hxxps://bebetter-fivem[.]space/download

Resubmissions

12/04/2025, 19:20

250412-x19jdszns5 10

12/04/2025, 19:18

250412-xz2r6azxby 4

Analysis

max time kernel
106s
max time network
108s
platform
windows11-21h2_x64
resource
win11-20250410-en
resource tags

arch:x64arch:x86image:win11-20250410-enlocale:en-usos:windows11-21h2-x64system
submitted
12/04/2025, 19:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://bebetter-fivem.space/download

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4032_884284688\hyph-gu.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4032_884284688\hyph-sq.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4032_884284688\hyph-ta.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4032_884284688\hyph-und-ethi.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4032_463683017\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4032_884284688\hyph-cy.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4032_884284688\hyph-mn-cyrl.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4032_884284688\hyph-sk.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4032_884284688\hyph-hi.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4032_884284688\hyph-nn.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4032_884284688\hyph-or.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4032_463683017\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4032_1172927675\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4032_884284688\hyph-gl.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4032_884284688\hyph-la.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4032_884284688\hyph-nb.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4032_884284688\hyph-nl.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4032_463683017\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4032_884284688\hyph-en-gb.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4032_884284688\hyph-it.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4032_884284688\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4032_74785275\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4032_884284688\hyph-hy.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4032_884284688\hyph-sl.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4032_884284688\_metadata\verified_contents.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4032_463683017\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4032_884284688\hyph-eu.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4032_884284688\hyph-fr.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4032_884284688\hyph-ka.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4032_884284688\hyph-lt.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4032_884284688\hyph-sv.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4032_884284688\hyph-uk.hyb	msedge.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4032_1172927675\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4032_884284688\hyph-de-ch-1901.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4032_884284688\hyph-es.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4032_884284688\hyph-te.hyb	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4032_884284688\hyph-kn.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4032_884284688\hyph-ru.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4032_884284688\hyph-as.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4032_884284688\hyph-hr.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4032_884284688\hyph-pt.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4032_884284688\hyph-tk.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4032_884284688\hyph-bn.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4032_884284688\hyph-de-1996.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4032_884284688\hyph-et.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4032_884284688\hyph-ga.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4032_884284688\hyph-mr.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4032_884284688\hyph-mul-ethi.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4032_884284688\hyph-cu.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4032_884284688\hyph-hu.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4032_884284688\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4032_463683017\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4032_74785275\deny_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4032_884284688\hyph-de-1901.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4032_884284688\hyph-el.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4032_884284688\hyph-en-us.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4032_884284688\hyph-pa.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4032_74785275\deny_full_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4032_74785275\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4032_884284688\hyph-af.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4032_884284688\hyph-bg.hyb	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133889591065643664"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4144164418-4152157973-2926181071-1000\{723D7AD0-DEAD-4477-BF57-58A6EC80BC94}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4144164418-4152157973-2926181071-1000\{4867E9A6-AC89-4F90-8109-B4D362C3215A}	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4032	msedge.exe
4032	msedge.exe
1300	chrome.exe
1300	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
4032	msedge.exe
4032	msedge.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1300	chrome.exe
Token: SeCreatePagefilePrivilege	1300	chrome.exe
Token: SeShutdownPrivilege	1300	chrome.exe
Token: SeCreatePagefilePrivilege	1300	chrome.exe
Token: SeShutdownPrivilege	1300	chrome.exe
Token: SeCreatePagefilePrivilege	1300	chrome.exe
Token: SeShutdownPrivilege	1300	chrome.exe
Token: SeCreatePagefilePrivilege	1300	chrome.exe
Token: SeShutdownPrivilege	1300	chrome.exe
Token: SeCreatePagefilePrivilege	1300	chrome.exe
Token: SeShutdownPrivilege	1300	chrome.exe
Token: SeCreatePagefilePrivilege	1300	chrome.exe
Token: SeShutdownPrivilege	1300	chrome.exe
Token: SeCreatePagefilePrivilege	1300	chrome.exe
Token: SeShutdownPrivilege	1300	chrome.exe
Token: SeCreatePagefilePrivilege	1300	chrome.exe
Token: SeShutdownPrivilege	1300	chrome.exe
Token: SeCreatePagefilePrivilege	1300	chrome.exe
Token: SeShutdownPrivilege	1300	chrome.exe
Token: SeCreatePagefilePrivilege	1300	chrome.exe
Token: SeShutdownPrivilege	1300	chrome.exe
Token: SeCreatePagefilePrivilege	1300	chrome.exe
Token: SeShutdownPrivilege	1300	chrome.exe
Token: SeCreatePagefilePrivilege	1300	chrome.exe
Token: SeShutdownPrivilege	1300	chrome.exe
Token: SeCreatePagefilePrivilege	1300	chrome.exe
Token: SeShutdownPrivilege	1300	chrome.exe
Token: SeCreatePagefilePrivilege	1300	chrome.exe
Token: SeShutdownPrivilege	1300	chrome.exe
Token: SeCreatePagefilePrivilege	1300	chrome.exe
Token: SeShutdownPrivilege	1300	chrome.exe
Token: SeCreatePagefilePrivilege	1300	chrome.exe
Token: SeShutdownPrivilege	1300	chrome.exe
Token: SeCreatePagefilePrivilege	1300	chrome.exe
Token: SeShutdownPrivilege	1300	chrome.exe
Token: SeCreatePagefilePrivilege	1300	chrome.exe
Token: SeShutdownPrivilege	1300	chrome.exe
Token: SeCreatePagefilePrivilege	1300	chrome.exe
Token: SeShutdownPrivilege	1300	chrome.exe
Token: SeCreatePagefilePrivilege	1300	chrome.exe

