133758e8668c62b76a3bb316679387038e3e57b3e4c4becf3bafe12f82bf7bdf

Analysis

max time kernel
900s
max time network
901s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 19:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0d65305fae28a387b40b3a456e61e5f6aa2d415b.exe
Size 796KB
Sample260925-x4gmsavdpb
SHA256 133758e8668c62b76a3bb316679387038e3e57b3e4c4becf3bafe12f82bf7bdf
MD5 d75f1257f8583af7121240890ab2d72f
SHA1 0d65305fae28a387b40b3a456e61e5f6aa2d415b
SHA512 27b79173e22b58fbb1d8c11dbecef1c1c53cd3a20b9b5b94689d31f080a07865edbf41c768be606def8dfc24b127287602d57471a02b5179e4b0b9f3e8a9e741
SSDEEP 12288:hDVL+7JSjDPQ9khNcp3IjE/Y5C9+Xy34lYhOsfzGP3K:+7WIAcpYjgY492y3wMO06P3K
TLSH
T1CB059E906BF84019E7BF5F76B4B248168B75F903A8B9E7AE4794509E2CE13038D24377
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5860_1891253421\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5860_1671926787\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5860_1671926787\Mu\Cryptomining	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5860_1671926787\Sigma\Entities	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5860_523682363\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5860_1349523937\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5860_1465434401\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5860_1109112296\safety_tips.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5860_1109112296\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5860_457015494\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5860_1671926787\Mu\Social	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5860_1497430927\automation.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5860_52450563\autofill_bypass_cache_forms.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5860_2136385211\crs.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5860_2136385211\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5860_1349523937\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5860_1497430927\extraction.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5860_52450563\regex_patterns.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5860_437186355\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5860_916309207\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5860_1109112296\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5860_1671926787\Mu\Entities	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5860_1671926787\Mu\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5860_1671926787\Sigma\Social	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5860_1497430927\travel-facilitated-booking-kayak.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5860_453085994\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5860_52450563\edge_autofill_global_block_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5860_1671926787\Mu\CompatExceptions	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5860_52450563\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5860_1671926787\Mu\Content	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5860_1671926787\Sigma\Cryptomining	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5860_1671926787\Sigma\Staging	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5860_625226352\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5860_608955964\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5860_461503391\deny_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5860_457015494\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5860_388843781\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5860_916309207\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5860_1465434401\arbitration_metadata.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5860_1671926787\Sigma\Fingerprinting	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5860_523682363\well_known_domains.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5860_1497430927\classification.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5860_52450563\v1FieldTypes.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5860_1760243031\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5860_1671926787\Mu\Analytics	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5860_1671926787\Sigma\Analytics	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5860_1671926787\Sigma\Other	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5860_1349523937\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5860_1349523937\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5860_1497430927\travel-facilitated-booking-bing.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5860_461503391\deny_full_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5860_1671926787\Mu\Advertising	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5860_1671926787\Mu\Other	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5860_1671926787\Sigma\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5860_1671926787\Mu\Fingerprinting	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5860_1671926787\Sigma\Content	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5860_2136385211\kp_pinslist.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5860_625226352\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5860_916309207\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5860_1109112296\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5860_1671926787\Sigma\Advertising	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5860_2136385211\ct_config.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5860_608955964\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5860_1497430927\manifest.json	msedge.exe

Loads dropped DLL 2 IoCs

pid	Process
5860	msedge.exe
5860	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	0d65305fae28a387b40b3a456e61e5f6aa2d415b.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	0d65305fae28a387b40b3a456e61e5f6aa2d415b.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3132	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1704430598-3087477806-3297458608-1000\{A8630141-1E80-4025-B80A-F59567545EB6}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2432	msedge.exe
2432	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
5860	msedge.exe
5860	msedge.exe
5860	msedge.exe
5860	msedge.exe
5860	msedge.exe
5860	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4116	0d65305fae28a387b40b3a456e61e5f6aa2d415b.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5860	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4116 wrote to memory of 5860	4116	0d65305fae28a387b40b3a456e61e5f6aa2d415b.exe	89
PID 5860 wrote to memory of 4188	5860	msedge.exe	90
PID 5860 wrote to memory of 6068	5860	msedge.exe	91
PID 5860 wrote to memory of 3132	5860	msedge.exe	93
PID 5860 wrote to memory of 6068	5860	msedge.exe	91
PID 5860 wrote to memory of 6068	5860	msedge.exe	91
PID 5860 wrote to memory of 5748	5860	msedge.exe	94
PID 5860 wrote to memory of 5748	5860	msedge.exe	94
PID 5860 wrote to memory of 2624	5860	msedge.exe	95
PID 5860 wrote to memory of 2624	5860	msedge.exe	95
PID 5860 wrote to memory of 2624	5860	msedge.exe	95
PID 5860 wrote to memory of 4680	5860	msedge.exe	96
PID 5860 wrote to memory of 4680	5860	msedge.exe	96
PID 5860 wrote to memory of 4680	5860	msedge.exe	96
PID 5860 wrote to memory of 2440	5860	msedge.exe	97
PID 5860 wrote to memory of 5524	5860	msedge.exe	98
PID 5860 wrote to memory of 2440	5860	msedge.exe	97
PID 5860 wrote to memory of 2440	5860	msedge.exe	97
PID 5860 wrote to memory of 5524	5860	msedge.exe	98
PID 5860 wrote to memory of 5524	5860	msedge.exe	98
PID 5860 wrote to memory of 5500	5860	msedge.exe	100
PID 5860 wrote to memory of 5500	5860	msedge.exe	100
PID 5860 wrote to memory of 2104	5860	msedge.exe	101
PID 5860 wrote to memory of 1064	5860	msedge.exe	102
PID 5860 wrote to memory of 2104	5860	msedge.exe	101
PID 5860 wrote to memory of 1064	5860	msedge.exe	102
PID 5860 wrote to memory of 4516	5860	msedge.exe	103
PID 5860 wrote to memory of 4516	5860	msedge.exe	103
PID 5860 wrote to memory of 4516	5860	msedge.exe	103
PID 5860 wrote to memory of 3348	5860	msedge.exe	105
PID 5860 wrote to memory of 4272	5860	msedge.exe	108
PID 5860 wrote to memory of 4272	5860	msedge.exe	108
PID 5860 wrote to memory of 1716	5860	msedge.exe	109
PID 5860 wrote to memory of 1716	5860	msedge.exe	109
PID 5860 wrote to memory of 4408	5860	msedge.exe	111
PID 5860 wrote to memory of 2100	5860	msedge.exe	112
PID 5860 wrote to memory of 564	5860	msedge.exe	113
PID 5860 wrote to memory of 3128	5860	msedge.exe	114
PID 5860 wrote to memory of 3128	5860	msedge.exe	114
PID 5860 wrote to memory of 5040	5860	msedge.exe	118
PID 5860 wrote to memory of 5040	5860	msedge.exe	118
PID 5860 wrote to memory of 3264	5860	msedge.exe	119
PID 5860 wrote to memory of 3264	5860	msedge.exe	119
PID 5860 wrote to memory of 2888	5860	msedge.exe	120
PID 5860 wrote to memory of 2888	5860	msedge.exe	120
PID 5860 wrote to memory of 2432	5860	msedge.exe	121
PID 5860 wrote to memory of 1308	5860	msedge.exe	122
PID 5860 wrote to memory of 1308	5860	msedge.exe	122
PID 5860 wrote to memory of 2532	5860	msedge.exe	123
PID 5860 wrote to memory of 2532	5860	msedge.exe	123
PID 5860 wrote to memory of 2516	5860	msedge.exe	124
PID 5860 wrote to memory of 2516	5860	msedge.exe	124
PID 5860 wrote to memory of 5132	5860	msedge.exe	126
PID 5860 wrote to memory of 4852	5860	msedge.exe	125
PID 5860 wrote to memory of 5132	5860	msedge.exe	126
PID 5860 wrote to memory of 4852	5860	msedge.exe	125
PID 5860 wrote to memory of 5784	5860	msedge.exe	127
PID 5860 wrote to memory of 5784	5860	msedge.exe	127
PID 5860 wrote to memory of 3236	5860	msedge.exe	128
PID 5860 wrote to memory of 3236	5860	msedge.exe	128
PID 5860 wrote to memory of 2664	5860	msedge.exe	129
PID 5860 wrote to memory of 2664	5860	msedge.exe	129
PID 5860 wrote to memory of 5460	5860	msedge.exe	130
PID 5860 wrote to memory of 5460	5860	msedge.exe	130

