hxxp://fortnite[.]gg

Analysis

max time kernel
597s
max time network
599s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
28/03/2025, 01:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://fortnite.gg

Score

7^/10

discovery motw phishing

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
5620	msedge.exe

Mark of the Web detected: This indicates that the page was originally saved or cloned. 1 IoCs

phishing motw

flow	ioc	pid	Process
724	https://storage.googleapis.com/script.aniview.com/ssync/62f53b2c7850d0786f227f64/ssync.html	5528	msedge.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5620_1536305179\_locales\am\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5620_897168085\hyph-pt.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5620_1536305179\offscreendocument_main.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5620_1536305179\_locales\be\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5620_1536305179\_locales\zu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5620_984828666\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5620_897168085\hyph-nb.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5620_1536305179\_locales\bg\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5620_1536305179\_locales\ml\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5620_1536305179\dasherSettingSchema.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5620_1536305179\_locales\gu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5620_897168085\hyph-hu.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5620_1536305179\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5620_1059280034\well_known_domains.dll	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5620_897168085\hyph-bn.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5620_897168085\hyph-cu.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5620_897168085\hyph-el.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5620_897168085\hyph-und-ethi.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5620_1824505643\Part-FR	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5620_1824505643\Part-NL	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5620_1536305179\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5620_1536305179\_locales\ta\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5620_1536305179\_locales\vi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5620_1428656813\protocols.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5620_247907949\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5620_1110916143\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5620_897168085\hyph-hy.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5620_1824505643\Filtering Rules-AA	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5620_1536305179\_locales\ka\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5620_1428656813\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5620_897168085\hyph-bg.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5620_897168085\hyph-sl.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5620_1824505643\Part-ZH	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5620_1536305179\service_worker_bin_prod.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5620_1536305179\_locales\es_419\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5620_1536305179\_locales\my\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5620_1536305179\_locales\fil\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5620_1536305179\page_embed_script.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5620_1536305179\_locales\en_US\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5620_1536305179\_locales\lo\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5620_1536305179\_locales\fr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5620_897168085\hyph-be.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5620_897168085\hyph-de-1901.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5620_897168085\hyph-nl.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5620_1536305179\_locales\pl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5620_1536305179\_locales\lv\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5620_1536305179\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5620_1536305179\_locales\hy\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5620_442798924\crs.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5620_897168085\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5620_1536305179\_locales\th\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5620_1536305179\_locales\sk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5620_247907949\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5620_984828666\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5620_715356776\Microsoft.CognitiveServices.Speech.core.dll	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5620_897168085\hyph-fr.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5620_897168085\hyph-te.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5620_1536305179\_locales\ja\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5620_1536305179\_locales\pa\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5620_1059280034\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5620_897168085\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5620_1824505643\Part-RU	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5620_1536305179\_locales\mn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5620_897168085\hyph-mn-cyrl.hyb	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133875987332424571"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1062200478-553497403-3857448183-1000\{BD7175FE-CD35-48DB-936A-412090FE9E79}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
6908	msedge.exe
6908	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 57 IoCs

