677f383d13f13e044285d75c345bbb620af03c913088e3d8787c85cbe714ff1
MD5 3f12d9d93c89ed277af7cb35ac319ede
SHA1 b47e46d4579f7157ea56f9b60d15563023d5a6d5
SHA512 66c4451e2498e0697640971b9703d1c462fa068f6618a39c1b5a7c730c64430e67ecacd26ab6a17f2c9f0bdd95641100581b64e77b7d398df6babddff871deff
SSDEEP 24576:m7VwAHGoF4ilLFvpJQySfdI6B+Ufe2EcshsYKjW:m7VwAHlNpJJSfdLBHm2E6YmW
TLSH
T19A2523EEEE2916CAF156F7B0A0246200951F3F8F61FC63C3D21FD6F118D24AE4296566
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007e
Size 1024KB
SHA256 c7845e9b8c56cd5ed6492c7f84058aa8328b3f554e77ea7b8b0a82a4fe364e69
MD5 39e9f89859a7a4e119f1513670ef8908
SHA1 6ed77cf4cf9e0ba600822df1c4210e28c20cb6b7
SHA512 e7dc85e6fa482c9f6057701d5db178ad3cf5778fa244957248df4ad24e0bdd9532376bb353ba918d61cc8109add16e0d7fb3e646e00199271bcfba93979af5a4
SSDEEP 24576:iEvtFjr0FV0J5OuNPa2ZFb1GBWdX4xRDE:3F/0u5lXZt0ACJE
TLSH
T1772533655DA1A6BB70F9395290807C52F62BAE908DB2B83EFB1FC5F44437C89C016DD2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007f
Size 128KB
SHA256 0130851cf68e329fab9c839c1e6805d93a4fbc5f41d92b7966c8d6928d2d865f
MD5 1e35518daeb96a14c0fe1c03ef09d441
SHA1 72e19f69d8c1b751886f02d1b20cf87c5f95187a
SHA512 35be0b80102e4b57478dfa2f74f1891d0d9d7aca3f3fb94f5093dc84f08082b624ff8ff987f7f86562793deb5ccab062ff52b5d9cac3f29f99aee692f684a400
SSDEEP 3072:7CQZmFrxZBK2LPSbG5ajde7R8XQLtTj7uSXdzv:7CTFrNKdqsRSRvTj3xv
TLSH
T10CD3BF2AFBB19F12C4329176CCD543203732DDC467969617A2583AA14C892FB67E74FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000080

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000080
Size 25KB
SHA256 c2b3920b9e868dd39aa741b9bace8db29fa2c1e795fe191de6e74bb6669b3249
MD5 a3ab23ac9761466e3efa8dd2777f1f51
SHA1 e17df69b4bbfb0e986bccb94aa178c9254bcd9a5
SHA512 e1ee1eb2a39388642f748e63878dbe9727ec3ea2752beb935f5cf57b9cd0d51be2e4d87278489335a213fabcc59ec94eef04ae0adcbbc35c49d46f90f43dbfc8
SSDEEP 384:50fW/Jz/iRW9jS04Xf/7nkMLeeIEr/ugnvwca4UJKYjlCe0RPuIfnxjJxjaaUDmV:OfWRriRWYH+ETgca45HRPn1UDhpaG0Yg
TLSH
T177B2CFE2D4B4B55EC3CAE57CB5151C40D9C43DE4A2F62F3EE5D620A6615AA3F40B4C0D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000092