Suspicious use of FindShellTrayWindow 56 IoCs

pid	Process
5372	msedge.exe
5372	msedge.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe
1300	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5372 wrote to memory of 3712	5372	msedge.exe	79
PID 5372 wrote to memory of 3712	5372	msedge.exe	79
PID 5372 wrote to memory of 6060	5372	msedge.exe	80
PID 5372 wrote to memory of 6060	5372	msedge.exe	80
PID 5372 wrote to memory of 3156	5372	msedge.exe	81
PID 5372 wrote to memory of 3156	5372	msedge.exe	81
PID 5372 wrote to memory of 3156	5372	msedge.exe	81
PID 5372 wrote to memory of 3156	5372	msedge.exe	81
PID 5372 wrote to memory of 3156	5372	msedge.exe	81
PID 5372 wrote to memory of 3156	5372	msedge.exe	81
PID 5372 wrote to memory of 3156	5372	msedge.exe	81
PID 5372 wrote to memory of 3156	5372	msedge.exe	81
PID 5372 wrote to memory of 3156	5372	msedge.exe	81
PID 5372 wrote to memory of 3156	5372	msedge.exe	81
PID 5372 wrote to memory of 3156	5372	msedge.exe	81
PID 5372 wrote to memory of 3156	5372	msedge.exe	81
PID 5372 wrote to memory of 3156	5372	msedge.exe	81
PID 5372 wrote to memory of 3156	5372	msedge.exe	81
PID 5372 wrote to memory of 3156	5372	msedge.exe	81
PID 5372 wrote to memory of 3156	5372	msedge.exe	81
PID 5372 wrote to memory of 3156	5372	msedge.exe	81
PID 5372 wrote to memory of 3156	5372	msedge.exe	81
PID 5372 wrote to memory of 3156	5372	msedge.exe	81
PID 5372 wrote to memory of 3156	5372	msedge.exe	81
PID 5372 wrote to memory of 3156	5372	msedge.exe	81
PID 5372 wrote to memory of 3156	5372	msedge.exe	81
PID 5372 wrote to memory of 3156	5372	msedge.exe	81
PID 5372 wrote to memory of 3156	5372	msedge.exe	81
PID 5372 wrote to memory of 3156	5372	msedge.exe	81
PID 5372 wrote to memory of 3156	5372	msedge.exe	81
PID 5372 wrote to memory of 3156	5372	msedge.exe	81
PID 5372 wrote to memory of 3156	5372	msedge.exe	81
PID 5372 wrote to memory of 3156	5372	msedge.exe	81
PID 5372 wrote to memory of 3156	5372	msedge.exe	81
PID 5372 wrote to memory of 3156	5372	msedge.exe	81
PID 5372 wrote to memory of 3156	5372	msedge.exe	81
PID 5372 wrote to memory of 3156	5372	msedge.exe	81
PID 5372 wrote to memory of 3156	5372	msedge.exe	81
PID 5372 wrote to memory of 3156	5372	msedge.exe	81
PID 5372 wrote to memory of 3156	5372	msedge.exe	81
PID 5372 wrote to memory of 3156	5372	msedge.exe	81
PID 5372 wrote to memory of 3156	5372	msedge.exe	81
PID 5372 wrote to memory of 3156	5372	msedge.exe	81
PID 5372 wrote to memory of 3156	5372	msedge.exe	81
PID 5372 wrote to memory of 3156	5372	msedge.exe	81
PID 5372 wrote to memory of 3156	5372	msedge.exe	81
PID 5372 wrote to memory of 3156	5372	msedge.exe	81
PID 5372 wrote to memory of 3156	5372	msedge.exe	81
PID 5372 wrote to memory of 3156	5372	msedge.exe	81
PID 5372 wrote to memory of 3156	5372	msedge.exe	81
PID 5372 wrote to memory of 3156	5372	msedge.exe	81
PID 5372 wrote to memory of 3156	5372	msedge.exe	81
PID 5372 wrote to memory of 3156	5372	msedge.exe	81
PID 5372 wrote to memory of 3156	5372	msedge.exe	81
PID 5372 wrote to memory of 3156	5372	msedge.exe	81
PID 5372 wrote to memory of 4028	5372	msedge.exe	82
PID 5372 wrote to memory of 4028	5372	msedge.exe	82
PID 5372 wrote to memory of 4028	5372	msedge.exe	82
PID 5372 wrote to memory of 4028	5372	msedge.exe	82
PID 5372 wrote to memory of 4028	5372	msedge.exe	82
PID 5372 wrote to memory of 4028	5372	msedge.exe	82
PID 5372 wrote to memory of 4028	5372	msedge.exe	82
PID 5372 wrote to memory of 4028	5372	msedge.exe	82
PID 5372 wrote to memory of 4028	5372	msedge.exe	82

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://bebetter-fivem.space/download
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2e0,0x350,0x7ffc7a58f208,0x7ffc7a58f214,0x7ffc7a58f220
  2⤵
  PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1732,i,16008099341659919604,9791374010736878864,262144 --variations-seed-version --mojo-platform-channel-handle=2096 /prefetch:11
  2⤵
  PID:6060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2060,i,16008099341659919604,9791374010736878864,262144 --variations-seed-version --mojo-platform-channel-handle=2056 /prefetch:2
  2⤵
  PID:3156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2432,i,16008099341659919604,9791374010736878864,262144 --variations-seed-version --mojo-platform-channel-handle=2452 /prefetch:13
  2⤵
  PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3364,i,16008099341659919604,9791374010736878864,262144 --variations-seed-version --mojo-platform-channel-handle=3416 /prefetch:1
  2⤵
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3392,i,16008099341659919604,9791374010736878864,262144 --variations-seed-version --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4832,i,16008099341659919604,9791374010736878864,262144 --variations-seed-version --mojo-platform-channel-handle=4880 /prefetch:14
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4708,i,16008099341659919604,9791374010736878864,262144 --variations-seed-version --mojo-platform-channel-handle=4840 /prefetch:14
  2⤵
  PID:2796
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5624,i,16008099341659919604,9791374010736878864,262144 --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:14
  2⤵
  PID:5508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5696,i,16008099341659919604,9791374010736878864,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:14
  2⤵
  PID:2436
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1140
    3⤵
    PID:3580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5728,i,16008099341659919604,9791374010736878864,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:14
  2⤵
  PID:2636
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5624,i,16008099341659919604,9791374010736878864,262144 --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:14
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --field-trial-handle=5744,i,16008099341659919604,9791374010736878864,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:1
  2⤵
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  PID:4032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x240,0x244,0x248,0x23c,0x254,0x7ffc7a58f208,0x7ffc7a58f214,0x7ffc7a58f220
    3⤵
    PID:5704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1764,i,4669005577541328898,15378236334654776305,262144 --variations-seed-version --mojo-platform-channel-handle=2180 /prefetch:11
    3⤵
    PID:5844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2148,i,4669005577541328898,15378236334654776305,262144 --variations-seed-version --mojo-platform-channel-handle=2140 /prefetch:2
    3⤵
    PID:5240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2508,i,4669005577541328898,15378236334654776305,262144 --variations-seed-version --mojo-platform-channel-handle=2516 /prefetch:13
    3⤵
    PID:2844
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4364,i,4669005577541328898,15378236334654776305,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:14
    3⤵
    PID:3136
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4364,i,4669005577541328898,15378236334654776305,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:14
    3⤵
    PID:5988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4548,i,4669005577541328898,15378236334654776305,262144 --variations-seed-version --mojo-platform-channel-handle=4540 /prefetch:14
    3⤵
    PID:1704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=4640,i,4669005577541328898,15378236334654776305,262144 --variations-seed-version --mojo-platform-channel-handle=4792 /prefetch:1
    3⤵
    PID:4984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4816,i,4669005577541328898,15378236334654776305,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:14
    3⤵
    PID:5544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5092,i,4669005577541328898,15378236334654776305,262144 --variations-seed-version --mojo-platform-channel-handle=4596 /prefetch:14
    3⤵
    PID:3416
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=5484,i,4669005577541328898,15378236334654776305,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:1
    3⤵
    PID:5312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4388,i,4669005577541328898,15378236334654776305,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:14
    3⤵
    PID:1680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5640,i,4669005577541328898,15378236334654776305,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:14
    3⤵
    PID:5376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5796,i,4669005577541328898,15378236334654776305,262144 --variations-seed-version --mojo-platform-channel-handle=4424 /prefetch:14
    3⤵
    PID:5796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5220,i,4669005577541328898,15378236334654776305,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:14
    3⤵
    PID:4916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4240,i,4669005577541328898,15378236334654776305,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:14
    3⤵
    PID:5300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5920,i,4669005577541328898,15378236334654776305,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:14
    3⤵
    PID:2492
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4524,i,4669005577541328898,15378236334654776305,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:14
    3⤵
    PID:1128