pid	Process
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	456	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	456	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe
5620	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5620 wrote to memory of 5164	5620	msedge.exe	86
PID 5620 wrote to memory of 5164	5620	msedge.exe	86
PID 5620 wrote to memory of 5528	5620	msedge.exe	87
PID 5620 wrote to memory of 5528	5620	msedge.exe	87
PID 5620 wrote to memory of 1968	5620	msedge.exe	88
PID 5620 wrote to memory of 1968	5620	msedge.exe	88
PID 5620 wrote to memory of 1968	5620	msedge.exe	88
PID 5620 wrote to memory of 1968	5620	msedge.exe	88
PID 5620 wrote to memory of 1968	5620	msedge.exe	88
PID 5620 wrote to memory of 1968	5620	msedge.exe	88
PID 5620 wrote to memory of 1968	5620	msedge.exe	88
PID 5620 wrote to memory of 1968	5620	msedge.exe	88
PID 5620 wrote to memory of 1968	5620	msedge.exe	88
PID 5620 wrote to memory of 1968	5620	msedge.exe	88
PID 5620 wrote to memory of 1968	5620	msedge.exe	88
PID 5620 wrote to memory of 1968	5620	msedge.exe	88
PID 5620 wrote to memory of 1968	5620	msedge.exe	88
PID 5620 wrote to memory of 1968	5620	msedge.exe	88
PID 5620 wrote to memory of 1968	5620	msedge.exe	88
PID 5620 wrote to memory of 1968	5620	msedge.exe	88
PID 5620 wrote to memory of 1968	5620	msedge.exe	88
PID 5620 wrote to memory of 1968	5620	msedge.exe	88
PID 5620 wrote to memory of 1968	5620	msedge.exe	88
PID 5620 wrote to memory of 1968	5620	msedge.exe	88
PID 5620 wrote to memory of 1968	5620	msedge.exe	88
PID 5620 wrote to memory of 1968	5620	msedge.exe	88
PID 5620 wrote to memory of 1968	5620	msedge.exe	88
PID 5620 wrote to memory of 1968	5620	msedge.exe	88
PID 5620 wrote to memory of 1968	5620	msedge.exe	88
PID 5620 wrote to memory of 1968	5620	msedge.exe	88
PID 5620 wrote to memory of 1968	5620	msedge.exe	88
PID 5620 wrote to memory of 1968	5620	msedge.exe	88
PID 5620 wrote to memory of 1968	5620	msedge.exe	88
PID 5620 wrote to memory of 1968	5620	msedge.exe	88
PID 5620 wrote to memory of 1968	5620	msedge.exe	88
PID 5620 wrote to memory of 1968	5620	msedge.exe	88
PID 5620 wrote to memory of 1968	5620	msedge.exe	88
PID 5620 wrote to memory of 1968	5620	msedge.exe	88
PID 5620 wrote to memory of 1968	5620	msedge.exe	88
PID 5620 wrote to memory of 1968	5620	msedge.exe	88
PID 5620 wrote to memory of 1968	5620	msedge.exe	88
PID 5620 wrote to memory of 1968	5620	msedge.exe	88
PID 5620 wrote to memory of 1968	5620	msedge.exe	88
PID 5620 wrote to memory of 1968	5620	msedge.exe	88
PID 5620 wrote to memory of 1968	5620	msedge.exe	88
PID 5620 wrote to memory of 1968	5620	msedge.exe	88
PID 5620 wrote to memory of 1968	5620	msedge.exe	88
PID 5620 wrote to memory of 1968	5620	msedge.exe	88
PID 5620 wrote to memory of 1968	5620	msedge.exe	88
PID 5620 wrote to memory of 1968	5620	msedge.exe	88
PID 5620 wrote to memory of 1968	5620	msedge.exe	88
PID 5620 wrote to memory of 1968	5620	msedge.exe	88
PID 5620 wrote to memory of 1968	5620	msedge.exe	88
PID 5620 wrote to memory of 1968	5620	msedge.exe	88
PID 5620 wrote to memory of 1968	5620	msedge.exe	88
PID 5620 wrote to memory of 1968	5620	msedge.exe	88
PID 5620 wrote to memory of 1968	5620	msedge.exe	88
PID 5620 wrote to memory of 1968	5620	msedge.exe	88
PID 5620 wrote to memory of 1968	5620	msedge.exe	88
PID 5620 wrote to memory of 2764	5620	msedge.exe	89
PID 5620 wrote to memory of 2764	5620	msedge.exe	89
PID 5620 wrote to memory of 2764	5620	msedge.exe	89
PID 5620 wrote to memory of 2764	5620	msedge.exe	89
PID 5620 wrote to memory of 2764	5620	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument http://fortnite.gg
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x268,0x7ffc1b75f208,0x7ffc1b75f214,0x7ffc1b75f220
  2⤵
  PID:5164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1776,i,7691332956800903153,10488761675993825647,262144 --variations-seed-version --mojo-platform-channel-handle=2500 /prefetch:3
  2⤵
  - Mark of the Web detected: This indicates that the page was originally saved or cloned.
  PID:5528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2204,i,7691332956800903153,10488761675993825647,262144 --variations-seed-version --mojo-platform-channel-handle=2512 /prefetch:8
  2⤵
  PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2472,i,7691332956800903153,10488761675993825647,262144 --variations-seed-version --mojo-platform-channel-handle=2464 /prefetch:2
  2⤵
  PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3516,i,7691332956800903153,10488761675993825647,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
  2⤵
  PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3532,i,7691332956800903153,10488761675993825647,262144 --variations-seed-version --mojo-platform-channel-handle=3768 /prefetch:1
  2⤵
  PID:388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=5028,i,7691332956800903153,10488761675993825647,262144 --variations-seed-version --mojo-platform-channel-handle=5052 /prefetch:1
  2⤵
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=5228,i,7691332956800903153,10488761675993825647,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:1
  2⤵
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5404,i,7691332956800903153,10488761675993825647,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:8
  2⤵
  PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5472,i,7691332956800903153,10488761675993825647,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:8
  2⤵
  PID:5148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6016,i,7691332956800903153,10488761675993825647,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:8
  2⤵
  PID:5128
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6280,i,7691332956800903153,10488761675993825647,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:8
  2⤵
  PID:5456
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6280,i,7691332956800903153,10488761675993825647,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:8
  2⤵
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5628,i,7691332956800903153,10488761675993825647,262144 --variations-seed-version --mojo-platform-channel-handle=6588 /prefetch:8
  2⤵
  PID:3924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=6720,i,7691332956800903153,10488761675993825647,262144 --variations-seed-version --mojo-platform-channel-handle=4000 /prefetch:1
  2⤵
  PID:5724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=6068,i,7691332956800903153,10488761675993825647,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:1
  2⤵
  PID:5540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6956,i,7691332956800903153,10488761675993825647,262144 --variations-seed-version --mojo-platform-channel-handle=6964 /prefetch:8
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --field-trial-handle=7092,i,7691332956800903153,10488761675993825647,262144 --variations-seed-version --mojo-platform-channel-handle=6524 /prefetch:1
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --field-trial-handle=7132,i,7691332956800903153,10488761675993825647,262144 --variations-seed-version --mojo-platform-channel-handle=7172 /prefetch:1
  2⤵
  PID:5928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --field-trial-handle=7312,i,7691332956800903153,10488761675993825647,262144 --variations-seed-version --mojo-platform-channel-handle=7180 /prefetch:1
  2⤵
  PID:5544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --field-trial-handle=7320,i,7691332956800903153,10488761675993825647,262144 --variations-seed-version --mojo-platform-channel-handle=7468 /prefetch:1
  2⤵
  PID:5124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --field-trial-handle=7632,i,7691332956800903153,10488761675993825647,262144 --variations-seed-version --mojo-platform-channel-handle=7620 /prefetch:1
  2⤵
  PID:1724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --field-trial-handle=7804,i,7691332956800903153,10488761675993825647,262144 --variations-seed-version --mojo-platform-channel-handle=7788 /prefetch:1
  2⤵
  PID:1544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --field-trial-handle=7988,i,7691332956800903153,10488761675993825647,262144 --variations-seed-version --mojo-platform-channel-handle=8044 /prefetch:1
  2⤵
  PID:5344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --field-trial-handle=8176,i,7691332956800903153,10488761675993825647,262144 --variations-seed-version --mojo-platform-channel-handle=8148 /prefetch:1
  2⤵
  PID:1604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --field-trial-handle=7660,i,7691332956800903153,10488761675993825647,262144 --variations-seed-version --mojo-platform-channel-handle=8324 /prefetch:1
  2⤵
  PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --field-trial-handle=7468,i,7691332956800903153,10488761675993825647,262144 --variations-seed-version --mojo-platform-channel-handle=7960 /prefetch:1
  2⤵
  PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --field-trial-handle=7524,i,7691332956800903153,10488761675993825647,262144 --variations-seed-version --mojo-platform-channel-handle=7532 /prefetch:1
  2⤵
  PID:904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --field-trial-handle=7552,i,7691332956800903153,10488761675993825647,262144 --variations-seed-version --mojo-platform-channel-handle=6884 /prefetch:1
  2⤵
  PID:3924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --field-trial-handle=8084,i,7691332956800903153,10488761675993825647,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:1
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --field-trial-handle=6544,i,7691332956800903153,10488761675993825647,262144 --variations-seed-version --mojo-platform-channel-handle=3860 /prefetch:1
  2⤵
  PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --field-trial-handle=7280,i,7691332956800903153,10488761675993825647,262144 --variations-seed-version --mojo-platform-channel-handle=7224 /prefetch:1
  2⤵
  PID:1512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7984,i,7691332956800903153,10488761675993825647,262144 --variations-seed-version --mojo-platform-channel-handle=7604 /prefetch:8
  2⤵
  PID:6028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --field-trial-handle=8048,i,7691332956800903153,10488761675993825647,262144 --variations-seed-version --mojo-platform-channel-handle=7136 /prefetch:1
  2⤵
  PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --field-trial-handle=7912,i,7691332956800903153,10488761675993825647,262144 --variations-seed-version --mojo-platform-channel-handle=6548 /prefetch:1
  2⤵
  PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --field-trial-handle=6668,i,7691332956800903153,10488761675993825647,262144 --variations-seed-version --mojo-platform-channel-handle=7144 /prefetch:1
  2⤵
  PID:932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --field-trial-handle=6628,i,7691332956800903153,10488761675993825647,262144 --variations-seed-version --mojo-platform-channel-handle=7060 /prefetch:1
  2⤵
  PID:2440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --field-trial-handle=8596,i,7691332956800903153,10488761675993825647,262144 --variations-seed-version --mojo-platform-channel-handle=8580 /prefetch:1
  2⤵
  PID:732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --field-trial-handle=8728,i,7691332956800903153,10488761675993825647,262144 --variations-seed-version --mojo-platform-channel-handle=8760 /prefetch:1
  2⤵
  PID:4196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --field-trial-handle=8900,i,7691332956800903153,10488761675993825647,262144 --variations-seed-version --mojo-platform-channel-handle=8912 /prefetch:1
  2⤵
  PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --field-trial-handle=9060,i,7691332956800903153,10488761675993825647,262144 --variations-seed-version --mojo-platform-channel-handle=9072 /prefetch:1
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --field-trial-handle=9248,i,7691332956800903153,10488761675993825647,262144 --variations-seed-version --mojo-platform-channel-handle=6652 /prefetch:1
  2⤵
  PID:6156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --field-trial-handle=9412,i,7691332956800903153,10488761675993825647,262144 --variations-seed-version --mojo-platform-channel-handle=9388 /prefetch:1
  2⤵
  PID:6216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --field-trial-handle=9556,i,7691332956800903153,10488761675993825647,262144 --variations-seed-version --mojo-platform-channel-handle=9288 /prefetch:1
  2⤵
  PID:6284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --field-trial-handle=9860,i,7691332956800903153,10488761675993825647,262144 --variations-seed-version --mojo-platform-channel-handle=9620 /prefetch:1
  2⤵
  PID:6352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --field-trial-handle=9524,i,7691332956800903153,10488761675993825647,262144 --variations-seed-version --mojo-platform-channel-handle=9928 /prefetch:1
  2⤵
  PID:6464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --field-trial-handle=10036,i,7691332956800903153,10488761675993825647,262144 --variations-seed-version --mojo-platform-channel-handle=10032 /prefetch:1
  2⤵
  PID:6564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --field-trial-handle=10200,i,7691332956800903153,10488761675993825647,262144 --variations-seed-version --mojo-platform-channel-handle=10168 /prefetch:1
  2⤵
  PID:6632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --field-trial-handle=10348,i,7691332956800903153,10488761675993825647,262144 --variations-seed-version --mojo-platform-channel-handle=9932 /prefetch:1
  2⤵
  PID:6696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --field-trial-handle=10480,i,7691332956800903153,10488761675993825647,262144 --variations-seed-version --mojo-platform-channel-handle=10504 /prefetch:1
  2⤵
  PID:6756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --field-trial-handle=4924,i,7691332956800903153,10488761675993825647,262144 --variations-seed-version --mojo-platform-channel-handle=9840 /prefetch:1
  2⤵
  PID:6448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --field-trial-handle=9764,i,7691332956800903153,10488761675993825647,262144 --variations-seed-version --mojo-platform-channel-handle=9620 /prefetch:1
  2⤵
  PID:3264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --field-trial-handle=9912,i,7691332956800903153,10488761675993825647,262144 --variations-seed-version --mojo-platform-channel-handle=9968 /prefetch:1
  2⤵
  PID:2120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=9992,i,7691332956800903153,10488761675993825647,262144 --variations-seed-version --mojo-platform-channel-handle=7728 /prefetch:8
  2⤵
  PID:6332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=9392,i,7691332956800903153,10488761675993825647,262144 --variations-seed-version --mojo-platform-channel-handle=7560 /prefetch:8
  2⤵
  PID:6344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7740,i,7691332956800903153,10488761675993825647,262144 --variations-seed-version --mojo-platform-channel-handle=8916 /prefetch:8
  2⤵
  PID:6320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --always-read-main-dll --field-trial-handle=8328,i,7691332956800903153,10488761675993825647,262144 --variations-seed-version --mojo-platform-channel-handle=8428 /prefetch:1
  2⤵
  PID:2576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --always-read-main-dll --field-trial-handle=6804,i,7691332956800903153,10488761675993825647,262144 --variations-seed-version --mojo-platform-channel-handle=8316 /prefetch:1
  2⤵
  PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --always-read-main-dll --field-trial-handle=8452,i,7691332956800903153,10488761675993825647,262144 --variations-seed-version --mojo-platform-channel-handle=8364 /prefetch:1
  2⤵
  PID:6636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --always-read-main-dll --field-trial-handle=7948,i,7691332956800903153,10488761675993825647,262144 --variations-seed-version --mojo-platform-channel-handle=2044 /prefetch:1
  2⤵
  PID:6716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --always-read-main-dll --field-trial-handle=5740,i,7691332956800903153,10488761675993825647,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:1
  2⤵
  PID:3344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=9420,i,7691332956800903153,10488761675993825647,262144 --variations-seed-version --mojo-platform-channel-handle=3964 /prefetch:8
  2⤵
  PID:5416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5728,i,7691332956800903153,10488761675993825647,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:8
  2⤵
  PID:5236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=8236,i,7691332956800903153,10488761675993825647,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:8
  2⤵
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=5580,i,7691332956800903153,10488761675993825647,262144 --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5704,i,7691332956800903153,10488761675993825647,262144 --variations-seed-version --mojo-platform-channel-handle=3320 /prefetch:8
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=10676,i,7691332956800903153,10488761675993825647,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:8
  2⤵
  PID:5352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --always-read-main-dll --field-trial-handle=10436,i,7691332956800903153,10488761675993825647,262144 --variations-seed-version --mojo-platform-channel-handle=2836 /prefetch:1
  2⤵
  PID:6096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --always-read-main-dll --field-trial-handle=6524,i,7691332956800903153,10488761675993825647,262144 --variations-seed-version --mojo-platform-channel-handle=7772 /prefetch:1
  2⤵
  PID:3212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=9780,i,7691332956800903153,10488761675993825647,262144 --variations-seed-version --mojo-platform-channel-handle=1012 /prefetch:8
  2⤵
  PID:1224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5772,i,7691332956800903153,10488761675993825647,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:8
  2⤵
  PID:4132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=1012,i,7691332956800903153,10488761675993825647,262144 --variations-seed-version --mojo-platform-channel-handle=7924 /prefetch:8
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --always-read-main-dll --field-trial-handle=9528,i,7691332956800903153,10488761675993825647,262144 --variations-seed-version --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5496,i,7691332956800903153,10488761675993825647,262144 --variations-seed-version --mojo-platform-channel-handle=9988 /prefetch:8
  2⤵
  PID:1756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4800,i,7691332956800903153,10488761675993825647,262144 --variations-seed-version --mojo-platform-channel-handle=1848 /prefetch:8
  2⤵
  PID:5224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --always-read-main-dll --field-trial-handle=7724,i,7691332956800903153,10488761675993825647,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:1
  2⤵
  PID:512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --always-read-main-dll --field-trial-handle=5536,i,7691332956800903153,10488761675993825647,262144 --variations-seed-version --mojo-platform-channel-handle=9848 /prefetch:1
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4028,i,7691332956800903153,10488761675993825647,262144 --variations-seed-version --mojo-platform-channel-handle=8892 /prefetch:8
  2⤵
  PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --always-read-main-dll --field-trial-handle=9904,i,7691332956800903153,10488761675993825647,262144 --variations-seed-version --mojo-platform-channel-handle=8244 /prefetch:1
  2⤵
  PID:6280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --always-read-main-dll --field-trial-handle=10792,i,7691332956800903153,10488761675993825647,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:1
  2⤵
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --always-read-main-dll --field-trial-handle=10820,i,7691332956800903153,10488761675993825647,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:1
  2⤵
  PID:1688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3452,i,7691332956800903153,10488761675993825647,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:8
  2⤵
  PID:1892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=84 --always-read-main-dll --field-trial-handle=2508,i,7691332956800903153,10488761675993825647,262144 --variations-seed-version --mojo-platform-channel-handle=9008 /prefetch:1
  2⤵
  PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=85 --always-read-main-dll --field-trial-handle=5816,i,7691332956800903153,10488761675993825647,262144 --variations-seed-version --mojo-platform-channel-handle=10796 /prefetch:1
  2⤵
  PID:5348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=10776,i,7691332956800903153,10488761675993825647,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:8
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=10848,i,7691332956800903153,10488761675993825647,262144 --variations-seed-version --mojo-platform-channel-handle=7760 /prefetch:8
  2⤵
  PID:880