C:\Users\Admin\AppData\Local\Temp\0d65305fae28a387b40b3a456e61e5f6aa2d415b.exe
"C:\Users\Admin\AppData\Local\Temp\0d65305fae28a387b40b3a456e61e5f6aa2d415b.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://apps.microsoft.com/store/detail/9NQXWX0MHS3B?ocid=&referrer=psi
  2⤵
  - Drops file in Windows directory
  - Loads dropped DLL
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ffb7b20c188,0x7ffb7b20c194,0x7ffb7b20c1a0
    3⤵
    PID:4188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1536,i,14869249433748442595,6104270386342766202,262144 --field-trial-handle=2156,i,2902814402218759855,13262660040522791013,262144 --variations-seed-version --mojo-platform-channel-handle=2160 /prefetch:2
    3⤵
    PID:6068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1824,i,7041778701477767100,3426968312450194277,524288 --field-trial-handle=2156,i,2902814402218759855,13262660040522791013,262144 --variations-seed-version --mojo-platform-channel-handle=2104 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2404,i,10447689256276371827,1407007304123541954,524288 --field-trial-handle=2156,i,2902814402218759855,13262660040522791013,262144 --variations-seed-version --mojo-platform-channel-handle=3164 /prefetch:13
    3⤵
    PID:5748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3500,i,8772604182294512424,5858665120764352073,2097152 --field-trial-handle=2156,i,2902814402218759855,13262660040522791013,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
    3⤵
    PID:2624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3504,i,6876391332021719401,12009082017610481236,2097152 --field-trial-handle=2156,i,2902814402218759855,13262660040522791013,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
    3⤵
    PID:4680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4196,i,17034856166722850104,3895268130292019916,2097152 --field-trial-handle=2156,i,2902814402218759855,13262660040522791013,262144 --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:1
    3⤵
    PID:2440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4208,i,10551719126652326347,11273396943104441246,2097152 --field-trial-handle=2156,i,2902814402218759855,13262660040522791013,262144 --variations-seed-version --mojo-platform-channel-handle=4876 /prefetch:9
    3⤵
    PID:5524
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5264,i,11644971577591999300,17088799209000911125,524288 --field-trial-handle=2156,i,2902814402218759855,13262660040522791013,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:14
    3⤵
    PID:5500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5504,i,14846166026092563232,8160716029533123540,524288 --field-trial-handle=2156,i,2902814402218759855,13262660040522791013,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:14
    3⤵
    PID:2104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5500,i,13051092780034155888,12701307697793907351,524288 --field-trial-handle=2156,i,2902814402218759855,13262660040522791013,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:14
    3⤵
    PID:1064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5868,i,6085134725513916425,12106713256105576702,2097152 --field-trial-handle=2156,i,2902814402218759855,13262660040522791013,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:1
    3⤵
    PID:4516
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6264,i,14279766908519260138,4365644446101905803,524288 --field-trial-handle=2156,i,2902814402218759855,13262660040522791013,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:14
    3⤵
    PID:6044
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6264,i,14279766908519260138,4365644446101905803,524288 --field-trial-handle=2156,i,2902814402218759855,13262660040522791013,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:14
    3⤵
    PID:3348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6568,i,1697042284098085158,1529400220834035620,524288 --field-trial-handle=2156,i,2902814402218759855,13262660040522791013,262144 --variations-seed-version --mojo-platform-channel-handle=4836 /prefetch:14
    3⤵
    PID:4272
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6932,i,11117608975159323878,11629584430999107708,524288 --field-trial-handle=2156,i,2902814402218759855,13262660040522791013,262144 --variations-seed-version --mojo-platform-channel-handle=6940 /prefetch:14
    3⤵
    PID:1716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7008,i,10615465840434043544,13828512269893591293,524288 --field-trial-handle=2156,i,2902814402218759855,13262660040522791013,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:14
    3⤵
    PID:4408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4944,i,11349743015484845546,16032692998539769472,524288 --field-trial-handle=2156,i,2902814402218759855,13262660040522791013,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:14
    3⤵
    PID:2100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4188,i,3910505393616960883,7204139352387619598,524288 --field-trial-handle=2156,i,2902814402218759855,13262660040522791013,262144 --variations-seed-version --mojo-platform-channel-handle=4876 /prefetch:14
    3⤵
    PID:564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5688,i,13037778532473167773,12135309330976561921,524288 --field-trial-handle=2156,i,2902814402218759855,13262660040522791013,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:14
    3⤵
    PID:3128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,4894882615824999530,160541894429320739,524288 --field-trial-handle=2156,i,2902814402218759855,13262660040522791013,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:14
    3⤵
    PID:5040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4184,i,4533709153603982956,666261734262071347,524288 --field-trial-handle=2156,i,2902814402218759855,13262660040522791013,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:14
    3⤵
    PID:3264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,11367374117918680936,9283835426331564473,524288 --field-trial-handle=2156,i,2902814402218759855,13262660040522791013,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:14
    3⤵
    PID:2888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5332,i,10926160615858078128,12904123212350600217,262144 --field-trial-handle=2156,i,2902814402218759855,13262660040522791013,262144 --variations-seed-version --mojo-platform-channel-handle=7080 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5684,i,3717163217224379285,2422945379171916718,524288 --field-trial-handle=2156,i,2902814402218759855,13262660040522791013,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:14
    3⤵
    PID:1308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6740,i,4952103381695090945,10877860294501676232,524288 --field-trial-handle=2156,i,2902814402218759855,13262660040522791013,262144 --variations-seed-version --mojo-platform-channel-handle=6736 /prefetch:14
    3⤵
    PID:2532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3604,i,8803038285309375378,9818249807676490840,524288 --field-trial-handle=2156,i,2902814402218759855,13262660040522791013,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:14
    3⤵
    PID:2516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5296,i,3772388271899478340,11833914516768647464,524288 --field-trial-handle=2156,i,2902814402218759855,13262660040522791013,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:14
    3⤵
    PID:4852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6104,i,11838955235638682621,16224156825572930478,524288 --field-trial-handle=2156,i,2902814402218759855,13262660040522791013,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:14
    3⤵
    PID:5132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6156,i,4285919364675912335,13499415167537119623,524288 --field-trial-handle=2156,i,2902814402218759855,13262660040522791013,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:14
    3⤵
    PID:5784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5580,i,16762595015707048759,13107582337127652274,524288 --field-trial-handle=2156,i,2902814402218759855,13262660040522791013,262144 --variations-seed-version --mojo-platform-channel-handle=1216 /prefetch:14
    3⤵
    PID:3236
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5580,i,11071420412414591754,17689292373424588253,524288 --field-trial-handle=2156,i,2902814402218759855,13262660040522791013,262144 --variations-seed-version --mojo-platform-channel-handle=4184 /prefetch:14
    3⤵
    PID:2664
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3676,i,9698889151049493018,16456877631279264842,524288 --field-trial-handle=2156,i,2902814402218759855,13262660040522791013,262144 --variations-seed-version --mojo-platform-channel-handle=6868 /prefetch:14
    3⤵
    PID:5460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6332,i,12371976865136703151,5868005412942583773,524288 --field-trial-handle=2156,i,2902814402218759855,13262660040522791013,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:14
    3⤵
    PID:912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6816,i,9096132126670153814,4930396599472317776,524288 --field-trial-handle=2156,i,2902814402218759855,13262660040522791013,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:14
    3⤵
    PID:1248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6332,i,6903636066919896584,5922599155140226811,524288 --field-trial-handle=2156,i,2902814402218759855,13262660040522791013,262144 --variations-seed-version --mojo-platform-channel-handle=4752 /prefetch:14
    3⤵
    PID:5648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6932,i,18376861503450283330,12583166176342455555,524288 --field-trial-handle=2156,i,2902814402218759855,13262660040522791013,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:14
    3⤵
    PID:5776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,18003756403139702196,21373127578218111,524288 --field-trial-handle=2156,i,2902814402218759855,13262660040522791013,262144 --variations-seed-version --mojo-platform-channel-handle=6840 /prefetch:14
    3⤵
    PID:2524
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5820,i,6090059480379251274,9741027405638872826,524288 --field-trial-handle=2156,i,2902814402218759855,13262660040522791013,262144 --variations-seed-version --mojo-platform-channel-handle=6840 /prefetch:14
    3⤵
    PID:3344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5720,i,16421386134965650722,3451512905396668253,524288 --field-trial-handle=2156,i,2902814402218759855,13262660040522791013,262144 --variations-seed-version --mojo-platform-channel-handle=6840 /prefetch:14
    3⤵
    PID:3888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7084,i,7208848321006663223,6588914529688988671,524288 --field-trial-handle=2156,i,2902814402218759855,13262660040522791013,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:14
    3⤵
    PID:3512
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6800,i,13278667567765084588,16516636551733862751,524288 --field-trial-handle=2156,i,2902814402218759855,13262660040522791013,262144 --variations-seed-version --mojo-platform-channel-handle=7124 /prefetch:14
    3⤵
    PID:5524
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2932,i,6176504100217233613,16844639660845094053,524288 --field-trial-handle=2156,i,2902814402218759855,13262660040522791013,262144 --variations-seed-version --mojo-platform-channel-handle=6868 /prefetch:14
    3⤵
    PID:2520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6916,i,6087479501317205968,1320151376006377851,524288 --field-trial-handle=2156,i,2902814402218759855,13262660040522791013,262144 --variations-seed-version --mojo-platform-channel-handle=6880 /prefetch:14
    3⤵
    PID:1284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6992,i,16605886993381277486,908119352174898441,524288 --field-trial-handle=2156,i,2902814402218759855,13262660040522791013,262144 --variations-seed-version --mojo-platform-channel-handle=6848 /prefetch:14
    3⤵
    PID:3828