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:5092

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
  2⤵
  PID:1188

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:5856

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ffc5689dcf8,0x7ffc5689dd04,0x7ffc5689dd10
  2⤵
  PID:5992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1956,i,10702210093826660315,5764342014969803437,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=1952 /prefetch:2
  2⤵
  PID:4124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=2084,i,10702210093826660315,5764342014969803437,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=2160 /prefetch:11
  2⤵
  PID:3524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2336,i,10702210093826660315,5764342014969803437,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=2376 /prefetch:13
  2⤵
  PID:5968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3216,i,10702210093826660315,5764342014969803437,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:1704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3532,i,10702210093826660315,5764342014969803437,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4224,i,10702210093826660315,5764342014969803437,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=4272 /prefetch:9
  2⤵
  PID:920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4192,i,10702210093826660315,5764342014969803437,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=4736 /prefetch:1
  2⤵
  PID:4352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=4996,i,10702210093826660315,5764342014969803437,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=4980 /prefetch:1
  2⤵
  PID:5740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5516,i,10702210093826660315,5764342014969803437,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=5528 /prefetch:14
  2⤵
  PID:5780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5624,i,10702210093826660315,5764342014969803437,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=5644 /prefetch:14
  2⤵
  PID:4892

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
PID:5876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc5689dcf8,0x7ffc5689dd04,0x7ffc5689dd10
  2⤵
  PID:2124

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:2200

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2636

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
ea6b02fcfb01dfb7f60ddc75e03f762f

SHA1
472cac56de907cae7c5535c04ff6e511214a3dc9

SHA256
4fab76338ccec448e3d431748621f238362f8a4a9ae69c7299dd1bcbbeb62a0e

SHA512
6e34eb557b77176121266e6c1d71c6ab767a14720285e89370dde118c16f3e18cf2c66cd4832916905266fa156cde291a4558a644b267b5cd17a824d66e406a5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\8fa60d9d-f066-484d-82dd-d63323d02b62.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
414B

MD5
a88cb4e96edb09f5f2e01922a844f331

SHA1
6f524f531201ac58f9f544f60a2d256b4291c37b

SHA256
dc5b698dcbb8e209a28d342df4594072d4bf2e9d0d0388c0aabb977aa8b330d3

SHA512
fe3e789e0f2b1b77c853a2f4d6ba7e9a7b99e1ac9ab9382bc15446c3f065630459cc19c0de41388288bef5db2c1ebd1517360a163e854f40074644692f5434d5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000001

Filesize
216KB

MD5
50a7159ff34dea151d624f07e6cb1664

SHA1
e13fe30db96dcee328efda5cc78757b6e5b9339c

SHA256
e990d9d31c4c7d57dd4795e43baea05501fb6ea8b7760f89001be660425dd01b

SHA512
a7768dd7e315b07754a305080e0fc023765e5a224b2c3824e8e10f29286df63bbdefef379e069941fd8cd9c7c3befce976779ae2efdfb6e7da697b09d7f07250

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
7c0f224ba928b6cd34a2220253d94503

SHA1
897ead3bc07c0ae0aa0f553ea98b10d43b012794

SHA256
ff75f50b882ca521e4dc9ba9e58fcc3a79136fc06217af8d4ae08030160087e3

SHA512
984d2909f524954208e932108f4dbee6ef0210131e5e5cdc584a9840931848dc0a4164bb5a05143e722c603d11230382c58c336272b8fbb3b2ff888b3f28e467

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\588c1310-4885-4862-9413-97c81e6ad06f.tmp

Filesize
2KB

MD5
5cf2ab7b0cfa2a8277c6dcd97ac3619f

SHA1
11600ec16199e6c3208100e39e0b07199ca9bf9a

SHA256
0f491074dd3f6a2263c8b82031eaa5c17a247c65a01b8bcbe1ea2737eacde5c1

SHA512
8578b08ebcd564876f780680d3bc6ca29ef135b81d20ebe5af8c05866db35c1c1bc5b9ff0f3aad042029245e6bbe738d72da38507de6817d3e552070872f05d5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
9bf3c5961fed763bcc841c11c6fd42e2

SHA1
780eab4b3db1dac0576dc63c52e696c3cac10c2e

SHA256
e16d86bd25224a9b36188ab2be61a1cf3f1fb8756141838a7aa691eab75420ad

SHA512
0878e110a5c78d2c9fecdfa10acd09496f46db449b28664e0950729e0503abb68ae21a8ea1af3631ca7c5362e6ea4ea35d13441222d65b1385dafb2f947524ff

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
a10ab9b0d7e287c8ea8f58db277532c0

SHA1
95b34bfba8eee8710855b1a6da50b690dcd7b843

SHA256
2761f79fad138f0cd3f2662f8fc49fab922c7a545d3ed03630d09ef0a580ce85

SHA512
e84a91bd9268479e28a58d94aba46745b8acfc3f2aa02f20c38fc7bd04f7277911137c9a694fa875c10809bf723a7ba1c9d11134c04535275d4e432cc27d950a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
ba9a3c5f2f1b3dbcf21218c471180ce1

SHA1
f834aad2401030fab617420e22c32e1d7057e67a

SHA256
e6f39535ba2180536c42066e1e7f876aead157be8eb797c98ec5cba8c88309f4

SHA512
b1b57b9282c4faa44004912bc003310f5542bfd1e9cab55b408cc505ac5db01ac45187d2895e9c581e2665c1bda9f3bfba8905da70a943b0703047010f4d5181

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
9a6af3d3f3f8cd5aa640b356fa8d40f3

SHA1
82de7cbf74a7ce2cb24f6a30d5aba069f55402c2

SHA256
87a71bd1b060c97f1be5a23292226661e8dc4f0b42626a9353b0b02690748c83

SHA512
c9f9fc85df1ff1326ae89436d4fb95892e4dfa6114f6eb5313d371b14751c4652180aee1d0a2c175db930084479b2e6141a3453a458464d076ea68e5d1ec4de4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
a6f5f395cfb96d52111b677ed1937de9

SHA1
9d5b4a9caf8eb7a5ae427f138b4b237978e61212

SHA256
722173935d20d1ac7190b61346d7b17e63773010769238bca826a0484a7e92d4

SHA512
13d2a5b63c9b6b8779be88e04e5f261e20e6f7bf73ae86fcdf117c7486961754d20879c4360f71cfc3a1103192523f2557c8e0793860b0497c1315cd618323cc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5934c2.TMP

Filesize
48B

MD5
7ba7244badf7aa39c6a1293a9e0a8fd7

SHA1
4ef7f66fef90435ec72933a2507faed6ec0e676c

SHA256
0dfdcd9dae004037c0957d87b6f8ee2d9f549c372337a493ba0f8ac01508146a

SHA512
037b84a0d47ca64b748ee2e72f4dbdbdc344232b0b65f3928e7f0f8cabe1139f020f1d31542bedae5fb0e12c7fb10d4bc17b60e4e905e3b0f7b7cf5deeaec6ae

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
152KB

MD5
898d1ccee81b681d072ae01043c80678

SHA1
541413b317d0b85a4155149c7e2caac414d4690b

SHA256
137b12e73756d275236e1f03c6d382aa1a12378571e9eb35dc901fbb445d239c

SHA512
47dbba6db026d6c927875e15eaa6796d157952adac224872d4d82cd54c91bc404d0685191f7a23c2f556e56a60dd3d0aa38aec6f35af6a80382f85ce7387fd1c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
78KB