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:4648

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
  2⤵
  PID:3096

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x490 0x4c8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\chrome_Unpacker_BeginUnzipping5620_1059280034\manifest.json

Filesize
141B

MD5
811f0436837c701dc1cea3d6292b3922

SHA1
4e51a3e9f5cbf8c9c96985dabe8ffc2de28dae87

SHA256
dbfb38a16e33a39c35ac50bd81782e4608be14954f1df69ac8272c0b9ce87a5d

SHA512
21e7bf2f8333b2900bcbcb871ede14684073249597d105095dc7d3f101e7ccc326068732f11d4a167365f245a3f2205793f520c7666d7f948e70919b40b43d35

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping5620_1110916143\LICENSE

Filesize
1KB

MD5
ee002cb9e51bb8dfa89640a406a1090a

SHA1
49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2

SHA256
3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b

SHA512
d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping5620_1110916143\manifest.json

Filesize
79B

MD5
7f4b594a35d631af0e37fea02df71e72

SHA1
f7bc71621ea0c176ca1ab0a3c9fe52dbca116f57

SHA256
530882d7f535ae57a4906ca735b119c9e36480cbb780c7e8ad37c9c8fdf3d9b1

SHA512
bf3f92f5023f0fbad88526d919252a98db6d167e9ca3e15b94f7d71ded38a2cfb0409f57ef24708284ddd965bda2d3207cd99c008b1c9c8c93705fd66ac86360

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping5620_1428656813\manifest.fingerprint

Filesize
66B

MD5
496b05677135db1c74d82f948538c21c

SHA1
e736e675ca5195b5fc16e59fb7de582437fb9f9a

SHA256
df55a9464ee22a0f860c0f3b4a75ec62471d37b4d8cb7a0e460eef98cb83ebe7

SHA512
8bd1b683e24a8c8c03b0bc041288296448f799a6f431bacbd62cb33e621672991141c7151d9424ad60ab65a7a6a30298243b8b71d281f9e99b8abb79fe16bd3c

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping5620_1428656813\manifest.json

Filesize
134B

MD5
049c307f30407da557545d34db8ced16

SHA1
f10b86ebfe8d30d0dc36210939ca7fa7a819d494

SHA256
c36944790c4a1fa2f2acec5f7809a4d6689ecb7fb3b2f19c831c9adb4e17fc54

SHA512
14f04e768956bdd9634f6a172104f2b630e2eeada2f73b9a249be2ec707f4a47ff60f2f700005ca95addd838db9438ad560e5136a10ed32df1d304d65f445780

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping5620_1824505643\manifest.json

Filesize
116B

MD5
2188c7ec4e86e29013803d6b85b0d5bb

SHA1
5a9b4a91c63e0013f661dfc472edb01385d0e3ce

SHA256
ac47cc331bb96271da2140941926a8accc6cb7599a6f3c17bd31c78f46709a62

SHA512
37c21eaff24a54c2c7571e480ff4f349267e4404111508f241f54a41542ce06bcde4c830c6e195fc48d1bf831ed1fe78da361d1e43416cfd6c02afa8188af656

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping5620_238221064\manifest.json

Filesize
53B

MD5
22b68a088a69906d96dc6d47246880d2

SHA1
06491f3fd9c4903ac64980f8d655b79082545f82

SHA256
94be212fe6bcf42d4b13fabd22da97d6a7ef8fdf28739989aba90a7cf181ac88

SHA512
8c755fdc617fa3a196e048e222a2562622f43362b8ef60c047e540e997153a446a448e55e062b14ed4d0adce7230df643a1bd0b06a702dc1e6f78e2553aadfff

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping5620_442798924\manifest.json

Filesize
102B

MD5
a64e2a4236e705215a3fd5cb2697a71f

SHA1
1c73e6aad8f44ade36df31a23eaaf8cd0cae826d

SHA256
014e9fc1219beefc428ec749633125c9bff7febc3be73a14a8f18a6691cd2846

SHA512
75b30c0c8cef490aaf923afbdb5385d4770de82e698f71f8f126a6af5ef16f3a90d0c27687f405274177b1a5250436efddd228a6d2949651f43bd926e8a1cc99

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping5620_516059799\manifest.json