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5728

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3156

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1092

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:5708

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 68f353a62995fc87917d7d1eef768abe00ffab02e1d3e469100f99b6987f6488
MD5 5ba62d3fe2ddefdf87e8dd139f3e421b
SHA1 1986deda7bda2ac5b490eacb9fe2784fb6d01648
SHA512 4e6a767b24298d2e01c8dbefa41509e1bc67cf2c2f34fd0bf866fc1017e1d15a470a5a95feb8ee1cccf4b8ccf5fa9054bcbb93919c00de89eeffec199b68baf9
TLSH
T19CD02BB5DFFCCC62D54820B802518E116085B41519490040DA03FC04DD110814D03555
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 648887a89dac8888df245d8758dcd78e85ae79931c9464f19b0967fcd69c3d2f
MD5 b053e18c94ac6f6c60a9e0a281e1687b
SHA1 17ed2d8ae6844c2878132336a2fea7d044381f8b
SHA512 abf3d05979a55f573445c0c7a95529a5899c0d9f55f350b3eb35132d8502e23e6c764ffc98e92f4374754aa22e9292fd03f8e6e8113c0e919f428e797e339bfa
TLSH
T151D02BB9DFECCD62D54820B402508E116095B4156D490040D903BC04DD110814D03569
MD5 SHA1 SHA512 TLSH

