06c04265131333026f7175838e23002982e45f41716f2903416e09cfedb3a505

Analysis

geolocation tags

asiadelhiinindia
user interaction
yes
max time kernel
900s
max time network
904s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/06/2026, 11:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7WQOTBZB.htm
Size 22KB
Sample260620-m8bl8aev6m
SHA256 06c04265131333026f7175838e23002982e45f41716f2903416e09cfedb3a505
MD5 5ee61375b62e6a3523403ff14232584f
SHA1 555fd386c70a6b386cf27716d8f983a5ad529ebb
SHA512 d389934a877e95d0b816c51ec38d4809803ed02bfcd1d8402113e64e1164daddcc78098e8dc19fc05425e618601befb546a7f067e886d12eebc4b6bd45fb1632
SSDEEP 192:Sx+fF8wVi0e/zu1zt0WKDhWMOO/xXyk8efUv76DQ4sClFa9/FhBm7N24N/zu1O:Sx+N8wVi0rsxXoe3LahIIg
TLSH
T12AA2DC31A4F0703B82C2E1E566246B19FE82C507F51BAD11B2BE0BC95FD6F828D2761D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery persistence ransomware trojan

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
121	3348	msedge.exe

Executes dropped EXE 64 IoCs

pid	Process
1996	tor-browser-windows-x86_64-portable-15.0.16.exe
6012	tor-browser-windows-x86_64-portable-15.0.16.exe
2020	tor-browser-windows-x86_64-portable-15.0.16.exe
5752	firefox.exe
5416	firefox.exe
1992	firefox.exe
6032	firefox.exe
5928	firefox.exe
2188	firefox.exe
4936	tor.exe
3788	firefox.exe
6188	firefox.exe
6216	firefox.exe
6260	firefox.exe
6800	firefox.exe
8100	firefox.exe
7204	firefox.exe
7868	firefox.exe
4908	firefox.exe
7480	firefox.exe
8040	firefox.exe
2840	firefox.exe
7076	firefox.exe
8044	firefox.exe
7800	firefox.exe
5024	firefox.exe
2980	firefox.exe
6420	firefox.exe
4040	firefox.exe
6732	firefox.exe
7376	firefox.exe
3056	firefox.exe
7524	firefox.exe
2968	firefox.exe
6140	firefox.exe
552	firefox.exe
6212	firefox.exe
7404	firefox.exe
8168	firefox.exe
3384	firefox.exe
8244	firefox.exe
8272	firefox.exe
8844	firefox.exe
8872	firefox.exe
8316	firefox.exe
8356	firefox.exe
7596	firefox.exe
8904	firefox.exe
8824	firefox.exe
9208	firefox.exe
8300	firefox.exe
9076	firefox.exe
9108	firefox.exe
8976	firefox.exe
7764	firefox.exe
8720	firefox.exe
1420	firefox.exe
9092	firefox.exe
7432	firefox.exe
9204	firefox.exe
8776	firefox.exe
6492	firefox.exe
2488	firefox.exe
7420	firefox.exe

Loads dropped DLL 64 IoCs

pid	Process
1996	tor-browser-windows-x86_64-portable-15.0.16.exe
6012	tor-browser-windows-x86_64-portable-15.0.16.exe
2020	tor-browser-windows-x86_64-portable-15.0.16.exe
2020	tor-browser-windows-x86_64-portable-15.0.16.exe
2020	tor-browser-windows-x86_64-portable-15.0.16.exe
5752	firefox.exe
5416	firefox.exe
5416	firefox.exe
5416	firefox.exe
5416	firefox.exe
5416	firefox.exe
5416	firefox.exe
5416	firefox.exe
5416	firefox.exe
5416	firefox.exe
5416	firefox.exe
5416	firefox.exe
5416	firefox.exe
1992	firefox.exe
1992	firefox.exe
1992	firefox.exe
1992	firefox.exe
1992	firefox.exe
6032	firefox.exe
6032	firefox.exe
6032	firefox.exe
6032	firefox.exe
6032	firefox.exe
5928	firefox.exe
5928	firefox.exe
5928	firefox.exe
5928	firefox.exe
5928	firefox.exe
2188	firefox.exe
2188	firefox.exe
2188	firefox.exe
2188	firefox.exe
2188	firefox.exe
6032	firefox.exe
6032	firefox.exe
5928	firefox.exe
5928	firefox.exe
3788	firefox.exe
3788	firefox.exe
3788	firefox.exe
3788	firefox.exe
3788	firefox.exe
2188	firefox.exe
2188	firefox.exe
3788	firefox.exe
3788	firefox.exe
6216	firefox.exe
6216	firefox.exe
6216	firefox.exe
6216	firefox.exe
6216	firefox.exe
6260	firefox.exe
6188	firefox.exe
6260	firefox.exe
6188	firefox.exe
6260	firefox.exe
6260	firefox.exe
6188	firefox.exe
6260	firefox.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	firefox.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
280	api.ipify.org
281	api.ipify.org
282	api.ipify.org

Checks system information in the registry 2 TTPs 1 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	firefox.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setupact.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	UserOOBEBroker.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileCoAuth.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3348	msedge.exe

Checks processor information in registry 2 TTPs 64 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Current Record Version	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134264272777191689"	msedge.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	firefox.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3839916939-1319118069-2256772647-1000\{34154338-4DC1-4C60-89F4-704C8647DF76}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	tor-browser-windows-x86_64-portable-15.0.16.exe
Key created	\REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2416	msedge.exe
2416	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 22 IoCs

pid	Process
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5416	firefox.exe
Token: SeDebugPrivilege	5416	firefox.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe

Suspicious use of SendNotifyMessage 20 IoCs

pid	Process
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
5416	firefox.exe
5416	firefox.exe
5416	firefox.exe
5416	firefox.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
5416	firefox.exe
5416	firefox.exe
5416	firefox.exe
5416	firefox.exe
5416	firefox.exe
5416	firefox.exe
5416	firefox.exe
5416	firefox.exe
5416	firefox.exe
5416	firefox.exe
5416	firefox.exe
5416	firefox.exe
5416	firefox.exe
5416	firefox.exe
5416	firefox.exe
5416	firefox.exe
5416	firefox.exe
5416	firefox.exe
5416	firefox.exe
5416	firefox.exe
5416	firefox.exe
5416	firefox.exe
5416	firefox.exe
5416	firefox.exe
5416	firefox.exe
5416	firefox.exe
5416	firefox.exe
5416	firefox.exe
5416	firefox.exe
5416	firefox.exe
5416	firefox.exe
5416	firefox.exe
5416	firefox.exe
5416	firefox.exe
5416	firefox.exe
5416	firefox.exe
5416	firefox.exe
5416	firefox.exe
5416	firefox.exe
5416	firefox.exe
5416	firefox.exe
5416	firefox.exe
5416	firefox.exe
5416	firefox.exe
5416	firefox.exe
5416	firefox.exe
5416	firefox.exe
5416	firefox.exe
5416	firefox.exe
5416	firefox.exe
5416	firefox.exe
5416	firefox.exe
5416	firefox.exe
5416	firefox.exe
5416	firefox.exe
5416	firefox.exe
5416	firefox.exe
5416	firefox.exe
5416	firefox.exe
5416	firefox.exe
5416	firefox.exe
5416	firefox.exe
5416	firefox.exe
5416	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1132 wrote to memory of 5856	1132	msedge.exe	89
PID 1132 wrote to memory of 1032	1132	msedge.exe	90
PID 1132 wrote to memory of 3348	1132	msedge.exe	91
PID 1132 wrote to memory of 1032	1132	msedge.exe	90
PID 1132 wrote to memory of 1032	1132	msedge.exe	90
PID 1132 wrote to memory of 1740	1132	msedge.exe	92
PID 1132 wrote to memory of 1740	1132	msedge.exe	92
PID 1132 wrote to memory of 2708	1132	msedge.exe	93
PID 1132 wrote to memory of 2708	1132	msedge.exe	93
PID 1132 wrote to memory of 2708	1132	msedge.exe	93
PID 1132 wrote to memory of 3260	1132	msedge.exe	94
PID 1132 wrote to memory of 3260	1132	msedge.exe	94
PID 1132 wrote to memory of 3260	1132	msedge.exe	94
PID 1132 wrote to memory of 5716	1132	msedge.exe	96
PID 1132 wrote to memory of 5716	1132	msedge.exe	96
PID 1132 wrote to memory of 5028	1132	msedge.exe	97
PID 1132 wrote to memory of 5028	1132	msedge.exe	97
PID 1132 wrote to memory of 3264	1132	msedge.exe	99
PID 1132 wrote to memory of 5584	1132	msedge.exe	102
PID 1132 wrote to memory of 5584	1132	msedge.exe	102
PID 1132 wrote to memory of 5584	1132	msedge.exe	102
PID 1132 wrote to memory of 1728	1132	msedge.exe	103
PID 1132 wrote to memory of 1728	1132	msedge.exe	103
PID 1132 wrote to memory of 1728	1132	msedge.exe	103
PID 1132 wrote to memory of 6060	1132	msedge.exe	104
PID 1132 wrote to memory of 6060	1132	msedge.exe	104
PID 1132 wrote to memory of 6060	1132	msedge.exe	104
PID 1132 wrote to memory of 4904	1132	msedge.exe	105
PID 1132 wrote to memory of 4904	1132	msedge.exe	105
PID 1132 wrote to memory of 4904	1132	msedge.exe	105
PID 1132 wrote to memory of 5768	1132	msedge.exe	106
PID 1132 wrote to memory of 5768	1132	msedge.exe	106
PID 1132 wrote to memory of 5768	1132	msedge.exe	106
PID 1132 wrote to memory of 4536	1132	msedge.exe	107
PID 1132 wrote to memory of 4536	1132	msedge.exe	107
PID 1132 wrote to memory of 4536	1132	msedge.exe	107
PID 1132 wrote to memory of 5684	1132	msedge.exe	109
PID 1132 wrote to memory of 5684	1132	msedge.exe	109
PID 1132 wrote to memory of 5684	1132	msedge.exe	109
PID 1132 wrote to memory of 2588	1132	msedge.exe	110
PID 1132 wrote to memory of 2588	1132	msedge.exe	110
PID 1132 wrote to memory of 5800	1132	msedge.exe	111
PID 1132 wrote to memory of 5800	1132	msedge.exe	111
PID 1132 wrote to memory of 5800	1132	msedge.exe	111
PID 1132 wrote to memory of 1972	1132	msedge.exe	112
PID 1132 wrote to memory of 1972	1132	msedge.exe	112
PID 1132 wrote to memory of 1972	1132	msedge.exe	112
PID 1132 wrote to memory of 868	1132	msedge.exe	114
PID 1132 wrote to memory of 3272	1132	msedge.exe	115
PID 1132 wrote to memory of 2936	1132	msedge.exe	116
PID 1132 wrote to memory of 5200	1132	msedge.exe	117
PID 1132 wrote to memory of 5944	1132	msedge.exe	118
PID 1132 wrote to memory of 5944	1132	msedge.exe	118
PID 1132 wrote to memory of 5944	1132	msedge.exe	118
PID 1132 wrote to memory of 1996	1132	msedge.exe	120
PID 1132 wrote to memory of 6012	1132	msedge.exe	119
PID 1132 wrote to memory of 2020	1132	msedge.exe	121
PID 1132 wrote to memory of 3784	1132	msedge.exe	123
PID 1132 wrote to memory of 3784	1132	msedge.exe	123
PID 1132 wrote to memory of 3640	1132	msedge.exe	124
PID 1132 wrote to memory of 3640	1132	msedge.exe	124
PID 1132 wrote to memory of 2416	1132	msedge.exe	127
PID 1132 wrote to memory of 4280	1132	msedge.exe	128
PID 1132 wrote to memory of 4280	1132	msedge.exe	128