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000092
Size 1024KB
SHA256 eb11e09bec7e591fd9b4120259d0f89f63b10a590b221ec650fb19a070e3c06c
MD5 992bc7ddd754ec49404266814f2035f3
SHA1 838bfcb7b2a6451763352fd7621829c458f160b0
SHA512 3b9be7cc24bf7cb597b9a9a6c7f2f80524069653fe021e8c9f4d73b0f88f856f2fbc25b28492acbb683909bf837a68376611f79154819402b1c7564bb2ef6a6f
SSDEEP 24576:uR+j8gsbBi07rM45mfnW1G+0T/zZBilnkqOH1N/:ufbbBiMrM45GCoZBss
TLSH
T1F525339D7C4B2F42DAB5A0B62DFC91D1877E1FC43320E65B6163A5D165DA02C0EC88E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 be197464df64558cd90ce4272796cf9f892834a99097c9637c41ab4877da44f4
MD5 37c209e8e3bf693a7bac3355ae445a06
SHA1 00ef95fe7864683112391e0f00aea59ae9388e38
SHA512 5bcdf499995b12f6dd4939b094453c49919ba865213fc90ece7321e87677623359deb28afc6089dd2aaad15d66ac46d4b33bc1d4d309920a0c0c5a50d2062d79
TLSH
T1466197CE54AA4AB5FF5F9278A9E1108F3A7066E07F436D223D7ACC3870657819338254
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58c4a3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58c4a3.TMP
Size 3KB
SHA256 5e88da12d36e663082030458914eb8112f539234b88d79f4f13bbaddc1b7aae3
MD5 dd352f9dc27a180de80ce7671e23b6a1
SHA1 62d776b7147ba46bae52eda0ac4347bb1324fefd
SHA512 c4dee52477d893137da2bd69915f3700de0399e1c369c7c1885908a637f81947abeb06da9d0d9f16042c3e00987ecb18aa61faff7b4a32955bae0baccfa79aca
TLSH
T15D61858E516A4AB5FF9F9278A9E120CF3A7056E07F436D223D7ACC7870263818338354
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 d9af1e593f6e70395bcb394462f1e93cb86029f59641b50cc5ba2118f9fcd4a5
MD5 408d39966a272cc975dbd372c3ecb201
SHA1 d7f09b4f156ffcc329e7837e3bfdff63a8ca843f
SHA512 cd1bf4b0e6833996eb18fc148f2d6c2ae39554511c770ce45bfb95b72b02054adeeb9f505449f4c0919eaf2046587aec1bcef19bcc54e8f0957bbc13efc582da
TLSH
T1DE1157B783E5C5AE8A1156F0AA24AE2BCE1C0516431C3C1989E4EF2B93F3475E14295B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 a11d7375a800e045f0663d745647026bf29a93d7a5d50fe8f8156f8e03fe1f27
MD5 f10a2136c39eb2a02b307020e62ff060
SHA1 9d9ce0c7f18a6a505c2a616996ce885e1712474c
SHA512 4dcf611e24f888302e1da9ed2badc69c53383f5f1578298e2771ad935fe477aa2bbf90f894dddd22f0f3eef440e7077f30c3657a22be03464be146853fbca00a
TLSH
T19021ADF783E186AECA1156F09914AE2BCE5C0506831C3C6989D4FF2BD3F3071E142A5B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 78c71ddb98404168befaec8bc051b70d6a14b0fb714fee221fb27d91584262ac
MD5 a111b7d8b12c13d622d277014f5f4c89
SHA1 c3d679f1442ece4bbb82a455c3a108b9aa269ffa
SHA512 1273da0b1506ae05fef9cf6a394ec7e2e36afae58b6b52eca4b3107c9b8210abf9bb24a6d6a9e1162441ed1bcf45b94996b15893026374530f8e8d959b11d3f6
SSDEEP 192:sxZCW/URJOTZMY/f5vsZCBMPEdpQlCClCqHW6+WNrCeuB/Y3Cz2nxIgrJ:sxZCW/UPgZN/f5vsZCBBT3qHbOPB/fST
TLSH