MD5
badfab5e1895ceaac779214d7821408b

SHA1
c6adf7f976b77f34cfe03e07dcdba1b831ea578e

SHA256
e7307152ffdccb673cd1ee9c8ed2959fac5e18ee1b589babf8cb45eedc5f2e8d

SHA512
4058dbed7302a3ab688a676a22ca02e7d534b3f85c7da1170734dfbee17863b7eb6f29d2eef565b023cab0f78d921e8f22aa67d5f04c9618a929b57d9eb6c500

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
152KB

MD5
743b1bd0e5593aa289fdb23d21aed9fa

SHA1
ac7a67524eb2ac3827bbc2e921b2d1824f7d138a

SHA256
3590cfb1f06a41a8180ea7a850f773ac3a24278f4a8557f21a1a8c87736796fe

SHA512
7247285796aba4579fb29df8cf4d3f0d65280f621838ecfcd82a98745a87dfb647cde35df3ab0331500bdb1c5738b24284fe29f18181f61484f837f401913469

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma

Filesize
1024KB

MD5
f05b0294ae4949feed0706bc80fa6418

SHA1
346bb7d2d99251c193652ad4ae7ef2964565b98d

SHA256
1c02e2feba3b2af3c045d1ed01f8a67e0923f7e357b32c434e567eef6aac4138

SHA512
348366e162f3a037e74d0e9ff422ba7ca3e14c2b170f50bab2a4b88b29a572028e56965c332bc63cbe89de1a3467c215893ecf3cac514d786ec7ea30c08bcc05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
9e4597d6e9951c90f605fa4a330843b2

SHA1
c9a4c72aba3b9584e03d0db43aee91e51094c369

SHA256
272d838982199dc905b6eea7f57fc331c216efacab7d865cf427fa4972aff009

SHA512
adbf3948d11ce019ee5a0e8971b7b08567c7a3de742e03274ae0bd868f64f4d09e93e91e38681b34eb017af7d4708e5484b776b9b3828715d05f35621423fe05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0

Filesize
44KB

MD5
5bd33e15a1c2b9fc315f47e4ef413292

SHA1
85d98e11ca4df112e357b112adcaf46be1d7886d

SHA256
939adc4918c8cd77e513dd7185e5dd31ab6530cbeb8e816e942cb07aeaafabc1

SHA512
14a1d8a55fa4ed7faed2c3044c0b3d6d172b248fbcadcc825722ae0c53c90fd3e28d9f3f33b72e49dc10e7a7d3d2dfa85862dd3c15a9870a0d8fef128dafdac2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1

Filesize
264KB

MD5
434a955a9b53e83d71ecd038002f960c

SHA1
8862978f3762fa395ba05af8eb802dcce8c9fe3c

SHA256
26d59119bf33511f68b84562b885bb5ed990a34c333d78804f2471cf48eae667

SHA512
c990622f42ed5c154913a97bf7c00f21436bebc56f6b40ab2a027e9f91664894fb569f2e7844145912048998451c7959a94cab32d271352ee71d5959ff4f61fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2

Filesize
1.0MB

MD5
c402366aa0d20b3911e83c8d9d31f40c

SHA1
5e3e9d639cea0e0a5b923b2103cefa6496b85ccf

SHA256
f60e2d63efdf725cc5f4520e58fb71686daf56d83dd325c6baebcc5edec648a9

SHA512
e6b9feeaccda825d83841332a260483a53f2eaf8ea53f8430e948ac9bcf6f5d5ed96b74450b30f3ffcf1f1ae58d48517c4c2fd095092e3894f0f98dc7353eba0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3

Filesize
4.0MB

MD5
b29bd41bb4497b0d1741ac2dfa31ec81

SHA1
e33bb5f7cfac69730e47f562a013c2c6d0956b3a

SHA256
58c6f40083c8bf05653a7521b50b6e6df220677ca6c043862dd021f2e258eaa7

SHA512
da61a196ab41bce30f9a225f0fd91622a048a2bebe0241e6aa9f4b05defd34b3fbca4c0094886d35603fb75205674e01504889ba5351dccfc88d2dfb50e926c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000049

Filesize
34KB

MD5
c6975c159a1f5fe625ae9cc86f0eae55

SHA1
8d585360bf715fc24a220f6b3e9cb79943843679

SHA256
54ff81636bf6da76038b97e76a28eb7670d2da02f0079d37683ef42c62e75a89

SHA512
6aee047af22ef5055e9bad028e8cd3c16ab75a23f1975e2b3ff4c7e00885962aaf4c6393f588fe2a90067e265bc4e3d79c2ed3343e17542c291f5fa9007f3325

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00004a

Filesize
58KB

MD5
636cd23f68cd58a834198522aa6986af

SHA1
ea065cf63da78732ab024c2fa2f4692fd0a62a36

SHA256
fbcf8871f0f081825f2fcd078919f62f21fd87e2cdcb57eaf19907087b4dfa0b

SHA512
3d2d642b0f7da38246b1ff965579411967d8d0a7efdf0da0c667c23f62bae8382fe1f22c67d67e105a21775f27afe16f9cc3d1aa4a6fbffa843409b4cfe0239d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00004b

Filesize
100KB

MD5
f989b3df1da7e8451d64c0ffe01afd82

SHA1
6d40a628150a04b2ac77118d21aa0d9c390f9d8d

SHA256
b3dd5fa06cb6876e60aa8ca688701fb3d3632058904efeb7fc68ce8fe160aefe

SHA512
544d93570f305f9badc0ced4b257de50223769c779094e7d279d1270d8e409224a02eca6d2a887cad337371e43928cefaee10cb5c34bf43c6d1131364360a7da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00004c

Filesize
355KB

MD5
c2e5c9273ba1970475df40ac3900c277

SHA1
3ed5f584687cb41ca2ec8282f7b16f5d1d647218

SHA256
22b9f735c88a35f8f406125cfb1de6e9da4024e24846bd269b10e1838303333d

SHA512
f1a3a0e17a341a4852f8175603b304f64509f1139fd6984cd6e26432b4816dee56115b3d192f880cdc81344c51b9d7fe1bb12cbc198315f6c8d30ab9cc34b5cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00004d

Filesize
163KB

MD5
9ffac4c0c1561ae79b218a6f7d239b12

SHA1
01060f640e2ab303daf6bf31ca384e222caed2f5

SHA256
79c907a3d370f01addcd65d09a6b5ef47015911f0ac521fa4885965c622ffde0

SHA512
e809f6860b55cbdf4d7135f47c2227b8c9dcc791dbf7bb2285b408a4960cff01d252fa9aa9f1175bf08ab3133b3cb69a9946f8c11c244470c395cd162f07f9b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
acbe23ac028f763df9908738e96a2d97

SHA1
0415e5216a9e03b87c4e5c1af7f91040e06adf20

SHA256
7dcd07dfc2fe70cd3d43f6557fb2429382b9b39ede6ba6722724eda5c6407a5f

SHA512
37d8c8d008a9010e399dcaf50ef3dcd55c973e12f4d34c181176c0b9f9be8526a1b2ec250735574d1ab208dbeaf7c3597f8d256291a4ecd36ce28f17e5b770fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
9f4fbe4206cc95a93dbe406e52b21fe6