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\7WQOTBZB.htm
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x284,0x7ff938b0c188,0x7ff938b0c194,0x7ff938b0c1a0
  2⤵
  PID:5856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1564,i,16161099022117931114,17165021707495160953,262144 --field-trial-handle=2316,i,13197899825288197603,3431529978230810998,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:2
  2⤵
  PID:1032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1736,i,14445627332079470390,18266171207569102582,524288 --field-trial-handle=2316,i,13197899825288197603,3431529978230810998,262144 --variations-seed-version --mojo-platform-channel-handle=3104 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:3348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2492,i,17202643457266607085,184592325754442328,524288 --field-trial-handle=2316,i,13197899825288197603,3431529978230810998,262144 --variations-seed-version --mojo-platform-channel-handle=3360 /prefetch:13
  2⤵
  PID:1740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3640,i,8840555478691043318,5352268332009385785,2097152 --field-trial-handle=2316,i,13197899825288197603,3431529978230810998,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:1
  2⤵
  PID:2708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3664,i,7060154364383756558,12728164528320601370,2097152 --field-trial-handle=2316,i,13197899825288197603,3431529978230810998,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:1
  2⤵
  PID:3260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5180,i,1826738736375762625,9276402306002113201,524288 --field-trial-handle=2316,i,13197899825288197603,3431529978230810998,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:14
  2⤵
  PID:5716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5192,i,1308648522384084268,15940196064064366076,524288 --field-trial-handle=2316,i,13197899825288197603,3431529978230810998,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:14
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,9834995322670370057,10509044123859791689,524288 --field-trial-handle=2316,i,13197899825288197603,3431529978230810998,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:14
  2⤵
  PID:3572
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,9834995322670370057,10509044123859791689,524288 --field-trial-handle=2316,i,13197899825288197603,3431529978230810998,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:14
  2⤵
  PID:3264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=6248,i,3012687764297698800,6777551340665564755,2097152 --field-trial-handle=2316,i,13197899825288197603,3431529978230810998,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:1
  2⤵
  PID:5584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3908,i,13513050222097626715,14270100061738595574,2097152 --field-trial-handle=2316,i,13197899825288197603,3431529978230810998,262144 --variations-seed-version --mojo-platform-channel-handle=3896 /prefetch:1
  2⤵
  PID:1728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6648,i,15071650077269696999,14972354361934944336,2097152 --field-trial-handle=2316,i,13197899825288197603,3431529978230810998,262144 --variations-seed-version --mojo-platform-channel-handle=6660 /prefetch:1
  2⤵
  PID:6060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6072,i,17089023658348495720,16192385787434408278,2097152 --field-trial-handle=2316,i,13197899825288197603,3431529978230810998,262144 --variations-seed-version --mojo-platform-channel-handle=6856 /prefetch:1
  2⤵
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5944,i,875632038210305584,17763419785420475245,2097152 --field-trial-handle=2316,i,13197899825288197603,3431529978230810998,262144 --variations-seed-version --mojo-platform-channel-handle=3788 /prefetch:1
  2⤵
  PID:5768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=7028,i,273335479256913608,11481838652899339083,2097152 --field-trial-handle=2316,i,13197899825288197603,3431529978230810998,262144 --variations-seed-version --mojo-platform-channel-handle=6984 /prefetch:1
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=7132,i,11514603086840078136,18315435619930485300,2097152 --field-trial-handle=2316,i,13197899825288197603,3431529978230810998,262144 --variations-seed-version --mojo-platform-channel-handle=7092 /prefetch:1
  2⤵
  PID:5684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6828,i,6047796091693912278,16892046058168236453,524288 --field-trial-handle=2316,i,13197899825288197603,3431529978230810998,262144 --variations-seed-version --mojo-platform-channel-handle=6668 /prefetch:14
  2⤵
  PID:2588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6340,i,7776170777528973594,11927475636060314732,2097152 --field-trial-handle=2316,i,13197899825288197603,3431529978230810998,262144 --variations-seed-version --mojo-platform-channel-handle=3788 /prefetch:1
  2⤵
  PID:5800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=7684,i,13475387634760955587,2040689932429754007,2097152 --field-trial-handle=2316,i,13197899825288197603,3431529978230810998,262144 --variations-seed-version --mojo-platform-channel-handle=7764 /prefetch:1
  2⤵
  PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=808,i,4714364939868036728,2982990017161277813,524288 --field-trial-handle=2316,i,13197899825288197603,3431529978230810998,262144 --variations-seed-version --mojo-platform-channel-handle=7932 /prefetch:14
  2⤵
  PID:868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7924,i,13829627655131082180,12328582852016427721,524288 --field-trial-handle=2316,i,13197899825288197603,3431529978230810998,262144 --variations-seed-version --mojo-platform-channel-handle=7976 /prefetch:14
  2⤵
  PID:3272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7928,i,7440753141725833779,16785220821526612617,524288 --field-trial-handle=2316,i,13197899825288197603,3431529978230810998,262144 --variations-seed-version --mojo-platform-channel-handle=8020 /prefetch:14
  2⤵
  PID:2936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5340,i,12535819684459160149,13961078559761182919,524288 --field-trial-handle=2316,i,13197899825288197603,3431529978230810998,262144 --variations-seed-version --mojo-platform-channel-handle=8100 /prefetch:14
  2⤵
  PID:5200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=3300,i,13765680398387529895,3596384742201531991,2097152 --field-trial-handle=2316,i,13197899825288197603,3431529978230810998,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:1
  2⤵
  PID:5944
- C:\Users\Admin\Downloads\tor-browser-windows-x86_64-portable-15.0.16.exe
  "C:\Users\Admin\Downloads\tor-browser-windows-x86_64-portable-15.0.16.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:6012
- C:\Users\Admin\Downloads\tor-browser-windows-x86_64-portable-15.0.16.exe
  "C:\Users\Admin\Downloads\tor-browser-windows-x86_64-portable-15.0.16.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1996
- C:\Users\Admin\Downloads\tor-browser-windows-x86_64-portable-15.0.16.exe
  "C:\Users\Admin\Downloads\tor-browser-windows-x86_64-portable-15.0.16.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies registry class
  PID:2020
- - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
    "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:5752
  - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
      "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Checks whether UAC is enabled
      Checks system information in the registry
      Checks processor information in registry
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SendNotifyMessage
      Suspicious use of SetWindowsHookEx
      PID:5416
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -parentBuildID 20260616011530 -prefsHandle 2588:26449 -prefMapHandle 2592:276393 -ipcHandle 2624 -initialChannelId {a4de2f82-0a73-4c2c-a230-42d869c06c77} -parentPid 5416 -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 1 gpu
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1992
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 2184:27031 -prefMapHandle 2120:276393 -jsInitHandle 2180:242716 -parentBuildID 20260616011530 -ipcHandle 2368 -initialChannelId {c16337a6-c25f-4d59-acc1-424d16619a5f} -parentPid 5416 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 2 tab
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:6032
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -parentBuildID 20260616011530 -prefsHandle 2160:27716 -prefMapHandle 2224:276393 -ipcHandle 2924 -initialChannelId {31c80d34-0943-4c69-899b-47e508be1cba} -parentPid 5416 -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 3 rdd
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5928
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 3264:27778 -prefMapHandle 3268:276393 -jsInitHandle 3272:242716 -parentBuildID 20260616011530 -ipcHandle 3288 -initialChannelId {4758696b-0209-4ffe-95a8-6221495899a5} -parentPid 5416 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 4 tab
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2188
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Tor\tor.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Tor\tor.exe" -f "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\torrc" DataDirectory "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor" ClientOnionAuthDir "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\onion-auth" --defaults-torrc "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\torrc-defaults" GeoIPFile "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\geoip" GeoIPv6File "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\geoip6" +__ControlPort 127.0.0.1:9151 HashedControlPassword 16:258b14132f7d6b97609eb2534e8b53217b6b80e9bcc848c5cdacf325c0 +__SocksPort "127.0.0.1:9150 ExtendedErrors IPv6Traffic PreferIPv6 KeepAliveIsolateSOCKSAuth" __OwningControllerProcess 5416 DisableNetwork 1
        5⤵
        Executes dropped EXE
        
        PID:4936
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 3800:27891 -prefMapHandle 3804:276393 -jsInitHandle 3808:242716 -parentBuildID 20260616011530 -ipcHandle 3816 -initialChannelId {5921190d-338e-47cd-80b4-3383e757e0fe} -parentPid 5416 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 5 tab
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks processor information in registry
        
        PID:3788
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 3676:27388 -prefMapHandle 3672:276393 -jsInitHandle 3712:242716 -parentBuildID 20260616011530 -ipcHandle 3500 -initialChannelId {7694674d-45d1-4c32-968e-6b0f7d82f8ea} -parentPid 5416 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 6 tab
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks processor information in registry
        
        PID:6188
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 2364:27388 -prefMapHandle 3244:276393 -jsInitHandle 3248:242716 -parentBuildID 20260616011530 -ipcHandle 3564 -initialChannelId {b1ed6ac6-d1eb-475a-a248-520e493129a1} -parentPid 5416 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 7 tab
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks processor information in registry
        