T14A22D7566E38697B8CCBD229BA15BF53E2F95032A1D51E58FAFC861C04E76CD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 26KB
SHA256 a2dbd2a42999b7796229105bc8377ff9aeb85a407c357c284b9548435db31bdd
MD5 1b987a10d5e265a99d8d9c65869db04d
SHA1 cc330a1a351536ccbfa385215764511958d229ff
SHA512 ba9afaae57bdcb09fdf9d0c005c9d4aa32f927af40ba6b0215d75e1774268da492c21f7a28e301f4c43b1ae54a1f7d40b1606ff6cbdbb10bc31e60f90eb4af72
SSDEEP 384:sxZCW/UPwZN/f5vsZs66s8qMpRiYnazAW8pZS15posJWeT+V2CBvCa3IHbXb5CWZ:sOov/fh4Mnc7WeT+4X3HbrZ
TLSH
T1BCC20905A924C8778EC35D2C683D7E33E9EC506212C5DEDA5AECCA1C019E1FDAB47857
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 a87617c2a35d34e855ec2d8a399a0780ffed70d3857ab7eac45b076fc9010626
MD5 e66164ef18c8989ddaebe864c4daf87f
SHA1 dc5edb2a9a80bf68dbc9f2437fc7125dd139b81a
SHA512 92a8bdf028c2671b9fa913ef8c275594ee49a4b569d98ddf1d50f8dbf078064e23c75d913c4f8aa852e4c1542427f073bee9bc9bce870da1e9e9d1b21f8ced63
SSDEEP 192:sxZCW/URJOTZMY/f5vsZDCBMPEdpQlCClCXYHW6+WNrC/u/89Y3C+2nxIg5ANJ:sxZCW/UPgZN/f5vsZDCBBT3IHbOWk9fW
TLSH
T19A22C7566E38697B8CCAD229BA15BF43E2F95032A1D51E58F6FC861C04E76CE121780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 d106b3bea5f96ffc478a1b7bc2070e102355fc7d0c98f6a4c651dc2b3b799966
MD5 98aecc39b860c1d9ca53a31a936039e9
SHA1 c3afb9b6de63289bc985937f11ae8f2857603f4f
SHA512 deea3a9276f34200c62696877934949fe58927dc15d63f09513e9f3c772dd6085cb56d27128aec0e0fbd6c2ad6baf69d2f0b5e2ce2b9de63d69536d136a6406d
SSDEEP 192:sxZCW/URJOTZMY/f5vsZrB8CBMPIdpQlCClCXYHW6+WNrbAbY3i2nxIg5A3J:sxZCW/UPgZN/f5vsZr2CBvT3IHbYba9Y
TLSH
T10432C7566E38697B8CCBD61DBA15BF53E2F9503292D11E48BAFC8A1C04E76CD121780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 d8d02a494eb9db4cbc43330252456fc0fde6207d9492a951450935aa7bbe6140
MD5 00133de6a425875c96cb2a6e8970853e
SHA1 fa7f78cb81b5b1cdd8092e5f7ed428a44a36044f
SHA512 f30e524f932e90639867e5bcca7eeec731eab597fb7be690c06ff804d6ef07dc5d9d5d57b6d8826e6b875f0dd9917fc28e03272381630b4b385007cf78c54ab6
SSDEEP 192:sxZCW/URJOTZMY/f5vsZrB8CBMPEdpQlCClCXYHW6+WNr1aBY3Z2nxIg5ANJ:sxZCW/UPgZN/f5vsZr2CBBT3IHbQBx9M
TLSH
T1C622B6566E38697B8CCBD229BA15BF53E2F95032A1D50E58B6FC8A1C04E76CD121780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 2e0cf16da9829686d4534ed65e0a169c90e505aabed4b42580f7511cea504d3b
MD5 821c425a3214aca1ecdd96964080294b
SHA1 40d46e4559f135562f1e9230c3f45e7a8307cfcf
SHA512 da6fae9f8c202db97fedd3861a4a7288ccf6dd173bb996bebdb40c15eb8ccabdbdec8ae3794781b32b6c7dcea58c69f8df6f7578b1548f90ba4402684cd0a4bc
SSDEEP 192:sxZCW/URJONZMY/f5vsZrB8CBMPIdpRYYWlCClCXYHW6+WNVJQmUC7Y3QW2nxIgY:sxZCW/UPwZN/f5vsZr2CBvCa3IHbE/Cy
TLSH
T16642C8566A24697B8CDBD62DFA25BF13E2F9503251D11E58BAFCCA1C00E76DD221380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 cb9c8f8e1c8cbd90bf224ce470972d5ce269a378e2b33dc43ddca2cefebcc1d0
