killmbr | e1ccf67c2a92c333d5616421d1d8d4a17be6f37098d2b0e7e1b5a5788bcd3559

Analysis

user interaction
yes
max time kernel
492s
max time network
601s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 08:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
memz.bat
Size 22KB
Sample260925-knm4eace24
SHA256 e1ccf67c2a92c333d5616421d1d8d4a17be6f37098d2b0e7e1b5a5788bcd3559
MD5 8a61abaa7503339f2e4b7e82f9654d96
SHA1 d87d6ebfe336608ee513fe223e273daa6cdf6260
SHA512 49cd8611bc691b4b085481e5df49a940436cbdf0c5fadfe9010579e946d85c584040475bc30b969e267e6df301855c57345672fc0193888baa133217188c5ef8
SSDEEP 384:kJf5kQ6y5p1B9ssikk2EWROSgD4VDOqEnXrU6Pf:YBkQfp1Byef7gD40XgO
TLSH
T155A229F3764767476AB4C84CEE2FE90DFD5828EB02808E54A9CF04B794AD5E0F46C925
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

bootkit defense_evasion discovery execution killmbr persistence trojan wiper

Malware Config

Signatures

Family: KillMBR
KillMBR is a trojan that attempts to overwrite the Master Boot Record.
wiper trojan killmbr

Detects KillMBR 1 IoCs

resource	yara_rule
behavioral2/files/0x001100000001c43e-315.dat	family_killmbr

Executes dropped EXE 7 IoCs

pid	Process
5252	installer.exe
4872	installer.exe
5960	installer.exe
5048	installer.exe
3928	installer.exe
2792	installer.exe
1220	installer.exe

Deobfuscate/Decode Files or Information 1 TTPs 1 IoCs

Payload decoded via CertUtil.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
5856	certutil.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	installer.exe

Drops file in Windows directory 29 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3248_1007801126\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3248_1007801126\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3248_1236471498\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3248_1849835592\automation.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3248_1803426501\deny_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3248_1007801126\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3248_28089450\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3248_1236471498\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3248_1849835592\classification.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3248_1849835592\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3248_1849835592\travel-facilitated-booking-kayak.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3248_28089450\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3248_890060754\crl-set	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3248_2094946182\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3248_1849835592\travel-facilitated-booking-bing.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3248_28089450\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3248_1803426501\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3248_28089450\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3248_890060754\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3248_240831936\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3248_1803426501\deny_etld1_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3248_1803426501\deny_full_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3248_464179460\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3248_240831936\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3248_1007801126\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3248_1849835592\extraction.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3248_464179460\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3248_1236471498\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3248_1236471498\_metadata\verified_contents.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1720	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mspaint.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mspaint.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Taskmgr.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5228	msedge.exe

Checks SCSI registry key(s) 3 TTPs 11 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	Taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	Taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	Taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	svchost.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134347995938946906"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4280978039-528710165-233981602-1000\{CD022BFD-6615-4D8B-96D3-28E63683F77B}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4872	installer.exe
4872	installer.exe
5960	installer.exe
5960	installer.exe
4872	installer.exe
4872	installer.exe
5048	installer.exe
5048	installer.exe
5960	installer.exe
5960	installer.exe
4872	installer.exe
4872	installer.exe
5048	installer.exe
5048	installer.exe
4872	installer.exe
5960	installer.exe
5960	installer.exe
4872	installer.exe
5048	installer.exe
5048	installer.exe
4872	installer.exe
4872	installer.exe
5960	installer.exe
5960	installer.exe
3928	installer.exe
3928	installer.exe
4872	installer.exe
4872	installer.exe
2792	installer.exe
2792	installer.exe
5048	installer.exe
5048	installer.exe
3928	installer.exe
3928	installer.exe
5960	installer.exe
5960	installer.exe
4872	installer.exe
4872	installer.exe
5048	installer.exe
5048	installer.exe
2792	installer.exe
2792	installer.exe
4872	installer.exe
4872	installer.exe
5960	installer.exe
5960	installer.exe
3928	installer.exe
5048	installer.exe
5048	installer.exe
3928	installer.exe
4872	installer.exe
4872	installer.exe
5048	installer.exe
5048	installer.exe
3928	installer.exe
3928	installer.exe
5960	installer.exe
2792	installer.exe
5960	installer.exe
2792	installer.exe
4872	installer.exe
4872	installer.exe
3928	installer.exe
3928	installer.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 45 IoCs

pid	Process
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: 33	392	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	392	AUDIODG.EXE
Token: SeDebugPrivilege	6448	Taskmgr.exe
Token: SeSystemProfilePrivilege	6448	Taskmgr.exe
Token: SeCreateGlobalPrivilege	6448	Taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3248	msedge.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe
6448	Taskmgr.exe

Suspicious use of SetWindowsHookEx 23 IoCs

pid	Process
3264	mspaint.exe
3264	mspaint.exe
3264	mspaint.exe
3264	mspaint.exe
1220	installer.exe
1220	installer.exe
1220	installer.exe
1220	installer.exe
1220	installer.exe
1220	installer.exe
1220	installer.exe
1220	installer.exe
1220	installer.exe
1220	installer.exe
4044	mspaint.exe
4044	mspaint.exe
4044	mspaint.exe
4044	mspaint.exe
1220	installer.exe
1220	installer.exe
1220	installer.exe
1220	installer.exe
1220	installer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 5856	1720	cmd.exe	90
PID 1720 wrote to memory of 5252	1720	cmd.exe	91
PID 5252 wrote to memory of 4872	5252	installer.exe	92
PID 5252 wrote to memory of 5960	5252	installer.exe	93
PID 5252 wrote to memory of 5048	5252	installer.exe	94
PID 5252 wrote to memory of 3928	5252	installer.exe	95
PID 5252 wrote to memory of 2792	5252	installer.exe	96
PID 5252 wrote to memory of 1220	5252	installer.exe	97
PID 1220 wrote to memory of 5088	1220	installer.exe	98
PID 1220 wrote to memory of 3248	1220	installer.exe	101
PID 3248 wrote to memory of 1268	3248	msedge.exe	102
PID 3248 wrote to memory of 3344	3248	msedge.exe	103
PID 3248 wrote to memory of 5228	3248	msedge.exe	104
PID 3248 wrote to memory of 3344	3248	msedge.exe	103
PID 3248 wrote to memory of 3344	3248	msedge.exe	103
PID 3248 wrote to memory of 2816	3248	msedge.exe	105
PID 3248 wrote to memory of 2816	3248	msedge.exe	105
PID 3248 wrote to memory of 2424	3248	msedge.exe	107
PID 3248 wrote to memory of 2424	3248	msedge.exe	107
PID 3248 wrote to memory of 2424	3248	msedge.exe	107
PID 3248 wrote to memory of 4336	3248	msedge.exe	108
PID 3248 wrote to memory of 4336	3248	msedge.exe	108
PID 3248 wrote to memory of 4336	3248	msedge.exe	108
PID 3248 wrote to memory of 2512	3248	msedge.exe	109
PID 3248 wrote to memory of 2660	3248	msedge.exe	110
PID 3248 wrote to memory of 2512	3248	msedge.exe	109
PID 3248 wrote to memory of 2512	3248	msedge.exe	109
PID 3248 wrote to memory of 2660	3248	msedge.exe	110
PID 3248 wrote to memory of 2660	3248	msedge.exe	110
PID 3248 wrote to memory of 260	3248	msedge.exe	111
PID 3248 wrote to memory of 260	3248	msedge.exe	111
PID 3248 wrote to memory of 5224	3248	msedge.exe	113
PID 3248 wrote to memory of 5224	3248	msedge.exe	113
PID 3248 wrote to memory of 5224	3248	msedge.exe	113
PID 3248 wrote to memory of 2996	3248	msedge.exe	114
PID 3248 wrote to memory of 2996	3248	msedge.exe	114
PID 3248 wrote to memory of 5400	3248	msedge.exe	115
PID 3248 wrote to memory of 5400	3248	msedge.exe	115
PID 3248 wrote to memory of 2744	3248	msedge.exe	117
PID 3248 wrote to memory of 4724	3248	msedge.exe	118
PID 3248 wrote to memory of 4724	3248	msedge.exe	118
PID 3248 wrote to memory of 1768	3248	msedge.exe	121
PID 3248 wrote to memory of 1768	3248	msedge.exe	121
PID 1220 wrote to memory of 4304	1220	installer.exe	123
PID 3248 wrote to memory of 3152	3248	msedge.exe	124
PID 3248 wrote to memory of 3152	3248	msedge.exe	124
PID 3248 wrote to memory of 3152	3248	msedge.exe	124
PID 3248 wrote to memory of 1500	3248	msedge.exe	125
PID 3248 wrote to memory of 1500	3248	msedge.exe	125
PID 3248 wrote to memory of 1500	3248	msedge.exe	125
PID 3248 wrote to memory of 1380	3248	msedge.exe	126
PID 3248 wrote to memory of 1380	3248	msedge.exe	126
PID 3248 wrote to memory of 1380	3248	msedge.exe	126
PID 3248 wrote to memory of 3336	3248	msedge.exe	127
PID 3248 wrote to memory of 4508	3248	msedge.exe	128
PID 3248 wrote to memory of 5444	3248	msedge.exe	129
PID 1220 wrote to memory of 5748	1220	installer.exe	130
PID 3248 wrote to memory of 4396	3248	msedge.exe	131
PID 3248 wrote to memory of 4396	3248	msedge.exe	131
PID 3248 wrote to memory of 4396	3248	msedge.exe	131
PID 3248 wrote to memory of 2948	3248	msedge.exe	132
PID 3248 wrote to memory of 2948	3248	msedge.exe	132
PID 3248 wrote to memory of 2948	3248	msedge.exe	132
PID 3248 wrote to memory of 4672	3248	msedge.exe	133

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\memz.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Windows\system32\certutil.exe
  certutil -decode c installer.exe
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:5856
- C:\Users\Admin\AppData\Local\Temp\installer.exe
  installer.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5252
- - C:\Users\Admin\AppData\Local\Temp\installer.exe
    "C:\Users\Admin\AppData\Local\Temp\installer.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:4872
- - C:\Users\Admin\AppData\Local\Temp\installer.exe
    "C:\Users\Admin\AppData\Local\Temp\installer.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:5960
- - C:\Users\Admin\AppData\Local\Temp\installer.exe
    "C:\Users\Admin\AppData\Local\Temp\installer.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:5048
- - C:\Users\Admin\AppData\Local\Temp\installer.exe
    "C:\Users\Admin\AppData\Local\Temp\installer.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:3928
- - C:\Users\Admin\AppData\Local\Temp\installer.exe
    "C:\Users\Admin\AppData\Local\Temp\installer.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:2792
- - C:\Users\Admin\AppData\Local\Temp\installer.exe
    "C:\Users\Admin\AppData\Local\Temp\installer.exe" /main
    3⤵
    - Executes dropped EXE
    - Writes to the Master Boot Record (MBR)
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1220
  - - C:\Windows\SysWOW64\notepad.exe
      "C:\Windows\System32\notepad.exe" \note.txt
      4⤵
      System Location Discovery: System Language Discovery
      PID:5088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://answers.microsoft.com/en-us/protect/forum/protect_other-protect_scanning/memz-malwarevirus-trojan-completely-destroying/268bc1c2-39f4-42f8-90c2-597a673b6b45
      4⤵
      Drops file in Windows directory
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:3248
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7fff85e2c188,0x7fff85e2c194,0x7fff85e2c1a0
        5⤵
        