        PID:6216
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 3624:27388 -prefMapHandle 3628:276393 -jsInitHandle 4076:242716 -parentBuildID 20260616011530 -ipcHandle 4088 -initialChannelId {dfcf5caf-c508-44fb-9469-a19a0b38df34} -parentPid 5416 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 8 tab
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:6260
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -parentBuildID 20260616011530 -sandboxingKind 0 -prefsHandle 1912:30022 -prefMapHandle 4268:276393 -ipcHandle 4280 -initialChannelId {dd52e5a8-b020-4e86-ae26-4de897c7c603} -parentPid 5416 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 9 utility
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:6800
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 4048:29043 -prefMapHandle 1912:276393 -jsInitHandle 4284:242716 -parentBuildID 20260616011530 -ipcHandle 4460 -initialChannelId {b59bca32-7047-4266-a39a-17787a1cb575} -parentPid 5416 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 10 tab
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:8100
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 4892:29621 -prefMapHandle 4996:276393 -jsInitHandle 5032:242716 -parentBuildID 20260616011530 -ipcHandle 4820 -initialChannelId {a69e7c1c-26db-43fb-8361-c7bae163389b} -parentPid 5416 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 11 tab
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:7204
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 5296:29741 -prefMapHandle 5332:276393 -jsInitHandle 5324:242716 -parentBuildID 20260616011530 -ipcHandle 4932 -initialChannelId {9bf3dbe6-d99a-42b0-89c6-b2ca16e242e2} -parentPid 5416 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 12 tab
        5⤵
        Executes dropped EXE
        
        PID:7868
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 4084:29903 -prefMapHandle 1872:276393 -jsInitHandle 1936:242716 -parentBuildID 20260616011530 -ipcHandle 3520 -initialChannelId {894277ea-13f8-47e1-ab26-5ebdb32ed8d1} -parentPid 5416 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 13 tab
        5⤵
        Executes dropped EXE
        
        PID:4908
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 4560:29903 -prefMapHandle 4564:276393 -jsInitHandle 4548:242716 -parentBuildID 20260616011530 -ipcHandle 3572 -initialChannelId {5c27c400-4530-46ba-b4b4-68dba4615093} -parentPid 5416 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 14 tab
        5⤵
        Executes dropped EXE
        
        PID:7480
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 5360:29903 -prefMapHandle 5496:276393 -jsInitHandle 5516:242716 -parentBuildID 20260616011530 -ipcHandle 5500 -initialChannelId {6f9694d7-dc26-4cec-8c37-199d2548b6ae} -parentPid 5416 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 15 tab
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:8040
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 5100:29903 -prefMapHandle 5500:276393 -jsInitHandle 5516:242716 -parentBuildID 20260616011530 -ipcHandle 3512 -initialChannelId {a98a02c1-54c0-4b91-b1ff-6f3a5c06f349} -parentPid 5416 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 16 tab
        5⤵
        Executes dropped EXE
        
        PID:2840
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 4164:29903 -prefMapHandle 2884:276393 -jsInitHandle 5332:242716 -parentBuildID 20260616011530 -ipcHandle 4952 -initialChannelId {8cd5d1cf-0396-4caf-a9a1-c1d7883c9c52} -parentPid 5416 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 17 tab
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:7076
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 3316:29903 -prefMapHandle 5064:276393 -jsInitHandle 4516:242716 -parentBuildID 20260616011530 -ipcHandle 4968 -initialChannelId {83ba7398-f1dc-4340-85f7-f0e302e403b0} -parentPid 5416 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 18 tab
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:8044
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 4968:29903 -prefMapHandle 4516:276393 -jsInitHandle 5064:242716 -parentBuildID 20260616011530 -ipcHandle 5948 -initialChannelId {885d9b65-5792-47b7-973d-f91b2c93f93b} -parentPid 5416 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 19 tab
        5⤵
        Executes dropped EXE
        
        PID:7800
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 2364:29903 -prefMapHandle 5076:276393 -jsInitHandle 3640:242716 -parentBuildID 20260616011530 -ipcHandle 5316 -initialChannelId {6d37c355-ebed-4ba2-a87d-3429e31ade98} -parentPid 5416 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 20 tab
        5⤵
        Executes dropped EXE
        
        PID:5024
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 3704:30027 -prefMapHandle 2140:276393 -jsInitHandle 3076:242716 -parentBuildID 20260616011530 -ipcHandle 6256 -initialChannelId {0efd5297-6c57-4426-ac20-3faa19eda3ea} -parentPid 5416 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 21 tab
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:2980
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 6364:30079 -prefMapHandle 6368:276393 -jsInitHandle 6372:242716 -parentBuildID 20260616011530 -ipcHandle 6324 -initialChannelId {97b3bdac-23e5-429d-b7f4-518e3bb14edd} -parentPid 5416 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 22 tab
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:6420
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 5864:30079 -prefMapHandle 6300:276393 -jsInitHandle 6296:242716 -parentBuildID 20260616011530 -ipcHandle 6288 -initialChannelId {fdb2d069-c5bd-49bd-9b6d-2cfec497863d} -parentPid 5416 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 23 tab
        5⤵
        Executes dropped EXE
        
        PID:4040
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 6012:30507 -prefMapHandle 6000:276393 -jsInitHandle 5988:242716 -parentBuildID 20260616011530 -ipcHandle 5980 -initialChannelId {d173fee7-e81c-4476-9be9-f9db56710250} -parentPid 5416 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 24 tab
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:6732
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 3620:30507 -prefMapHandle 5976:276393 -jsInitHandle 1760:242716 -parentBuildID 20260616011530 -ipcHandle 4400 -initialChannelId {b63779ec-7be7-420f-b788-23dfd74c736a} -parentPid 5416 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 25 tab
        5⤵
        Executes dropped EXE
        
        PID:7376
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 6612:30507 -prefMapHandle 3272:276393 -jsInitHandle 5912:242716 -parentBuildID 20260616011530 -ipcHandle 6624 -initialChannelId {65b01fe0-a9be-4ece-ad98-0c75b31d4040} -parentPid 5416 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 26 tab
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:3056
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 6124:30547 -prefMapHandle 6108:276393 -jsInitHandle 6112:242716 -parentBuildID 20260616011530 -ipcHandle 1008 -initialChannelId {970afec0-145a-4aad-b0bc-33cddfbc716c} -parentPid 5416 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 27 tab
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:7524
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 3108:30547 -prefMapHandle 3644:276393 -jsInitHandle 6632:242716 -parentBuildID 20260616011530 -ipcHandle 6628 -initialChannelId {62d5d431-2110-4add-8501-f7e84bedb117} -parentPid 5416 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 28 tab
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:2968
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 6616:30547 -prefMapHandle 6836:276393 -jsInitHandle 2036:242716 -parentBuildID 20260616011530 -ipcHandle 7528 -initialChannelId {47e3f007-0bec-465a-92dc-ddbcb2bb7a95} -parentPid 5416 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 29 tab
        5⤵
        Executes dropped EXE
        
        PID:6140
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 6908:30547 -prefMapHandle 6896:276393 -jsInitHandle 6872:242716 -parentBuildID 20260616011530 -ipcHandle 6832 -initialChannelId {9634e230-9883-484c-9469-26128839f701} -parentPid 5416 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 30 tab
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:552
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 7804:30547 -prefMapHandle 7808:276393 -jsInitHandle 7812:242716 -parentBuildID 20260616011530 -ipcHandle 7468 -initialChannelId {3d1de1ee-269e-446f-a703-416d46c40e0a} -parentPid 5416 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 31 tab
        5⤵
        Executes dropped EXE
        
        PID:6212
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 7940:30547 -prefMapHandle 7944:276393 -jsInitHandle 4148:242716 -parentBuildID 20260616011530 -ipcHandle 7844 -initialChannelId {35710c3b-d370-41e0-b2c6-a868031aa91e} -parentPid 5416 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 32 tab
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:7404
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 7832:30547 -prefMapHandle 7460:276393 -jsInitHandle 6644:242716 -parentBuildID 20260616011530 -ipcHandle 8112 -initialChannelId {ef9ee746-a0b5-4fe2-97bd-ea9eafa5801e} -parentPid 5416 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 33 tab
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:8168
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 8296:30547 -prefMapHandle 8300:276393 -jsInitHandle 8304:242716 -parentBuildID 20260616011530 -ipcHandle 7460 -initialChannelId {0381b1b0-99f3-4c75-a625-241f0d2b56af} -parentPid 5416 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 34 tab
        5⤵
        Executes dropped EXE
        
        PID:3384
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 7932:30547 -prefMapHandle 7108:276393 -jsInitHandle 7332:242716 -parentBuildID 20260616011530 -ipcHandle 6836 -initialChannelId {17128d2c-2f2d-4883-9782-089d893e907b} -parentPid 5416 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 35 tab
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:8244
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 7580:30547 -prefMapHandle 7568:276393 -jsInitHandle 7532:242716 -parentBuildID 20260616011530 -ipcHandle 7776 -initialChannelId {db4e2539-bbcf-4a25-9255-d987b2738636} -parentPid 5416 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 36 tab
        5⤵
        Executes dropped EXE
        
        PID:8272
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 8540:30547 -prefMapHandle 8536:276393 -jsInitHandle 8532:242716 -parentBuildID 20260616011530 -ipcHandle 8556 -initialChannelId {b54d42f5-0eac-487c-901b-4104b36cd118} -parentPid 5416 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 37 tab
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:8844
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 8720:30547 -prefMapHandle 8724:276393 -jsInitHandle 8728:242716 -parentBuildID 20260616011530 -ipcHandle 8736 -initialChannelId {00af4a72-6d2e-46ef-a170-76c2e220ea13} -parentPid 5416 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 38 tab
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:8872
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 6328:30547 -prefMapHandle 6956:276393 -jsInitHandle 6208:242716 -parentBuildID 20260616011530 -ipcHandle 8744 -initialChannelId {70136e5e-fd78-405e-acbf-48891cd453e2} -parentPid 5416 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 39 tab
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:8316
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 8888:30547 -prefMapHandle 8884:276393 -jsInitHandle 8880:242716 -parentBuildID 20260616011530 -ipcHandle 8872 -initialChannelId {103cacef-78f2-45cf-b7e9-a73ff56ccc71} -parentPid 5416 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 40 tab
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:8356
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 6036:30547 -prefMapHandle 7008:276393 -jsInitHandle 7036:242716 -parentBuildID 20260616011530 -ipcHandle 8764 -initialChannelId {b9afbba3-0073-4669-9e7e-6e3afe0e8857} -parentPid 5416 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 41 tab
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:7596
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 8764:30547 -prefMapHandle 7036:276393 -jsInitHandle 7008:242716 -parentBuildID 20260616011530 -ipcHandle 8508 -initialChannelId {2d737acb-68d8-4a82-99ac-9d741f74f45c} -parentPid 5416 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 42 tab
        5⤵
        Executes dropped EXE
        
        PID:8904
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 7664:30547 -prefMapHandle 6988:276393 -jsInitHandle 8844:242716 -parentBuildID 20260616011530 -ipcHandle 7416 -initialChannelId {f56f3f06-9b31-4d0a-ab5c-27985c880f13} -parentPid 5416 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 43 tab
        5⤵
        Executes dropped EXE
        