MD5 bc6ec7d0dcd2642dbf2364db4b1069b1
SHA1 d7e2fa63714f4fa9509b554fcc2ce3c3031569cb
SHA512 8b9087cbe987aeb8d2cfca319a2ecf45162eaab40ec8b4025fffaaaa04b9c54081dbaefdd568df4ddac39dd620bd0606e9bd1340db1c77bd7ccbee532eb7a313
SSDEEP 768:+a30AbSWvS2998F1+UoAYDCx9Tuqh0VfUC9xbog/OVGmLlLJ72prolZMq:+a30AbSWvS299u1jaLmLZ12Ct
TLSH
T160C2DA3F640CCA7E4FC01A9DDC6AAF9B6F9802C796648D4447FA984C02C77EA51274DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4f3a185e-5bc2-4345-ae38-581f252b2759\index-dir\the-real-index
Size 456B
SHA256 91631e4f7ab1178283c6c5c2667c10840e270b2cc37e4554611b98a2f8fbec5e
MD5 e63a8ed0720ffd29d3ed31a48945f657
SHA1 5860ff01f7b293a8fba538f3e55b33426ada0d0c
SHA512 861c2c16afad38828e55b1241b8a1e10f3e1ff079c7073c080a14ec2661e4cce7d001869143ce48aa44625a14242cc4bd870d4d0314efc014dea43fc8366aa24
TLSH
T193F020D91D138209F8544174303D602656B155EC62946E0F64FDD01A9C557845E4566C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5d0206.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4f3a185e-5bc2-4345-ae38-581f252b2759\index-dir\the-real-index~RFe5d0206.TMP
Size 456B
SHA256 adffc2979dfc18ce7a116c268729dadfcf46e2b0f06ed600680c7a4cda823f82
MD5 cf77414fe245a95b54303e360a768e1d
SHA1 dab5e9dc6979b7ddac4bf10da1d76d3b77363226
SHA512 c59891c15c9ed8dc789e097d2e81f8f8c2741b1b4c19f306e051727a76b97786015a28056fb0fb17d810d3c97cb1b028aeb6230d96c9935fa6f2f7ea648a1660
TLSH
T1EFF07DD85113D345FC088230A57EA12762A16448A2603E0F61FAE055CC46F845D83F75
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 a329e5eb02cb6f8ee9585066ce548b9361dffbf93ee2432b3cdf066ff16cff9f
MD5 1d41be5a1667db1aa28347a55075faf8
SHA1 9ae2f3551b698b6e959fc488e7847d327093ae83
SHA512 cf8457de65d7cf0c667e2201f56af45ef77b89f7868bec1d79feea7c01e35587f072cebb812618b3b108bf6e1707affaf87f5acb358924ea62e53e2d6efa06c7
TLSH
T1B0E068F229F71850FCAB83D4147088A181057894DA08BC4F50AA62C764B03153805C10
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 831ef40f327dbf16ac961eaa48a0c390c90f994d24a538394dcb28cb44ef18b8
MD5 5a8683541aa7849502eab277b93fed04
SHA1 68ad0efe2baed5cc5b79a71b38e27491828d1a44
SHA512 6677102ebb76c01e13b24696e815a896d74a028e9f0260bd31c8cbeb0634934118cc980bc1bfc3430428a54038d92e276c867a05c04a930d2229fbc222822a21
SSDEEP 384:bvsNEyW+PopuYJ6o6l1U79iX5Fbzt7U3GDRSJ:rYocAaRo3X
TLSH
T1FE423C35ACB86C3B4DE39554F44B36235EB8915BDBD86F90C9EC2F1E02DB1985307912
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0fba475b8f30d328de3ebfc435d69330acea7dd9373ce06600278c3a15af90dc
MD5 b85665ed1d0e7bc6f6ca90a010765f0a
SHA1 e91976c837e82d5d85bcff7555c70da4c76fbe21
SHA512 0e50d510812602a25fc4fb07b257b5d88e4741d6229246cd0045e0daafea4ceacdadeb6703f9a909e3e2a342445e58e4cf6f19a589483e52945e8547381ae734