        PID:1268
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1644,i,6230351217867065329,11582213857742482867,262144 --field-trial-handle=2240,i,2361311589554117813,14391615746506132604,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:2
        5⤵
        
        PID:3344
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1900,i,14905086914931369032,18002319092307677835,524288 --field-trial-handle=2240,i,2361311589554117813,14391615746506132604,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:5228
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2488,i,11599887170807765214,6602210426157562377,524288 --field-trial-handle=2240,i,2361311589554117813,14391615746506132604,262144 --variations-seed-version --mojo-platform-channel-handle=3068 /prefetch:13
        5⤵
        
        PID:2816
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3600,i,15295883278230268897,7996705656269277960,2097152 --field-trial-handle=2240,i,2361311589554117813,14391615746506132604,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
        5⤵
        
        PID:2424
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3628,i,18012763826561245120,2686467784220891948,2097152 --field-trial-handle=2240,i,2361311589554117813,14391615746506132604,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:1
        5⤵
        
        PID:4336
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4344,i,2750731211980255739,7669159370467502170,2097152 --field-trial-handle=2240,i,2361311589554117813,14391615746506132604,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:1
        5⤵
        
        PID:2512
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4324,i,12260074484745795913,15561336605428176728,2097152 --field-trial-handle=2240,i,2361311589554117813,14391615746506132604,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:9
        5⤵
        
        PID:2660
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3748,i,8072240817286700105,4940844669037383920,524288 --field-trial-handle=2240,i,2361311589554117813,14391615746506132604,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:14
        5⤵
        
        PID:260
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3744,i,3114809442995723210,6957714944683618844,2097152 --field-trial-handle=2240,i,2361311589554117813,14391615746506132604,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:1
        5⤵
        
        PID:5224
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5444,i,17698488784456610901,9911760728395959928,524288 --field-trial-handle=2240,i,2361311589554117813,14391615746506132604,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:14
        5⤵
        
        PID:2996
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5428,i,2045780428944018229,8171570452871697194,524288 --field-trial-handle=2240,i,2361311589554117813,14391615746506132604,262144 --variations-seed-version --mojo-platform-channel-handle=3708 /prefetch:14
        5⤵
        
        PID:5400
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6248,i,3670072186862287282,15407168011133671536,524288 --field-trial-handle=2240,i,2361311589554117813,14391615746506132604,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:14
        5⤵
        
        PID:3820
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6248,i,3670072186862287282,15407168011133671536,524288 --field-trial-handle=2240,i,2361311589554117813,14391615746506132604,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:14
        5⤵
        
        PID:2744
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6316,i,18445837960911410567,817708931401124451,524288 --field-trial-handle=2240,i,2361311589554117813,14391615746506132604,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:14
        5⤵
        
        PID:4724
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6612,i,17877363192301620005,8105008332472767114,524288 --field-trial-handle=2240,i,2361311589554117813,14391615746506132604,262144 --variations-seed-version --mojo-platform-channel-handle=6724 /prefetch:14
        5⤵
        
        PID:1768
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6512,i,13121894464907164267,1168313282879438984,2097152 --field-trial-handle=2240,i,2361311589554117813,14391615746506132604,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:1
        5⤵
        
        PID:3152
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5064,i,538179815206580048,14233966522622014070,2097152 --field-trial-handle=2240,i,2361311589554117813,14391615746506132604,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:1
        5⤵
        
        PID:1500
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=3756,i,2260920415160508907,16927621520055142354,2097152 --field-trial-handle=2240,i,2361311589554117813,14391615746506132604,262144 --variations-seed-version --mojo-platform-channel-handle=4160 /prefetch:1
        5⤵
        
        PID:1380
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6520,i,12621295912821590895,6395368541006228475,524288 --field-trial-handle=2240,i,2361311589554117813,14391615746506132604,262144 --variations-seed-version --mojo-platform-channel-handle=3872 /prefetch:14
        5⤵
        
        PID:3336
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5080,i,7434104915078020976,13756158604308429350,524288 --field-trial-handle=2240,i,2361311589554117813,14391615746506132604,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:14
        5⤵
        
        PID:4508
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5392,i,4489321828206395589,16364536722546585776,524288 --field-trial-handle=2240,i,2361311589554117813,14391615746506132604,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:14
        5⤵
        
        PID:5444
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=5496,i,16167084910571617665,9745293140359292020,2097152 --field-trial-handle=2240,i,2361311589554117813,14391615746506132604,262144 --variations-seed-version --mojo-platform-channel-handle=2052 /prefetch:1
        5⤵
        
        PID:4396
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6804,i,8515426478730934256,8047710512461869739,2097152 --field-trial-handle=2240,i,2361311589554117813,14391615746506132604,262144 --variations-seed-version --mojo-platform-channel-handle=6788 /prefetch:1
        5⤵
        
        PID:2948
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6428,i,4483848460038619576,3788763374480977820,524288 --field-trial-handle=2240,i,2361311589554117813,14391615746506132604,262144 --variations-seed-version --mojo-platform-channel-handle=6756 /prefetch:14
        5⤵
        
        PID:4672
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7064,i,6977006848370501045,9834878966746034117,2097152 --field-trial-handle=2240,i,2361311589554117813,14391615746506132604,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:1
        5⤵
        
        PID:5924
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7252,i,9380572095006350732,10746082349400915288,2097152 --field-trial-handle=2240,i,2361311589554117813,14391615746506132604,262144 --variations-seed-version --mojo-platform-channel-handle=7236 /prefetch:1
        5⤵
        
        PID:3408
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7492,i,6813293825845129068,16155518711857253827,524288 --field-trial-handle=2240,i,2361311589554117813,14391615746506132604,262144 --variations-seed-version --mojo-platform-channel-handle=7472 /prefetch:14
        5⤵
        
        PID:2396
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=5608,i,2215462781539107688,11346194963356542903,2097152 --field-trial-handle=2240,i,2361311589554117813,14391615746506132604,262144 --variations-seed-version --mojo-platform-channel-handle=7488 /prefetch:1
        5⤵
        
        PID:2312
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=7564,i,9604707503440443921,2931202595493810031,2097152 --field-trial-handle=2240,i,2361311589554117813,14391615746506132604,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:1
        5⤵
        
        PID:5968
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7328,i,4607669147169839369,4949295620961520537,524288 --field-trial-handle=2240,i,2361311589554117813,14391615746506132604,262144 --variations-seed-version --mojo-platform-channel-handle=7268 /prefetch:14
        5⤵
        
        PID:5504
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=7568,i,11807305505001961279,12814716905521755756,2097152 --field-trial-handle=2240,i,2361311589554117813,14391615746506132604,262144 --variations-seed-version --mojo-platform-channel-handle=7316 /prefetch:1
        5⤵
        
        PID:3408
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=7536,i,4481399752380963637,6325619576050196194,2097152 --field-trial-handle=2240,i,2361311589554117813,14391615746506132604,262144 --variations-seed-version --mojo-platform-channel-handle=7320 /prefetch:1
        5⤵
        
        PID:4680
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7528,i,9251406031402949407,10304277489298236396,262144 --field-trial-handle=2240,i,2361311589554117813,14391615746506132604,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:10
        5⤵
        
        PID:1260
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7548,i,14443988620248168566,16350476171388459976,524288 --field-trial-handle=2240,i,2361311589554117813,14391615746506132604,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:14
        5⤵
        
        PID:1824
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=5428,i,11373319787174042279,4735659277894145109,2097152 --field-trial-handle=2240,i,2361311589554117813,14391615746506132604,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:1
        5⤵
        
        PID:424
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=5872,i,14711878341667597619,15731590271902521404,2097152 --field-trial-handle=2240,i,2361311589554117813,14391615746506132604,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:1
        5⤵
        
        PID:2472
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6852,i,15357769275383735587,12047511689676662872,524288 --field-trial-handle=2240,i,2361311589554117813,14391615746506132604,262144 --variations-seed-version --mojo-platform-channel-handle=7492 /prefetch:14
        5⤵
        
        PID:252
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5460,i,14257799809128797098,10291803154962120875,524288 --field-trial-handle=2240,i,2361311589554117813,14391615746506132604,262144 --variations-seed-version --mojo-platform-channel-handle=3964 /prefetch:14
        5⤵
        
        PID:4760
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3700,i,8099035054921730596,15576168021576823203,524288 --field-trial-handle=2240,i,2361311589554117813,14391615746506132604,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:14
        5⤵
        
        PID:5796
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7740,i,4958103017449317243,9045461362974760574,524288 --field-trial-handle=2240,i,2361311589554117813,14391615746506132604,262144 --variations-seed-version --mojo-platform-channel-handle=7724 /prefetch:14
        5⤵
        
        PID:1492
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=7864,i,10660836119273954922,12457510957052027162,2097152 --field-trial-handle=2240,i,2361311589554117813,14391615746506132604,262144 --variations-seed-version --mojo-platform-channel-handle=7668 /prefetch:1
        5⤵
        
        PID:2984
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=5820,i,6378015928304249324,18244486200497450911,2097152 --field-trial-handle=2240,i,2361311589554117813,14391615746506132604,262144 --variations-seed-version --mojo-platform-channel-handle=7872 /prefetch:1
        5⤵
        
        PID:4544
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5844,i,3913614462212359782,17349145850545925709,524288 --field-trial-handle=2240,i,2361311589554117813,14391615746506132604,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:14
        5⤵
        
        PID:4248
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=8068,i,12257220573640090080,7331764947961749856,2097152 --field-trial-handle=2240,i,2361311589554117813,14391615746506132604,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:1
        5⤵
        
        PID:4556
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=3596,i,12889968698823962935,4623881966693768940,2097152 --field-trial-handle=2240,i,2361311589554117813,14391615746506132604,262144 --variations-seed-version --mojo-platform-channel-handle=7996 /prefetch:1
        5⤵
        
        PID:1948
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=8116,i,9328144719283419863,12593673120425738604,2097152 --field-trial-handle=2240,i,2361311589554117813,14391615746506132604,262144 --variations-seed-version --mojo-platform-channel-handle=8128 /prefetch:1
        5⤵
        
        PID:1912
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=8048,i,16932919091947086880,3880646153127592505,2097152 --field-trial-handle=2240,i,2361311589554117813,14391615746506132604,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:1
        5⤵
        
        PID:3880
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3700,i,3854471746677215192,3917565571223665319,524288 --field-trial-handle=2240,i,2361311589554117813,14391615746506132604,262144 --variations-seed-version --mojo-platform-channel-handle=6864 /prefetch:14
        5⤵
        
        PID:2088
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=8396,i,14632627583713074997,1216028150789340467,2097152 --field-trial-handle=2240,i,2361311589554117813,14391615746506132604,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:1
        5⤵
        
        PID:4312
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=8448,i,12451801974152753871,9308336620489463943,2097152 --field-trial-handle=2240,i,2361311589554117813,14391615746506132604,262144 --variations-seed-version --mojo-platform-channel-handle=8428 /prefetch:1
        5⤵
        
        PID:3716
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=8416,i,2284817167555617096,14646184383690567298,2097152 --field-trial-handle=2240,i,2361311589554117813,14391615746506132604,262144 --variations-seed-version --mojo-platform-channel-handle=8548 /prefetch:1
        5⤵
        
        PID:4140
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=8640,i,14422045713764575499,16203214651737011946,2097152 --field-trial-handle=2240,i,2361311589554117813,14391615746506132604,262144 --variations-seed-version --mojo-platform-channel-handle=8656 /prefetch:1
        5⤵
        