        PID:8824
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 7744:30547 -prefMapHandle 7748:276393 -jsInitHandle 7732:242716 -parentBuildID 20260616011530 -ipcHandle 7720 -initialChannelId {5d7dd47e-0be7-4c20-9d30-b4a5a4fd1fb4} -parentPid 5416 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 44 tab
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:9208
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 8464:30547 -prefMapHandle 6984:276393 -jsInitHandle 6128:242716 -parentBuildID 20260616011530 -ipcHandle 8744 -initialChannelId {d5c21040-947d-4269-a19e-a14165026678} -parentPid 5416 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 45 tab
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:8300
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 6304:30547 -prefMapHandle 6100:276393 -jsInitHandle 6084:242716 -parentBuildID 20260616011530 -ipcHandle 8004 -initialChannelId {c5a705e6-4ca8-4133-98c0-6042ef0d3d7c} -parentPid 5416 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 46 tab
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:9076
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 8792:30547 -prefMapHandle 8796:276393 -jsInitHandle 6120:242716 -parentBuildID 20260616011530 -ipcHandle 8876 -initialChannelId {a8f43456-be4c-4839-b9fd-c5a2bcb4e270} -parentPid 5416 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 47 tab
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:9108
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 6172:30547 -prefMapHandle 8796:276393 -jsInitHandle 6160:242716 -parentBuildID 20260616011530 -ipcHandle 6116 -initialChannelId {bbfbeab4-4366-4733-bf7b-f408fad3de98} -parentPid 5416 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 48 tab
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:8976
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 8552:30547 -prefMapHandle 8664:276393 -jsInitHandle 8288:242716 -parentBuildID 20260616011530 -ipcHandle 8304 -initialChannelId {29aca10b-1a38-41ce-8300-a26dfcdef3ee} -parentPid 5416 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 49 tab
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:7764
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 7396:30547 -prefMapHandle 7952:276393 -jsInitHandle 6960:242716 -parentBuildID 20260616011530 -ipcHandle 8096 -initialChannelId {cac5ae26-1bad-4d85-9a09-c2c6841275c4} -parentPid 5416 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 50 tab
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:8720
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 5976:30547 -prefMapHandle 8732:276393 -jsInitHandle 8232:242716 -parentBuildID 20260616011530 -ipcHandle 7380 -initialChannelId {cb0c6c42-04c8-4996-8a5f-f3fa2a91d6d7} -parentPid 5416 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 51 tab
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:1420
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 8680:30547 -prefMapHandle 8732:276393 -jsInitHandle 8272:242716 -parentBuildID 20260616011530 -ipcHandle 8532 -initialChannelId {9991a92b-bb97-463e-aff9-f4fd4b86d765} -parentPid 5416 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 52 tab
        5⤵
        Executes dropped EXE
        
        PID:9092
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 8220:30547 -prefMapHandle 7976:276393 -jsInitHandle 7644:242716 -parentBuildID 20260616011530 -ipcHandle 8532 -initialChannelId {19c86373-ef6f-44d3-acd6-06018a658e39} -parentPid 5416 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 53 tab
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:7432
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 7764:30547 -prefMapHandle 7656:276393 -jsInitHandle 8100:242716 -parentBuildID 20260616011530 -ipcHandle 8352 -initialChannelId {a0a89ee9-ca17-445a-bcce-8dc2f331c8c7} -parentPid 5416 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 54 tab
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:9204
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 7868:30547 -prefMapHandle 7856:276393 -jsInitHandle 7816:242716 -parentBuildID 20260616011530 -ipcHandle 7928 -initialChannelId {74bb791a-e5b6-4932-8ca7-24b2d9fe5591} -parentPid 5416 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 55 tab
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:8776
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 7388:30547 -prefMapHandle 7824:276393 -jsInitHandle 8376:242716 -parentBuildID 20260616011530 -ipcHandle 8928 -initialChannelId {61e29544-4221-479b-a0e9-af3f484327b8} -parentPid 5416 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 56 tab
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:6492
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 8384:30547 -prefMapHandle 8436:276393 -jsInitHandle 8364:242716 -parentBuildID 20260616011530 -ipcHandle 9108 -initialChannelId {731c5fb2-76ee-4dea-a747-5fac433e892d} -parentPid 5416 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 57 tab
        5⤵
        Executes dropped EXE
        
        PID:2488
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 8344:30547 -prefMapHandle 7940:276393 -jsInitHandle 7888:242716 -parentBuildID 20260616011530 -ipcHandle 7236 -initialChannelId {11be9194-69da-473a-8a6e-11efb8de355b} -parentPid 5416 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 58 tab
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:7420
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 7868:30547 -prefMapHandle 8312:276393 -jsInitHandle 8388:242716 -parentBuildID 20260616011530 -ipcHandle 7592 -initialChannelId {5e986827-4471-4b1d-8865-bcae775c23ff} -parentPid 5416 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 59 tab
        5⤵
        Checks processor information in registry
        
        PID:1664
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 8468:30770 -prefMapHandle 6216:276393 -jsInitHandle 4400:242716 -parentBuildID 20260616011530 -ipcHandle 8340 -initialChannelId {46570e78-63e7-4e73-a02f-9f886140dd8e} -parentPid 5416 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 60 tab
        5⤵
        
        PID:8944
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 7036:30770 -prefMapHandle 6064:276393 -jsInitHandle 7580:242716 -parentBuildID 20260616011530 -ipcHandle 6276 -initialChannelId {1f8976ea-8cca-4edd-a0fa-9d3172159772} -parentPid 5416 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 61 tab
        5⤵
        Checks processor information in registry
        
        PID:7344
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 7912:30770 -prefMapHandle 9100:276393 -jsInitHandle 7284:242716 -parentBuildID 20260616011530 -ipcHandle 6448 -initialChannelId {e768f63d-acbd-4aa6-bae1-85b7b0a1245f} -parentPid 5416 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 62 tab
        5⤵
        
        PID:8476
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 6416:30770 -prefMapHandle 6464:276393 -jsInitHandle 8816:242716 -parentBuildID 20260616011530 -ipcHandle 6380 -initialChannelId {05ed1f82-c729-4d86-ad14-4b7dc8a3ef7b} -parentPid 5416 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 63 tab
        5⤵
        Checks processor information in registry
        
        PID:2248
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 7944:30770 -prefMapHandle 7480:276393 -jsInitHandle 7556:242716 -parentBuildID 20260616011530 -ipcHandle 8816 -initialChannelId {03da6c45-08f6-4666-b573-8f6fbcbd87b2} -parentPid 5416 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 64 tab
        5⤵
        
        PID:4064
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 7008:30770 -prefMapHandle 2024:276393 -jsInitHandle 6228:242716 -parentBuildID 20260616011530 -ipcHandle 6948 -initialChannelId {65aefb4a-5d78-4e38-b1df-db492f441c25} -parentPid 5416 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 65 tab
        5⤵
        Checks processor information in registry
        
        PID:8596
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 8780:30770 -prefMapHandle 8804:276393 -jsInitHandle 6016:242716 -parentBuildID 20260616011530 -ipcHandle 7592 -initialChannelId {783e9815-538b-4fe5-8a58-7f1dd752ffcc} -parentPid 5416 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 66 tab
        5⤵
        Checks processor information in registry
        
        PID:8052
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 6332:30770 -prefMapHandle 8352:276393 -jsInitHandle 9188:242716 -parentBuildID 20260616011530 -ipcHandle 7908 -initialChannelId {17af58a6-11e2-408e-9964-c408b28121be} -parentPid 5416 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 67 tab
        5⤵
        Checks processor information in registry
        
        PID:6504
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 6092:30770 -prefMapHandle 7548:276393 -jsInitHandle 6892:242716 -parentBuildID 20260616011530 -ipcHandle 7680 -initialChannelId {1b1b4ebe-1782-406d-b504-38ab1e6bfacf} -parentPid 5416 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 68 tab
        5⤵
        Checks processor information in registry
        
        PID:6456
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 5944:30770 -prefMapHandle 8028:276393 -jsInitHandle 6884:242716 -parentBuildID 20260616011530 -ipcHandle 8624 -initialChannelId {902eb0ed-ff66-449b-8fa5-c104d1d21090} -parentPid 5416 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 69 tab
        5⤵
        Checks processor information in registry
        
        PID:7296
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 8548:30770 -prefMapHandle 8668:276393 -jsInitHandle 6984:242716 -parentBuildID 20260616011530 -ipcHandle 6812 -initialChannelId {7de14853-d7b0-4d85-b501-17b7d2edd03e} -parentPid 5416 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 70 tab
        5⤵
        
        PID:9200
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 7572:30770 -prefMapHandle 6036:276393 -jsInitHandle 6508:242716 -parentBuildID 20260616011530 -ipcHandle 7268 -initialChannelId {89c1f485-ed99-4d07-8581-4ce1614b4c78} -parentPid 5416 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 71 tab
        5⤵
        Checks processor information in registry
        
        PID:8548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7032,i,6222815561623428896,7067241991888604232,524288 --field-trial-handle=2316,i,13197899825288197603,3431529978230810998,262144 --variations-seed-version --mojo-platform-channel-handle=7100 /prefetch:14
  2⤵
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5320,i,8918350940610720673,14173983543602702009,524288 --field-trial-handle=2316,i,13197899825288197603,3431529978230810998,262144 --variations-seed-version --mojo-platform-channel-handle=8088 /prefetch:14
  2⤵
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6344,i,9556618273976198828,10683279049902523517,262144 --field-trial-handle=2316,i,13197899825288197603,3431529978230810998,262144 --variations-seed-version --mojo-platform-channel-handle=7084 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=8208,i,9442860605979172898,13161572245417110590,2097152 --field-trial-handle=2316,i,13197899825288197603,3431529978230810998,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:1
  2⤵
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=8340,i,7562875757118502386,18134999048004595864,2097152 --field-trial-handle=2316,i,13197899825288197603,3431529978230810998,262144 --variations-seed-version --mojo-platform-channel-handle=8356 /prefetch:1
  2⤵
  PID:6048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=8380,i,10515666705147291298,14600952698873880831,2097152 --field-trial-handle=2316,i,13197899825288197603,3431529978230810998,262144 --variations-seed-version --mojo-platform-channel-handle=8416 /prefetch:1
  2⤵
  PID:3300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=8528,i,6367137934423873761,8301798184424806445,2097152 --field-trial-handle=2316,i,13197899825288197603,3431529978230810998,262144 --variations-seed-version --mojo-platform-channel-handle=8524 /prefetch:1
  2⤵
  PID:5228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=5564,i,8719781131054822993,10905477972156892987,2097152 --field-trial-handle=2316,i,13197899825288197603,3431529978230810998,262144 --variations-seed-version --mojo-platform-channel-handle=8592 /prefetch:1
  2⤵
  PID:3636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=8572,i,2047551602243159808,2861577533132628138,2097152 --field-trial-handle=2316,i,13197899825288197603,3431529978230810998,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:1
  2⤵
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=8396,i,153094002550987027,7211209303421711207,2097152 --field-trial-handle=2316,i,13197899825288197603,3431529978230810998,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:1
  2⤵
  PID:124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=5436,i,16293386499121903383,12954130833301031547,2097152 --field-trial-handle=2316,i,13197899825288197603,3431529978230810998,262144 --variations-seed-version --mojo-platform-channel-handle=8772 /prefetch:1
  2⤵
  PID:5420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5452,i,4218840763753377301,12635011639573985352,524288 --field-trial-handle=2316,i,13197899825288197603,3431529978230810998,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:14
  2⤵
  PID:2164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8760,i,12410730178438210706,3390412935563412043,524288 --field-trial-handle=2316,i,13197899825288197603,3431529978230810998,262144 --variations-seed-version --mojo-platform-channel-handle=8996 /prefetch:14
  2⤵
  PID:5200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5800,i,10805545112194026465,16941847964637327833,524288 --field-trial-handle=2316,i,13197899825288197603,3431529978230810998,262144 --variations-seed-version --mojo-platform-channel-handle=8912 /prefetch:14
  2⤵
  PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1088,i,9180670995484286413,1458527291625213224,524288 --field-trial-handle=2316,i,13197899825288197603,3431529978230810998,262144 --variations-seed-version --mojo-platform-channel-handle=3120 /prefetch:14
  2⤵
  PID:8004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=3920,i,9000376727309960223,6652588200466302879,2097152 --field-trial-handle=2316,i,13197899825288197603,3431529978230810998,262144 --variations-seed-version --mojo-platform-channel-handle=7832 /prefetch:1
  2⤵
  PID:2044