SSDEEP 192:LONM6AmwprQmiUyC4CD6siX5FbeJi7mNU6:LONM6ipdjpD6siX5FbL72U6
TLSH
T15702E935BD686C7B8DF3AE59B54737235FA5116BEA902F84C9E81B2C01D765C1307832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 ac16f1427b3409743cf0fb78421b1cfd3121911ba5b74f7308617b4fa526a300
MD5 71c4387b91d6c758d82c34a6f613c673
SHA1 c4cad1527c41c3851d30171c04063c7680fd604e
SHA512 875a3410a690e1e287f51eb0a717b58ed5f0355820dcb23125830e1b2ca917df98418aede7692a0478dd844afa6a3ad39bd3cee3957bb1de9f52e38f791a3277
SSDEEP 384:IZcIdvsNEyW+PopuYJ6o6l1Uq9iX5FbzL7UtgOIwZOynLpUComE:2pYocPaPoXsoNM
TLSH
T152828D36ACB86C7A5CF7E554F44A36135F78912BD6D9AF8088EC6B2E01E65D4030BD23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 0edef2212b987def6ac08935f1a2ac3a161202c3169ffd423b6ebb694597b543
MD5 af3d7b8fb7daf69086404cad460cf0fd
SHA1 bb91d5a23cc2a2f553be0158658b8827176e929f
SHA512 4a67c6c0bba013ef9879cf253e3129c43696ae8d2003f592fd9e8e1c3818c0b17ccd596a17ac8506aa6b75e36b9cf907853d762c54fd52b0913eb4331e406f73
SSDEEP 384:EZcIdvsNEyI+PopuYJ6o6t1Uq9iX5Fbzi7UtgOIwZOynLpUComE:ip0oqPaGoXsoNM
TLSH
T1B3828C369CB86C7A5CF7A554F54A36035F78906BE7D9AF80C8EC6B2E01D6598030BC23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 95fd1b3513b7ffa01e401e5cb1beb00beaae5d02625e42b90ecc46e47f922b77
MD5 10622b2433aecf8703a7f7952652998e
SHA1 e2f9b91df5e42a5b3deaf7c736b6f99f97ef4182
SHA512 ec1b1d7cb71a58635f50e26f163ed2d4c1937faa1243d36a3c5e7f49ce1486873d4864c5a8c6c1c3d5abba9856012769d27cbcdce6de08c6c36bbb3190065ee9
SSDEEP 192:LON4v6Amwp6uQmiUyCvCDUmsiX5FbzQeGlR7C/HU6:LON4v6ip6qjqDUmsiX5FbzQ7UU6
TLSH
T1F4122B36A8B86C7B4DE3A954F44735135EB5526BEB846F80C9EC2B2C02EB55C530BC23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 5eaf4ba98bf4bc1c3c2da048c9f38902b28cb49309043be0cf2fbcc61ef4dfd0
MD5 82834d0001c55db0a3ebf9f488ee5b30
SHA1 836b9d6b687d3e76810112826278bf2b59830c9d
SHA512 c19c7d30b83500d0d6d1f207f2dca51b9665c646c5b8fff4e9a6b719e34ec9c7b1de16258aebf83048f37ed189e5dfe9b8cd9fdbebe5a8c9b58394a6958fe343
SSDEEP 384:AZcI1IXsNVBIpPopuYJcoLOUq9iX5Fbz17UtgOIwZOynLpUComE:+1czo+PaJoXsoNM
TLSH
T1A2928D359CB86C7B6CF7A554F48A36035FB8956BD6C99F80C8EC6B1E05D6598030BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 307f0b00adbd698d010db80dd37b371b352a4e2fadc69a527524c0d45f3a7a36
MD5 9a509adf48986c76a9009d6eb0ac812e
SHA1 b2e3c4b5b3357fbec256105e7810917f68422a2e
SHA512 5a34a29bb42b75e43594d721cc4ef718dd9c1d88c394abbdf2d21eb60c923cd2baff88aaba4fc32d2b659486e2acf4d96e462d3bb0560feb2ae9581c82c48e41
SSDEEP 384:YZcI1InvsNEyI+PopuYJ6o6t1Uq9iX5FbzR7UtgOIwZOynLpUComE:m1k0oqPa9oXsoNM
TLSH
T1F8828D369CB86C7B5CF7A554F54A36035FB8946BE7D99F80C8EC6B2E01D6598030BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