SHA1
35477ce905aea2a36474e6afd2104ee5849250c9

SHA256
991f5f70714a8649b0a45ef55178c733d346e004c566bc2add4aa787161c5810

SHA512
03d5b807e72b69b4b55062b1fd299a4888cd065d0214659de57e6f37eb9e31ad68fc972edbff60a26a20cd03ea381640ab373891c640348bb2bd673c58d369ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe57b093.TMP

Filesize
2KB

MD5
49ae8653933585a599c07f27b1f4e57f

SHA1
0c0157e458bfc2cbdafe7c8da16c9287da0e5862

SHA256
ff2d9adfb167de150ca177f76a7ce2a693aebd283818749a1ed70a0ae18d93c5

SHA512
370358b1d5b1c11a93ef88ae1258175aabe368ffc45624dbe8d40da5986b1b5117907e5ce5b37a4272c66745fcd08090c232da58191aa89bc0719eb4c2eee8eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Filesize
346B

MD5
a8c85977a58625499a2bf31ddabbaee5

SHA1
1d67487c4b07c785e90cbcffc147afd47a002653

SHA256
fb2127063588b762522a0bd63da419b5ce19b9cdc03b50fc318a9ca00a78152a

SHA512
4dc465fbcd204b398a4622989b039fbbb0d63e6d73b47653fda9b58f389a80cb149a3054ed7527b3ae2c8ab8896f15345ed49d4b44e91e4b86fec5be6f159e6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Filesize
319B

MD5
2837e73346300b4692f894994e3c0354

SHA1
9768b5db726a59758e8b61d2178c077db2269f02

SHA256
1b6689c5974f8b3f58a11e84a9707efc50961b4edd3c883be0bf3fb53fdc078d

SHA512
61880a14cadbd3067c9ad3cd8f74669ec578aef7d9bbde79a95b21fe46143a8d987104c30ed43210015707fb8b9ee91ed19274a9ec392c34bad22bb666375cc9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

Filesize
192KB

MD5
41cdb5b69a4d8b59d2145d3c9f66e42a

SHA1
f5e2df0555541c9b96f19a39daea3fa4675df251

SHA256
72924cabdb333adca26ae517a70f2f5e42c395061e09f02b63ed2838cee14cdb

SHA512
5756e36634f35fe42ec4e3838779d8befc9b7a564b22e5737cf80ebaf60fefa76961952e19322e5b4664f37f52866ed06b54daf89db51b030f5b07627cbd9fef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
2b66d93c82a06797cdfd9df96a09e74a

SHA1
5f7eb526ee8a0c519b5d86c845fea8afd15b0c28

SHA256
d4c064db769b3c109da2ed80a53fbab00987c17421a47921e41e213781d67954

SHA512
95e45c0aea0e704be5f512dffaae377d4abef78da99b3bca769264d69be20f2570daf2f47905645217e1b2696e42b101f26149219f148b4d6dd97a6c2868b6f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Filesize
170B

MD5
9970a066f483c82e3ec8a4be7e6a0f9a

SHA1
22db719d15a7dc3cd0d7bf46dbc3b10bc32afe7f

SHA256
17daa89cc60924b79dffde077d84c90e93bf73a3f1bf398199b2e8354515f53f

SHA512
518473641d6df36f7988d4a4cb78b5e454208dfc5b296491fa7632f377bfeadad8c5f84d3bfa2aa598037691b34d613b58a294ab545d83d398cbdf8b7c109c36

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Filesize
334B

MD5
105a7fd235e22aa66766f3325ac70019

SHA1
9d9809e7839c827262e79b6d112c2dad5e9253e8

SHA256
644125846546df62e1f171dac6a60eb06d0f9c6beed2cad64060c5237b84b604

SHA512
637349f5399166305302a913f2cede916588821e83c3d2fde1b042bb32370f31e6e03f23479c9be812db45e20a8af7c0435bb5f009e1592c4d4ac7982ea292d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Filesize
20KB

MD5
3dc23e8b72ee9fcbc8368b13cf468e93

SHA1
a6f687f15d0ae8dd5f8a1392ac27243b3ec1fcf0

SHA256
d5ae98ddecf044f81fe8fdde47a0c3d1111ba3780338c49a924b26f1e98ecf25

SHA512
a212259b2c6da9066b8ab673cac4a4f8184a64869e8ed10655afec02306d743aed76051519ee50aaa680721b501e7e48d55759199c63798b2b76497ca4104be2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
29cee160036b70999a841eb0a8a649e0

SHA1
ecdd8101b6e612cbd1504b5715a933df8e3ec3e1

SHA256
24d70d15686a5ddb5871eaac5486ef73600882f78d184e58db50da813b578fd4

SHA512
192ffbc7eee7dc89dd9c930ea0c553ea7d3a8f25d43590ef08275cac0c70eda349eb7925b2c6523e2ab875ecb8ae55e3ead68ba39cf115ce9bbd6f3b7d5c7c6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
909909327883c68caa1ac622a1b38691

SHA1
bab47e6c16e50c3284bfc4644cbeb2d3d93fbfb6

SHA256
3513bda818bdb3999f334848d3ce5f8e4d795c925b19d6ec03e57c74208d97f8

SHA512
f7b683f68693fe9e366a88a78b2c0d9ae372d9f29f43918b10580e7e1ca4cf00752c91474538b5513bf0a4acce12ada71adc950a4fcfd1b5465eded6fbf3e213

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Filesize
36KB

MD5
ade1640ffb0bef2bf3df48f57031556a

SHA1
b1f1a9fb031e5ea8ac270fcc3b97998a29494d8e

SHA256
c2084530c4ed2f0dcc7686a65df6b718485f609f0145c03f93f987656a1acd05

SHA512
6f1f8c917af87cd5733a25e363afba798ff3796bf3d14e002f64b50c76a599e2bea7d8590b518e0d42f6d20ed61169c8bb751893ddeb7d113a55eaa4bffae12e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity

Filesize
188B

MD5
41328ee164d52f3ad32f9ae1d4d92e54

SHA1
6f70a92d9bbd60fe78ee6c445276921363bf54aa

SHA256
e29f4b8e87592583c7bada8cc38ee3dfd188c06078e6fbab87834e33f5fa1317

SHA512
9350b1d8d5cae2493e29ca580c52a7218d559a96d3e39677e4eccfd358be0670159556df4411a9fac77eb7cbd07688af73661e7ed36e59be1d3456a718e738ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\e55bc941-e34d-4c27-bd90-d591e6f4df73.tmp

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
17KB

MD5
0a81bf4bdb96392e3d3128dac103928c

SHA1
4c195a92ddcdbef9c7b78f59f67effbf06f8ee0f

SHA256
ba10b87ce8ed6af4f8e2541fe3fb66fd0af4f1c73c5ede0df58a5e91e18a75a0

SHA512
ea8c6e7ba05be2c04bb44ba0c386a7e0c623392435e42c9a806068c6b599a1d750c2f63d85d262e814ce25bfcc93b844bc79adde503eb6775f8afd54914cf60b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
37KB

MD5
d4c6966bb6b2883f140320396144147b

SHA1
80427903ea6fa3b2a5672017fa09e55505e8a9dc

SHA256
98f8e3df747dd8becfc300f24aee06803ae087bac9ca2dd819d28209c833e946

SHA512
03679f194bd1cf40a48ad82c73ee079cd8bdd9a3a84195734043939312f43f09f30f14d006aaad278055417c7b8f0074f86607b37897112bd925c3dec1f3c4da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\f5417672-d12f-43cd-a1db-5f60f28ef2d9\index-dir\the-real-index