        PID:1404
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --metrics-shmem-handle=8496,i,1815354756209825288,14316821655236940211,2097152 --field-trial-handle=2240,i,2361311589554117813,14391615746506132604,262144 --variations-seed-version --mojo-platform-channel-handle=8532 /prefetch:1
        5⤵
        
        PID:860
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --always-read-main-dll --metrics-shmem-handle=8756,i,322804691167219630,17603449525346737364,2097152 --field-trial-handle=2240,i,2361311589554117813,14391615746506132604,262144 --variations-seed-version --mojo-platform-channel-handle=8784 /prefetch:1
        5⤵
        
        PID:3716
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8688,i,17009783851760872238,8128375189527637788,524288 --field-trial-handle=2240,i,2361311589554117813,14391615746506132604,262144 --variations-seed-version --mojo-platform-channel-handle=8676 /prefetch:14
        5⤵
        
        PID:3880
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8604,i,8132928201350839998,18352771068489244088,524288 --field-trial-handle=2240,i,2361311589554117813,14391615746506132604,262144 --variations-seed-version --mojo-platform-channel-handle=8660 /prefetch:14
        5⤵
        
        PID:2080
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --always-read-main-dll --metrics-shmem-handle=8668,i,9841250709486163400,16807006011241372921,2097152 --field-trial-handle=2240,i,2361311589554117813,14391615746506132604,262144 --variations-seed-version --mojo-platform-channel-handle=8652 /prefetch:1
        5⤵
        
        PID:3844
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --always-read-main-dll --metrics-shmem-handle=9132,i,2081237379376042833,12116377583454843174,2097152 --field-trial-handle=2240,i,2361311589554117813,14391615746506132604,262144 --variations-seed-version --mojo-platform-channel-handle=9112 /prefetch:1
        5⤵
        
        PID:5692
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9264,i,4465472642360236934,12625335381992580316,524288 --field-trial-handle=2240,i,2361311589554117813,14391615746506132604,262144 --variations-seed-version --mojo-platform-channel-handle=9316 /prefetch:14
        5⤵
        
        PID:3304
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --always-read-main-dll --metrics-shmem-handle=8284,i,4905243123943375623,98295025013680119,2097152 --field-trial-handle=2240,i,2361311589554117813,14391615746506132604,262144 --variations-seed-version --mojo-platform-channel-handle=8876 /prefetch:1
        5⤵
        
        PID:3688
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --always-read-main-dll --metrics-shmem-handle=6184,i,16806340506486239444,5894210178937846705,2097152 --field-trial-handle=2240,i,2361311589554117813,14391615746506132604,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:1
        5⤵
        
        PID:7016
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --always-read-main-dll --metrics-shmem-handle=8700,i,16987894550897186592,16091382484336694850,2097152 --field-trial-handle=2240,i,2361311589554117813,14391615746506132604,262144 --variations-seed-version --mojo-platform-channel-handle=8692 /prefetch:1
        5⤵
        
        PID:6796
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --always-read-main-dll --metrics-shmem-handle=9496,i,4477190929781997430,10302801913143455660,2097152 --field-trial-handle=2240,i,2361311589554117813,14391615746506132604,262144 --variations-seed-version --mojo-platform-channel-handle=8660 /prefetch:1
        5⤵
        
        PID:7000
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9592,i,1476917161105986278,17788355455942632563,524288 --field-trial-handle=2240,i,2361311589554117813,14391615746506132604,262144 --variations-seed-version --mojo-platform-channel-handle=9608 /prefetch:14
        5⤵
        
        PID:6200
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --always-read-main-dll --metrics-shmem-handle=8380,i,8149120194572926944,5952492752058516801,2097152 --field-trial-handle=2240,i,2361311589554117813,14391615746506132604,262144 --variations-seed-version --mojo-platform-channel-handle=6736 /prefetch:1
        5⤵
        
        PID:6288
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --always-read-main-dll --metrics-shmem-handle=9176,i,5143498957916980292,7160312843402807894,2097152 --field-trial-handle=2240,i,2361311589554117813,14391615746506132604,262144 --variations-seed-version --mojo-platform-channel-handle=9184 /prefetch:1
        5⤵
        
        PID:5032
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --always-read-main-dll --metrics-shmem-handle=9244,i,9599953210797258108,13433998545090008683,2097152 --field-trial-handle=2240,i,2361311589554117813,14391615746506132604,262144 --variations-seed-version --mojo-platform-channel-handle=9164 /prefetch:1
        5⤵
        
        PID:6476
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --always-read-main-dll --metrics-shmem-handle=9712,i,1107205006068596599,6304001877024118727,2097152 --field-trial-handle=2240,i,2361311589554117813,14391615746506132604,262144 --variations-seed-version --mojo-platform-channel-handle=9532 /prefetch:1
        5⤵
        
        PID:6564
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9688,i,1512302726652718954,17850510505871881669,524288 --field-trial-handle=2240,i,2361311589554117813,14391615746506132604,262144 --variations-seed-version --mojo-platform-channel-handle=9252 /prefetch:14
        5⤵
        
        PID:3400
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --always-read-main-dll --metrics-shmem-handle=6212,i,5425750210863889770,4135397114276583472,2097152 --field-trial-handle=2240,i,2361311589554117813,14391615746506132604,262144 --variations-seed-version --mojo-platform-channel-handle=7380 /prefetch:1
        5⤵
        
        PID:7004
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --always-read-main-dll --metrics-shmem-handle=10048,i,4762961623760112716,9814776976994709579,2097152 --field-trial-handle=2240,i,2361311589554117813,14391615746506132604,262144 --variations-seed-version --mojo-platform-channel-handle=10008 /prefetch:1
        5⤵
        
        PID:3484
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --always-read-main-dll --metrics-shmem-handle=9208,i,5061750343685405583,3423890650588637986,2097152 --field-trial-handle=2240,i,2361311589554117813,14391615746506132604,262144 --variations-seed-version --mojo-platform-channel-handle=9596 /prefetch:1
        5⤵
        
        PID:6720
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --always-read-main-dll --metrics-shmem-handle=8888,i,7798720294638761189,16861972499086644844,2097152 --field-trial-handle=2240,i,2361311589554117813,14391615746506132604,262144 --variations-seed-version --mojo-platform-channel-handle=9844 /prefetch:1
        5⤵
        
        PID:5524
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --always-read-main-dll --metrics-shmem-handle=10204,i,17241448593228795814,17000641005874891894,2097152 --field-trial-handle=2240,i,2361311589554117813,14391615746506132604,262144 --variations-seed-version --mojo-platform-channel-handle=10188 /prefetch:1
        5⤵
        
        PID:476
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9608,i,2170637015618873071,11014501143941612379,524288 --field-trial-handle=2240,i,2361311589554117813,14391615746506132604,262144 --variations-seed-version --mojo-platform-channel-handle=9232 /prefetch:14
        5⤵
        
        PID:6172
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --always-read-main-dll --metrics-shmem-handle=10276,i,18270074942829117318,13573646483236126143,2097152 --field-trial-handle=2240,i,2361311589554117813,14391615746506132604,262144 --variations-seed-version --mojo-platform-channel-handle=10296 /prefetch:1
        5⤵
        
        PID:6352
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --always-read-main-dll --metrics-shmem-handle=9844,i,9537622421015278579,12998621305090045577,2097152 --field-trial-handle=2240,i,2361311589554117813,14391615746506132604,262144 --variations-seed-version --mojo-platform-channel-handle=8848 /prefetch:1
        5⤵
        
        PID:3412
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --always-read-main-dll --metrics-shmem-handle=9288,i,8403737624583374718,2465236041164825020,2097152 --field-trial-handle=2240,i,2361311589554117813,14391615746506132604,262144 --variations-seed-version --mojo-platform-channel-handle=9636 /prefetch:1
        5⤵
        
        PID:3444
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --always-read-main-dll --metrics-shmem-handle=6228,i,8394770476830066115,3393942360614769478,2097152 --field-trial-handle=2240,i,2361311589554117813,14391615746506132604,262144 --variations-seed-version --mojo-platform-channel-handle=10276 /prefetch:1
        5⤵
        
        PID:6904
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --always-read-main-dll --metrics-shmem-handle=10484,i,14163046680716425325,4419192648793311075,2097152 --field-trial-handle=2240,i,2361311589554117813,14391615746506132604,262144 --variations-seed-version --mojo-platform-channel-handle=9784 /prefetch:1
        5⤵
        
        PID:5508
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --always-read-main-dll --metrics-shmem-handle=10448,i,10401465517023249143,7630214756353857181,2097152 --field-trial-handle=2240,i,2361311589554117813,14391615746506132604,262144 --variations-seed-version --mojo-platform-channel-handle=9288 /prefetch:1
        5⤵
        
        PID:1084
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --always-read-main-dll --metrics-shmem-handle=9636,i,7113958096081083467,12983496189154245838,2097152 --field-trial-handle=2240,i,2361311589554117813,14391615746506132604,262144 --variations-seed-version --mojo-platform-channel-handle=10248 /prefetch:1
        5⤵
        
        PID:2840
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=84 --always-read-main-dll --metrics-shmem-handle=10408,i,9944636527931616734,5278823257775752501,2097152 --field-trial-handle=2240,i,2361311589554117813,14391615746506132604,262144 --variations-seed-version --mojo-platform-channel-handle=10380 /prefetch:1
        5⤵
        
        PID:1488
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=85 --always-read-main-dll --metrics-shmem-handle=8928,i,6940952654620093045,16836214938075860949,2097152 --field-trial-handle=2240,i,2361311589554117813,14391615746506132604,262144 --variations-seed-version --mojo-platform-channel-handle=9688 /prefetch:1
        5⤵
        
        PID:5468
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=86 --always-read-main-dll --metrics-shmem-handle=10720,i,12897640516691324591,3089536233998782788,2097152 --field-trial-handle=2240,i,2361311589554117813,14391615746506132604,262144 --variations-seed-version --mojo-platform-channel-handle=10268 /prefetch:1
        5⤵
        
        PID:1516
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=10408,i,10121152014323089253,6741968893568859348,524288 --field-trial-handle=2240,i,2361311589554117813,14391615746506132604,262144 --variations-seed-version --mojo-platform-channel-handle=10448 /prefetch:14
        5⤵
        
        PID:4012
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=88 --always-read-main-dll --metrics-shmem-handle=9900,i,5767667891645407468,10869449674862522041,2097152 --field-trial-handle=2240,i,2361311589554117813,14391615746506132604,262144 --variations-seed-version --mojo-platform-channel-handle=9136 /prefetch:1
        5⤵
        
        PID:5404
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=89 --always-read-main-dll --metrics-shmem-handle=10596,i,302159628994243395,16622256134040028178,2097152 --field-trial-handle=2240,i,2361311589554117813,14391615746506132604,262144 --variations-seed-version --mojo-platform-channel-handle=10904 /prefetch:1
        5⤵
        