Submit Download

799412af-85db-4481-a33c-f3f09a92b7fa.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\799412af-85db-4481-a33c-f3f09a92b7fa.tmp
Size 12KB
SHA256 26512ce2141099086dba3891991fd485a1a2cb6ce62108744fa242b0e542a696
MD5 c3c6ccb49cb5d2a8c683602916970b5f
SHA1 849d4f4aeadca928f344641007100074f4eb4c41
SHA512 16a7f5e74456704b0949cb9e470ed2261a0b413f1089e7f66a570cfdccb2439084b739e7a19fdb2cdca007a5ee631208f62e99c4d3d76aa4b1d575f099c7d04f
SSDEEP 192:sxR/RlC44/feBsDsZw9gn5zzoA8p9r/g6+WN/X4/lcvNcanXtiT4GZIgDzxJ:sxR/i44/feBsDSwin5ip/5w/Yn9iTp7
TLSH
T18E42955DAD24A97B8CCBE219BA55BF53D2F91033A0911E48A6FC9A1C04E76DD220381B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 99004fd3f1e35960471331dab4189e4ea062936695c67a5bb74bb3cca062230e
MD5 caf4cfaf52a7db50660f9095421969a2
SHA1 88fc162f00c057278ac80583cf6a9f8de1cb3542
SHA512 84d6a12070bdff675b7d29e123e85c1a05ec160fe2f5dd354af7ed84c655f5662c7eb37a7c6de96b1b4a86ce8ba4b81732e6444577a429ba0b9049b22e35b8ab
TLSH
T1C3E0268808CAC3BFA714684FC2684B4CC2813B0A92CC6ADA2B008C88F441194E7DAEF1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 cc6c616153d20d6f72358a847a566ab2f0ed6df208d03257e21843cc92447bc9
MD5 2371c3c223c8451362f4485432c9592c
SHA1 39507eb1f9ddf57cca2fd42c69f578a20566051a
SHA512 1c2cc8c4f39036fc48a46eec4097d3afa4005ed21ecc273b539a430ca97aa5f5c1c1d14d15604cf674196d9ccc50c8983af85227b2706a2ed7b9c346577a3da5
TLSH
T162E026AC04CDC32EBB10A48B417C470C9280370F93CC6AAA1704CC84B643544A786AB7
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 82712ad707509d7e6333a2b04fd0b297ead78371ff626c69c6d5bccea4904929
MD5 c72385e916d1ae75bf2f8dd00f36a430
SHA1 08647394f8f2134eb9383b0264ce438aad6d9876
SHA512 b1e091e32334302a46a007ce322a61f26c702815dc8fea8e33f52f11d1999368bad7b9aaf6cd9a009d064c4b65cdcd1121ab0f2846c4b8e3245d3d3a5f91fd72
TLSH
T19DE026C824C9D36EA714659782B8474DD680370BD6CCAE9E1700CC84B603840AE8AEB2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 f9a1f46ad4a9bc0e32f1eb4f427e941453d73794032d57769fb3557641f4ccfc
MD5 32a51126784e8e44986f057103c1782f
SHA1 b9d4b547623c259fc4c2e68426d1a6a97198a783
SHA512 8082dbbf1b1a219c7ca1967815f91415539cbff0d0b58f8f27ab730b2580a69b90f4f060bb51f560358b9f6d633ac9b902ae4cbc728f530a34122ad9adf93e39
TLSH
T165812150C26B6274FF58B232C0F5174B763485AC0E933EE0CB9BD0B6DA8F3A5818950D
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 53a659d15ad7d065bbc4b0d7994d5bb907aa5bf001dfeec671a650b599a24821
MD5 a79169393a7d42940c9668b9c9ebae09
SHA1 1a0568ed1a77b7684e4d69529bce9ef4ad4bb0ea
SHA512 82792891be6e97d8e3a7ddae99afd9c635c21e247297968879fe164e3414dc949b87cd8ab87a0dfdcc88ade92b019c29f32fd5798666a015a34037b335dcb463
TLSH
T1EB719CF783F4856E890195F0AA18AE2BDE2D0615432C7C5689E4EE27D3E3472E14165F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 204f7448859c07efd591b85df8526cfeaa371dd8a892354ab051e51dcd6a32b3
MD5 e9aa90c3f69a4deafdca747f17f9d8c4
SHA1 8db2b1a6a9acc7fafbb83ce8675b3a269099621a
SHA512 f47842b0fbd67235e82495ab5e6a88dcb9b9ab8c14c6e9e6ba1190b1adfba3777cc0aa3cc6be043c9016ea9aaebf8c3baaac93b27a02e0b88ddafb6ccafd05fe
TLSH
T1EE71BEF783B4856EDA0195F0AA18AE2FDF2C0515432C7C6989E4EE27D3E3472E14265B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 26KB
SHA256 bd2c4ec5112db9377aa19337411c1d2e28e7ee262aa1350ec5e17abcb16452d2
MD5 03631b2d44c299a3f8331ab8ab1393a9
SHA1 5485bde9882bb87a0fcbcb7d87bd22b1b15bb36b
SHA512 bc8063a9e3add15a4bec0bf1fba210ed3a20816f5520bd1a477dec1210acf78f3fa95600583c74a54a39f314044aff1d506e092dd5c33f0de838a77360e4428b
SSDEEP 384:sxR/i44/feBsj66s8qMpRiYnazAW8pZS15posJWeT+B5Swin5iX/5w/Yb9iTpZ:sjix/fe64Mnc7WeT+B55ing/5yYb9iTH
TLSH
T13CC20809A824C83B9EC36D18653DBE33DAEC506261C5DEDA56ECCA1C01DE1FDAB07857
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 f31d7a760bbbc08cbc4eb1351732c01f35fa7c225469f08aff9b237f2a93c2c7
MD5 a3ca87d9424dd2c2ccd3d6a5a65e7e05
SHA1 1d5844021c392d4718d59bb217ed363f0c4b76a4
SHA512 bbfcf5ee86481eace1e37b2ce600284aeda2be0478578b1ca710daa923206992247c724c6382982650c9218881d7f29f488efe20b817de9906466dd5e9b46d35
SSDEEP 192:sxR/RlC44/feBsusZw9gn5zzoA8p9r/g6+WN/X4/lcvNcabXtiT4GZIgDRxJ:sxR/i44/feBsuSwin5ip/5w/Yb9iTpZ
TLSH
T11742975DAD24A97B8CCBE21DBB55BF53D2F91033A0911F48A6FC8A1C04E76DD220381B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 bbe0d56ac6717f61289ab1df51a9bc8acc12115ea15792bd9b59e61fd0dd6fcb
MD5 f0031e9fecc32adbefd45baf0365fd7d
SHA1 09bda7a9274e07370285b1eaa98c4ad197559131
SHA512 8a6f7579164d5fdbeee0768716eb0a0e1700c0fdda170f094d344f94a3f5ac85ae3f787a18dce48b5bf0b0d4fae610cf858b7b458c2e20c20788ee12b541ccee
SSDEEP 192:sxR0RlC44/feBsnsZw9gn5zzoA8p9r/g6+WN/X4/lcvNcanXtiT4GZIgVxJ:sxR0i44/feBsnSwin5ip/5w/Yn9iTpp
TLSH
T11442965DAD24A97B8CCBE21DBA55BF53D2FD1033A0951E48A6FC9A1C04E76DD220381B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 0d805d3b10764343433f4844037998f509c20beb63effe19c5e672587015507b
MD5 438cba430610ac2abfbd437492a39006
SHA1 5487a92d119e5d3f82551841aa25297f480fc40d
SHA512 ca1e852d20a2d39793145f649c6d56368ae50ace3bc6f07783f977a447a17cd0eff037ca7d08a7f1037f8ca8646b31777c772f8133a999012d050bf4e132da93
SSDEEP 768:DFakj4yG7pLuLbs5Wg1Bf9t8F1+UoAYDCx9Tuqh0VfUC9xbog/OVfbJ97gEroMIo:DFakj4ymEbs5Wg1Bf9tu1jaAbJxgPMl1
TLSH
T1B4D2DA3B744CCB7E4F804A9DDC197E9A6DA802CB9598C94047F9981D03C6BEE521A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 370B