Filesize
2KB

MD5
e666508aab807aa6aa123725d136dba6

SHA1
fa33648a071ffc24725bc5412684756906720845

SHA256
283fc8931baa5168545daf42f30357c38d600627b283c1315e15effb5c7ee049

SHA512
733049071a2464ec1a987aa9107874fd9f6f4204071a7d47907a69a60873408c86f473a6a73c7471f20c7e6517cbd6228ebe8c8b9148b0536a79d03580626102

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt

Filesize
253B

MD5
19e6e8be2c5e36a8155db66bd81a24fa

SHA1
8c606892b03805f8209d6eef777a369ed89224e1

SHA256
f661a6c42b76fcc5ff8dd3d1a4cc7c92372b52fb36c2274e95ff17a3d0671c27

SHA512
658a5ef1e5668050e263698af785458ba43209ae030ef01446bd47e250e92c29ff607ea1bcd7965a2b9c604e211ca0dc96c380729ac5b73ea35cbbd636b52534

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt

Filesize
253B

MD5
42a5a5d580bbba00d7d30a6530fe6bb5

SHA1
d9a03a1652e6939af631c635e5b329764534b51e

SHA256
6b88d827ad16a3f8b347c3c272fa7935ddf4da65df33ae3242b823e28825a033

SHA512
b1f539d2c529c7df2747cd8b6c0c163e93955a899a2da0e4adb6147f094fa83ea703d5f6af62185167634eed2769e898f68f629d23f0a317d427f75304995cd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG

Filesize
335B

MD5
cb5f38dce4606f8db3ecb2ea0ba5b3ed

SHA1
f737dcf827e79c3e72292a31c2a4778c88cc9c2d

SHA256
94d1ca226fd34c1d3b0189ce4174d144263e1103622ec4b5f3ce8a02adaa15c2

SHA512
40fefc87b46b42e2e05259066babd3e3347bea6b40220118e7a66cb4143534407e26618f4f8401ec05a258d171056b6ddcee1f1add76471f4463b092d115226a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
556d15f89d85f82df6060dffd03e45f1

SHA1
3ce5ce006396bf2e77dba8492a4e063a214669fc

SHA256
30e4bbec4d28faf155773dec7272f98885457e6a25e7e08dde542e9a9b1a8667

SHA512
6ac3c791400f62d99f9fb2cbe4c640c208c800adaad32c9fa83ca993e1b3557afc6eef5939c258d3d5eb9ffd770b429de060969a5519b5d9242bc455a9fcb84b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58270b.TMP

Filesize
48B

MD5
6cb906afe754623f36e3a17490a0fcd8

SHA1
9bd75502bced495d57ea53cd51969d5e3b08b68c

SHA256
bf2058227d9b06e4d12706c95e75faecda1129f6362b6591134241ec376bc1cf

SHA512
5e8ae077bcaa30cd7148135cec9c71ee3cba285dbb97ef628a19cd2fb63c78f378baf586875d95c5bb5131469dce8d9a4eef3837e36b005abb8517b74871fa7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log

Filesize
112B

MD5
82a3d3b2510aac3ce224c51c4a6099b4

SHA1
eaf62daab9d549836b1f8c60d8ea14c34d7ed847

SHA256
8b65ebbf93cf5b0b1be636693effaf7f50a26417f9a96cd1ee1092137905438a

SHA512
4a654c7d5ea30d2d89476d5afedf3c147782d6d5d7605c3471a94379614eb9ee7743df751ff96d4735d782707986f4acc015e3a4aa239c1071e6011173691939

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Filesize
350B

MD5
bf157d4c6b2b072da715f43befa86741

SHA1
cc86daa37438b9da8cd42e5e83b28ff331117da9

SHA256
56846f325311335a3acd0ababe1b0e2161c206bfb3d9ed7ddb0ce69fab3fb478

SHA512
366b775abb6201c2daf86062c1d46375b822643b5b0901497d5abed19f47708325c861994a8d05854b57f460740fd4d0eda1bdf8420a4bb8852c69365ac14b07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Filesize
326B

MD5
fa135b746318ff62de1ba4c6c8d96157

SHA1
f5cdeacab0263c52f970821e278eaa21f52c535f

SHA256
1d40dae4964aec276234e71997d59954730f4460df75514d2fedd148156efb62

SHA512
37ea174d4f051708fdbd19bdda8e6c7e0ec53980342d9d1c7cb6d969869053c9bc44ef91cd81a1fb71ff52e9a4d66f1957d8abcf28d2f9dc4d17a02c12516e76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
25KB

MD5
bc095c4f8e2bcdbcfa3b777e687b3abe

SHA1
d8d65abbddcdad64e31c750935a6880f96adcf39

SHA256
53955ed0da9ad3c4233c2fdff47975324680550035db99e5363e24d7e86bde57

SHA512
eef1e0d6b2e9db385642a30cf90c3864aa860a0b9e48bdbf8b99dd7b9b76033997173517393788847dfc3c25ca8fad2f5f6c435c8deb6557648bfeb2c9979e1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
3f631606a470b54522db6b7e51b63b51

SHA1
5842901f8b1da44247f08ad59d2ef0ce172710f3

SHA256
1510ba6c08daa1f29156d370ee8ba939d50611676b7b03d746c8c3ac9f70a2cc

SHA512
933fb7e961d896ab6c0ef3db88425b14cc344b6b0023026303909655555931b6f6bbf7ddd6e7a8bc13920ee89fac4242869ab5ede2fd45784865e01129605700

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links

Filesize
128KB

MD5
a122713b43e46deb450b4725f942fa5c

SHA1
1088159e8b79d860792d677e39d1670fda7e270d

SHA256
1d5a7b15338d47502613aeabd5a37b52af595214ab4b588d0da7963ed5700028

SHA512
d7c26dcf621421fa374c6f1338a0ffde179eb573bee14c1df4dc77d9d6a4f88570d46a9e546d70db80c71a5345c9ad188b8bda01ead048e848109daded00f66d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Filesize
228KB

MD5
5d80ad68eccfc9e6d7a45ef312a27641

SHA1
d8e5aa58f563bda48efee0e5a9d38bc0930b935f

SHA256
eb2db18cde8a14efc6c400beb233d1210ad1abc14ccec81fc39017663e0a280d

SHA512
b6e23b701318669709c1b5e4d8684b875b974c668f4b71d719937c42fb911c7397fb2036634e4b2bc3ce94e5764e21ac8053dd1a347c8cc6c767cebcaf48bb07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json

Filesize
13KB

MD5
cf9a0cd1d5f9c8cdeb87ef3f7d30d15c

SHA1
c543e62aab24c205db6014414161c13375e9a71c

SHA256
b24f36278e4c85a8fcd66021d48c69d6b07be605673e02f0fe185bf3319f47f4

SHA512
39ad5c5753e5398906b94ab039d2eae7fe420fe35a53f190bda84d4f9262f3b14841cdf4ec76cdbff6a4578a26ab1e6c4b11ba326ec8cc38a2e2904a6f2c0d8e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log

Filesize
1KB

MD5
a52d227d05347b120d57de3adfff31dd

SHA1
a4d0b7ac8eb338689211588bd90b02eb0cb5c848

SHA256
671e823f0c4282681be55501d09b4621c6a00ef4e4317391d424a0b12a2e6514

SHA512
be432d1c953f94bcf8390dd25554cf109f63d13c5cae1a14cb74c748be3eba78076d55b3c9b2957890f2353fd69010cb8f826c89aa1b3c4cfc26afd0790e4d44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Filesize
10KB