        PID:6596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+2+remove+a+virus
      4⤵
      PID:4304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+to+code+a+virus+in+visual+basic
      4⤵
      PID:5748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+to+get+money
      4⤵
      PID:1036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+to+create+your+own+ransomware
      4⤵
      PID:1380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=montage+parody+making+program+2016
      4⤵
      PID:804
  - - C:\Windows\SysWOW64\mspaint.exe
      "C:\Windows\System32\mspaint.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+to+send+a+virus+to+my+friend
      4⤵
      PID:4220
  - - C:\Windows\SysWOW64\explorer.exe
      "C:\Windows\System32\explorer.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:4580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=dank+memz
      4⤵
      PID:5620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=is+illuminati+real
      4⤵
      PID:4312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=mcafee+vs+norton
      4⤵
      PID:4272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+2+remove+a+virus
      4⤵
      PID:1260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=dank+memz
      4⤵
      PID:3008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=stanky+danky+maymays
      4⤵
      PID:5396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://play.clubpenguin.com/
      4⤵
      PID:2100
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:6800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=facebook+hacking+tool+free+download+no+virus+working+2016
      4⤵
      PID:5032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=virus+builder+legit+free+download
      4⤵
      PID:4012
  - - C:\Windows\SysWOW64\mspaint.exe
      "C:\Windows\System32\mspaint.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4044
  - - C:\Windows\SysWOW64\Taskmgr.exe
      "C:\Windows\System32\Taskmgr.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Checks SCSI registry key(s)
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:6448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=minecraft+hax+download+no+virus
      4⤵
      PID:2684
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=is+illuminati+real
      4⤵
      PID:3348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=minecraft+hax+download+no+virus
      4⤵
      PID:6728
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=john+cena+midi+legit+not+converted
      4⤵
      PID:3352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=virus+builder+legit+free+download
      4⤵
      PID:6456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://motherboard.vice.com/read/watch-this-malware-turn-a-computer-into-a-digital-hellscape
      4⤵
      PID:6272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://softonic.com/
      4⤵
      PID:1448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+to+code+a+virus+in+visual+basic
      4⤵
      PID:1680
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=vinesauce+meme+collection
      4⤵
      PID:6596
  - - C:\Windows\SysWOW64\mspaint.exe
      "C:\Windows\System32\mspaint.exe"
      4⤵
      PID:456

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:544

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4608

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4792

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004D8 0x00000000000004D4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:392

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
- Checks SCSI registry key(s)
PID:3608

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Deobfuscate/Decode Files or Information

T1140

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ec6a4f25194d7df920f023b94035789770d82b866f099f5b5c173cc54b917115
MD5 3f1c1794ec8ced524804973bbce2d4ac
SHA1 6590c89953e8a722e5a484b9a6cf54a706728368
SHA512 4d64e702748a9bdaaf0d9e615e1a53c00d60b36678bc7c8cbf081669c63c3b8c23886cf0b3633e50e54853f273a2e585b73bb1a35f53ef1493bf40ac357ee359
TLSH
T1F1D02BF0B7ECD443C084507800F21574112571301518C2F02311E18805042810511315
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 08b551008bdcc4de6c80e8d8ffe37c1b7477ababb9604ca97c52b81aed70fdae
MD5 4cd8e5e902146ba19eacbbf4f2e5586c
SHA1 94f807b68c16fd008173350beb37c8686810bcbd
SHA512 6381a86b9ddf9099cf403e36e8c774a996a2a9e547c95e0b2070ef6e2e5e94028cf8284c9fb284f5f80b523066ed68d34895e768192628c20598a4e881c034ca
TLSH
T1D5D02BF4B7DCD543C084507400F11574113571306918C2F02311E18805042810512329
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 18c10d403cd666c0e94205369be7564926e3d8c77ab575248b780616dd8effab
MD5 5dc5de9abcf91e556c5afe3762feb49d
SHA1 11efe28914297b86549f56f041dedd74e36fe01d
SHA512 76f886e71c33a8a2c73b004e5ffeafb97a9cdda3357a9f4ac6cbb08ebef166ff3dd11bab5800f095ca6f72b7020e7226de353f69881addf7d2cc5922fb097d10
TLSH
T1B6E07DAD0AC8C22EB300684781AC470C82C0371BD2CC6E1A3700C5887043740F7C6AD3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 89619a97bd799f4e12ccbc53cf459ca5f3dda8907af683f9f8cdfabaa45530f4
MD5 e0f44fec694789e989e6de6c35cd0927
SHA1 d07915f4a707e8b36fd5a674092821fab009ee94
SHA512 3f12ee26a463ba4ddf1549defcca3924e6aae9d2d23e4467f8e8e890c6670d296cd73acd7bbec656ce4f45c986ef506feec3d623e6bdcc3353a297c351dee08f
TLSH
T1D77193768391F3A4FB5E3072D8CA14BA373348B9EC830E1B85B8E6B079827587C5C004
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 ad15f94355fa09ef30a29e748d163a7c0fc90b5ea14822b084e4f00991758f51
MD5 fe39db910d2e536058e086155bed83ff
SHA1 20b8f7b5b3a0f4742ce22a70a1e260cfa9f5cb94
SHA512 1168388f9b00cf3d190fa838d88fda6ff95a97f83abfc8e20c27596f5b20fb16a19f85fbb6e69227b4596ddc8f9d3c8ea024a2ec0383cf2ef1fb2e39110a4062
TLSH
T1966171759391F3A5FBAD3072C4CA15BA773788B1EC870E1B86B8E6B47942719785C008
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 630dd0460f9ecec3fb8b65965473aa91170163c1bfc06f1b2b5c45bdaf1a19ac
MD5 2ce8983b63cdf82894e130c78328e5e7
SHA1 172b974acf4451892cfca41f02182fba304e4d99
SHA512 f8ea7147b4998a2563f641721b2629cf510169a6f35660726e946054ab30560fade80dd47639983c454465f02e8270daf378c803e3b86598cb7f27c8a0b89377
TLSH
T14361707593A1F3A5FB9D30B2C4CA15BA773748B1EC831E2B86B8E6B478427197C5C008
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59f0fd.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59f0fd.TMP
Size 3KB
SHA256 e25f557a94398cddf718f6627d2122665bf470596f02bbb46070f914bc162d23
MD5 04eca0cadb515bed49a718f2ad4aa330
SHA1 410b8efde9a349629f6cdc0cabd9b54bc843bffb
SHA512 d5ab92bba438ad37a71ffe652558b0f25bd6d949142861426a9db124ae5da3a6721fc7f65fe522d0fdfd8d1a5c07ed6192ec944d7bd9ae629fa422ca488ea49f
TLSH
T1EB6170749351F3A4FB9C3072C8CA15BA773788B1EC830E2B86B8E2B478827197C5C008
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 46b8a2c0907974d6a878b736af30a70e7c7b40a9678e333a1ec04b780f8e0395
MD5 95efe54521299faa15899ba50c698796
SHA1 a368b778f85059d16faa89e9d72f842f2e3b6d47
SHA512 8b2be9f3534ea074fe7f5707086e49158f29e20a743e46b676779fd56af44f47e4090916fdff9858278fec6b5cc02327892c7a1af0640818733f183e254bd621
SSDEEP 96:DTOG7LncVZ65VTcdZzBPBbdmBiABweL/i/E:DqG7LcVZWVTC15bIBi0bL/i/E
TLSH
T18A918DF7C7E8862EC91196F4AB14AF2FDE1D0924431C3D5A88D4AE2B93E3871E14165F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 a982bb9fd2021520619c30f82cc681413af856b5807e2d7edf865baade153f5d
MD5 9869a8800cd2db7130afeb6fc0dedb90
SHA1 675e7d0eb83e8de2d85d5bf03e42906997bf5549
SHA512 885a5a743162ec41dcf93476b3042900d891d0584beb7196f39159fc007013a6dc6de60e5dd703d5868367e9f19edc0b847de6c1711e7a8ea15241c1979e0c29
SSDEEP 192:DqG7Lg8IOf+6VZWVTC15boi0AVNDpacf80E:DqG7Lg8IOf+6VZWVTC15boi0AVNDpacE
TLSH
T1C3E179F7C3E8862ECC5156F49B257F2FCE1D0928421C3D5A88D99E1B93E2871E10565F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 b72943f5cda9355e19a9b0298a4edfa4c2dcd695e651408a055f5661c968e0fd
MD5 e6854365f763569a4964a702546c7b65
SHA1 a0b7052f959660c12cee95765bf916f098324371
SHA512 acc766200beae064314f35b51090806166bc8410067576c111718769b1ff1efb1d480481dbaa47b45300aeb51523186dcd9b10422e9de6523584613085be55bf
SSDEEP 192:DW1JjQ1ABOCLhML2oFSVZWVTI15bbi0XuJ4Jnj4qWTYetZi796mvoAmCO7E:DW1JjQ1ABOCLGL2oFSVZWVTI15bbi0XF
TLSH
T12F1279B787F4962ECD2166F4AB157F1FCE1D0928821C3D6A88D4AE27A3E2471E10175F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 e0b86deda17cd34ceec6377164055dc099021cb4fb6e50be8b2075cb8204c5eb
MD5 64257639d5a32028d75a37e7ffc233aa
SHA1 0c3e27ce9debcb394572d4cf465221b442b64a1e
SHA512 c06d61bff9094785effea562ea2f546d9d11671da0261cca9f9a85b99d7b6759500ec092ced903c725cf94a19a76c5aef00345ab1e79d67fbb2c921ad9da39a4
SSDEEP 96:D/O1lgJjQ1ABOCvVZ65VTcBzBPBbdBiABXuJ4JnwBj4/dhNtbE:DW1KJjQ1ABOCvVZWVTI15bbi0XuJ4Jna
TLSH
T10AC1CAF783E4862ECD5096F49B15AF2FCE2D0528432C3D6A88D4AE2793D2872E10575F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 f6e522aaca2c1e3474c7358bfba7b2e0a9bbcf9ee3c525cb979ea40c918e78a6
MD5 284dfdee1723f49f08781ad0fc063561
SHA1 907062161d2b910c126bfab90750a26f9490a61e
SHA512 2965ea00e2b3b4fbe9a2c0fd0f800d63b40910e574d155c2d2cdf5c3764689e06131d3258f5816faf6d4d579c49a6a5fb1b7888541931ffe4abadb18155843f8
SSDEEP 192:DW1K8IOf+COCvVZWVTI15bbiwVNDpankj4vGHnE:DW1K8IOf+COCvVZWVTI15bbiwVNDpanR
TLSH
T101E18BF7C3E8862ECC5196F49B15BF2FCE1D0928421C3D6A88D99E1B93E2871E10565F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 162f921373f3546811be000a8f4b033319d15b3afdf25658d98c8bd85f4f887a
MD5 37a27df0ef165c8b06bdc76c64a65bb8
SHA1 f477f68bdcbc90ef7928860b47f23356f4870195
SHA512 e2cb8532c63ae068352b5a46c60e186d2d543f4ea24ee9b8d236360fcfaf1ce10e84b33bcc201a5f8bc009497b11ed213f1bc6be3cce7b84b8809f0b584757da
SSDEEP 192:sxR9RiCB/fusR5jZ/MzoA8pEq36zf/g6+WND6MSpZhF/ArRsg3jiG5IgDaIJ:sxR9nB/fusLN/9I/5iF/orT
TLSH
T1F052B95AAD24697B9CD7D219BB15BF27E7F91032A0D51E44AAFC8B1C04E76DD220380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 a01e958f90cce5e5499870a9d55f47c2f65fd0656f28ebfa1c569d6e803790c1
MD5 20e94ddd38ac694ca6af08490ee66f53
SHA1 eb34075e9b0b6481f5ed727eee6ab4f7ccfe1f12
SHA512 17300ce709ece5cf1a59a85bb5403de7befd309c4a0cfcb88f5a53b71ad186faf7878f8d0496f0b775aaec9fbe3aac352813eeb0d52fef3c34e416be14891c8d
SSDEEP 192:sxR9RiCB/fusRbjZ/DzoA8p9f/g6+WNBSp/ArRn93jiG5IgD4IJ:sxR9nB/fusZN/yl/5K/arF
TLSH
T1A942B859AD28A97B9CC7D21DBB55BF63D6F91032A0D51E48A6FC8B1C04E76DD220380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 27KB
SHA256 465e33a01f89914df5bb6b6f59cd10a5098a23a14da0c001b1c3f43c9333ae1c
MD5 a56b2b4364b0f085a520bfcf52e2ea45
SHA1 56b53b6f32a60b7bcda1e014dceb39829718508d
SHA512 eddb991fba0a87b3e9965c80e2eb7784ac5d1a6c7e17f96b9b9627e89595a5b81abc613ffed2f7bd1cba152e572ce5af32c5e70e0e2d8e7d192323adc5338153
SSDEEP 384:sxR9nB/fusW66s8qMpRiYnazAW8pZS15posJWeT+2N/eP/himPhkmnrT:s5nB/fs4Mnc7WeT+2Zu/hZ7
TLSH
T164D208499824C87B9AC39D18653DBE33EAEC505261C5CEDA5AECCA1C01DE1FDAB07853
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 eabc965f7451c0e07fe2815a73dd53c56b052a1d4dfe15c9efc0a7a01377d5f8
MD5 008211035812a8cb34d135a63ffac872
SHA1 5f81260412c73ad0c7f5ceece937537f91fb8bf9
SHA512 76d17049d0b916961eba8b736b669d58a4192bbe41ace18a6888d9c528ad8ead02b0fcc7ddef1e86ee8df9a1fe3a62211691490aa4798311dd91eccefc0e4380
SSDEEP 192:sxR9RiCB/fusR5jZ/CzoA8pSxe7f/g6+WND6MSpZ9ioHjBArMkmdqq3jiG5IgDas:sxR9nB/fusLN/P3/5imMBkmTrT
TLSH
T15452C95AAD34697B9CD7D219BA15BF27E2F91032A0D51E44EAFC8B1C04E76DD220381B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 010de03f4e6f8d67f56b5b8dfe3469f6428b819f620e20c244367b7968146673
MD5 acbab66da9b78900aede6303ef6f6d27
SHA1 f717f3cba1d77baec9034d0056ad8f4827938c9e
SHA512 c0d41143a00a9a9bc62d2308d459945f18229a298c1efeed3ae8716ab0b302fe8ce37c9d79ab132d7403b5ac78c656f37bd6bedbac4afa5d1d90a3eb8cdb801c
SSDEEP 192:sxRyRiCB/fusrbjZ/DzoA8p9f/g6+WNBSp/ArRn93jiG5IgVIJ:sxRynB/fus/N/yl/5K/are
TLSH
T13642B959AD28A97B9CC7D21DBB15BF63D6F9103260D51E44E6FC8A1C04E76DD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 bea542bc88586c7ef2f51a9a8d52e20edcecc1b4da2eeec3aa2d3cfbbaff81ed
MD5 0ea37491b6ea76e641b83c0b0c9da2a8
SHA1 0a08b758e3e7dee2c4871c2b38a415b491971a34
SHA512 bf0e0ee904fdc49f54ab33e7ca73572ad659463d6e22c162cba3d900903b8519d7c90fd3f41a4b2311fd8778e489f684218f26cd29ece4f78281a7bb8291882b
SSDEEP 768:UEg+rC7pLuLb7uWgf/fXH8F1+UoAYDCx9Tuqh0VfUC9xbog/OVrwl6ty/roqCzeq:UEg+raEb7uWgf/fXHu1jaYwl4ysJN
TLSH
T114D2DA7B644CCB7F4FC00ADD9C1A7E9B6DA802CB9698CD8047FA891D02C67EA51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 9b8cf0e2d85291cfba08e65c7dad0bf65d8f749b46badd221383068bf251ab80
MD5 f11c88bd16512a64818f6b24cf36b4d0
SHA1 ea23b02e25b273d61467519f704a5a6883032024
SHA512 57ee47bb82cb69bb27b8c84af7ab49725f0e491fe838a0bb82278b07640521b2b1ec5b3e31cb63a272615b9b4bb04fd58e2c5daeaa8253376f7c7eabcb7284ef
TLSH
T104E068B32EAB0890AE9F97C7143240A901557CC8DD00AC0F802A92DB94A2258644AC20
MD5 SHA1 SHA512 TLSH