544d80c3-a49f-432c-ba11-565672b59115.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\544d80c3-a49f-432c-ba11-565672b59115.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 bb00180e33c4afb732365009ef024994ea8fa6ab7d904780c48e778b8cdf4e6f
MD5 09b0d5a6f196c8c010e8e4a47474a8a8
SHA1 9bdb9b83fafd379c12e6e18b8867fb22ad686fda
SHA512 922f632aa494718468927ec9c43368be65dceb0025d184fef9c53c81329248567df2d24d8fa5a7d43a12dc587b1c2c3e3e27be82bfe0fa9b5d162ad86db1c46d
TLSH
T16F411758AAE91118B3B72F4AABF6A8AD487BBD772E07D45E10150D4F0A22B40CC61737
MD5 SHA1 SHA512 TLSH

Submit Download

_cat-crosseyes.jpg

Path C:\Users\Admin\Downloads\_cat-crosseyes.jpg
Size 26KB
SHA256 e3dbad3f3e815cf016672c4374361a9d68d5a77f2c89f26b62260795da6940c5
MD5 ebc880bbc38875853640cde5964f595b
SHA1 14267b4b280d9792795c9c8ec8ee6a0212a2ff38
SHA512 0d0cc77e016bfc2076a437a32e42a19ce71c19191ce78a81f2164296491ce92156ffc25684ab6b2743693b7a16c55ca0c75fce8754d5a2c2aae071535ccbe93a
SSDEEP 768:0wu8wwd7VcrNQ2Mi0StR8YvJUoIsPMm/UKe7vOScqXKKiY:0wtVmrNrQSPJUjsP9/C7qq6KiY
TLSH
T197C2D1D269944823DDCE29D2918F93B75E837E2BD0ED366070A22100F5AC5392796D3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_cat-cute.jpg

Path C:\Users\Admin\Downloads\_cat-cute.jpg
Size 87KB
SHA256 b1d1005b14deca1ed1e078758d7fc0dd9917748b46f71b0be16b44c57bd0088c
MD5 b95f972b9b33ef69ca3b9fb1b0adef5a
SHA1 d8ad42fab3f36712b6205d6205ac0947615caec3
SHA512 5448bcbca0acbc02b2cf12e81fadb1a0a1b5b27128a530a3620576b58a26926b8b07f814f2dbc60716321f883e75d08a3f606b14b8cae56e459065c7456b4def
SSDEEP 1536:CXVNM1U5gAODlROkxNOkt448G222osmY9XpZ8MQ4FABE2vhuRzih0wWbVB0GnN0x:IM2WlR0G448GamK8MQ4YvUzo0wW52GnE
TLSH
T188931212A7F2DD92C50DCCBE7692417BFF98C60C97F467E848281B16348A361D63D64E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ee2aa570-c428-4d21-b034-b2feb1db4062.tmp

Path C:\Users\Admin\Downloads\ee2aa570-c428-4d21-b034-b2feb1db4062.tmp
Size 50KB
SHA256 05b23ec1f5ff6d4b3cb7419ed22b1663281c4ec193c3810b18a2108414de62a3
MD5 f67b92fd8e324343e1ac281c71cd211a
SHA1 8be7f9cee879c485ccbaeab70dfa57a9604db8be
SHA512 7896f149941425e8c3314b715e53a528f14adcf88be108f94ed6eeee123f3bd5777ba113dfe7cfa7edd9b4a96edf2173f10e2692481443799e8daa75b23c08d2
SSDEEP 768:YY8J6WJ6bK7zkL3nuhkFy85m2ZUf7KKGnQjhI7o6eVJOtw53SkrDI7W4dqO:YHJ6b+z23uhkacPncI7ksm3xsWDO
TLSH
T16D3301888DD4568077FE16BA9C2E028241857CDDDF9F3DFB058F215891305AEA05F97B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1468-537-0x00000233F98E0000-0x00000233FA009000-memory.dmp

Download

memory/1468-162-0x00000233F98E0000-0x00000233FA009000-memory.dmp

Download