MD5
8b712fa5c45969438b08de6e8c12a87e

SHA1
1b0d553eaac28229d1b7c2caa61eb2c6ee4d7f2a

SHA256
5151d119689a038daaa929e3dff75f84948ada9533680b57d72622b1bbe1df6e

SHA512
1994b7059eb4aed17434774bb66d8412554cf537fb42e76a7472914a3e565bedfdc12a4bbb2577a6627e0d8e241484064ae362c29e1338cd735424f59fda8582

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Filesize
322B

MD5
6dc0b5b3a3c6e7a63eb7232ed13c3ffd

SHA1
4914e020b0d29aee23376651842cca259c01b809

SHA256
fc8e408dcef5465f117ac4874dd308df396303d10a6f42a35041915e1ddc7ddb

SHA512
99a04d378aaf6a813b7e7b539264a15f51da68d002cc7593668c50471ad3abbbef7f7aa98658c97e0b7c8d8804c2e054001b0df7127a94bf6ec900cacbffbe95

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Filesize
1KB

MD5
d0bda43ac82da2dd800f04e512f39f19

SHA1
720d6143891e81319e88d3d5f9c3554c43b7348d

SHA256
7235850273ede1c6768e90177f5e4d615f0a78683e88345ebd5509482f2e353f

SHA512
ce0194105aabb324d57f297f09c70ef3cf16589045b9b70fbf6320b485f6b30cda4834ec303e34c65ee35cdc5b48fb74c05db49e4afbe78d427dfe64b5ad446a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Filesize
340B

MD5
60a5ddc6f45ec2209bf9b467a6d6810c

SHA1
c6a910b78d3b1d4997f75da2a6ddfe9b558bfefe

SHA256
e27f60da3236ec41b50c3b91a7f2b81d2c1684cc1b8d2bc951b24e7e3856bec9

SHA512
e54668fb239ca99d74e69bc6ac47ebea06f1f2cf1bd929a3ce174b2d7e8c6675cedefb44c15fa0c569f5b078017157814d260194c29b92a62b45e6521d642166

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
469B

MD5
721ca58d6388ed2b24ef1c370adc7e2d

SHA1
a9ee9d0811ce3d19beaf71e6f7d459e4bee03d2c

SHA256
e373bd45dd125ed77fd523bcc86fbf1be26bd835d691fcfef37fa85510b89b66

SHA512
781610b6b1eec3be96e70e91edc488cbb9a8be63c9ea6ea8b605fb04dbb32f84f211181c23f3882ef828410d64faa84c395dd1095700fab0fc44b87e98e920b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
20KB

MD5
661356026484b226281a12efb1e90ce3

SHA1
f7dc541f85f5dbda7ca5e6f4b0e55662fd51aadb

SHA256
8702cab5e9887395a757d7cd1412d9981665f8809e434aad0c273e3056316ac4

SHA512
e631ac0b81585a9d2b53851169a0e47cfa5d2a96e6febc8edba520412b03cef6374d39a26312a37513e076d69798314efe10a3b4ab3927bddc07e8da6305c8a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
22KB

MD5
3f8927c365639daa9b2c270898e3cf9d

SHA1
c8da31c97c56671c910d28010f754319f1d90fa6

SHA256
fc80d48a732def35ab6168d8fd957a6f13f3c912d7f9baf960c17249e4a9a1f2

SHA512
d75b93f30989428883cb5e76f6125b09f565414cf45d59053527db48c6cf2ac7f54ed9e8f6a713c855cd5d89531145592ef27048cf1c0f63d7434cfb669dbd72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\aa963d76-b0b7-4605-be0e-d7518c651ead.tmp

Filesize
904B

MD5
fdc50a586ef37c78c0be908f2ee6d78c

SHA1
64088a983e42d81b5692046bae1ecc7ef545fd6d

SHA256
0e2e2697a474328896221ee5ebcd84895d1f9482c23575cd46ba9c807b5b9498

SHA512
2a6c70e183972b17b594c7c59f39fcf99c7891d2c3238a6946e2264adb782bfec223a6e15d99ba70f9a22b40e1546fdc2dc8491c333bbee9850cfc4a280d7484

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_0

Filesize
44KB

MD5
ae97dd1690e3ab49ee01a8072d90e40b

SHA1
13673d7f0e0eb3743da6852920d776d522c0f084

SHA256
e43a29c8ce0197471292cd084a0f803a3044b52578e7f4c85d088aadc5bccf1f

SHA512
6afbb676a405a8e90aeed41a53254746a6825920e3141506cb8682d6efd0930fd4edf1b6f330a894c95197a8f4c87c3f872dcd0563a6056216366d616eada88b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1

Filesize
264KB

MD5
a5a65d7574d935d622c155d27b0fdbac

SHA1
931c129dede55e3b0d535c6f309f1a6e61d11379

SHA256
3d6141e3189b434e9bc42c4ce13dda2b53967102b6913e4e7aa0b508a9685081

SHA512
03b094f4d48f64f0d0b37ad14ce514f6ebaaf01a17f3e737f50e80520d11084ced3d67f057dc2201c746377a69855034bb7360eb5a2f63bde0ff4fdf5956b51a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_3

Filesize
4.0MB

MD5
4b0b6f38bb060a0c615eca6fcf81b94c

SHA1
131ef763d7922f47a775a866d38eab36d7fe3c26

SHA256
f9fdd0c3f57642ac04e4bee8bc2f87c96f4f9c272e3970636e91532f0b011bd7

SHA512
d60bdd31bf4cb8a9e8e40fb35f2cdd9e11c1c2fcb5f65c36f036ae8b84576b6c9ddfcdf5c12e9c539e4515e425e5bcdb7635476b34eba7271d53044ca9d8f3c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1

Filesize
264KB

MD5
71c4c4e0b8405793f706a86ffbf8f794

SHA1
435cfa94728d8c9a4bde4be8e6f117b75ae2a204

SHA256
0914f84e74a3cafe2719dc51f7f188ff6ebff5a014c8686185a5995bd51dde9f

SHA512
b674d94031cf400575aff36afb17d57507fce3b1b2343c19f9e9b25d95b125d199d97f9cf73442c89f6ac5fb67a7c1a4dd50ee2da165de721a943bc34863cf9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser

Filesize
120B

MD5
a397e5983d4a1619e36143b4d804b870

SHA1
aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4

SHA256
9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4

SHA512
4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

Filesize
13B

MD5
3e45022839c8def44fd96e24f29a9f4b

SHA1
c798352b5a0860f8edfd5c1589cf6e5842c5c226

SHA256
01a3e5d854762d8fdd01b235ce536fde31bf9a6be0596c295e3cea9aaf40f3dd

SHA512
2888982860091421f89f3d7444cacccb1938ef70fc084d3028d8a29021e6e1d83eaef62108eace2f0d590ed41ece0e443d8b564e9c9a860fc48d766edb1dc3d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
47KB