Submit Download

716c8460d7ae09d5_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\716c8460d7ae09d5_0
Size 255KB
SHA256 bca8822ea026ce8f0e5137588e7d683dd9c3234cbf59a2cfbaa8c7b8adbbad9e
MD5 4ea74e038a9b9a27d54cf9a6d49c9081
SHA1 e8b3b40ac0a9f9470bf9d732fce0ff73517834eb
SHA512 47f94da1651573db8e35ec48a01259b22b89935ca8242e7fe6b79981b2164b465f0d9b204c8723bc37817718fa90492c4cc93fbde95325cb22d7c1caac967673
SSDEEP 6144:NHs2tXQJZztZaWTGFS/6vIzH1luEXEPfv8LQnQkp+RIuMBK5:NHs2tXQJZRsFpYEP38LQnQkGIuUK5
TLSH
T1D4448D723300B13FA8278EA1A6BF7F4E3835E217DD1705B8D5E4E9358BE6DB91422548
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 31ad8af867fb7cbb7fede2420b7a69ffca2cca26ab6e860f5f4df7b5b11b27be
MD5 e9f751a70dda0263d615c5457efa5f9b
SHA1 7659f23e8989e5efee98775e71707a11c1aad101
SHA512 0f6463e146e4521c801fee8720f0fa23b98ccf3607d37882d00ef03d83a0aed5ec7fa613153b2a7657b5ab3528f4c0965d33286d90063f7caadaf953891b3968
TLSH
T19CB022000C082A2BCF00EF3223C32CE033303E28BFA38F0200E000E8823320A0280208
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 6c88744a56fd8b01e52d06ffba5d3cb6c97d6d308ca61733b24b4d4015f9122d
MD5 34c3b55ef0f3138d5aaff29e3974fe2c
SHA1 279328f2d1ea32b9b4994140b84c6b8884be554b
SHA512 5c45e02723a5beecdfe27e67ca63ed406934843c678b3214ce7489b535a325387c683ae17e5429f8630a18b2275100e5bb59b7eb18061c2fb0943cb07dd5683d
SSDEEP 24:KIGqMvbvIIhlE1hI7vIGbEKnnhvFE15TUSz6xLhTZyX3mqsB7hoojHkXjotPImtM:K0kInKh2kTyxKI/KnqsrJIpK6skbye
TLSH
T119912054327A46407A7D294892D1A76E864233A33168F72F7BEE00A15E7FE190CFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a6cf4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a6cf4.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 1a6afa727712158fc097ff674f5a43d7b3eefc6e1ff24c8065347aa830b2cee4
MD5 27dc23528cc9a8b98d3197e95eab0d68
SHA1 5fce8ade8943648faa483a6b0e19bc8e83b159b2
SHA512 e9ab0015c0b82e3b398fc067a3291b0512079a00af1bda0bf543a298c32ac33fd11e62c048172cfb8600b98a7d401d03e36aadf5f9a76bb4f4422fca4cd37b39
SSDEEP 768:mJ3jEwO5ftxUQJ65fgGM1TnXMqOaJe2sfHw:mJ3xeQfgt1TnxO2e2s/w
TLSH
T137F2BE31A9699CB36CF7D285B306A2926EF550B7D4851E98E9ED6F0F008725F170BC23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 b9b260a6a730be06ab03f6cc4fed1074338548741a3347b2b9ab9dcf46e37ec2
MD5 c8c0831a2ab8b3d46323237f7ef33b4d
SHA1 42e2663243b409db7636836a89d152cc4ec345b8
SHA512 377ba31f6a8b1f86357a01508759cf9cd9dddcc5838008589c7a2bcee47dbb736e2e7e0e06b20cbabac44365ae46db5dc47f0fd8f7e1df2f718c24758d569fec
SSDEEP 768:LJ3Vg3wO5ftxUQJ/5fgGM1TnXMqOaJe2sfHw:LJ37exfgt1TnxO2e2s/w
TLSH
T1F2F2BE31A9658CB36CF7D285B306B2926EF540B7D4841E98E9ED6B0F008725F170BC23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 921aa3cabe3cf89689bbc0de824c58a0596855d6ce8f2f8788898f91a6c05051
MD5 8d0074e2d857bf4405f02dd37c1a4d82
SHA1 79c7247261b3d722e22b2ac17cdfec8fc527ec16
SHA512 cd7c9e04118116e2ce4b5ce9c25e138a97aeb5676c996a9c44f19e64303c3f4746c5bdc6a0a749b590774cc2a4553a50a60de67110c8eb7715fa753ef0f9e881
SSDEEP 768:ZFHX3rwgiiIO5ftxUQnR5fgGM1TnXMqOaJe2sfHw:PX3skzfgt1TnxO2e2s/w
TLSH
T1471328F698D78976E8AE8783A33D6D525DFCC063B4885984B7D85D0DCC821BFC30A812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 d964a73454edfc54e5b01822973c2556052d612917196a060e85ed838176eef8
MD5 03271076680cbc5508d95c57f9ddc23f
SHA1 1fe1b1f08647c1a9e4e1f6c458154b0e24918a5e
SHA512 27745b446cefda84a10d5190658a10529ba6ba1afd634afbf779d1f4127602f9daa178f0f0133741888d20b60ecaed75cd7fda956103a0ad1a7def64b96e7c73
SSDEEP 768:ZF6e3OwgTDIO5ftxUQW5fgGM1TnXMqOaJe2sfHw:Ce33xfgt1TnxO2e2s/w
TLSH
T1381318F698D78977E8AE4783A33D6D5299FCC063B4885984B7D95D0DCC861BFC30A812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 5975dbe992f97e9f05b4bf98c063397b7e94bff3cd6cec9f333619fcf812b7fe
MD5 5a08e85a9e1186b6485db560daaceff1
SHA1 fdef3b64d04513106efdf9118f4d42fca0be7339
SHA512 9ecb39293ef20193451cfd3b7c0ec078a93e97538d68e863f5e90eb96cf0150604d4d5f15d0a029a5d15afbea7f55dcf3342cb472abe61de5083d4e0bf2ed9c7
SSDEEP 768:UJ3EwwO5ftxUQ85fgGM1TnXMqOaJe2sfHw:UJ3uDfgt1TnxO2e2s/w
TLSH
T134F2BE31A9659CB36CF7D285B306A2926EF540B7D4845E98E9ED6B0F008765F170FC23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 e63262ed0cd04a2c547a50db51c3d507e159244760b9f86dcd44dc09782354c0
MD5 9288dca970b0e7140b6dc7a0acc3f819
SHA1 de5dd7170c9bb6a270dafeaafc8f2615eb45576f
SHA512 e665ba8156adc55d2c67a5b06b10b606e517b344c76988aa1082a7da4eca7908662e4c356600db51c0f047470db3c4c2d349b190dc03260dc86adf019f8864e3
SSDEEP 768:5/UxvxjgC+93wBwO5ftOu5fgGM1TnXMqOeuAaP8:sZj3+935cfgt1TnxOZAG8
TLSH
T13A03CF36AC556C77DCF2D384730AA3A7AEF2446385C52AA899ED3E0E019B35D530BC53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 72505b0a5d76b71b4444597546dc8af0515c88f5247efe3ab9c179c65f818cb3
MD5 1b0931b43e46c29ca4f1c7417bfa1f58
SHA1 90c2bcba1be6278320ac20fc30c764dae524a072
SHA512 d3a00db4d68c5f4e315edfb136a9bf8ecda55ec2f7c3e9b26f77837da04f5d682698e57cb365bf59ebef478a9000e0d46d6a5383b98c87990df70e428c945ebf
SSDEEP 768:ZF5P3vwgU0IO5ftxUQs5fgGM1TnXMqOaJe2sfHw:xP3szfgt1TnxO2e2s/w
TLSH
T1EB1317F598D78977E8AE8783A33D6D4299FCC063B4885984B7D95D0DCC861BFC70A812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 f31095a83c40b315bda40f55ffe4a4a572dcb6cf6c08323536fba2d995ec6eb3
MD5 7d0458ef0d5b339542d785443f5074b1
SHA1 d3b3b70a26d77410af56aa452fddfa463f38f613
SHA512 3388fcec3c8b9c894e5a1df02961957453720f6a3b19fbacba4352e36cb2fad5e818fe2acf7999a3811713bd2f903df6ddbfb8482e5bbf128ac15ba00056e63f
SSDEEP 768:ZFp/3vwgzQIO5ftxUQs5fgGM1TnXMqOaJe2sfHw:h/3tzfgt1TnxO2e2s/w
TLSH
T1501317F598D78977E8AE4787A33D6D4299FCC063B4885984B7D95D0DCC861BFC30A812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 4b72fdfecb0b14e6cb488ec61847c596d861578639d7bba51b5b1b851374487d
MD5 e5f1ce1c13a5ee3be55466b4224e5ceb
SHA1 18add590e7820ee26c37ed2e506ad7557782ed9f
SHA512 f28df4d9bcbdef8cf698ff4198735aed23dbb0a514beb799da618605fe8362e68b2a89b8034d1d71f20bae705607ced046d0e91fe0c94474f767365f107532e8
SSDEEP 768:ZFOP3vwgByIO5ftxUQn5fgGM1TnXMqOaJe2sfHw:mP3dQfgt1TnxO2e2s/w
TLSH
T1451316F698D78977E8AE4787A33D6D4299FCC063B4885984B7D95D0DCC861BFC30A812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 6335e63172f3ac3c020b4e5d17d16e4ae4b0d1e0629dfaaec3d53623d0460d15
MD5 c2aea4c78a8a643925fdbad5f030cb72
SHA1 4e1ba882db859580c5866000dee6b1785c599394
SHA512 d76705260ad2ec2ddf5a4a1b8cc386d712f780cf0677c6f77e9d67a64ff27f99640dea77ae124bf554b97da84a9b0f159b4721eaee2908bf67a38c3860aeb98e
SSDEEP 768:ZFGI3vwg0eIO5ftxUQ55fgGM1TnXMqOaJe2sfHw:uI3Yyfgt1TnxO2e2s/w
TLSH
T15B1317F698D78977E8AE4787A33D6D4299FCC063B4885984B7D95D0DCC861BFC30A812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 d793844f13f7b5bf55a5efec81842a7401b08726455d8ebf50049768d7a4fbb0
MD5 de63f612cb485345ca47cff84f6a73ce
SHA1 ef8464ade7f5ce8d64ca8bf8541c047b2b5bdb8b
SHA512 a44cb8603fe343ef186a7ca095314991e75a2cc4f78bac387054933cd349ea7cae5208aecfac362410ad99abfdda2107f70c080bc64923883cee8d258b896d1c
SSDEEP 768:ZF2G3vwghDIO5ftxUQ/5fgGM1TnXMqOaJe2sfHw:OG3qEfgt1TnxO2e2s/w
TLSH
T1D41317F598D78977E8AE8783A33D6D4299FCC063B4885984B7D95D0DCC861BFC30A812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 55353c7b44dfe712d760f4fe1124212c90306af01acb1c092415fe26bd3b8d27
MD5 10d55517a96cfd0d786afa5073e1679d
SHA1 924047311b623caa18a15aa86ac6335a476ed531
SHA512 d4956a2a1057a5b94075a86ab705f5be1ee5240991aaa1406377eba62b2bb7c51fb6b445910adf31eb4c802cc1026890b1fb4729714d683bffccb27c46605a73
SSDEEP 768:ZFgZ3vwgjWIO5ftxUQQ5fgGM1TnXMqOaJe2sfHw:oZ3rrfgt1TnxO2e2s/w
TLSH
T13E1317F598D78977E8AE8787A33D6D4299FCC063B4885984B7D95D0DCC861BFC30A812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 fcf5b7f569eabf6388946fb299713c458329aac1aa8370ab1475f23fc73d8226
MD5 bc3e21ee1b31733326fda39a9a41c87e
SHA1 07d27be60d07f1b73bf9bc63c9205b261a8122ff
SHA512 533c91b248efeaf3ba3017988472952c3e4855137c5c6aafda26dbe50f0d9191e3d09655cad574b6fec6b24b99bad25bd922b64fe814d3d60d66e0e3623cbacc
SSDEEP 768:ZFA93vwgTiIO5ftxUQy5fgGM1TnXMqOaJe2sfHw:493zFfgt1TnxO2e2s/w
TLSH
T15F1316F698D78977E8AE4787A33D6D4299FCC063B4885984B7D91D0DCC861BFC70A812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 48dea16808892fc275403fb2a55f9f017bfaf1d588c92314e00d9249fa481bc6
MD5 528bea68892563fcbf1688ded36d3aed
SHA1 cac13ad0fb2370f9fc0e78bb1485ea4ecd31e184
SHA512 8ee5f84cf48ac9ddf8a80e633c529633c8af61e047c1628c8b0a33af5a5f56b823837fac5bf102ef8134903eadd0986da970f4e2daa28fd91f3a146ac065461e