SHA256 4ddd22c696810bd5b694c26063ca69bddf5a70b090724f8a518376faffaf0380
MD5 6ff4ee623744bfca2fb0764da1f6105a
SHA1 c65bc920f501d4d8bc26f6bda19ec4b401667957
SHA512 6599a49da2604eb922af6c69f2b1ea160e5280a614fa981ddb5f36442ca4e201e260fdeecb337a337947d69259a855a1584b33f3b75ce54f61cb05b48b61b718
TLSH
T13CE0C0FA2CF62C20ED7F53E9243000A40041F429C544BE4FE026E2C374B1352201EC33
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\c4c000ab-b8ef-4b93-bd51-80c3928b95f2\index-dir\the-real-index
Size 4KB
SHA256 9eca5e728ad63a8c57b4d32c90e31abd2b1a15cf7598e9adbeb77069d34dfa23
MD5 a7a0a5258192df2f6995886fadfeec81
SHA1 d03aa44d57b037b93aa82d1d3db2daed8361ef6d
SHA512 b02c8ae29f8446695b46b2f166084073a921a7691ae1a4ea67f79996434dbab40eedcab06df33bb3c4235991c0e78516ea4b20b5d6531238d679320f2b9f5edb
SSDEEP 48:bK5FMnm5g8wg07703cm9MTB/nlxeBgd8iNr0weGg5DaH7Li1rFJQtjj7W503f4+c:bAF1V077TmABnBtwGgi7LgeFzfZIZWW5
TLSH
T12781DA007C9AFE38C7FA0533F4B859AE773567CD198E3A1A20FD65E56B832140D514A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5a02ef.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\c4c000ab-b8ef-4b93-bd51-80c3928b95f2\index-dir\the-real-index~RFe5a02ef.TMP
Size 48B
SHA256 2b8ddf5d839110610cafe07ba9f4cc7ae739d107022c10364131e433129f516a
MD5 f284a0e4e8f34bde8869cd5c88054c24
SHA1 e0369a2b50a89b3fad9c0b0e131c39ee286c5f62
SHA512 0c6534c6b7a78cad71829806b2db38fe1dec14a6e672bc2011f745cf242354e5a3ffbe1f8b82853d976ee105fb34c73fb7e477ba712a04047729f3b045390d6f
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\ea3c53e5-b5c3-459a-9281-6d46eb3616ca\index-dir\the-real-index
Size 72B
SHA256 aa7e09a52f9aeb7cfe38a1b6ef099922a8867c2cde708be761916062b5839d11
MD5 365d2322822f82abd55ce5a776bcf0c6
SHA1 6c0c4a39a489b08540081902a67be5404bf1a9ac
SHA512 db1e68309b6991475ed266550f96f819c3c656352b892b3990dd569e342af592690fc9d5960f7053a2a9a98a29830b7ca0e3dbb577ce3d1f3de7ed2d8910a98a
TLSH
T191A0025049459822E003C6B55075418E62158EDD0715430290E5018899915408292032
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59e8a1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\ea3c53e5-b5c3-459a-9281-6d46eb3616ca\index-dir\the-real-index~RFe59e8a1.TMP
Size 48B
SHA256 e010dedff4f557e308b6fce7831fdd2a52256ca8225d1eafcb3ac414f91e29e5
MD5 50a18c10ef23dd2bd6034d901c0a761b
SHA1 f7f05b093b021bb573fa310d7eb881d011f39a7b
SHA512 766d27cdbb9cc3d9253bd1466dcf66d05bc35da04da60608286b77f5ebca0a5fc2495dc8b7f6085bfb92a5b2a236eb5a5b04f0d741455075bdfc86db9c5e57f4
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\index.txt
Size 386B
SHA256 ad717987881a325f23d29c6a9f3f5ac1bd10b68ead2ac0a47a23bb50f7cc3d7c
MD5 4a71c2e88069be46f49b24197a13ae32
SHA1 9dfe3eeac4aa959efa11dc4483bcf2cb06fd2e3d
SHA512 cc22b53e99f9c68de3068e3983fda046d623c1dba68fb47171299deb015e4c3dcc8d41b7cb2d96b8cd5e477325628116dcc609af788c2b9b892ccc0a2941bd37
TLSH
T175E0685B62768221D7B115ED06A5F2ACD83F3E435E40DEB940C0B05208BF62A8563F07
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\index.txt
Size 383B
SHA256 e7e9aca4c19535288defbc1509d8a4f09123be4876666c49845da1e1c14b881d
MD5 6cf61b46b0a34fcd3f629f2275a4d74b
SHA1 51cf195634185418a808fd01a1c059ab5024dc6d
SHA512 0df8883e8e8e0fe52a22e232b91ea311c2a8bd2f27b91c4687c1d73150f0c23d0dadb0acae00e8cbe346119ec35816cb0de9df4a06092662f57ee673cf4d6370
TLSH
T165E0685A62778221DB7155FD1AE9F7A8C82F32439E40DEB940C0905708AFA2A8463F07
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe599a71.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\index.txt~RFe599a71.TMP
Size 195B
SHA256 1f4bc3302222301d3292aab0b79769181ad71c2c7494c178c14bf6db0a78400a
MD5 1d64df54432d81e47f5cb528f4c835e1
SHA1 9367cecb7aea58ea8fe66d0fddb913fdad414a5e
SHA512 b984f63e31501548aac85ca0b3c36aa8a3f2cd12aae45a2b262d9b8645aa4a9739b830dc8dce15740b7c3d9719a3cc04220f54845b2a8f1d9b5078f485100628
TLSH
T12FD0125E80328101CBE556E61D52F395D92B2D4359D1CCA99084B0415DBA36A4583A55
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 aa44c33db6a010192ef364daa08007a38782d2bb9f65cf49ad3a06a3f8e2750a
MD5 0c1db6b389b72889af0bfed442a962e7
SHA1 5d30d0a9c2084a5184ae27bc1b8e201b13e444b2
SHA512 0ad3b32d3cb1dbe1d12749ee7cbfea0e5b7983d01f16992391230bb2099201b31c374dbbf0778be6b4676922071609442c92915aacfa2d59752176091de05a5d
TLSH
T1E7A002904542630FD449D3F862455144B330DF1497112219C0E001A5C8D97504156101
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59e824.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59e824.TMP
Size 48B
SHA256 6e6eb8c218d4495d270b2409731f13f25a14a06a9f2eba8bff800141c64bb6fa
MD5 a365b696be5c0fbd9644bed7b31fad60
SHA1 02386c0c6e8b53c28df4c3a8d0ed9defc69fcc0f
SHA512 e9a34bfa4315e2501fb3f92df2242d185100151f8819c149bf7c0058516570bbf73946baf2aa99b1c26c30b31064addeccf96b5d248a735078879976b7bddbfa
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 d459a61d87c5d0f165d03980659a24ee4a988f1f482d92a743d692b2fc1e036e
MD5 d515ccecd6cb3ac85523a9b4574b3ef2
SHA1 771237a27e78d7d01eecabc4a34456f5aa77a867
SHA512 83b4476cd1941839e51ab72e7685f46ab8ff2a6d2587a4156af1597290aeda47c9bdc725c65c11788422432660bb10a733a662e8c993705a4f14224dbf203d3a
SSDEEP 96:KckQKRKKuDiKgA/mrUIOss9tABwPw9Kn8Pu972upgsGyz:Cvttta
TLSH
T160919862317F5692397D3408A2E4A79E534731A33068EA3B3BE900725E6BE141DFC5DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