Filesize
176B

MD5
6607494855f7b5c0348eecd49ef7ce46

SHA1
2c844dd9ea648efec08776757bc376b5a6f9eb71

SHA256
37c30639ea04878b9407aecbcea4848b033e4548d5023ce5105ea79cab2c68dd

SHA512
8cb60725d958291b9a78c293992768cb03ff53ab942637e62eb6f17d80e0864c56a9c8ccafbc28246e9ce1fdb248e8d071d76764bcaf0243397d0f0a62b4d09a

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping5620_715356776\manifest.json

Filesize
76B

MD5
ba25fcf816a017558d3434583e9746b8

SHA1
be05c87f7adf6b21273a4e94b3592618b6a4a624

SHA256
0d664bc422a696452111b9a48e7da9043c03786c8d5401282cff9d77bcc34b11

SHA512
3763bd77675221e323faa5502023dc677c08911a673db038e4108a2d4d71b1a6c0727a65128898bb5dfab275e399f4b7ed19ca2194a8a286e8f9171b3536546f

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping5620_897168085\hyph-as.hyb

Filesize
703B

MD5
8961fdd3db036dd43002659a4e4a7365

SHA1
7b2fa321d50d5417e6c8d48145e86d15b7ff8321

SHA256
c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe

SHA512
531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping5620_897168085\hyph-hi.hyb

Filesize
687B

MD5
0807cf29fc4c5d7d87c1689eb2e0baaa

SHA1
d0914fb069469d47a36d339ca70164253fccf022

SHA256
f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42

SHA512
5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping5620_897168085\hyph-nb.hyb

Filesize
141KB

MD5
677edd1a17d50f0bd11783f58725d0e7

SHA1
98fedc5862c78f3b03daed1ff9efbe5e31c205ee

SHA256
c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0

SHA512
c368f6687fa8a2ef110fcb2b65df13f6a67feac7106014bd9ea9315f16e4d7f5cbc8b4a67ba2169c6909d49642d88ae2a0a9cd3f1eb889af326f29b379cfd3ff

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping5620_897168085\manifest.json

Filesize
82B

MD5
2617c38bed67a4190fc499142b6f2867

SHA1
a37f0251cd6be0a6983d9a04193b773f86d31da1

SHA256
d571ef33b0e707571f10bb37b99a607d6f43afe33f53d15b4395b16ef3fda665

SHA512
b08053050692765f172142bad7afbcd038235275c923f3cd089d556251482b1081e53c4ad7367a1fb11ca927f2ad183dc63d31ccfbf85b0160cf76a31343a6d0

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping5620_984828666\manifest.json

Filesize
118B

MD5
bfd928cc511db8e8550a3e5a00cfe169

SHA1
569543caeacc652b8a78bc1aee3ae06027456eb0

SHA256
c49d97c9219d36b85b6541c049f1fb766a6b587b064253ea7a2a4daf3cad64e3

SHA512
94ba54500dafee7013cb90c921509f1be94de9d9ad4825aa0444f4038c178bf2f70e9210943247582f36af81c93a94af68424b3f3ac25743acab145fc7ff61e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.9\protocols.json

Filesize
3KB

MD5
f9fd82b572ef4ce41a3d1075acc52d22

SHA1
fdded5eef95391be440cc15f84ded0480c0141e3

SHA256
5f21978e992a53ebd9c138cb5391c481def7769e3525c586a8a94f276b3cd8d6

SHA512
17084cc74462310a608355fbeafa8b51f295fb5fd067dfc641e752e69b1ee4ffba0e9eafa263aab67daab780b9b6be370dd3b54dd4ba8426ab499e50ff5c7339

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
690f9d619434781cadb75580a074a84d

SHA1
9c952a5597941ab800cae7262842ab6ac0b82ab1

SHA256
fc2e4954dbe6b72d5b09e1dc6360ea699437a2551355c2950da0b3d3a4779fc1

SHA512
d6b1da8e7febf926e8b6c316164efbbac22c7c3d9e4933a19fffba3d1667e1993cdeb5064aa53816c0c53f9d2c53e204772de987eb18adbb094a0fb84ae61fa9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000007.log

Filesize
21KB

MD5
411d09f8d6ebd57168637550ed080015

SHA1
654917f6c71c3e121cb1e9635a8d01d23492accb

SHA256
3a5b028846c1ac964c8c9181af164ff8e8f0636ed1938d6473c2bb5ed317d176

SHA512
b703decd64e6073006c4124cc245af3b392be3104fa484fe7193e2dc26d26fc0850d9a8aea443cc76c1943cda736ce61e5d704bf83673bfcefa2b2f1b982f1b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old

Filesize
352B

MD5
dd8bdb3e222949823452dd416475d5e9

SHA1
5de75f25cde69f3aa77bc5ba645913b4a9251ee7

SHA256
177c635091a8f0b1a071fb404bc38e487085af31196e0a0181d2c8aa208cfc5a

SHA512
b917495d2fc93166ed6a6ab00c0111528c5f874b64ca58bf7ded7a1e289bd12ed5611c0c234f6707858c5dd1d6466618eb1194c8f4cddea92e7d3184bb2d474f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001

Filesize
268B

MD5
91a46703d1abf6b640af761246f0bd2f

SHA1
1a39e0f688193079440f92758e5cbed4de6b9ef4

SHA256
88b605ac8adbf98dddd40e69419d43610d22eff45fe6151871138f73516ac0e1

SHA512
da35f00bf7d542dc47b17166b0d97c233b02bdb6bfaee17bdd20227889eec9eeb71cc14213422e309a45446416bb4aac0de087a41cc36f7a2514e8a1ff7ee62a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009b

Filesize
85KB

MD5
76ca242042653bbeb7336666afc47eeb

SHA1
3fc7dbfc6475c3dc7aad74af4c0f681dcb2d7bb9

SHA256
fe3e9be31b063bf320e4847159614ac0d6ff675e3894d76815601343a8f6249d

SHA512
6f7971996a3a94ebc843340fe02b8a3ff9c394f9603f6e1298a378c4020fd3318cad340fa6221bc75d72ead836b56e52ac70afd408665e4e338028fbb69d3e22

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009f

Filesize
927KB

MD5
d92e995a6a35f58dc5a21b7d134dbaaa

SHA1
31ea5503b7d4df4e9be9eb74de116ff93b526239

SHA256
9a306a1de3489f44f291b5e84f59c9d6cbcca23f93fbab56adb4f48b9b1ee558

SHA512
7f559d0fd57c5c2da67a04e6984fca82cc039f6fee2aa913f8b6ff9c1e1d0e36f23e2e169edf57c33e1434ae6981bda405f82c3a6bcf6a717c45a962b3ed6970

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b4

Filesize
837KB

MD5
904b019b3a7304caa4c870fd8b9694ce

SHA1
e14542e634b2f16bcc6130d9b89fca1229b64514

SHA256
69ffd064bccc7084d05fbcfaffe2f0eeac9536d3101b20612f638bb831cd4992

SHA512
21c591af5a870f7f92522e2ef373f04b55214378730dbebd42e14bfad7cbbe3b066ace5380c6ba3e14dded58367738503b255bba7a118277ecb038090e957821

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b8

Filesize
20KB

MD5
f69cefb34e81abe998b7b4c0cc0cdbf0

SHA1
b4d4d39233a096793eddabac7b913373160ea7a1

SHA256
a8787de8a8d93bb7a6d9aa55572db8d806693978d0365240507ba62905657174

SHA512
6c8ceebb276bfe4ab080eb03bc8f497c72b7ce7fdd70d3d1689c60eb3dc091ff4af97fb21ae4dc9b6589c21638ef27c7194ee52780da6690c04baaa4c12fc4b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000bd

Filesize
1024KB

MD5
6355e1fe1ecf026e45336f5968bacaaf

SHA1
a42ac8da9ffcbd2d4f60201f7912a9485bd1ca3e

SHA256
bf15005e114584126512d8ea9af75ca6e7c11732949ecad3b172206b93998548

SHA512
552d5118d8bd6b35d8ad99fe553bfa12f9cdc35a880eb3d4808866ddc02ab42cc4696f705f87cd3fb38006752603597f422acffd0b412b106dbcc385fe82d6a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000be

Filesize
1024KB

MD5
8a18da458bdf40eb0fecd5453fd1c824

SHA1
5df69cf6538b7009068a4b635b53a63a19600170

SHA256
412fbec46b0c283b58ea03063da633bbe1da20dff2b4fb6cc1b5490a712685d3

SHA512
eba438c38fa33b4b962467b820c5b2730450749a4bfbc2073dbdc0f9c8f70d1c8d79535f790ceb58736614bf977b9308fbb76f22fb6c974e49ff8a252160d937