MD5
7b9639a4ff0835feec8518385a86ec53

SHA1
a55402351165e724ebef7c17a97a74cc1b22fc87

SHA256
2de8e8fc88de4fa11e2363088f43ddabd78cc4087ee6ab3c037bc3dabd0dd81c

SHA512
462b6429cfdee81334f70b7be97e68319ab55730388dca21ceafd650fa8c36310c3e033fc23b6370a8603cee959ba0da8109188b8b089ca091341f8f57262752

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
42KB

MD5
e030c5a1ff50ec3c90d17d43d335bc9a

SHA1
30fd11215ee46124c04cf5f4a087d3aa53b6c06a

SHA256
049286625f45e7ce74311cf4b36d7c989bbd100ddc709f4952e97f6a0a318423

SHA512
8955f9703881481c2f572565e993557120a49747e27db5d99012f3e9eea5a0bbb44142e1f8fedd51966b1d332ce9440eb48972112acd418d602d199486a2f47a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
48KB

MD5
d211de1f2794b68b12522535ca29d88b

SHA1
42b34e048f8e4c568324cbfedbf91f4a33cf31ee

SHA256
c8cd75e51f28cd5b30594f7314bf58aaa57045c3526790aa8f32362c5bcef7ee

SHA512
9966d648f89d23d85b4598ec7659eea063d5bb3e2ff6e0bb6212fccaf302bb1063d6867a6e730f36e03102603ba4f80fb0b5a2dcf6b7829b6af47dbe298f0b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
41KB

MD5
fb6361c736a9c327c9677ecbe25b66a2

SHA1
356fefa2e74a83985a96d5562fc6e74409501079

SHA256
4b9ef2a9ca643e712084b6842b12afe16525c2106d6fc3a4c7dcbdfb422053e5

SHA512
109de8b27fc257335c6c4ba702a7fc1c78e407c2d15ceb35e0b57dab1e5ca7940fe896bac223b24a05356a73c581046ad78b77735c8dc65ed6bf47495d7e67fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
48KB

MD5
1923dfe87d33985fc3c5c3ece5765a1f

SHA1
08cbe5f727456b3efe56e125a54fe50de5a389ca

SHA256
b97294eb37917bb16c39d1cc4b398f6ec5c47f4c8d433afea1f98011bf0ce7cc

SHA512
024e5996c9964d6b78b6f2423ca9f1a2308ec699d863ad42ef626a7b3b1f568cf4689a1cf77b5ca98591ce9685ae0a32f0f96424b9055c93676e1159a13b4df5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
3f0a731a91b3447fdfe25ccba1159b83

SHA1
4cf2d7a49bab7f4922dff5869fae64e7be4dd9b0

SHA256
0c86317c0131d147bef0dfac8f0f08fb47429bd2bad1d55c52e9507eceb2bd3b

SHA512
519d735f1e2ca8868681115f879f2be7bfab4e4214bb25433886296231cec5d670202912ef43fa4d9063c19cb5d4d4f347b0da4f7b9489cec338c8c85cba73cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1

Filesize
264KB

MD5
819bcc5b9b7b93eb1cef580fb0a00639

SHA1
06357b95f788b0d4d94b4c58a54af137f4581c44

SHA256
9126aebaaecfe4525322108ae006735f091bf3a747b672bfa457c118e9a7b972

SHA512
06586da0250c37df42b8317580136021d3dea97ce0b1000e4106920aa97ab0424eca416ff5635ce974b35c7a78d445388c9f4bdfc02f0e03d6b9bce27c9cd85a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations

Filesize
86B

MD5
961e3604f228b0d10541ebf921500c86

SHA1
6e00570d9f78d9cfebe67d4da5efe546543949a7

SHA256
f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed

SHA512
535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472

Download Submit
C:\Users\Admin\AppData\Local\Temp\cv_debug.log

Filesize
2KB

MD5
75c877a2053b94f73b80212cc87622de

SHA1
d792d78bbfe0ca04991305789ccc547546871ad0

SHA256
1d61e52bfc66e62369e01bb40dfe99867a4350e1d3785b92da222857aed53084

SHA512
f3bc9560c6d5eafce93f018b4d4a43ea17dcda8a889d774844820b361f8efe4c4b72a7fbcc0933a5bb16a8e5fc2218d01f5a521d1e28665881512949c51d445f

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4032_1172927675\manifest.json

Filesize
76B

MD5
ba25fcf816a017558d3434583e9746b8

SHA1
be05c87f7adf6b21273a4e94b3592618b6a4a624

SHA256
0d664bc422a696452111b9a48e7da9043c03786c8d5401282cff9d77bcc34b11

SHA512
3763bd77675221e323faa5502023dc677c08911a673db038e4108a2d4d71b1a6c0727a65128898bb5dfab275e399f4b7ed19ca2194a8a286e8f9171b3536546f

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4032_463683017\LICENSE

Filesize
1KB

MD5
ee002cb9e51bb8dfa89640a406a1090a

SHA1
49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2

SHA256
3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b

SHA512
d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4032_463683017\manifest.json

Filesize
85B

MD5
c3419069a1c30140b77045aba38f12cf

SHA1
11920f0c1e55cadc7d2893d1eebb268b3459762a

SHA256
db9a702209807ba039871e542e8356219f342a8d9c9ca34bcd9a86727f4a3a0f

SHA512
c5e95a4e9f5919cb14f4127539c4353a55c5f68062bf6f95e1843b6690cebed3c93170badb2412b7fb9f109a620385b0ae74783227d6813f26ff8c29074758a1

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4032_74785275\manifest.json

Filesize
176B

MD5
6607494855f7b5c0348eecd49ef7ce46

SHA1
2c844dd9ea648efec08776757bc376b5a6f9eb71

SHA256
37c30639ea04878b9407aecbcea4848b033e4548d5023ce5105ea79cab2c68dd

SHA512
8cb60725d958291b9a78c293992768cb03ff53ab942637e62eb6f17d80e0864c56a9c8ccafbc28246e9ce1fdb248e8d071d76764bcaf0243397d0f0a62b4d09a

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4032_884284688\hyph-as.hyb

Filesize
703B

MD5
8961fdd3db036dd43002659a4e4a7365

SHA1
7b2fa321d50d5417e6c8d48145e86d15b7ff8321

SHA256
c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe

SHA512
531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4032_884284688\hyph-hi.hyb

Filesize
687B

MD5
0807cf29fc4c5d7d87c1689eb2e0baaa

SHA1
d0914fb069469d47a36d339ca70164253fccf022

SHA256
f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42

SHA512
5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4032_884284688\hyph-nb.hyb

Filesize
141KB

MD5
677edd1a17d50f0bd11783f58725d0e7

SHA1
98fedc5862c78f3b03daed1ff9efbe5e31c205ee

SHA256
c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0

SHA512
c368f6687fa8a2ef110fcb2b65df13f6a67feac7106014bd9ea9315f16e4d7f5cbc8b4a67ba2169c6909d49642d88ae2a0a9cd3f1eb889af326f29b379cfd3ff

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4032_884284688\manifest.json

Filesize
82B

MD5
2617c38bed67a4190fc499142b6f2867

SHA1
a37f0251cd6be0a6983d9a04193b773f86d31da1

SHA256
d571ef33b0e707571f10bb37b99a607d6f43afe33f53d15b4395b16ef3fda665

SHA512
b08053050692765f172142bad7afbcd038235275c923f3cd089d556251482b1081e53c4ad7367a1fb11ca927f2ad183dc63d31ccfbf85b0160cf76a31343a6d0

Download Submit