domain_actions.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Domain Actions\3.0.0.20\domain_actions.dll
Size 82KB
SHA256 e5c9378b540360fb4ab0b16bf40ed18bd99cf4a8a5a6923f4f240d373fb441cb
MD5 aeb538c29f46cf0e19827ce47594488b
SHA1 db32b33a5811c303b1e37e1ab956df20ba44b355
SHA512 38488a42e5c532442a65fd4edab683f1f63eea71bae3ba2f801693647f633af9d836171dc751b342dc2e0e7784266eb9a40f677c0d3c9f651e7374f1af707852
SSDEEP 1536:NocewxXknaFpdgxBf8paY3JQzQik428fKagFVbydki806yav7Sz:NZvx3bgrfrPza428fIe76yaDS
TLSH
T1F783F1C0DA6C0117EE6B4D75D17959CA6BB9D6B50BA0B3EB2372845A0E02FC5EF36700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fcd3c487-ad77-4c96-9088-5e7cbc3ddca5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\fcd3c487-ad77-4c96-9088-5e7cbc3ddca5.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 ad3903bcea614b4e91c37811c65a7ccbf7389845ee9a93e2f427035bf168eb64
MD5 d519e378438277b2f4d6d2da5249885b
SHA1 4a9d5654de5552ed445cf99ba4bd9e3fe5578dc0
SHA512 74a1083fe853f9831fc4440053ca409a195cfb180fee4849fb7b2cae2f755ef71bea41de9b4c3549f3a4582ee1b2fec2c4f8843e8be65f7a6d181b3e1880e1dc
SSDEEP 768:35b3w6XnkieOMYftNjTnUPO4Qp7cPAiSm2eo4w4cciGrTFlx2svP/:35b3wUkSjTwQpYoimeoR4ccFFD2sn/
TLSH
T129F2CFB5D8B8DE736CFB928476496342BFF4506398C55F44CADA6B0E00836AE071BC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 90de2710aca9d199a5a84d198d6a5d370523b1487fffdeae9894cbb572f07b9e
MD5 85d0670353c4855132375366227bfdab
SHA1 520def3f4dc0bb3f86fb431c6ccaea490b47421d
SHA512 2290b154939313d8de85e08fde269f29850583dfda0442e1ea2c794176ab30194fd579f4e5df7b8e3d14043caad0e7e537a3b24844a0aaf17e09b8224ca5272f
SSDEEP 768:3F/UxvxjgC+i3k6XDkieOMYftNjTnUPO4Qp7cPAiSm2eo4w4cciGrTFlxKuMs:3oZj3+i3kUASjTwQpYoimeoR4ccFFDnZ
TLSH
T10803BF79A8A9AE239CF3A244365D2793FFF411A358C55E98CAD91F0E01873AD071BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 3b6b572625e271c9bf961cfb5d8d889c8c82a5973ab59bb6aa6d93c6a5db8cef
MD5 fd79b65fc100f8931d67100dd033e7f0
SHA1 d5ff3433542d11ad58d8b565e728c7f7db641a50
SHA512 4af8a332e3a5eb0ee48416391c97f84822911e5e4c02c8370f3150f2daa3a88b01431ce2594ca88e21d069ba2c95d2898d0fc9d011bf5c87a16e752b47be8744
SSDEEP 768:qFfi3dwgb6hnzuOMYft4FnnUPO4Qp7cPAiSm2eo4w4cciGrTFlx2svP/:0i3HuoFnwQpYoimeoR4ccFFD2sn/
TLSH
T1F61317F588E78A76E8AE5783673C6E429EBCC153B4885984F7951E4DCC821BFC30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 d862076d9efb258ec8960da1ea408cacf1864405710c65bbd2315c7f2dc215ce
MD5 3d658466a6389c33a290f7b5985179aa
SHA1 837f31750a7b5695591c94b312474db585798aba
SHA512 8919373fd03423718844ebb1a31922cb6e2fb9ecd83ff374f76c1128580b125383f4914144b1baf6fa4df33dd45edfc57e856fe5f37cdeb8d89eb106fa5c84aa
SSDEEP 768:8b3F6XnkieOMYftNjTnUPO4Qp7cPAiSm2eo4w4cciGrTFlx2svP/:8b3FUkSjTwQpYoimeoR4ccFFD2sn/
TLSH
T11EF2CFB5D8B8DE736CFBA28476492342BFF4506398C55F44CAD95B0E00836AE071BC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 93ed929ee58f4f0bf43bfc016c593b64e86783555bbe2c577189d57f137b046b
MD5 f5c541ca6043071e21e1d352b9c4d5b8
SHA1 d693336318242178c94e6a2d4aec8b14dca7a965
SHA512 9cb5174cbf523c4d575bbdb9060342b5ff95682d9a79d7f2d67c11ad6fba205308829618899a967fed2dd9d16d240a4b8946b6b4344222c712e1ad390bbe5452
SSDEEP 768:vw/UxvxjgC+5j3FV/x8uieOMKjFnUPO4Qp7cPAiSm2eo4w4cciGrTF5dAgZbCM3s:vdZj3+5j3F1xVwjFwQpYoimeoR4ccFFu
TLSH
T13103CFB598A8AE37CCF39784365D6342EFF1416395C12EA4CAE92F0D42872AD430BC46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