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000bf

Filesize
1024KB

MD5
8b73b5620662b7be008ad33f499ec32a

SHA1
25347634e2cee331de43ee5467495ca4c556b6b9

SHA256
635646536cc0c5b4d8ca24254d396ecfad97153bc53800ee4a935608d5a47b5e

SHA512
cad026303b390a0fdeba8d4855db0e38e04b3f928ac64d177c4a46f01e09576f84f1032a861334355fbeb7987011e314c38bf93389b1900f348c1a489691a6db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000e1

Filesize
67KB

MD5
60a30ef624fad5be472ee5d1acd1b2ab

SHA1
5dbb87bbc2e8a6143308e7928536ae778610794a

SHA256
d0ec8a13c2eb6a38d628cd7adaed308116164ceee003f816889b4db1735bfccf

SHA512
315e3ea4d4c6ccf6c14fc509933b01cb77c964b608cb95ce2ee8c331011adaf618e41cf4b8c499c4f6c9e137b88a34caaa7aaa44a69fdabed84df550e178d60a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000e5

Filesize
1024KB

MD5
1f5abb1ebc02e595ddbbae621ac326aa

SHA1
a74d3e60515156081d357c63c71e502c7cfabedc

SHA256
ce26540a3b4b776a42be14aba6d64a77dbddfd2e70865ca9c3ddd87c6e7e9f5c

SHA512
5ba9978125806b3d53a0f02b8b0d56531fdabb6fcb8919941a92ddf66150068b91c3f5073ff853f413a6075f348ab78b5af7865b770d864a59082eb14376e45f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000143

Filesize
21KB

MD5
d6f120944ac94311f350c2d19fe8d1c6

SHA1
401e3b21328895dba6629f135334b886fbc8a2de

SHA256
daa81f19c62f3c5304c7637656c1e689070da684538aec6813504859d88e9caa

SHA512
22bf67c198e93c7ac7b48c773b9102b7b9f19374e9699d964985a50b01a008fdf1b1a434824c405f3204ad73f131392b992145f5bdb5dd042bf39e98fc95a1ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00015a

Filesize
16KB

MD5
9c6b5ce6b3452e98573e6409c34dd73c

SHA1
de607fadef62e36945a409a838eb8fc36d819b42

SHA256
cd729039a1b314b25ea94b5c45c8d575d3387f7df83f98c233614bf09484a1fc

SHA512
4cfd6cc6e7af1e1c300a363a9be2c973d1797d2cd9b9009d9e1389b418dde76f5f976a6b4c2bf7ad075d784b5459f46420677370d72a0aaacd0bd477b251b8d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00015d

Filesize
62KB

MD5
292a7144ac6076827ee286446a70333b

SHA1
c44f65af003ad27b49ee90ecb3c8b1788ae0ddf6

SHA256
650a416042a408cbbe2448fb2ef009e0a3cab8c6344d32a52c1ae3d9a70dbe61

SHA512
0275591d449699dc3a65e49d4bbe457746b34f42f4fa7207e237a74bc75c2738dd2cc0a897cc01d91cf628f0ed0dc68619f219b85582bb99baccf1d78926e3e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000163

Filesize
23KB

MD5
8bb0a6e91cbcf4aca9c691e9225b34a8

SHA1
83d921cf6e8334253aded6cd30ffb5781cf3c0cb

SHA256
06df011163bc2147a0b8dbf5d412f24bfe7ebaaa1654a2d4ac2c68cc71373ddd

SHA512
27341610b65afd4d53f905989de533c340b3ea3b5da82463206e62e0880556786ae618459e06c9b24d43be73f59b7e5b68a85dd80ea52685fe18dc6b436e4cc4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000165

Filesize
48KB

MD5
2c497902a2b573596c5486bd3ba383f2

SHA1
09a202ef7c898dc204f1589cf4b662fb721d1950

SHA256
41dc1ec43b19e6cafe98f03a8212c5b37676df3c34e02f8cd654c5d4d8e84eac

SHA512
8f7d9f2e739e69edf522fb6a7a5accd2fa0d03682f6ea116e97f4113ce7567c7851ed342343119e77d163372d5f3fed89c36bbdfd2dbc9b17982af4a0661dcac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000175

Filesize
59KB

MD5
c082935421db88c0f7e4577be322cdd7

SHA1
8a170f7e425bccd8424fc3c128420611c21ced14

SHA256
58181a304b9bc3965b304f7a028b786e07d61801c15305f9fd57487940a2295d

SHA512
6ffbd30d88b69c07b8fdc8a27b10a8bb105adf0ba03f9feb21b5cad294e9b25d1db30cb00acba3db4149ff4b47f9c3359a9f30176c2fbecef3288a3d3d35ccf9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000178

Filesize
22KB

MD5
200ad90998391b4db23c01b3e8f9d8ec

SHA1
0effa349173fedafc65543c7f561a77453f9ad5b

SHA256
9ceb6beae7810a494969f2d44488e759b5daf43888f34fa3d8ecc4fa91bfa222

SHA512
4d83323aac4a9912178f3055f4f0e7828cdc319a93ee6e4957e9ed8331d50f71b67c76d1218f90305a4d466d5b65a8c995d121db63e79cd4ca4861d022bbf817

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00017c

Filesize
205KB

MD5
d3b8976e27142c4419f868b84af8dea2

SHA1
d13f402dd36ab008b888fc6eb02fa691f1e616b3

SHA256
13faec8c12303eb11119da6f58e7083183282f35ff7185d8530daffd2d22d9b8

SHA512
3917f7133a3594ca0d68b5640d0f8de44f137cd0dc61c1bb72ef05b7ad01991f2bb0332d98daa2f89bea59972537c4241db9aa868b9a0b4f6ab4dba38691c655

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\04ddf1cae2af6762_0

Filesize
303B

MD5
3ccede345d885dd7ce486c888954b412

SHA1
2a55e4ab54a3b0c83076e4600aa1c1967c31e08b

SHA256
8a1bf686a36e6664870062dea6b79efec27b09c10a89173fa95b5fd690ad04ba

SHA512
eea0b9697469d28b3078bf81d1be4a7ec92a24590c6a65f1c5e8247b82a6c3684ac6dc9d4737c88db6c41f6031cfca772d3ac950cca6ee02a9522e8d1464886c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e6a4f1f224ee3a7c_0

Filesize
55KB

MD5
eca7db1a9dd18f4c74d8afd2086894f1

SHA1
d7478241012d686c11a9148a5d3275159127bedb

SHA256
ffa9c95c0caee2e45d15e9457b719bf5f989dae5c3f3c04276921ecfee9c3c0b

SHA512
c57408e97c6e2cc811cf4eb9ac3353d84ecd84e076929b90c86a67a8ca7e68d6c6b5309764210d8cc5d1be56ed1f9bfb9cfa9d9b0ea407b41d2636f835c84e10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
7KB

MD5
36fb922c6a610a99ae2454e3addca475

SHA1
bcd699871eaf2c08d431f4315f0c361a56d32b03

SHA256
12d0af452ac6e7773574e9d9dc24df4360b00e22ec49ef82e626d8fc6440b69e

SHA512
97f92701167726cdb12f7b90f090b2d8d8e64364a21d6a5081c6e6c9926d21b5725e4f87742ad01cd26fbfc53dca63955dcdbffa24637de7179af1df0d2594a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
8KB

MD5
b7fe575bd8ee95589bbf038525ab3667

SHA1
895e194c11c6131b9449c50a24e8cb9f5e710924

SHA256
5bc2b88e9b7483e5f3cec1f0e6719c899b7374064cd3439c801239d3352b3d00

SHA512
b122500de9387a37118607e1ecd0ef13c709fc6177a4ced204bd3fdc68ab89ae00a6b6ae9a7b341dba319f9eb294247c1efbcac5b045deb00928e55e69de4035

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
6KB

MD5
c30dfb275e86910cef29143c7e7bffda

SHA1
5c3d1c46bf0204e445f4dceb2671f9db0c335981

SHA256
0997cc54873f209cb3f39f0dd4e668de1d1b3eb9423190eff5f94a7adb1f0fd3

SHA512
a1e76d82a881d789fbbf068b2600da5425c456c4b0fafd3b000f7b69ab2660afdc7745573cafa32a67f6417c1d4b7ddf8673e3cadad1bab93ffd73ef3cb869b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
8KB

MD5
5c3aade9392cb31b036ebcd3b44ddbf2

SHA1
64f935d7d99d71cf60b2a0add50a0780397c8ef9

SHA256
3435087b577e444fbaac63d914c26bd3485743df89b4b3f061c33e9716ca063b

SHA512
e25691e977064a0912f9d3f8dad8f30adcd572c46c8cb22c10563f80f12657d43023cb3d622ab63eeff0228f75e9245a223e161e61d2f3854392fc14ae18737b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
8KB