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2712

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2684

C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:5004

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:7356

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:6004

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:2900

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 83748c5f59c12f467f96b0d21c3c9653419dfd0271c8efbdeebbd6ba4bd7548e
MD5 96bfca4318642edfa521d002be0f096d
SHA1 447f1b34ddedc860a8f0bd0c6dc12c229624acab
SHA512 b49889400d8441bd0f61eebe0a2489d48e83671a4d77bfdef519545878aebce5aa04d5e498b1e16dc02fc2a5990edce5232840f2805bd3cf047ef33c92fa70f4
TLSH
T112D080277919E851C0561171583DC779561941473EE6C20F79D5F04ED8D645073D7543
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f955c8d6f1a1a3190d5e321035e28ca582fcb76ec2f60d653e90465ff9d1ea00
MD5 0213e77255f07e9c3fc2c451f7a980eb
SHA1 a625e805f5575150fe89058ebdc7b3356ff294ad
SHA512 94f5a80a660d01988274953f2dc96b3f630595c4d1011e0137458475b3b6bda55410996e5d95fff27f7dfa7d3bf4ad111036266eb70344bc4183986e8f524b78
TLSH
T1BBD080277919E851C05611315C39C7795619414B3EE5C20F75D5E04ED8D645063D7547
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 194a79f6993e4de2ab3894c90735bddf52697a9c3dd6533c3724f0df455fbb99
MD5 f893a849598e40a8dfe97e86b6c23416
SHA1 397b5def37df1f5eb5b428e7b0aaa74918b36241
SHA512 acc88561667696a6d52bb918cfc56f6cab5e1f2bda5fb3c031d30dde6c2e5a90b2d31f99d1f06a30a78fc1f222b9f394e5826892b88a84d4cf24dc8c11a64849
TLSH
T1A6E0268A85CBE32ED20CA4C7426D571C8281370EAEC96D5E27088C843685288AA8BDE0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 328B
SHA256 91420a4310d92460f96fde69797d8f01a4522db5cdb55bb446225b486047a0fe
MD5 e16f9628d8549f738d35fc658ed970e2
SHA1 b67b43ce8e5c020a7dfe2f1658dee6355c3d1a9f
SHA512 14627e6b06c2a1724b55d9e7111cd07c91aa63f13e1d9d5c8d329339251667d174ae89f2201bdce4515f8e0a95b4f37d970035dd89e2b18fcc9aa8e4f9156ce4
TLSH
T1A7E0268CDACAC32FD340659B436C670CC290360FE6C9E94E5B0884C83002A89A682698
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 0a2d6053d209482f1aeda38c4eee25f31a0c0d2d3171e578e0e0f8bc239fcab6
MD5 f6e2910892f7999898e24a1d53de5548
SHA1 df4fd40e37bdde1f76f5f28c995193f6425531df
SHA512 db3d2f7e6f2ca9eda41fbef215cd00585be9f6b90e8e5251bf2bd25f332f306e64079a3655ef203bea6cd78cec01c90990b7ba043fcf0f87c202795ac2dd40cc
TLSH
T160E0208454C9D36FF3086C8B415D570C4280374E96C49D8D3704CC853045145AD82554
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 14064fa4c619e556a9645ca0c338f8b63e4b02e7b9b90cbd48f270130ba8e354
MD5 1f9a8c86e1e1f102231a8764b6b01ca7
SHA1 ceaf2d1974fd1233f93e1404fb9e3e924dfdd271
SHA512 1dbecc849733748cadb584a24e7554311dfed001a65d59ed7d1cc3ba8159e7afe987bf0e435e78e54021e46d575adcb6feaa95eb43150710a350211c0aadd974
TLSH
T162E02B9AC961983708FC072868615747EF5513673740994F3A3E87098FB1F3A4286C5C
MD5 SHA1 SHA512 TLSH

Submit Download

f_00008b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008b
Size 67KB
SHA256 6a40cf4ef883645d8aac1ff07d15a9126683b31733b69684dee77dde6e92709d
MD5 8c3e389d3c501c507dd52dda749a6203
SHA1 c2cdec984bd048eac554eb12aa57f452a3c47b86
SHA512 2c2d65b80cd61359440f1de18ecfbd5f0e05e5a140da1b400db86fbe5bf24a98de0a70f1f80d58be438e91dff3d4cd2315d9516b136f130cde659bf6d5f4dd25
SSDEEP 1536:OHfu3iISLaL3JuWry2BxxQdJ7otPGmB+3XyPtO8vJRbrGT/W:mLLazoW2P9q+3CPtBRbrKu
TLSH
T179630291D782A8D842B9BB775D9DAE02072D84FA406B783C3A2B487EC30164FB757858
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008c
Size 400KB
SHA256 ce8271cfdedad8159ea39cda6734ecf6173bf46ab0634183cca08f5664d308c7
MD5 25df825ee84ed2812c8ad4bf380cd637
SHA1 416211ef7ea47b59dd47868698ef5676ed446f7b
SHA512 2e9ab286a8ad1bae04941d6fbe1ff3f241ba78e18c0254bd610bd0e40c641adad222d5bc5b056381e7f29a4af30d141d2da935fc09109a003f22b2d7d2be8081
SSDEEP 6144:2Hcy+Eys+jh/K0hfR9U8q1NBfF213QYO7Fm1gFcVxhh5OW6Nx0l1ZH0aAglb23ZG:28y+EOViKEnOuCNLvx7ZH9Agh23v4
TLSH
T1AF942318EFEF25CE1FE0565B7992A8D60FF91ED71F2EE821FA41160C00514FB15426B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008d
Size 160KB
SHA256 c1c91de32462e18a7542faeb612607d8a47106d7d5cbbcf209878a7a179deaa4
MD5 b944ff07458ac385f1cbe378c560c67e
SHA1 37fbe473a467e5b6d3a565b5f028f3d122643795
SHA512 6b10b3daaab94e20230384b2db9b8e9583337551cf8066f8355c2324e518f928e4e39f775862b2633ccccfbe9c88f4b326bec3aa2c953efefb84e119c247341c
SSDEEP 3072:NYLNNDLh61QVvHLq1qsM4ZLRWHl8mo5YpbUuw/+0TKOSepfJ:N0kKVvrCM4Ztt35u6HmOfJ
TLSH
T12FF312CA73AF37E4AEC2C58575090E4866323641D91C1099DEFAFEBC0468CB3D4B66D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000091

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000091
Size 62KB
SHA256 df670e09f278fea1d0684afdcd0392a83d7041585ba5996f7b527974d7d98ec3
MD5 c813a1b87f1651d642cdcad5fca7a7d8
SHA1 0e6628997674a7dfbeb321b59a6e829d0c2f4478
SHA512 af0d024ba1faafbd6f950c67977ed126827180a47cea9758ee51a95d13436f753eb5a7aa12a9090048a70328f6e779634c612aebde89b06740ffd770751e1c5b
SSDEEP 1536:Q9pfnSa+E9Az52gNbkYtUtqvUhZRHuLdrx07LXz:uhnSpE9A1EY6tBPix07Lj
TLSH
T1695301D4670EE2A579F2CF23BF59C5C00803162D8E11AA68FFA063878D8430BA793D1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000092

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000092
Size 70KB
SHA256 fb687d71a9090fd9b633c3653a29fd3ff5a0232219faf486fc7bef2442a2b0f8
MD5 457a06fdf8d4e3d90fe5d3f6666ad04c
SHA1 3f0907e5739b107188d38c2547a9bca8ba8c969f
SHA512 1333d720540ee69790ba13c32311775888e8018e5eb8c4af973133a68e10fb934465d98ff007bb79d40f31480bbb57dac100de1d427b6700b4379aeb69980197
SSDEEP 1536:Qdq4rH3xSG4yuk6NTmRH2Ma2mxKie56ckEcHhg8FimgmziZh6YoVLFPjlC/FQra:N4reyB6FmN8KqckEymWG/hFoLPjhra
TLSH
T1806312DC7216EB862B148A27F4E615C96B740947E2C9D9CA0D1D33EE1818E3F7FE2160
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000093

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000093
Size 309KB
SHA256 e2e4d97c20d4478e8e947480c8f6c71a2c795776d405366be70db82e4ea4ba77
MD5 8192d891e754afd81a399f98bc6b265f
SHA1 965e6c69f45118feab86eeebbb0fc4964f2b3a98
SHA512 7c2712a1e34da9062f50e7d93f4e74772044e45c265c682abcd4e28e4004dcdaf6ce7479a4e8785986a88a32257e4fac0ecf8ce23afe47968c4510df0a2c800b
SSDEEP 6144:vLKLj7yjWF276GNg9fpe3HdabIKSB1DkCXW8o0oMlppfbm:zgj7bSB1DkCXW8T5dbm
TLSH
T1D564F8C9F3877513835271B8E17B1208A23A2559D41D443CFEE9E5D23CBA686933B7B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000094

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000094
Size 19KB
SHA256 af18b3681e8e2a1e8dc34c2aa60530dc8d8a9258c4d562cbe20c898d5de98725
MD5 1bd4ae71ef8e69ad4b5ffd8dc7d2dcb5
SHA1 6dd8803e59949c985d6a9df2f26c833041a5178c
SHA512 b3ff083b669aca75549396250e05344ba2f1c021468589f2bd6f1b977b7f11df00f958bbbd22f07708b5d30d0260f39d8de57e75382b3ab8e78a2c41ef428863
SSDEEP 384:/Und3PKicut4yiFkC9RWzlJpa2/CKYOyDJmCZyXJTW4PO821GyLjSoBwNeS:0UizQDYlJpaQCKYOyDJpI5Kx821DS3Nz
TLSH
T13692E1670BCE314E422EE25FA316A51733E41BE1EFE49640D6AA70D81C38DA243179D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000095