well_known_domains.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Well Known Domains\1.2.0.0\well_known_domains.dll
Size 572KB
SHA256 2778063e5ded354d852004e80492edb3a0f731b838bb27ba3a233bc937592f6e
MD5 f5f5b37fd514776f455864502c852773
SHA1 8d5ed434173fd77feb33cb6cb0fad5e2388d97c6
SHA512 b0931f1cae171190e6ec8880f4d560cc7b3d5bffe1db11525bd133eaf51e2e0b3c920ea194d6c7577f95e7b4b4380f7845c82eb2898ad1f5c35d4550f93a14b6
SSDEEP 6144:XbBXgDO9CyiiKPFv3GPkDNiTHoIDiXkCBIvzVXCfwX5pWr+W1gUe3h576:XbBQDwi5FvGPkDNirYBIvzVXCoXWiWr
TLSH
T130C49E02B7D846A8D07AD0748A574642EA76BC950F74A6DF02E0B27D2F77BE45B3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 732B
SHA256 cf5e5467ab3de71fcb419acbbb754c3effd5e787864ffa7c767f24ff9bbe5ae3
MD5 87299a8105078d6252386ba9d333ff05
SHA1 c43e027b4174d2ae2c7f138de07b18ac0407148a
SHA512 f6678cce079ae97838bf5aebf3c195a2c82d27dd6546fd7e5428396130ca4bd2c809f2d2edca4f130da479624c3418beffe998ae1a032451706b9a47bad62885
TLSH
T1670110D14C3E1AC3C6B90EAFE04717EC40C89512B0D8387818CDF8A4917A41E345182E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 852B
SHA256 cc631188ae4a22c0621e596be3d4335218373ee3aafe98bb7b213069a0dc3b70
MD5 1a8162cc03c34509f59ea81728419884
SHA1 459f726ff17ed37a212bf5291cc592b4745c3c06
SHA512 129393fb77432dda8e2c4181dc778f609f56572e69213f9f8cffc544b845119929242d41078170b2dc72a678116df340544edb181c2aff069f8cd4ac2a541083
TLSH
T1E8011ED14C7E1AC7CABE0EAEA0872BEC44D86522B098347818CCF864917940E3451C3E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 9fb67212c8d86125f0c94498aacf0f20821354ee3d03a0e114e5c46587a59c4c
MD5 1e21f924e7b00cb8559ed5e1197dbe12
SHA1 7eabd14180e23c963b722ef6600f25e618badf4a
SHA512 e570cd20d4a9b640ed1467b60f24ba28615552a9074bb4e94b82b8a8f28de23f040ce7b259b5bb7376d5d06c861e96b2171b99e4ab6d7e7414b3175a31b2088c
TLSH
T1EA21FEE11D3A0EC6C5BD0EAFA0832AEC54E8A616B8D83074188CFD58913E41E2051C7F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 d1133029d0132ce3a37ab6f27e6878d1abdd9e2b5ea297e825514069cb6eba7d
MD5 d18be69773896cbf4e9e2c2a79a5bd5a
SHA1 e40e1920b8ecb2567cdbe8c198ff56a09109f220
SHA512 2be78429bfd984829ae4eab100dd17e1ab57da32f5b41408089476ee54e4bb33a5e8cd1f9b154c0c6c07b0d279d3d9d1c5fe40acca2a9ec3e481e3e2112076e9
TLSH
T1753103E15C3D1AD1C5BD0DBFB09B39FC94E89212B8E474796858ED68963E51E211083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 612B
SHA256 918167fab0fb4435546513252415c1a2e44b6e8e60caf6f31d07587ba0a71ab0
MD5 5ca920f0e1c81dfb329b916e242a4065
SHA1 1d068ad79883fd23c27647c98e761858e46f48cd
SHA512 2b99239123f922883dea3137835bb8b74713799981e5aa1434ea70db85e7666f2372db684f94bb599ecff70c8c31d02286b0587ffe620333eb1d4bbc7feb84b8
TLSH
T11DF002D04C3E19C3D5B90E6EA40717EC50D45517B0D8383804CDE894D07A05E315183E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 972B
SHA256 f837a0be79824b3ec6f3abca5350dfc7c56fc8e114e0bd4f52c3f8136da186e6
MD5 2028f83487553bbb26a0fd35240568f1
SHA1 69311c7b88dbc2d714c63ffb128c45a77993a372
SHA512 95490eb641e7973f170d67b9ed8606a774fc9049b1eebba2eaed7a32b1d591f4a427c7054aa4f769a5d2d728dc5b311b3f09f16cb3c757d551de6ba9e2a7f2bb
TLSH
T1221110D14C3A1AC7C6BE0EAEA0872BEC04D86613B4983074188CF958903941E3451C3E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 cf404f57ae1cd10fc2d112c68e9243f163cdc859ab2c645341f98a4fea67c9ab
MD5 b71e0902fa37e797e75cd9ae37891e41
SHA1 9915a40d83ec4f7d955ff1097bbde76edf972bd3
SHA512 3abe7f3cb00ee13203c18fe3497199f55f5d73b1d5bb250af8266ac6f6ec245061230f754dd275cfbad5dd02fb9644bc0eef06ad6c083edfc3ec82a925cc7186
TLSH
T19221FDA15C3D1AC6C1BD0DAFB0872AEC50E8A612F8D83478289CFD68913E52E2150C7F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 d4ec183e8e2c7d8401830c76f9b6b1bbf74760a37e81203f273b25742aa04a50
MD5 cd7968feba1cd21c19231f4768eb5a28
SHA1 543c5b69d023340065d48d0a766ad613477a20bb
SHA512 b0105ebd3120d6532149e04c929066d182f52782e0651d27909b1579defc7f01fa56873f0f000d1db0f0a792a13d3b0e00336b039720918034e88e5ea88d311e
TLSH
T186310FE15C3D19C2C1BD0DAFB0972AEC54E89612F8983438289CE9A8953E51D3450C7F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 921cc7b5c26303e027efc6fd174b105d3cc06d9150c8681d8c479cd5794bed7d
MD5 8d72017ed091e59e7ff5dcb779a6ed0d
SHA1 1879ad34d675d41498ad12886d68b401b1764783
SHA512 7e9a099e82cc434f1f02142277083df17afab6a4e8a5aee3558069616c134641a071ba866aa70b01f644c3fca175c74e5b78e5c8cf5141c74b1f183cd8b2b730
TLSH
T11A3102E15C3C1AD1C1BD0DBFB09739EC54E89212B8A87439689DE868963E51E245087F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 5f0d62f8ed460f4afd8352ad69f0eccc7ceb91cc3ff2069e6c09fa38456aeac3
MD5 cc9833d91ea3fa960f38d5f844506de9
SHA1 b23be526724784a6b648fb9fedf12ef439304ba2
SHA512 f77273c4138f5cbd8d9d50854fbdc94a93b073f9a14c3598082c8d12d31673175380078713399d283f308f12c4e813f2efb159339acc83df5f4dac4e9f5c3da2
TLSH
T1504102E05C3D1AD1C4BD0DBFB08B39EC94E89222B8E43479685CED68967E61D214083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 5c31842e1664b35fa3a50acd71fb36d96fa20f2ea288b8cd56a946618bd5815c
MD5 6cd9e80afd2cfb003133ab8ba52d8f8e
SHA1 55176120c51d857711f8ce144b9e263ee8f9712f
SHA512 a1038323843eadbcabe5fcbe34b80c98df3e538b4caade8865fdcfb3303ff5cf2d86299c7e28e448241a172d8df8e3ec4e400fb6f7d10d2beb32bce06a1d7f85
TLSH
T11811EFE15D391EC6C6BE0EAEA4873BED44E8A616B8E87078188CE958913951E2051C7F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 7ed6f13af4d23eb0fae3eeb6f116875b98baea8b85c64671cdcb9622373de239
MD5 ef02f4b8cd75b185f45eca8ccea2e6fc
SHA1 15c05c3e162dd5e4da0616bb9c33ace719a7b1a6
SHA512 794c5119bb048ed811133aa6b357649cf402d2e897d76c3a2224020d86989827d8c9c9115ca19e84f4607ff121078128ad4e6611b2b3c65515894873a07322ca
TLSH
T1643120E05C3D19C2C1BD0DBFB0972AEC44E89212F8A87439289CE858963E51E205083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 d4fdc52c5031cf870b9a0b57ee1143f48b7b2ab633f81ddbb7011a591a10803a
MD5 6db34e5b5412a7b0a18a8a898879a745
SHA1 3c2721a218694ac1ed83674b5001eadbfb8c436e
SHA512 c6fd57b38bedf9ed24376f2c3b7ced24e60f9f6ccfe0054acf5ffd869d884335cb32549d450fa396e5222a1e21b98d645df7324b7f4f6cd611915a0a4b10f622
TLSH
T1484125E0583C1AD1D4BD0DBEB08735EC94E8D322B4E4347D685CED98967A61D200083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 537de7cbcab10f3731aa5ac413709ce83c96c8203398184ea753cdc205bd9371
MD5 4b41b6d04d45cf65d26104097648b30a
SHA1 e50ff84be36564700fc7627bbd8e59f113cf1f29
SHA512 f8c816f6c617dbd360fdd03e7c149b1b1d6177c963e1f62567c9c5d4b8343204984f17acd9e55b4347dc6eac7dde6b825140e0bd8348cad9bbc2367c9e01190d
TLSH
T1C34111E05C381AD1D0BD0DBEB09739EC94E89722B4A434792C9CEDA8967A60D214083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