MD5
5f541fb1ddc7e940a3d46fffa8a30f29

SHA1
8b6347bbac4f30052527ffd221cadab7d55e017d

SHA256
11a1b05a87acb5dd7e6e75451097ee713fdf37376d6ebaa154438e8ca5864002

SHA512
a7b58853c486e4e42ec3f8863486e7320c197dd3d263791a64eb16a0eb953ccd47efcac55b7790e8fee3a7a3204a969507dbf7a220ccbec6083e96602fa77d45

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
7KB

MD5
f3709cdb03acfb007e216aa4b5966c84

SHA1
4ab0b165b35d9311fa2e620df2723d733c96476b

SHA256
a7e3ebd24ee2034380b45a435990ec55f809bc65d593df454033fab0e68df6df

SHA512
e32cec7f954da63e6f869dc007bc4427a07bcf18e1cfd911fecc1c7f5598aec6f8fe56d0ebbd9e4130a3b454d914e85ed4f92df90ee5ef3475d654df4f4254ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
7KB

MD5
8472494b7c6fb4ab464daec570200405

SHA1
4949e3f9219be1949947f088d2a0feca73d2905f

SHA256
114fe9178f86099e966b6c3c43fd15076ec5dd193deecd54164e709ba16166db

SHA512
2f05eb631318b04be6614c79af39467590a7446912a39c36dd1d861ad09918ce242a6c3a99369b0e34b256f32d14115e6aaf0e80ad0c8190abb7a6815eb8894d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
9KB

MD5
181efeaf7a365537a018d030e5de9be6

SHA1
d1e88e7f8b3500fd2b9b42f5c07096b2a364e90c

SHA256
552b07fd7d966ddd95b137a01d4fff91668949a8d85986bb4fd3b0ede19a85c2

SHA512
63bb577e518589db199ada8808019c32e12639a6d2bbe6b8d8d2696bab46cc5c185b0ff57f99c1fbf7d3643ac8d40f9d13e1f3450c0f6ac33a3ad1659430a49b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
9KB

MD5
7af0fdbb13d189251b2aa78943d56435

SHA1
03c2883a9fa070f4f1cde7106c0b5d995da44479

SHA256
25957aaf7e5afda6b840e5176d79469d2f8af6d7294bd0a9f2f9df7a991ce46b

SHA512
033cd517ad9c11e474a15da292cb4d7392b8a721814894b656648a4ff68e95bff50ebd6affc7fcbf2ab87559e1fc55a12c09584f1112b467010f71f55c97b8aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
8KB

MD5
8a3aec8ee5da48c4f97fbeeb40c09bcd

SHA1
917c99a8f1c6f7167cccb894f5bbc141483d6808

SHA256
be8cc954a7dcc3cccccf1852bedc1384d7bc9865644eb724e3ccd62e15a932fe

SHA512
f9019d462bd2abc09da068205ecf0fd8e48775dae4472fa4b4d03a356f914a0351e9bb2004ab92a7999159c073984b1395bdd1dfff7f94672734347db36dfc10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
9KB

MD5
a42ba4388717f81b8d4ed884c24fdb7b

SHA1
b881beaa7894c27f9d9b66dc878856f9926af2d6

SHA256
80d998e2778b387f51a896900c09fefe76d6919ba354e06320ba5fd292b981d1

SHA512
53082aa781320acd05f3d9daf8904c244d08d2d7e4a0da28018aee16ceda1c2d9439fd9652f10b36153e3f9d964ea1b404a204f2e41ddb6f20ea748cac4ba5f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
9KB

MD5
413624530cbcf33fc18a3af2cbd6b25a

SHA1
4120b6e41802e26f3f7c4cda4aa208699f862da9

SHA256
9f6f05367bc208569360bbdf60ec84e110d23641bbe88685966768df3c304da4

SHA512
86cc3736426cbf54350709980f6f545a06dff5e859ff542d923b836e7da518cdfb4bbca1757d70b43bed1f1108be6b444836dafff1be314fb5c1d77369d97160

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
9KB

MD5
590e13cc373cd6cd4f594524299cd1a1

SHA1
dd7b933f49a58db9c1fe0bc2e6012b037ddc535e

SHA256
1e9e17fafe5593e82b886f34d419c086a47d71bd4ed50b293c1b8c016b066a69

SHA512
89e1c15e7edb9539b34a696aa75115a9440237c513cc5a952c2c78cf05ec62565f9b76572ad6a806511e35aacf5593341f21f6a9dbf3216123d9b11d7f6a8143

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
9KB

MD5
c76b829d5027cea0798e11560aec5dbb

SHA1
c116c87b700153ec5d38e63ddedd6e85062788b3

SHA256
cbcf39bcdf5576f367f4d21648287c87cb85c0bd38874c3f4e322103537d0f25

SHA512
1b0b828278add3b4a765e37b249c22f7470f4dcb2688579c3e7eda73c09dbed85f6af5237818a405e1afa58117836a97e045afd0c71c2f008cc3f4bbc22d6201

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
8KB

MD5
a98bbe97d41df35d8ab3d6b632fdfc85

SHA1
fdf68808474c410192f07a606cacea655aa1fcc6

SHA256
c03abab4b1265ed31fe39048fee5cb2539ce883ce751b5e539ac91ca4bc928a5

SHA512
535269e92d6808d5386a51f679c8fd3e5201cc5e532e272181443dc68e3acb09ace1c8d8c14a466e33aad2bd697a9a8bb6d0ae90db4c9ee031b2fac42e5c0fe3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
9KB

MD5
e77860f1551b7bf3f7e2b0801e5a73a8

SHA1
899ce60cb04db7648484131e35156f98d637b9fc

SHA256
8a892b98ac0c8496a9d1eb1f5f560bf446402846c56bc30c820ee289f24fa9e9

SHA512
2851b49d610f16bcf55bde89ef530b3e510372625a73e4d02412900bf02e2fc9a5dfbd59baf281ddf5db0194811e6a27619430360921408e8fbbe9f818d66216

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
9KB

MD5
1b478178488f9567b5f9ce53a54bd341

SHA1
ef69c7f8b5e1b58b1a73d20306ec6c87ab6d25d7

SHA256
9eb26954118d9811973810b0f84d23917e716e5abdc200b4bbeb8443c2c26f69

SHA512
2af209580c8be0221513033e408c13fc45622c3d3b2bb13b8db63c5b08927e727b66ed53214eb17a2b15ad00472cf7f9c2686f0618461b97c40bd2417eb77e35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
8KB

MD5
19bc21a042c4285ef5e91344d3978b1a

SHA1
cb91d2ea3b9affd8cc8cba2419327a6ddddb4589

SHA256
af6ada7b2e66169d4c1b7fedfefd4b371f33e1bc068661446ce21105ea9ab9b3

SHA512
3305c1acde644a6c0acdc77ba0c96d8876d236064f76f2fb288da66fb583d80af9554c430d390e536fa2413cc378731c3b0a60586f793b1db4c8470fd446272d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe580422.TMP

Filesize
3KB

MD5
11ee83dc074045225db41ec345fbbbf2

SHA1
8f6e44e43ed48011f6bbcd4f5998022bc5cfca10

SHA256
7eb1280190a89d791f2bb5826ddff7c433282d49e5a6fdb15292d3bda6f6e835

SHA512
eea41b0f73a783a354f720accd0e8b338eeb4e62987a464c186b318e06027b572db2f3aae209e46633e6e70b2561b5a31c2760827f5728ba66032fb186307d3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
40e2018187b61af5be8caf035fb72882

SHA1
72a0b7bcb454b6b727bf90da35879b3e9a70621e

SHA256
b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5

SHA512
a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_fortnite.gg_0.indexeddb.leveldb\MANIFEST-000001

Filesize
23B

MD5
3fd11ff447c1ee23538dc4d9724427a3

SHA1
1335e6f71cc4e3cf7025233523b4760f8893e9c9

SHA256
720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed

SHA512
10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
33KB

MD5
6054d81b1946d57b526716877be43fb9

SHA1
bac43a3e44f74be8796dd1b9453cf163315e36ac

SHA256
da820e5c5daf43b2f5f434c8f6a24763ae1a0d8865d107507831a62a70a92cc6

SHA512
8a9c98cdef8923daf80aa2c66cffe58d287a9dfb37a4f167b98bc28062a42ca00ef909157212d427129e23947832e3e955aa575458d33db2a714a44ec6e25193