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000095
Size 38KB
SHA256 1ec693235f8713fad6da0d1e7cfa295440fd04dd6b3b0e223aaeff1d648bdf23
MD5 d0fa48257ea5743ce5c36e12ade7e675
SHA1 85930839f0b36619a5c5200aa05ce53eca1c020f
SHA512 3f535a7d1f5edd805c97ca1d5b0212a4f04e442d9ddfa12c35ceb364aef2ab2f376c27756cb4f0f7f1ce5f03dfefcf7f7a1494715a7a33fa9e3ef317e8675907
SSDEEP 768:0tmmarCvc5V9wk7ermUxd40JbcSNRT4TAkdHGLOcjNmK7RFK:0tmmiCvsV9N7u4tART8THGyib7RFK
TLSH
T1D1030252A53858F50157AEE3195954EC07E01D5C78A1BC57DE0290CE3DFDA77BC94E10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000096

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000096
Size 38KB
SHA256 ee11fe732ad5cdd818ca4f82802658b72b435ddafd277862c5ff5e8c7792fc5b
MD5 c64471b4dbf32d24e99720769aa56ec0
SHA1 5980f3fc4223d8267c10aa9aeb52ec471dc5638a
SHA512 b6ea0c14f07fe4d75bf2b923e2185137a67a0a5e7c16a82e568f3570511e5d5911c3194f235c7002b3d8a88b33e493be2af609a243d9559041542be62470ebae
SSDEEP 768:JDR+wPn/YVmMX2czoWhAhyAAZ+evDxcKzv4NZ7gNiI6ZFTm:XPUmMXfbyyAm7xcyQNZ7gf3
TLSH
T1FA03F134AE53235DF9175AB444B75AA1628BE50305E9803F2DA28BE93063FF526C4EDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009d
Size 40KB
SHA256 6710534877b62f10e7db1b692cdf7dffb99ee4da219926787ec05628529c0df0
MD5 3c87c64f548890eab60608422f7baba5
SHA1 24a24b32403f76a45425952de6a7a3984182a763
SHA512 52bcc1bf7d6cdb6bbe6e9a3b77dcd3849ec38fcb6e6be84fcb5a5ed9b859e024756b8129ef6c25ed9eaa27f87781aa641bd372cbb5db59aef30406cb445bc3c9
SSDEEP 768:MXZELorpvyPt96gZGyatx3J5mQaPl522Dc2hG73SZ4hwUw+VgJvNwL:MSLo9WVZTatx6xl5xgT7I4OUwkOG
TLSH
T18413F1B10F6673468C7B795D023D033FC1E6989A7A7C19CFD75EDB2A8A41A104C0F856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009e
Size 128KB
SHA256 711ef54e187b69822b2501eeb0f846e51a9a2d9bf9baba98314e10e38561f265
MD5 92fd7b93de08ddefef2c5d7739e61c4c
SHA1 8b9c0b81d673d431e9e13ce55b7b833b9f6cd653
SHA512 fec207ec6cab40244326b1f68e85b393bc0a5f8f81681aa82d2e2d7fb014e359cd9ca0e8e47b1c0d2faf8d66528ea918ccd591952cd4c8c880265902237bc9f2
SSDEEP 3072:9/btzvxU0wvPV9jT49zKz4vJzu0haN19OpbH/D6Y:95zvxUfbvqzx5ubN19QDL6Y
TLSH
T118D3D0A0DE0AA191CE176BF4F81C2E221F7915E565E47A0B4AB25C15B6CC14FE31FB0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009f
Size 55KB
SHA256 c654086e0a26939f965f607435679d19fbea65c2b41b677161d9d317f522c500
MD5 3b2159a39d57a3934d05d3a9f3a8f569
SHA1 0a87b380d67cde1264326a451e4a326e357a2e4a
SHA512 e9b0d010859d4ffc861edcff85f70a49f36f896fd117842430eea06beca633350c632b8e1227405c30b4616ce94224f25133b1e580592e0db4200e46ea9bb508
SSDEEP 1536:oXzU8oWUU5cDO7II2M1OP2GO8YYUr+eVm16u++:oXY8+UcSX3GO1YgPVq6u++
TLSH
T148430211C72C0B40BD492EB2E313E475A0B6F0D56B0AC3CEDB562356DF8A7666AB100F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000b5

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b5
Size 17KB
SHA256 5e7860755e4e8d250dff8b44a59d73472aec8cb985e59759c4e3383d43f143bf
MD5 c02a9981aac79d548df7f0617360103f
SHA1 1f8d55fbbf61745bf81c9aa875facec20c2f200a
SHA512 c75ddf5d53575aa498abb8b3b55d485fc5586da8c76e11fa1ad2bac2dbbdad7fded411354c383bdc5884e75c2eebeeb76b98558cea366e548686fa869d511baa
SSDEEP 384:Nl1zKQHW+g5V8sFb1zRT5gcvKpgF+etspdYaUahu5y/9U2:X1OQ2nHXVg0KhecuaQylU2
TLSH
T1A472D0EFA0D7418F63A4CBE1C2578E2F2C0366CF44A2416F122A5C9512E51FA128F7ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000b8

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b8
Size 256KB
SHA256 7cf6db9eed43b81665629edbed64b5a629e86cfaa0bb7bc644721687c5017311
MD5 f00ffa59a6f24a79d0a38984f1d1c667
SHA1 9c3ea96bb40c2ddce7d7033914eef469aa562c4e
SHA512 b00e01b45fdba4e8c350c7f27080f5f7bc3d66ca31b8acf702719afd529db4a153451dfe3957d1d72aafae48e4c0bcb16896abc66adc347414197c6386da17cf
SSDEEP 3072:RPm8oBF0z5yYNKxpATjY0DxYK3k+zkF2WNlkE:RPm8oBF0zMmTjY0tYMkWkFT/
TLSH
T19044D0B4F682D782CF432EB8A06C1D335B6614C432C99E0F47B29D21A5486AAD71F75F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000ba

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ba
Size 256KB
SHA256 f3fdb11faee00508cfab853c284debb72a6054ce7a437005f271fdaa419c8c9a
MD5 be569398e0e595dd2f72e1bc4cb2e4c7
SHA1 a7a59eddb0ea2dacb98ff03113480327c1805c9c
SHA512 475d255ae27e373971a32efb3c28faaa9aba5e3b6790329c211e038d1258f84b826b88aed8c7451749a608dad9aa433b9454520314c20339fe6527872bb15f61
SSDEEP 6144:oxQsrSL1TgnPaBehiQ0tlOw49YjoCrT3:eQESLNMaBeGyS7
TLSH
T14644BDB4FBC3D782CB132BBDA43D3D374BA852C561D05A0744639D26A598B26E30727E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000bc

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000bc
Size 19KB
SHA256 45c86a68cae71ab990bfd357685caaceb95cd2cf434c8bf3e4b448d34c6e73ee
MD5 4203534c47d0372b93f32420efc5db9e
SHA1 9ee35a46af3c48689de913646225efb807c6a084
SHA512 55ef96b2b981ba19419ecf62d9e22519975ca9756767eee8e3a599b7a1272b6e10e784bdde701504e6b1265e606762cc3fff9bc1c4cf7b75b5c7eb4beb9683f2
SSDEEP 384:Xt3Zz/K1w+wnNSFduuM5CQ2tDAwKzVGJEFlb0IUphtF7NvqJ547JyQ6p:Xt3Zn+6NSvFNQ2FAwGKIUp9BqJK7AQw
TLSH
T19B92D020EAF7EB166931E01351F460AF0C23E6D86189E4D132D9FC970C097F9B894E5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000bd

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000bd
Size 29KB
SHA256 2878999ca42446d29f8bc879cf32d28c4946fc3abac8000bfc65c7d4b0272503
MD5 5e0d934e2791c4d359550439ce40dad9
SHA1 875347a7b73a4f1db3247535118e0dec8f2c1923
SHA512 f58c6b93a82d106a1fb1f01acb55aa06eee8e819b5b4265a7c55776a0882c21f14963cabd51d693a05382b889320e6bc46b12b069dd72a2b9280bf82e0a9eac6
SSDEEP 768:qHSy/DWNqDWmQlVJ5u4uMJw1pwCbIcFH8mvnVos:qyy/DWkfUehxFHGs
TLSH
T1BBD2F1BD57137A6DD8F328C2705E4D62C1F1779B315198AD4B5C203A27223968D893FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000c1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c1
Size 18KB
SHA256 9f6221447166a281f2a26918891b137caffcd45d5ee639413887057f45c2e30e
MD5 3a2a723a809958bb1623c4f525c28f29
SHA1 93661484ec0b27388de3a19d03769404b48983d7
SHA512 f6428178d0949acb01052f4f5a1d5bcd22e84a58b21def39c67464c813433113726d0dd5a14a5c5f10e194b4e8235242db792e872ecae76fe954edd7aaba1406
SSDEEP 384:BS3NF+x8HuEkcve4huEMs7jayT3Q7by+yk4bajmQ:BO+ohuE3xewGyQ
TLSH
T1A282C08D9848B1D6DE9015D17FF2C45460C37F2AF9ADC3AD1E9C07D8491B00E2DA4639
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000e5

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000e5
Size 39KB
SHA256 0291a30f5de5bd11164b753aadd00cc57dc0e25c06cded3348f23eacda50d4a9
MD5 efc8d4a5cbc6559560fd6192d9cf4cdd
SHA1 c645308597aabe80c0cbc56a86d927f2aee4e8ca
SHA512 8953a72074eb0a32da27070ea5311cad6784570eb8ddb5e97c08a91eeb30c8e2356f8fcc9e558f2676989eae2ed625c04dcd9fc685770cb09f93b9268e639e43
SSDEEP 768:MnUWKt2ycQ/J0eDvD8MhRwcRfiQqwnZPiobC3I4x65s8oNpK3:NtppJjLD8MhRxJd+44Tfs
TLSH
T17503F1AD34F7C5C72154510188A1DBA784EBE7EF088314AE0B7234B9274B176B8BCD6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000e7