SSDEEP 768:ZFi93vwg7VIO5ftxUQB5fgGM1TnXMqOaJe2sfHw:q93COfgt1TnxO2e2s/w
TLSH
T1BB1317F598D78977E8AE4787A33D6D4299FCC063B4885984B7D95D0DCC861BFC30A812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 f70a94b6552131579b37a8520ce1eb01dffd661d2ed1b7cdcb8f7a6f277cfb64
MD5 628dcdf9f5cb61dc6f98aaafa72f04f3
SHA1 5254347bcf95abc2ee83cef50849b29ddfc8468d
SHA512 36b82aa2c6fabbc2db8a3c170cfb2fb0b26191c13efc4fd8b91a98ec93bab49a9b09d8362fbf5e311a4fc386651f5d3546ed598af3382d0e9c3804d70e09f433
SSDEEP 768:ZFdD3vwgtZ1IO5ftxUQA5fgGM1TnXMqOaJe2sfHw:FD3yrfgt1TnxO2e2s/w
TLSH
T1521316F298D78977E8AE4787A33D6D4299FCC063B4885984B7D95D0DCC861BFC70A812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 4147df71bf3d6d4b57cbd391992bd27f1fc9595dc7c11d7fabe68ac740ffed24
MD5 391f755ea5f3b60c0b20e895e586644a
SHA1 0c88af581567dd6f10669a6097f66ad033052394
SHA512 9eb4cd5952ec85a1cad086ab58ea345506491ee245858812fd46de5a410128a6b29b006029a1d21960ebd2f9725c44808f8cce8b343c8c8934171a5396f88846
SSDEEP 768:O/UxvxjgC+A33EwO5ftxUQJ65fgGM1TnXMqOaJe2sfZU:DZj3+A3FeQfgt1TnxO2e2sBU
TLSH
T1C513BF35A9699C73ACF3D244B31AA3A3AEF1147794811EA899FD6E0E018735E170BC13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 b1a6f328ada43e78b4e7e7b9d99f6cdf732ecefd66f113a5c8b9fa2efb38306c
MD5 b4d28d7759546163d03def6fc4edefd0
SHA1 170ce928e40cda6035a285e4f56ca5f45017b301
SHA512 d9b5b8fb3270cd490d119f3cea3a1963b7d8c974b8b8c90521666852e71d5c854347d4d0c0bb2a58d78cf53d853af167e657b4e0249b5049ba87ae2ae036160a
SSDEEP 768:ZF5v3vwgxn1IO5ftxUQc5fgGM1TnXMqOaJe2sfHw:xv3c7fgt1TnxO2e2s/w
TLSH
T1921316F298D78977E8AE4787A33D6D4299FCC063B4885984B7D91D0DCC861BFC70A812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 990226e5d848fd004ee42915014a3c45fd061f4cdab3fd97ef0bfb301aab6c78
MD5 f7fc005dfa230962264f3f8e2aa52e45
SHA1 dcbabcfc5192e70f7e32d6d9b8b9ec5fa0748ba4
SHA512 80e6548c0f63849e0716a17a7bb82e2797e62c39627d0e5f97452b4207fc65191cb7c230ed415f3d86bc72670444e1caf66fcc735244973334311711e5f77cc5
SSDEEP 768:ZFld3vwg941IO5ftxUQY5fgGM1TnXMqOaJe2sfHw:Nd3pPfgt1TnxO2e2s/w
TLSH
T1BB1306F298D78977E8AE4787A33D6D4299FCC063B4885994B7D91D0DCC861BFC70A812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 3dc59f5250a35956e486d1a6d533681a1be9ea85d99233cc2babe21e8b61c79e
MD5 fbdfd58944ba90e10ed3ed44f82f9fd3
SHA1 2bb45828f23624b505861381e2ba58531dcef844
SHA512 25517d29dad81569632eccdb632b629b37667a87ad29d1e28250bbdd561b02a9cc7c80ddabed3ff24da3412241c6a178170c08f2aae1f09fc325af375b365f27
SSDEEP 768:ZFTE3vwgR31IO5ftxUQX5fgGM1TnXMqOaJe2sfHw:7E3k8fgt1TnxO2e2s/w
TLSH
T1A51316F298D78977E8AE4787A33D6D4299FCC063B4885984B7D91D0DCC861BFC70A812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 7aa452ff0b4e293e7c42d64b3bde8d63628b73e0def8bdb5165bf15ba49babbd
MD5 5a7aac7322e9158bae1e9c72df728a1c
SHA1 6078a9681a54ec1defc03f36e14d0d03ca87fcab
SHA512 18254962f6dde7cd8736193d851fbf51cbddf0b173153efed0988d18b279610ab1025abfe287cd5683dee5f357c0a83dca634899ca77399624dddcee4607fa1a
SSDEEP 768:ZFur3vwgG4IO5ftxUQC5fgGM1TnXMqOaJe2sfHw:2r3kVfgt1TnxO2e2s/w
TLSH
T1501316F598D78977E8AE4787A33D6D4299FCC063B4885984B7D95D0DCC861BFC30A812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 a837cf2f753201e708c9acd942a3a86324b7b27a421abf73e3bd8618b754b103
MD5 11fa4b52fc5f162aec71d21b423ceaa5
SHA1 eca5fe46e2118bc1f82416abc08ada08427fe186
SHA512 d80071662ba9ad8257e235fe2dab47b3382e4e426e4e7a64268dad95667f1da740e22faf0c3573e230b6e96fab5fd8366b3526a029722544f546d977d3ab0009
SSDEEP 768:ZFkH3vwgNy1IO5ftxUQe5fgGM1TnXMqOaJe2sfHw:MH3blfgt1TnxO2e2s/w
TLSH
T1E71306F298D78977E8AE4787A33D6D4299FCC063B4885994B7D91D0DCC861BFC70A812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 c1852197b03a49c49803ddf4566955e134c72ca9a67ebc7dce599fa8da691e68
MD5 7533d761ea2d8ab955ce2975cb5169fe
SHA1 aa18666ee80440e164ca0a82c398bf8133c16632
SHA512 87439e573d07da585770f60f18e47154aac4ed8147db0a97a7c8743b37b52b62170f31d2e43cb2172302504467d3e5c6ec11f03be16bbe68bd5e64940bcf1887
SSDEEP 768:ZFta3vwgWgIO5ftxUQY5fgGM1TnXMqOaJe2sfHw:Va3gjfgt1TnxO2e2s/w
TLSH
T1C01317F598D78977E8AE8787A33D6D4299FCC063B4885984B7D95D0DCC861BFC30A812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 31b53d5a6fec73ddc7ce7db56778bbcd1ade9f11c3be104a8885f6d0b37a788f
MD5 f735f2772d1d5c390b12c917449ad36c
SHA1 0ecaf1331b0954193512314aa1141d7f8d8e6ba8
SHA512 657f02b7af999bed933ccfd4868b466602c9d1888e5e798adc77413170488c117a179249ee9620fe47f2540404810e8128cb6feef3b330542fc682d64cee6dc4
SSDEEP 768:ZFc33vwgKd1IO5ftxUQ85fgGM1TnXMqOaJe2sfHw:E33fbfgt1TnxO2e2s/w
TLSH
T1D51316F298D78977E8AE4787A33D6D4299FCC063B4885984B7D95D0DCC861BFC30A812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 5f05750156bf0dd37b0ee0d8cd50c4ba1318ef662609d22e15df81c3b256949f
MD5 b05365c939ff7e468894d99632317762
SHA1 5f759769a7154417ac517811eecfa60e7176d6d6
SHA512 960036a0bff5d8f257a8ae7d267d7d88a57c8d578b3e839afbf4a27a7de4e6939b61534e8fa822cfb71c0a3d01a432ec6128db7dec74a2da983ee42a3d89a77c
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 2a2e793a7bffb8fce3e43c215ddfe161a32d92ba6f415a33e2aa9b4abe0cbc48
MD5 ede3bcc2c4eba44881a3f6d6f8903167
SHA1 c4b30523b01e47578347fad3344067534af8cf07
SHA512 ddb3bf3d40babf2b0e7fc3bd2a697d758a8fc276b6cccc87b8e83138fa5766b60c01c8c74697266d6a8b3acbd6ddfd6b9c33d06d541a06a116d2d43a234135b9
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 4bf06528946f298ac76051ddfb8b59248ed642a76ca2abb2750be87d9a3090e0
MD5 12fb834f8083386873de514ce90ce208
SHA1 1780635d6a72a9ab8281c002314c18f9e6ad8a01
SHA512 cb3029180c85fb14199ad1793607460e984eca7fa01f01fec25c47eb6289e584d93446e3dc2c520a4a4537ccf48b8c859cb74bbbe0f72b959e09c805de8ecc5d
TLSH
T11AE00112920400BFC03C433000C31A347AF2902013F306856A2012B92A173412B30FC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 70a463d2b981ce2d2eb8a745795cc969d41df97ca38a5575d6bde5ce89665ab2
MD5 65870d93ffbd90393f9909a5ef962675
SHA1 5c9a03a680f294a076ef19a09d5d2157f8e1d81a
SHA512 0fa8ffe235d4ee7852f57c846b7a376ed197d7b1423351820a3a4608be67f4f58ac742c4cc9d34225435645d77e65e48207b8005438a7bf1823587d533b2a7cd
TLSH
T1BCE0CA03930860BFC47C033040C346352BB3803013E30A0B482412BA29223012F31EC2
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 4786d3d11ed57c42d1d0a1e9d42be60290060126a12a188e36cf4c93b0f24750
MD5 3b3e8a7eed5b586a6a49dce16f05dcf3
SHA1 7b401e5eae78bf72e57c61f21c59c3fff3a54966
SHA512 ffd94df6120aa6628bf172d89d3461eac7c0c31eab5a2fc7e9e6f9632e8a65213b995b0d6f4cfb7da2c66a7ef0811f392a7ab6caf218bdfd21b4ad530ce9a472
TLSH
T128E0094AE70494BFD53C4B3410C39B357BF2D1214BF316876A2112B96E9A7816F30EE0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 2ab52062253a4c93f6ea40f5b64bbbd8fb0bd70bc1201f19328bddefac2c673a
MD5 55263a06db4f95ddcd306f2b6d6c44e0
SHA1 979b2d6fcf777ca1511134e127c743f016bf9689
SHA512 09c34d2369ae7194d545178efb8d2a0fbd5439a434196eee3e1c13ed2c4fce8e3c2d6b7c5aadd58c5f75f21e522917d2228704ff2fbf855bf2525a0d13c053e5
TLSH
T1DCE0EA07931461BFD57C473044D356796BB7902157E30A4B581412BA29623012F35E82
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 4ba330c1ad74a46f89a4da690fbc283166c0a28125214629f1f7951ceccf5a9c
MD5 baf6775761d9f3a1d6d5c3f03b3e2bec
SHA1 3e4e5c85757dbc0f8b6f6b92578dc3e8be7c331c
SHA512 816f7440ddf2b87f3a34200422a1456699d8b7d3ae2e713dd35b4e85bbc5b0e5dc07867c8c715f0385d6143842d6d3cdab59008476c4c1f5eaff6ac8e7b98efc
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 2f57cbedb58922b3318224dec9bf149b9a24e1c5a69d3816f88c92f32bb85077
MD5 d75cad1bf6c2f9ae75968e59ec11b8cb
SHA1 a4fe09ef72cf71cee370b0fe90a8830a3bf72aae
SHA512 b47c4a0e0036930d2bf41f948ed262c8235d4e685ad06120cdf8550be7102c2b3ee79c6c909d10f8308fa1ccb8457b1284778397a2aebd9c8bd77d59115cf682
TLSH
T198E09212930595BEC47C033140D34A743AA3A12157E3460B5924167E39523452E34AC2
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 35dfb4756b78dadc1a0dcf10591fffea84174ec50ab424d03c077ed27eeb1ce2
MD5 dcd559f283f45c568a9895855425b631
SHA1 9f5dcebdc71c37a405c27107527740254f956591
SHA512 37800f84baa87e4af07dd358da5ebbb0f515b5307509393932f1f33794ecea98156772e208eee0a9497ebfd189edb501819a7be6147b0148c5157a016ed3c0e6
TLSH
T144E00942A70454BFC53C4B3000C39A357BF290200BF316866A2112B95EA67812F30ED0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 92af12f14c32ea6fc8c28b8c6cd45a4d1ebf8a39704ae8fa5f6a1ca01c6df9e8
MD5 8ad4651dcbd1f85100c2336972daab6e