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
32KB

MD5
1e85dc64a764455f5597d879aa9349c1

SHA1
a3bf7b0ea2fb1e0a915f13e1aa4545e00841dafa

SHA256
2ee42fe95d406a77fc57350395cad6795a227af122932510db1a079fad8177d8

SHA512
336062350e140b28095ca456140704202a6227fb6d407b230c9399f8abe0ed91a5c28a4e9a176dd228a15eb59a04ab660521ed65320350af85a88a68e6050d49

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
31KB

MD5
c1f2369381e113c9ad42d5a25ca9d5ab

SHA1
61c1f959ab36882ad4f1fa1446f80091a932792a

SHA256
d3fd0cc533b973db38ce8e5542b5e89122e23b216ac7a5b7c75ba9e82fae2e85

SHA512
b5a42dd5b4bfba340b36845b64ddb83e2195cf2e142e12ec74693a1c0d15bc1a25cb08903d8babda0e9aea4b1f4f3539bc1db10d3e80c1bc83439356931f0577

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
33KB

MD5
51b2583c6f3005c0c404958bbd7d522c

SHA1
c1c8ac07e4d30c7b9061641a3f52253c093b3e96

SHA256
d860641d84b4756a89350705899f711e72d6dfe0a52b5e6152a274d0b8b56958

SHA512
d7b532d3295aa46957c370cc548b58d222533702a478528515b93c66ea55bb8c8387eb14a4224ade9d7288a7341351c399e083be8b510c1ec80b51cbae972ec2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
34KB

MD5
1e68aea3f3ddd8f845dfb7ab2f11a63e

SHA1
9c730837d14eeec02eaa913f1ebeb47b94daf765

SHA256
715c6377589c96ee9c68f89e8acb282f0d0c4b55d4d63e9a0625d8679204d007

SHA512
c2628d4c220a0582b5bed5b8f4f05ea8dafefb6b6c17688eb3c67acbd1904b50517f45d6a38502feca141efcbd0e8e87f0843825ec617139024e811b86469cdc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
33KB

MD5
924d2140898dbc51f4784c6bc7933132

SHA1
9f21e79e08d0dce0a813660cc117f0d2b9ca8a7b

SHA256
23c5dbe87a5f5d798895c508d719bf01894e07d6088c42873324ffb14f0477cc

SHA512
b42ee6ce4d8b52f76ec0a4c6fefe640a11308a8cae349f234fb3d742b3b640522df3ad8497b2f37d4cf5ef4cf155de57cdead1a0e5cf338e8ef856a598b02892

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
31KB

MD5
79ae09d9859f2c3220942e40c93636e0

SHA1
7a10e86df5961a33fec039ab0f58ca2d43337c4a

SHA256
0c3a24488bbd22819cb8e490edeab4e4d69630a3514423b83429b61e0a4b6ca1

SHA512
471dad9faae03b81592170f6d577615a4dbec58cb5bbe076898915224c5a0b78f793e72ad5660d5ce91907c9f3c971d363eefa783599ec625742e880bb89b9c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
24KB

MD5
6ac3eef764f74ed98304f09cbf7a54d2

SHA1
fa02e04ff1858529f114c813acc232e8b4445743

SHA256
692746d1b45e05973bb4f4405a171b954e2dab654473def1405fa0e1ef7ae798

SHA512
372fcb7eaecdc304380590630bb04d8f762b1374c23cbcfb330687bd2d585b99e05fe4e6a1fc3815cbaee082989b456cef926c9a828a1a06854e01e69254b287

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
36KB

MD5
4706d275ddf71f1b997ddab1a370f395

SHA1
b7f5112ebc38c7e31af26711fe54f7fbc382667d

SHA256
fb032e9f6e94edd9456067029dfa2b219eb09b7b3919b88d4b8767eed4f7a44d

SHA512
81027ebc3b2fc66e162a57699809dc3eb3a5add6bc7f84fe6f7e34d15eac3923888ec55e005e98bf068d67a917a40f061cd79872ac024b2229e010b54ad84103

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\43777905-94d9-469f-bdca-c5a9e2858271\index-dir\the-real-index

Filesize
1KB

MD5
bc9cd9b7d5f4c182513f41983e79764d

SHA1
602787923355662acd6b8663bb43d3f32aa7cc79

SHA256
0d9d0ad8d6b63d35e4cb2e3eb36ca163e9021d43f39f23fd666cc40998202481

SHA512
a9800136dd1662bc18ee22a37165daebd7719bb262c198e6b3124ed1aebcc13fba6696c2ac38a2539c83cd6a4ea4f458ebd43cb9480820710b2d05b81c36b436

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\43777905-94d9-469f-bdca-c5a9e2858271\index-dir\the-real-index~RFe5bf876.TMP

Filesize
1KB

MD5
f32adb894b3eb8c2a89c0e89d069b8c2

SHA1
ec0e38b050c40f1d299f93691ae6ee91b7cccd18

SHA256
cbf6862c61fb071b75a05fb57d2374da6e06da68f4aaf549961d33c76e98309c

SHA512
6cf853b143e0f9195f6a2694ef4a95ebfac91c8fe1974d18c93ebdc3f2536140719a938f53c2dcdd3c5ba69d52edf783b3da052938647abcbbb4d8f27ebde02b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt

Filesize
253B

MD5
e978aa778283a873e6a0903377dba1bd

SHA1
cfef8511b38d492d5a1c771538a66bb57c22b6b8

SHA256
de9d3eb7959de29ce262dbb508822a0f68fc5885f1a525f50b74e6f63c6698f7

SHA512
b3a21d4a8201957ae4ccbf15b6c727a26d3168629cbd55cbc227471c45c4c33197d1e93696725b5b1eaebb757df03125c4d29c09ecb315d47432c0a7bb4e1a2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
09f9f11689fa13889120d3099e45c4a9

SHA1
6a2246f0311fb78fad105914c97e40be6810fb5c

SHA256
7ef8e602cd855ee3490813670ae5bad589ecc753c3745a869a89286c62c83814

SHA512
d89dda325dcb316c922dfd8f065fab15430031f49bd7e3d106a0f6eba9f22ba91ae49e157d182a9320aa301be87339db483488b99c8f0128c43b81d7ef61e80b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57b49a.TMP

Filesize
48B

MD5
b77ca2da528629e236a2718610a8b795

SHA1
393a7c57c2b0a1b35ff5c31fe20166380b456190

SHA256
2b6b2240e604c41a3fa1c273a946af27b812201fc240525fa4a7a2574c43b23b

SHA512
9d6ed7ba53137cc85cba44572ecd216d32302d3895985619ea30b6f11a991a1b9b0fada42153372dca0cad54551a25cbeb2f9275d6b7a71d27a749115dd5b6ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
12359eba68132ede9f2c117506a044be

SHA1
759447f52502dc33f1d51ebf92b7a6e8711ae5fc

SHA256
91b74778791774a8390b814437ecb2bb0398c491164753fd18102b74042d81a0

SHA512
d3b6d4412e07ab7c57ead1e5a11073d7a659ce1db7ec853e4097fa9b6af97049edba56c9a14866bf1d03a3b4090862e650b9ebd26ff7dd8abe4a5a979b717add

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.3.10\data.txt

Filesize
113KB

MD5
60beb7140ed66301648ef420cbaad02d

SHA1
7fac669b6758bb7b8e96e92a53569cf4360ab1aa

SHA256
95276c09f44b28100c0a21c161766eda784a983f019fc471290b1381e7ed9985

SHA512
6dfa4eca42aea86fba18bc4a3ab0eed87948ea1831e33d43426b3aca1816070ecb7fd024856ad571ca2734214a98cc55e413502b3deef2c4a101228a7377e9d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
23KB

MD5
231d606f1ecfa90832d762027574a5f3

SHA1
735d07f9c021110af7bf0daa228438431be33511

SHA256
2399cbda7189cb91b70f44007cdbab1c467fc8d48b62475685b1c461fcf42590

SHA512
37f738b36d0c7d96875b862d5a82a997a61035aa7307a5972ef2ce6a3c84564321d4480c1e83ce19d8fe0ad9c1c05c9cd505adad5f41af0f6e394e0be51d44bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
467B

MD5
3ace1577ffce507091a69bf51ab65d7f

SHA1
722666f50fd88bd184664dfefb862017c3f0bf53

SHA256
74352d67d4488dc7b78c8de05006928acf29081f7237d53f8b0b0bbdd2a27a64

SHA512
00595f1a71153591e98f1b63bdc6a677a999b99d73cf5a9362499748fc320cc9620dd64e4dbf6f2f25a2f1f1344d207ce149061ba9295b332647b7581cf65cef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
900B