ee4b87eb-e3d8-4357-a522-cda98d4678fc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ee4b87eb-e3d8-4357-a522-cda98d4678fc.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

Tmp6AA7.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp6AA7.tmp
Size 1KB
SHA256 28c871238311d40287c51dc09aee6510cac5306329981777071600b1112286c6
MD5 a10f31fa140f2608ff150125f3687920
SHA1 ec411cc7005aaa8e3775cf105fcd4e1239f8ed4b
SHA512 cf915fb34cd5ecfbd6b25171d6e0d3d09af2597edf29f9f24fa474685d4c5ec9bc742ade9f29abac457dd645ee955b1914a635c90af77c519d2ada895e7ecf12
TLSH
T10F21CA2FA1324D9E49BDF27D4C0B0CFE85260FB792F4960217541E12B04DD548AF8C4D
MD5 SHA1 SHA512 TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5860_326236350\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Other

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5860_1671926787\Mu\Other
Size 34B
SHA256 2b4a47b82cbe70e34407c7df126a24007aff8b45d5716db384d27cc1f3b30707
MD5 cd0395742b85e2b669eaec1d5f15b65b
SHA1 43c81d1c62fc7ff94f9364639c9a46a0747d122e
SHA512 4df2ce734e2f7bc5f02bb7845ea801b57dcf649565dd94b1b71f578b453ba0a17c61ccee73e7cff8f23cdd6aa37e55be5cb15f4767ff88a9a06de3623604fbf0
MD5 SHA1 SHA512

Submit Download

LICENSE

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5860_916309207\LICENSE
Size 1KB
SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
MD5 ee002cb9e51bb8dfa89640a406a1090a
SHA1 49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2
SHA512 d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c
TLSH
T17D31535723840B9306DA2B4566AEBDC4B0DDC02D7F27AE05186EF394537B52ED8B3443
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4116-27-0x000001557F610000-0x000001557F618000-memory.dmp

Download

memory/4116-26-0x000001557F600000-0x000001557F608000-memory.dmp

Download

memory/4116-20-0x000001557F700000-0x000001557F73C000-memory.dmp

Download

memory/4116-21-0x000001557F6C0000-0x000001557F6E6000-memory.dmp

Download

memory/4116-11-0x00007FFB81070000-0x00007FFB81A14000-memory.dmp

Download

memory/4116-0-0x00007FFB811FF000-0x00007FFB81200000-memory.dmp

Download

memory/4116-23-0x00007FFB81070000-0x00007FFB81A14000-memory.dmp

Download

memory/4116-22-0x000001551B220000-0x000001551B748000-memory.dmp

Download

memory/4116-24-0x00007FFB81070000-0x00007FFB81A14000-memory.dmp

Download

memory/4116-25-0x00007FFB81070000-0x00007FFB81A14000-memory.dmp

Download

memory/4116-7-0x000001557E980000-0x000001557E98A000-memory.dmp

Download

memory/4116-6-0x000001557F740000-0x000001557F7FA000-memory.dmp

Download

memory/4116-5-0x00007FFB81070000-0x00007FFB81A14000-memory.dmp

Download

memory/4116-19-0x000001557F6A0000-0x000001557F6B2000-memory.dmp

Download

memory/4116-4-0x00007FFB81070000-0x00007FFB81A14000-memory.dmp

Download

memory/4116-30-0x00007FFB81070000-0x00007FFB81A14000-memory.dmp

Download

memory/4116-3-0x00007FFB81070000-0x00007FFB81A14000-memory.dmp

Download

memory/4116-29-0x000001557F620000-0x000001557F62E000-memory.dmp

Download

memory/4116-34-0x0000015580060000-0x00000155801E8000-memory.dmp

Download

memory/4116-35-0x00007FFB81070000-0x00007FFB81A14000-memory.dmp

Download

memory/4116-2-0x00007FFB81070000-0x00007FFB81A14000-memory.dmp

Download

memory/4116-36-0x00007FFB81070000-0x00007FFB81A14000-memory.dmp

Download

memory/4116-28-0x000001557FE90000-0x000001557FECE000-memory.dmp

Download

memory/4116-37-0x00007FFB81070000-0x00007FFB81A14000-memory.dmp

Download

memory/4116-1-0x000001557E300000-0x000001557E3C6000-memory.dmp

Download

memory/4116-41-0x00007FFB81070000-0x00007FFB81A14000-memory.dmp

Download

memory/4116-52-0x00007FFB81070000-0x00007FFB81A14000-memory.dmp

Download