SHA1 155d1ed111062e308119242cea4e9a803707a3ac
SHA512 a5aa6e81bc0e1a06e75e8d3fbf06d87a956f9bc82d7a4787f544b5e47779de44d27d1c855b612039b580e715862c63eecc78360d324220f18da0a1b5a88f3588
TLSH
T133E0CA03930860BFC87C033040D349793BF3803013F34A0A492422BE29123412F31EC2
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 de9d30b8c1163e9cefdb0c5589d0ed4635b8dee3bb231e49b4b7679281c06a28
MD5 c34ac769d6f45b6a0e69d7b839c72319
SHA1 3ee9f59ab8f668c4f40baaf5d6dd4a16173ac1fe
SHA512 d6e9d03665ad3b7a98d1bdaf3cc59ee05dde23177e64b28010f2863a8b242485a40a1ce1d60c9176bf723490c5dbfb529d3832f8410021b36989c6a32e97f971
TLSH
T1A4E095029305A5BFC8BC033040D34A793BA3902012E3460A492426BE2A523892F35AC2
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 352d4b61beb144349ef422697327a21a7f9247689f483b9afb2b1371ae27138b
MD5 81c757b49d95ad7ff0f81653e2a2ac99
SHA1 67998d6681681d703e0e6d74505295075132bffe
SHA512 5a7ef8fd2ae4b209e5ea57ba2b4b87c7fcc612632f8358feca93c1af0b7031513abe50b4b6f5dc7826fe033267a302d0d09545f1b54c300c03c8770aaad49425
TLSH
T162E09213A30895BEC4BC033440D34A747FA3A12067F3528B6A246A7A2D623492F34AC1
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 567c24de4094ce26e5f984f37adc613f2fb8216230fafb83a7752766a181dc1e
MD5 68b46e90fe2f9d79946b6337ac9af131
SHA1 bc1ed8f878edc6e979406b1042ae1ca5f75fdc8c
SHA512 be428a61607da2a062e97a7927d204df762a1033b883c8b2aba295324585ab6f1c344c5d3e18b4c717894544779ed7a24a05fdc41d78184c0f048e1ce6a44b91
TLSH
T1F2E00107C304A4BFC53C0B3000C35B317BF2902587F30A8B1A2402BD39A63006F30E80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 26bd315a9aff64475a925a36a6548c380f2b90b548a53b634cb3105b8626b85d
MD5 e9a9e78f5f040bec8bd18cea0c88a647
SHA1 38bc7643e0180fb1b1f04a7ab37c9365351b1f31
SHA512 38441f6822380419c01088db8dad8b7a44fe33984d4db67c9655986bc3883529c2d38b9e6fff24cbbfc67b9f8d0775ff5cddb458fa8d7e2b8c2c88adb72b6219
TLSH
T10BE0EC07C308A4BFD53C073040D39A356BF2902587A30A8B1A2402B929A63016F31E91
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 bcd6f6b9b3f8b30b88488440ed2fe018b7a64a9ca8bb841b3dec45a16b72b077
MD5 444735a931c59e17c12b19d3af726646
SHA1 2c3cb0ce67db327fbc8e151760b6821d7d8c98af
SHA512 1a6741e2772be943ce3b12b4ffc605a444fdbc7dbb9977fdd2c74fc64d0cbd1da0902dd43c7178d507c5dac3bdd9cc8e079ba2d1b77f5b864689b3384bc5d932
TLSH
T118E05213A30490BEC4BC033440D38A303F93902067F3428B2B242ABA3D623093E34AC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 5198cfa7857c6e758f3396b14a4350526020c474ad950bb27c535c4ac945cf59
MD5 fa7e1ecf75a53aa6f9027ab2df76b56d
SHA1 88112042059e97ed0c52b2d94ea492e00d6e04d2
SHA512 f6e33b7a2299ff0a1ec469115d462d0f76d1e122f1a952abef3cbfa289aef60f5ebf0984add1475e31177654e0e104b7778cebf6e623acbe7eee1446f995cb19
TLSH
T128E00912970400BFC43C4B3000C31A347BF2902013F316866A2012B92E163812F30EC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 1ac74abaea4f232530235a508b73c24914c5f8ed25004dee12af739db5a75a5f
MD5 c579a4b4a96a01e77a8a2cd97918c80e
SHA1 3ac1288ad6cd167761ae69a45fec8bcde71cf838
SHA512 8df88d551569501efdd78882b0430d867e380b78c03d94a1d5717d681b029afb4965ad227932ffbcf478afc2a7589796645a1d18d8fff247e2d5832c6ad4b59e
TLSH
T149E04806D30450BBC43C0B3000C357303BF2D02047F302831A1002782D863401F30ED0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 0673b0cdb2ad37df703c117bf2f660c627e4c409438ca064628fb6a96c2084b3
MD5 1b0fe72311b08b74afa0529e634e5045
SHA1 b373ae68df9602f8b4099948e8e59f822e333820
SHA512 674fb804f3d59b8c13e27fcd519cd6730b96f9fc8978ef67c384b625c771f579eb9819c310da8daac4210048445c8eb50fe5f4fc5577c562e763baa8cb6cdbed
TLSH
T12EE09512930195BAC8BC033040D34A783BA3A02126E3060A5A242ABE3A623892E35AC2
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 217d22f5870a1b0849f69c518afea5ee1b0d23ca140030ccedf0f6d29f7dff0a
MD5 4deaaba8c3a6deac5628af444006d204
SHA1 220de59b281fbddab37e02faf9ea65b08fc501aa
SHA512 77b0f6040cf8b02ade9a595f6c32f3681d7d623184abbdb9ac9b4a1fb31594113f91b43a46a9c0f1c7dfe87c934a6a4ee29c4a8f164dd646c8264cb48df07504
TLSH
T1BAE00106C30464BBC53C0B3000C357312BF2902087F30686162002792DA63406F30EC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 6673fd96afcfd8e36d8152ac7b47661016e49d66a5c92db1b27b2ff217899514
MD5 dc9c4f327a80593d440d7b430e07c74f
SHA1 f67241f7d090972ef0e94b4ba95fb9b14886c8b9
SHA512 dca685e87cbd4c14e5dd55a3c34ad8ab7aa4674197f7d5b9c6cb5046596d644e9ebc7ea42a9c9bff4a8e7ff2dac8d16d817503be816230e6ddf6bcd3151ee49f
TLSH
T1C5E001079308A2BFD97C073044D356397FF3E03167E30A9B592412BE2A623022F35E82
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 17f2dd5a2e733f7e35ff389995976de13b00c7334827f99c182e1ed4bf888d19
MD5 da960e7e0a116e791b2a40ffbc20c02d
SHA1 c92095b0231acd8baac4e9f2105c6447ede913d6
SHA512 165154bf2c8287aa039a03fa985e0ff1663386932541baf2ff66003b021f3231d648230ce7e15b21db1463d1ad6145347384fdcc7cc77b05d0ace94e79ee1ca0
TLSH
T1B1E0C913A30595BEC47C033440D34A747FA3E12057F3064B5A24667E39523493F34AC1
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5a593d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5a593d.TMP
Size 392B
SHA256 daea6c18466e39b4ac2094a39304394e78dec01206e6a192c7d47d38fc9b0817
MD5 939c027df24d443ab047501f8067f7f3
SHA1 602d8fd977e0ebeb7168952da18e4aa14befb103
SHA512 4f8d7f204b65c846d6addae39dd27b723f8b2aa62c9854dce4645e6379ae0baead6b77b79812e2db4d466f7d7d025b48a38bef7cbde396b2d2c4aa3afd65fd07
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 9fb67212c8d86125f0c94498aacf0f20821354ee3d03a0e114e5c46587a59c4c
MD5 1e21f924e7b00cb8559ed5e1197dbe12
SHA1 7eabd14180e23c963b722ef6600f25e618badf4a
SHA512 e570cd20d4a9b640ed1467b60f24ba28615552a9074bb4e94b82b8a8f28de23f040ce7b259b5bb7376d5d06c861e96b2171b99e4ab6d7e7414b3175a31b2088c
TLSH
T1EA21FEE11D3A0EC6C5BD0EAFA0832AEC54E8A616B8D83074188CFD58913E41E2051C7F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 612B
SHA256 918167fab0fb4435546513252415c1a2e44b6e8e60caf6f31d07587ba0a71ab0
MD5 5ca920f0e1c81dfb329b916e242a4065
SHA1 1d068ad79883fd23c27647c98e761858e46f48cd
SHA512 2b99239123f922883dea3137835bb8b74713799981e5aa1434ea70db85e7666f2372db684f94bb599ecff70c8c31d02286b0587ffe620333eb1d4bbc7feb84b8
TLSH
T11DF002D04C3E19C3D5B90E6EA40717EC50D45517B0D8383804CDE894D07A05E315183E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 972B
SHA256 f837a0be79824b3ec6f3abca5350dfc7c56fc8e114e0bd4f52c3f8136da186e6
MD5 2028f83487553bbb26a0fd35240568f1
SHA1 69311c7b88dbc2d714c63ffb128c45a77993a372
SHA512 95490eb641e7973f170d67b9ed8606a774fc9049b1eebba2eaed7a32b1d591f4a427c7054aa4f769a5d2d728dc5b311b3f09f16cb3c757d551de6ba9e2a7f2bb
TLSH
T1221110D14C3A1AC7C6BE0EAEA0872BEC04D86613B4983074188CF958903941E3451C3E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 852B
SHA256 cc631188ae4a22c0621e596be3d4335218373ee3aafe98bb7b213069a0dc3b70
MD5 1a8162cc03c34509f59ea81728419884
SHA1 459f726ff17ed37a212bf5291cc592b4745c3c06
SHA512 129393fb77432dda8e2c4181dc778f609f56572e69213f9f8cffc544b845119929242d41078170b2dc72a678116df340544edb181c2aff069f8cd4ac2a541083
TLSH
T1E8011ED14C7E1AC7CABE0EAEA0872BEC44D86522B098347818CCF864917940E3451C3E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 732B
SHA256 cf5e5467ab3de71fcb419acbbb754c3effd5e787864ffa7c767f24ff9bbe5ae3
MD5 87299a8105078d6252386ba9d333ff05
SHA1 c43e027b4174d2ae2c7f138de07b18ac0407148a
SHA512 f6678cce079ae97838bf5aebf3c195a2c82d27dd6546fd7e5428396130ca4bd2c809f2d2edca4f130da479624c3418beffe998ae1a032451706b9a47bad62885
TLSH
T1670110D14C3E1AC3C6B90EAFE04717EC40C89512B0D8387818CDF8A4917A41E345182E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 5c31842e1664b35fa3a50acd71fb36d96fa20f2ea288b8cd56a946618bd5815c
MD5 6cd9e80afd2cfb003133ab8ba52d8f8e
SHA1 55176120c51d857711f8ce144b9e263ee8f9712f
SHA512 a1038323843eadbcabe5fcbe34b80c98df3e538b4caade8865fdcfb3303ff5cf2d86299c7e28e448241a172d8df8e3ec4e400fb6f7d10d2beb32bce06a1d7f85
TLSH
T11811EFE15D391EC6C6BE0EAEA4873BED44E8A616B8E87078188CE958913951E2051C7F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 cf404f57ae1cd10fc2d112c68e9243f163cdc859ab2c645341f98a4fea67c9ab
MD5 b71e0902fa37e797e75cd9ae37891e41
SHA1 9915a40d83ec4f7d955ff1097bbde76edf972bd3
SHA512 3abe7f3cb00ee13203c18fe3497199f55f5d73b1d5bb250af8266ac6f6ec245061230f754dd275cfbad5dd02fb9644bc0eef06ad6c083edfc3ec82a925cc7186
TLSH
T19221FDA15C3D1AC6C1BD0DAFB0872AEC50E8A612F8D83478289CFD68913E52E2150C7F
MD5 SHA1 SHA512 TLSH