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000e7
Size 67KB
SHA256 3e2e07ce08ca262a3194f0b4f1f4fca80f50c2a4d5c4a3479aebc23fe42c8fef
MD5 070829a836adef062c7df000d2d6346a
SHA1 603a7c9007ace371f77235ba54485a309504fa49
SHA512 30ad48bf663f4da23302a55382f292403b725d8954a031dc0b4aac70c34ec671898b541304d2128b1d0c766037e161ec2212efdfc67d9e1b49c3aa02cec897d2
SSDEEP 1536:oYz0PLR69MU5pT1woF58P5/qtnMmob9pcQOf6fIVi1lp31NY+hab3:TzcLROMULD58P1ynMm68qIg1lp31NY+E
TLSH
T1DD6302E09B0D455AEB133B3DE54FD37BA261BE0BB8C2C84570D5D614AE4B2064BC6B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000e8

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000e8
Size 22KB
SHA256 40743e33d45b47e38e00c6697d79894b5ac6ade5bf335fb438c239725408d7e2
MD5 2976c3a566cd224706eee14555165321
SHA1 ec1bba71072afc08f5f498dcdc6c0adbc0d32a1a
SHA512 32be68181f05fe49f9be71dbf0cf07e1a7e6928eb13cb603c1fee242c607e74583f81b7214e80b8f4ad12bece442ffccafd37327938df1a68a35e3cc2c117141
SSDEEP 384:9q6/jFQoLe1PbqEiMXtVeSYHbpwpHYrRbYNhG1VAQymzxNvFHmozyP45SCd:9q6/bLeBOEiMXmXq4ryNhGgmFTtC4g+
TLSH
T1E1A2E193E172E43A3DE03EC3205BACD422C4E31504DAF73F16BA4C961A26358B69701F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000e9

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000e9
Size 22KB
SHA256 506b0580a864d02111f6fd83c5a514a9fc0b17d11e8b71627504555f6b95bed8
MD5 49901fd0cced03fd647640ca3fe4a746
SHA1 1d307bf384e0d55dcdaa80dcceb9dc5525038f34
SHA512 0b3ecf2627608fc50816e8f7eb36a3d9cedc0405c527926c401298a4e36aabd717ec8708fa191ec0a45445c410887c6fdfd9830172a0918d7c1856d3ffb5ea4c
SSDEEP 384:hQSlkdv7BSFFoRu4K/Qc6fdKntI9aW7IcHdBBUeyemGxNmLiZiTdaHx:hVw7qFT4K/Qc6fMyz7IcPaLvi6BaR
TLSH
T134B2D04D5EBA3E09BD272FFE6867660221F8F4ADE452D6A3174BB1B412118111F4AB23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000ea

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ea
Size 56KB
SHA256 36c2e186a3d32f12357303a719334ddc39057fcb780a86409775aae614527f7b
MD5 da8d4cf399a54319d394edf8df3bf38a
SHA1 73dffb0579a4e78f6d09c0627698bed29f891aaf
SHA512 befdcef3f9cfe2321dbd795fc07328bc03122f835f1a391bea4be6e8a9697cd002253272209dd5194f4e8c4e143edccb6bf7445192f83080359be1602491c30a
SSDEEP 1536:V3bFoTt57VrzFPR0tBzFtlg9ZVvHwB5vvw:VZoT/VvFqt7tlgl47nw
TLSH
T13A43F19556E338E94EAC0E4417CCF13843B5718FA6F4B60E23565ACD2762B6D2CCC2B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000eb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000eb
Size 22KB
SHA256 accd8829a47bdf466075d062cd59aff2a1e9c3a8749a3fad825f6b98b96059d2
MD5 7aacc50348db533eac82534ed519f06a
SHA1 e790aaef39c4ab37d54849a52f2561c7c3cb42b9
SHA512 f8f593fddaa5b47f4f21e7679fe9113d2a61113d688591e6e06a0d3042a90387639b5bb3dd54b2710bd834343e5d45f0690037141a7e4ab812bac89e89f55bf1
SSDEEP 384:PQXshqHr6CbP4Bhp1QImo7/icjDdkyB4HS8VTMH5j7lcjOZWR001KjEYF7cYOX:oXs4HrHbPqLmoGcjB7l8V45j7mjOZOKS
TLSH
T12DA2E0226CD6A4E873681C55DF6277E2ACDB79D062CACD23C98409386B3E72951FCC90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000ec

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ec
Size 61KB
SHA256 b7ab20b5598bea174fd3644fdf71de68c0f32427aa3eaf2a08f54cfd454aef05
MD5 28364a8b6d41bec1980fec5c14219236
SHA1 2e29b7ef3d4295061b84bff43b3eaae38845ed0c
SHA512 514ebe4d4fa50cc39006295b72ee7799fd855183f655673a715396065def12611f95a58d1bfcbf7db3082eee8dbb1b72c46e0c3e8fab8755c03a56189d674402
SSDEEP 1536:t7KFL6WNNJR8pw24EglNzy7XWr7rm4g3IVuP7:t7KFL6WNNJR8pw24vNzy7XW7mP3P
TLSH
T11A530166E14FF94861FCD66E004B7C45878680EF64667F9F2C776078A932E44DF0288A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000ed

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ed
Size 21KB
SHA256 fd60c6877f438ce43c1f7b9c0ec964d230f13e24ec7f7f87db72e1dbd4d17c42
MD5 f216d9989f6efaf391343c4dc1167a17
SHA1 f2ba010de502c00fb5ed2794d89a47ed2a0d3273
SHA512 8f9fc5150d465b2057314e26cd4022aa5702fac99072e9be741eae4a07522fb164739b7e76c18181724930752feac1e4fe3ee29f00b9f19dcbc0a65914380aa0
SSDEEP 384:MdaMrilQ4kwc7RexmVP1SQEz/pJKrEd3cEH5CMe7xCDJOv:BQilQPwcACP1ozKSXRe7xwJOv
TLSH
T12BA2E16BF8499C715CC7B142E6E2A56E2C32CC1E7BDFE84E17DE740AC842129529983C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000ee

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ee
Size 31KB
SHA256 84724d04bb0e760516cad8479cb7c24e25378bb8b0652eddeaa948e8b938a151
MD5 19c29bd4a574123818450ed95c116eec
SHA1 4e2394c385352993554b4300eba8e0e268e96873
SHA512 016df59cb4ead7e1889affa7543348721b07acd09af934032a45036c489d0d74a099e4e68f8c52d9897b7a9df3ff06cf1c473c4a4d611b1cbfefa6d471b882bf
SSDEEP 768:OovC9msn4ksytp1ernU9+l8vXJtVgUoKUBeYB6xQ83vT90zhx8:kmANss8rhGv5AUTGeg+/TKFx8
TLSH
T1FEE2F1A2AE00A9CCD4104BCFB514D7DD2AB61556A0B77CD0F2FA049B2A0B919E0CF937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000ef

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ef
Size 66KB
SHA256 a29651cf468ad6a50a3a1b30ccfd79f077bf100c280ab8e5e0a3c1603040714a
MD5 cfe40cd688f07ca59be8d176c7d51208
SHA1 62167fc074f7f7a2a60949ce9a7542e60c86be03
SHA512 3ad09972e2553ffdb193d6bf9c11ceb7e73a5f465c579f7631e36b52e47cf51846b3c6bb4f7027b3f217eb0566724040cc29a0d70156622ea374e3b7f49b218f
SSDEEP 1536:JadYmIyLHOcJUSfE7t+HyK7r/3KSHr+S5LM35sBgf:VVyTD+gDr/3ZqFYe
TLSH
T1FA63018695463D051FBC2C0F7B1CFD6A202A844FC3AB1B3C0598BBE365205CFAE95E59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000ff