MD5
1dd7c52412c1a5c25f48a7e9b23435e6

SHA1
884916a8322b20ff2a628a6bb2149932bf3601bf

SHA256
1a16f45e062d4862f842776e4bb808537fac7ef9d66f5531237f64a6df077ff3

SHA512
6e73521282e7ca90d73815638f60540ca4ffe74b941cd537c6b261055009856738a99ed451fb3b7ea8d402d12cdd249d18afa8f5223f964c9830a16125504620

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
19KB

MD5
41c1930548d8b99ff1dbb64ba7fecb3d

SHA1
d8acfeaf7c74e2b289be37687f886f50c01d4f2f

SHA256
16cee17a989167242dd7ee2755721e357dd23bcfcb61f5789cc19deafe7ca502

SHA512
a684d61324c71ac15f3a907788ab2150f61e7e2b2bf13ca08c14e9822b22336d0d45d9ff2a2a145aa7321d28d6b71408f9515131f8a1bd9f4927b105e6471b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
54KB

MD5
eb043c69e392d69e9e086321cb0ba296

SHA1
d1c109704a2ca3beaa306761a54fbd9f4c226ebb

SHA256
6551291d30ea0c080732de2b65745031e30d8b168f4c4707d139fbebb3d2d5d6

SHA512
ccd3dfdd88aaf3906ab518330e545397e95a3cd7fcfcf3af8b176731816c1030f9805aaacf150f33257f17d91d8a17824665241bda9433f4bada62ecb574402c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
674272a839eedc5d260f939d734aa2b2

SHA1
a5f23ad1a4603db96dcc4997868d7a3f9948e57a

SHA256
942285334fcbbc1bd7a2f04938cdaac3427d4a8b3de5d9584c5426b0ec6067c5

SHA512
01d1b4831837fa3a0159103096f2cbfb8c56ee642aabaa9668082d9aecea6ef26780aac48049a970dc0f7c584cdcc70da22a9aa9c104e312296914a5f6758ea3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
767645091ef4e3247e5f94dc7b51715c

SHA1
95ccffb4f3cf6f49ea61ee6224dbe7cea16b554d

SHA256
34be695161900f6ac4f618f5632b0e7bd373a63cb2d5af78688fb8ca27628631

SHA512
671985de8e815387cf64a4ae40a9bbcfefff96081d8db3c49f0f7ca87e3d4b994f477e5cb065345f1a3555c7fbd571e0da807dfcc4f59004a34de6ad104c8989

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\22.0.0.0\crs.pb

Filesize
289KB

MD5
2b59269e7efdd95ba14eeb780dfb98c2

SHA1
b3f84cbc37a79eeecb8f1f39b615577d78600096

SHA256
ff2ced650772249abb57f6f19c5d0322d6df22c85c7cf2be193b6134e1b95172

SHA512
e4b454db2248021e0d198805ea54f1c0cfd84b9716a9348b1d0e0acb7c6fb5dd0839e532a5eb6d4410ab759d6688dd6cce8375ad55a150d738d280993142e9d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\22.0.0.0\ct_config.pb

Filesize
8KB

MD5
811b65320a82ebd6686fabf4bb1cb81a

SHA1
c660d448114043babec5d1c9c2584df6fab7f69b

SHA256
52687dd0c06f86a2298a4442ab8afa9b608271ec01a67217d7b58dab7e507bdf

SHA512
33350cce447508269b7714d9e551560553e020d6acf37a6a6021dc497d4008ce9e532dd615ad68872d75da22ac2039ef0b4fa70c23ec4b58043c468d5d75fd81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\22.0.0.0\kp_pinslist.pb

Filesize
11KB

MD5
0779206f78d8b0d540445a10cb51670c

SHA1
67f0f916be73bf5cffd3f4c4aa8d122c7d73ad54

SHA256
bf0945921058b9e67db61e6a559531af2f9b78d5fbedb0b411384225bdd366ec

SHA512
4140b2debe9c0b04e1e59be1387dca0e8e2f3cbc1f67830cbc723864acc2276cde9529295dcb4138fa0e2e116416658753fe46901dfa572bdfe6c7fb67bd8478

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
468e7db46ac79e77ca3153cb69320d13

SHA1
48693cb95543a53457d3499d02b558f98af7daae

SHA256
35ba9684848adad48e4d879afed38e1b211f43e293368f7da9c6415e0a057b58

SHA512
22e0d05980c6d822623c64a317f49acf56a3fde3f55b80977a20325f8a384b00d0697f2cee8627b52a6686c76b4186467f436d4dbf463b6be4399f8358c3c7f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe582bed.TMP

Filesize
392B

MD5
b8e779c6e707fcac096ceca8eb6548cd

SHA1
4b91b28018fbc947862bc02752a53738e405a145

SHA256
3e2f85abe7e213d875181dfc09393e22411554a6da44cc8a4cf675314dcd12d2

SHA512
c6adf54e3515c76e21d76eb01f65fad24a0ede6837ed9b20a966395f4bf10a1146a6c7ef46022cafe0f31442872eb37851ff1d9d36040e9ff22a3c65716c4b4b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.57\Filtering Rules

Filesize
1.8MB

MD5
d7c9c6d2e1d9ae242d68a8316f41198c

SHA1
8d2ddccc88a10468e5bffad1bd377be82d053357

SHA256
f215127185b2ee6b01e12b6ca75d3e5c4e454598dd4aed36124ae13d59afd547

SHA512
7fd14824e9200dd99e1fd2cee402656dc0cfc3d0a60058c5eb05c68e9e65b7f0b47e550fb4d6c2b59eba204dbf3ef9e69dc9723b43a9b3ccd5412d6b77715fc3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.57\LICENSE

Filesize
24KB

MD5
aad9405766b20014ab3beb08b99536de

SHA1
486a379bdfeecdc99ed3f4617f35ae65babe9d47

SHA256
ed0f972d56566a96fb2f128a7b58091dfbf32dc365b975bc9318c9701677f44d

SHA512
bd9bf257306fdaff3f1e3e1fccb1f0d6a3181d436035124bd4953679d1af2cd5b4cc053b0e2ef17745ae44ae919cd8fd9663fbc0cd9ed36607e9b2472c206852

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2025.1.17.1\keys.json

Filesize
6KB

MD5
bef4f9f856321c6dccb47a61f605e823

SHA1
8e60af5b17ed70db0505d7e1647a8bc9f7612939

SHA256
fd1847df25032c4eef34e045ba0333f9bd3cb38c14344f1c01b48f61f0cfd5c5

SHA512
bdec3e243a6f39bfea4130c85b162ea00a4974c6057cd06a05348ac54517201bbf595fcc7c22a4ab2c16212c6009f58df7445c40c82722ab4fa1c8d49d39755c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2025.3.27.1\typosquatting_list.pb

Filesize
628KB

MD5
291dc27655975b5be12155942f2d5fe5

SHA1
a2ed705924a4876ef92d17cca8883e7bd0ca6318

SHA256
e3ad9d77cabb94127ba2788196495e416bc58e7e7062fde2dfadb49df8a54296

SHA512
a34ead26dd64d97a30f2c76ff6a29d71573e1c343da5fe8b499e764fbd0a9c0cc432d309ed8e5b627eac59dd5597a8c64af69a96791ff5b9b85f134985fb6c65

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Well Known Domains\1.2.0.0\well_known_domains.dll

Filesize
572KB

MD5
f5f5b37fd514776f455864502c852773

SHA1
8d5ed434173fd77feb33cb6cb0fad5e2388d97c6

SHA256
2778063e5ded354d852004e80492edb3a0f731b838bb27ba3a233bc937592f6e

SHA512
b0931f1cae171190e6ec8880f4d560cc7b3d5bffe1db11525bd133eaf51e2e0b3c920ea194d6c7577f95e7b4b4380f7845c82eb2898ad1f5c35d4550f93a14b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ghbmnnjooekpmoecnnnilnnbdlolhkhi_1.fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72

Filesize
152KB

MD5
dd9bf8448d3ddcfd067967f01e8bf6d7

SHA1
d7829475b2bd6a3baa8fabfaf39af57c6439b35e

SHA256
fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72

SHA512
65347df34378c2bbb34417e2cccfb3251a0b2412422cc190eed9df525b6e0a9948e0295ea3c33b3ad873ce81e369e89a138ac41d6eb7229546c3269107e661de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
20d7ab90da89dc4d8edaff1653747774

SHA1
dafbbc6094cc88dec059d12accbc31fe1e818e2a

SHA256
75dfc051f502c0f894b792b30c8ca61de8d278f8327ae71fbbbd66387378ec83

SHA512
3c9b0ebb088989dfc11ada671611d161a6b6887747786a0704ab4fe712fd15cacd88b83408cfa2528227adcb017a9a224ff7ee638f5c245320d56dfb61e64010

Download Submit