Submit Download

99a483b9-b03f-4e22-ad71-fd0bd217fc14.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\99a483b9-b03f-4e22-ad71-fd0bd217fc14.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\c
Size 20KB
SHA256 ac4fa2b814601bf7914ee0dde1059c77a70de66693a758240c182d6c45a4d946
MD5 6a99fa18d6921277de7ab5af3d4649a0
SHA1 86a1871b49524dc75466474a89c6893a2cc82d7e
SHA512 94a84915a35fa4c27c7f21eca7fc47635928fa31e5664bb67115be3925e302ec67bd8e9dccc456c0b32deadb0718cbbfd8bccafe1c230c7aab2b9ed87504f19c
SSDEEP 384:H4cLaygZdhcElcsN0L0Phtstp3KVVOMqn6W2MG8h:YyayOcElc6ZMp3Ki6WnZ
TLSH
T1DD927C339567AAD75BFC5880E62D2D467D5C2B4B0180D39BAA8C48A7B4EC970477C83D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\c
Size 4KB
SHA256 7b1cd67ed6f2342dad21a714301fa825000d61f6a1227673590de379103bb669
MD5 9b5fbc1a14b08bfa2b62e7704445ae86
SHA1 ab05ecd17ce8fff1b0a6fd08fa25153cf49508e1
SHA512 02d8faa4783e083547ef5549b3b2da97c59354da9d80a7135b5d63c4d57389661e38f4a50544a51eeb8cbaeac75bf1c769756f6adb1401b99e210b1bdde87d37
SSDEEP 48:LrQ7gCf2iNCt2YvuKSPLcK8Ced34SWcXtYr2UjIu7lX6zErHCXPY92fFGF:LrQMu2iNsj2TcLhdoRctjzwKKEQF
TLSH
T1E691CA3214076ECF1BB97D98E02C1C14BD9D175BD2D4E509A9CD0863B99D630B7AEC78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

installer.exe

Path C:\Users\Admin\AppData\Local\Temp\installer.exe
Size 14KB
SHA256 a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d
MD5 19dbec50735b5f2a72d4199c4e184960
SHA1 6fed7732f7cb6f59743795b2ab154a3676f4c822
SHA512 aa8a6bbb1ec516d5d5acf8be6863a4c6c5d754cee12b3d374c3a6acb393376806edc422f0ffb661c210e5b9485da88521e4a0956a4b7b08a5467cfaacd90591d
SSDEEP 192:sIvxdXSQeWSg9JJS/lcIEiwqZKBkDFR43xWTM3LHn8f26gyr6yfFCj3r:sMVSaSEglcIqq3agmLc+6gyWqFCj
TLSH
T180624BCFBE204417D8F0C57530659234DFBACABA1B968EDF9CF91E529AC4C072823265
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3248_1932325058\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3248_28089450\LICENSE
Size 1KB
SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
MD5 ee002cb9e51bb8dfa89640a406a1090a
SHA1 49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2
SHA512 d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c
TLSH
T17D31535723840B9306DA2B4566AEBDC4B0DDC02D7F27AE05186EF394537B52ED8B3443
MD5 SHA1 SHA512 TLSH

Submit Download

note.txt

Path C:\note.txt
Size 218B
SHA256 8e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270
MD5 afa6955439b8d516721231029fb9ca1b
SHA1 087a043cc123c0c0df2ffadcf8e71e3ac86bbae9
SHA512 5da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf
TLSH
T1C3D0A719040784251C7052D17145A5A09B70562D77F626EB74DC690C212700F0B37C9A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/6448-1280-0x0000000006AC0000-0x0000000006AC1000-memory.dmp

Download

memory/6448-1267-0x0000000006AC0000-0x0000000006AC1000-memory.dmp

Download

memory/6448-1260-0x0000000006AC0000-0x0000000006AC1000-memory.dmp

Download

memory/6448-1281-0x0000000006AC0000-0x0000000006AC1000-memory.dmp

Download

memory/6448-1272-0x0000000006AC0000-0x0000000006AC1000-memory.dmp

Download

memory/6448-1274-0x0000000006AC0000-0x0000000006AC1000-memory.dmp

Download

memory/6448-1266-0x0000000006AC0000-0x0000000006AC1000-memory.dmp

Download

memory/6448-1279-0x0000000006AC0000-0x0000000006AC1000-memory.dmp

Download

memory/6448-1268-0x0000000006AC0000-0x0000000006AC1000-memory.dmp

Download

memory/6448-1270-0x0000000006AC0000-0x0000000006AC1000-memory.dmp

Download

memory/6448-1278-0x0000000006AC0000-0x0000000006AC1000-memory.dmp

Download

memory/6448-1262-0x0000000006AC0000-0x0000000006AC1000-memory.dmp

Download

memory/6448-1269-0x0000000006AC0000-0x0000000006AC1000-memory.dmp

Download

memory/6448-1271-0x0000000006AC0000-0x0000000006AC1000-memory.dmp

Download