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ff
Size 58KB
SHA256 354d9d5a64cbdd358cf944d0d16e1454309e92952bfa1e0412cd8704abf51930
MD5 12d1d004b4f972e30598cc84e7a35905
SHA1 b29bff1471ad9dc2495465b811d17bacd5892263
SHA512 c6e24a47f6d914f1f9264bf3d3c455efa80713e21b7ea3203f7c47a9b993fee9049d3cfbbde827086a056c719a74ee56ece5bf3ad4c93e387be63684c75260ba
SSDEEP 768:hc/18QLQuE9VBuD0WMLouw4QIRudo4FSaUqG+9/SfT3gl1Qqwh4wn:2HLQFZmu4IIdfO+9/SfTkOqwh5
TLSH
T18343D777124BBC8677631DC984183A455CB8BDAFA728D18DBDCC05C9A2FA060CD79EB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 6KB
SHA256 4b8e42441a4601f3a504b397828ecc5421bb798ceabaed676dcd9ff6f45da9e2
MD5 3843a99188ab5923d1983982c4c29182
SHA1 1b864d4056521b7020145829eb2fea8710c80b4d
SHA512 094ebaa150ad436e538f1589265896557bcf75173cda17d5e9e101d8a5155565ba9365e17d87412a1233d3d4283dfab82c96d833db2077e93d8aa4f267b52e8f
SSDEEP 192:ilbqwu3O9QcdCtIqzx6lIEgi9m0kX8PlBFZYpHrME86pr2tEdQ3GkVBveVK2RuZT:ilbqwu3O9QcdCtIqzQlIEgi9m0kX8Pld
TLSH
T11AE1D88585D12E22EFAB8EB7A4E6CCB23338658619172F16E0159135B8733E707837C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 4f355ad9d4384ebea83bd4d6c1e72760605a3beca4bc76f57fed3bd9ef919504
MD5 caad3a495726ddc1430ed3c2ca353318
SHA1 4b8677e2aa284511c359cfcf11b3a86234577258
SHA512 097956d761512cee480cee5be886257971bb847a4105d5e5437c2cf6a01b80d310d8f5aa9ff1b23d104ae8d279305bedf7c193cbb7677b78187f84cf09273431
SSDEEP 192:GvSr9n7uQ3UQEC97BpVmridl8kIfFwHpBF3AKIU9c4Llsr2PBTcQ3hVy6uZX/CjG:GvSr9n7uQ3UQEC97BpVmWdOkIfFwHpBS
TLSH
T1DBE14D45D2D0AA13EF579EB344EAECB13370678119471E02E59A6738B873FEB02930C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 61718ac55c0df16b2dc0c8478c7a8ea4a51c87feff4c7e4e1f24c1a459a85fe9
MD5 b1d4b683277a69565b03121207df4d1a
SHA1 e6aa0c954fe3a1bfd339f3690e938fe7633defa7
SHA512 0591c58fddd34716262d9fb83130b94381bbcc366ef9712fb085b80f6c95d1a87ecfa5ad53430220608f900b7aab641e27bd05fa30b577a4404f173770ca1d84
SSDEEP 192:ivK9njqQ3UQEC97Tp2qHidKkgfFwrpBF3AvIA9c4rlsr2PBzcQ3hVy6uZX/CjBVt:ivK9njqQ3UQEC97Tp2qCdKkgfFwrpBFu
TLSH
T149E13B49D2E16923EF679EB354E6D8B13334278228075E06E55A6334B873FEF06879C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe59093d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59093d.TMP
Size 3KB
SHA256 3d59708ce99947f66d045464a5f8f5b0e43312afdf862959512bc0e997a59220
MD5 79245639db7174f04b684da1e096227b
SHA1 5b2a0aca4e37e8e8173958e1e710f29276152f84
SHA512 c6d68538a09c30a5cc25ead131f894cca4423a2b9dcab48101b81b2435fe3f7196baee833dfe910ff302934181db1cf7df53643874b5e36402cb8c0377da90eb
TLSH
T10F712849C0E13E23EF6746BACAE7DCF133BE28423A373E2134945479B87277804A1484
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\000003.log
Size 17KB
SHA256 4ee070dc8f4d4de7023e2f902e362a70ade79627606f40f129d3e89c68d4593c
MD5 7c98d1acb2075ba48ff6be1f4af1afcf
SHA1 0cf559bc32821f5f4864b725f4e00831ed079a1a
SHA512 1b9aff196c21277120b36f3a32eae5e78e99ef573685b664a4383f312d0fd98430b49265f2c84f182271c91ed26f0b3907a7450ac97571ccb05e66982ca9c28c
SSDEEP 384:fBuCplUFoX+ysyyJvtu4yaKJpYpgi+rae8J37a9agaEaLaEa0acaNa:JuCp2FoX+ysyyJvtu4yaKJpYpgi+L8J3
TLSH
T18C82A952B5F81519F2BB5FBBA9B61B914CBABE562D04DC1D6860220E4C31F40CD73B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\LOG.old
Size 345B
SHA256 1dfc11377438eb615000acf6814e1bdcf360d2244ac522905579d1522d40fea2
MD5 b3d4f5b189dfd1c9b4c0fc86aafc0e93
SHA1 ef4155b125a578237f6005e0d21971651868e58e
SHA512 7ef1609470ed3cf3f7dd0149aa06567c74db0eef446f321960c9f2a095461ddcce4a9d5817bf49bf8e2157600a34c7586d94afed3779e85482e8eca956c2c5b6
TLSH
T151E0D879C4C9C21B921451D64529FB0DD6A7260E9689AE4A5E4CC850B946148B87E151
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 060f8d49c8a6f5f15f555076330e8a18a8cf341d5cd60b6adb6f78226c9f9997
MD5 6336b4f45d7116106955f2cb35ac5af9
SHA1 eb015f4b725f17ff0c3be2a7e567f964da2e0fff
SHA512 72e9b10a06ebef7c68cdc2205c3de38ad5922055bec02020a577ca07965a3e424e9e15b86f5f1acfc121c055a8edde14b9a00cfeeb1a79dbcbd3160e36ed3720
SSDEEP 192:D+11MXtyqNkoeadpag05OxF57gtc/GvtqjpYC6kbwNjj44jjsLj6V4:D+11MXtyqNkoeadpaX5OxF57gtc/Gvtm
TLSH
T1CCD1CBF783F5866DDA1196F0AA14AE1F8F5C0416436C396989E0AF0BD3F2472E142B5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 5e6573b877ef48213ea65c7196f0880e0339e1d67fa733a1c6ca0369396f8f5b
MD5 234860ed5a565bb46aae62b7edea70ec
SHA1 20c4d7cef0adef383f90f587294b0cc44b2d9c34
SHA512 74f70344f7fe49aa2f230053571171bb538b680ae07f56a5522a9beb209df83da6c2efa068093cc0793c6ee4a8be6defb4bff85cf972543446bac66e91093d6c
SSDEEP 96:DbS1L6OL4y+ft9Kdpaij6L0z+TOxFc57g0FV/tvs4:D+11L4y+ftQdpaij6L06TOxFc57g0Ftn
TLSH
T16FB1CCF3C3E5826DD91155F0AA247F2BCE1D0852436C3D5A88E4AF5B93F28B1E151B8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 c55350e85941ce756e5709f891c3dec72822420e26d11d797f6ed28efec1be55
MD5 0541ef841d6dcdb8c4c6ca717b1a7556
SHA1 55bf83bb652dfc1a29d0a08bffb31a26c1a21975
SHA512 a493c29c2d18d4223ffc8d63d6730d2f6517372c153374afa39830e6eda3a16612ad8de409de107fe4796b9bd51bdfa6573808ae42314a0f7d75dbbad281469d
SSDEEP 192:D+11MXqNkoeiEDdpag05OxFvqjpYC6kbwNjj44jjsLj6V57gcMAGtx:D+11MXqNkoeiEDdpaX5OxFvqjpYpkbwu
TLSH
T17BE1BBF783E5826DDA1196F0AA14AE1BCF5C0416436C396A89E0AF0BD3F2471E152B5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 7f118f62ce8f1cbeacea9a044928da458928f871a1025a5b25de457c63d80ec7
MD5 8909d5b58dfca6f7bfead7999ad67183
SHA1 43de1974a6b7ca7b19746208043ad655d1ed1ed8
SHA512 8da224bd780e9e43ae1db5118fe7ed141bbe6ae96d2bf81d21f6a3a2cd15fa4074e339183081f97bc5676ece2e20128d4778debd9f351cb266d61ea77fee9ba5
SSDEEP 96:DbS1L6OL4y+f1dpaij6L0z+TOxFc57g0FV/tE4:D+11L4y+f1dpaij6L06TOxFc57g0Fttx
TLSH
T1EFA1AAF3C3E5826DD91195F0AA247F2BCE190856436C3D5A88E4AF4B93F2871E151B8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 7c6893dba240d9cd4e266c9e987348ac00614b2d9b13d2b082525dc812a73a2a
MD5 5ac0fbc8e155005ff860c2cda017a232
SHA1 9973277394074110a84d667aaa79408c8d4e90dd
SHA512 6959778bae9baff8089e114c48173cfc4320789f64e431a38fd8f17a256cd7ba1ce78e4cf22c920f15335abd09d59fc87d7780e4bada38aa717c8ae1a45fea47
SSDEEP 192:D+11L4y+ftkSBDPdpaij6L05OxF573tUxVkvtHjgYC6vIwNjjjcxD:D+11LN+ftkSBDPdpaiGg5OxF573tU3k6
TLSH
T13BF1BDF7C3E5866DC91156F0AA246E1BCE1D0416432C3D5E88E4AF5B93F28B1E252B4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 2504eebd92c8e3864fa677648d9120008c3f3067464500f8d660d6f715d274ad
MD5 b61b7f8713688d309da1cd3103bdc17e
SHA1 d058b8c269965a5cf333022fd0b6ea4e18c94f46
SHA512 dd56bfee7c546f72bfabcffd01c6a05124826bc160d4db582e4dc0adc91824ad804102691a114160fbe267afeaf3eb46080533f9badb455c4a36100f90ee91d5
SSDEEP 192:D+11MXtyqkSBDPdpaij6L05OxF57gtc/GvtHjgYC6vIwNxLj44jjP4:D+11MXtyqkSBDPdpaiGg5OxF57gtc/GK
TLSH
T1B8E1DBF783E5826DD91196F0AA14AE1BCF5D0416436C3D6A89E0AF0BD3F2471E242B4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 aa972d3b36670de85737d835e9b59dd11090548acc60cc632e02a67b7c8b5c37
MD5 ee80f24ff9e4fd906414857d3fbb3964
SHA1 aa6a247d56f99fffd0059c63b0fabaf14da80a61
SHA512 91002c4779db980a799c8741bd476b23c2df274cdd5953323f718499b1e63d0e486fcc179b259b1c4ea5fda8352e0403d37b87aecc8edb42c9ec140a313215ff
TLSH
T13DD023531130B079955DFED5407BAC4FD76700560C32FEDE60D0ED58053546C1A0B151
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 210B
SHA256 89064ba1d071e94505be8514c238367055c350c89116bf76464b7d2bdd747cc9
MD5 bfcaec1738a3c4a0123aea550e207541
SHA1 76898397679b570f5eaa0994d80cdb8953068408
SHA512 e1b5a656769dd6c59af0bab5377842c1d76baa1d323a25c7826bc115d55cd7ff5cc65b677f742918066c27fad356c84923385eca80083f30088cfa9d90cae0e9
TLSH
T14BD02353111470B9D95DFE96807EAC4ED72510530C11EDED24E0ED58553545C1F0B041
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 3KB
SHA256 660ca4e3768521e3e7f2b762df113fdf68e8b9ea5cec9641456039b5fc362339
MD5 8cc637aef4938897b709771a8f2e4b60
SHA1 8c0d728928b83001113f3274aa4c4ec4f9ce7682
SHA512 965b096c41127041c2d257794e94b38889a2bc1b602a81bd62fdc6ddcf0a7d584921a84b61a54f630e5bce7d02669cc001dce43898c8e3190c4403db8d0d4811
TLSH
T1CD618DAB85BFF42F202D08EB1D687C092969B43141A1A4F6DEE6C37CA0914F71F16432
MD5 SHA1 SHA512 TLSH

Submit Download

ab899683-9e85-4c19-9889-195c76981fd7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\ab899683-9e85-4c19-9889-195c76981fd7.tmp
Size 1KB
SHA256 958ff315b8c52693ea94584071d704270ee358069f8c403f094deac02b21d920
MD5 5dfc3f76b6851093fcc8b7be1f59014f
SHA1 df86f579b39dce18475ace0e389bcbdb51bd89f4
SHA512 31e553cb95117598c2e1e1c24c83cab9489a70c1abe54bf1f27175eea64387bce774cc5de231adbdaf1612534834069cebe1a96d98eedc30f0e3d22cc84af1bb
TLSH
T11041A0F783E4866D8A0196F0B618BE2BDE1D0514832C3D5AC9E0EF5BD3E3471E141A5B
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 20KB
SHA256 3309453f66dd1695618783900b795a56218b99e3a48781ba6bb314083ead200d
MD5 e2f382d909322d236fb7c862819e6b0d
SHA1 da7c1286f5b9cf0eefb3402cf7247650adf1271c
SHA512 fcf5cc33732224d58a2f1580cb0cabd56d425c2b482eced2c4d0e1ddfdec606130b328e880112a8e7dc20f76fe8481c1f2b612c40d2e92e5ffe9be2e8eac98c5
SSDEEP 384:sxR4nPFG2m4R/ftsrBRb1adOw7Ui/56+/1kieMdyFp6:s+PXm4R/fQB3adOsZ/5nCDp6
TLSH
T13392FA16A524497BCCDBD614F955BF53D6F81023E9454E48AAFCCB0C04EEAED2203C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 eb30b350ea4c499d68efaf5b154edd3a636f35119b52fcbe638d3bbb62e5ec64
MD5 20e45898ea860dc155f8651432ca91e9
SHA1 8dbf2b42d16f743d5f7bc3ae078c39b0aff89729
SHA512 6d638365586944f8fc7abac92629a17ce1f5821b439f200361c25b1fee96e2efa301667cacce568a9c9470dd6597303f1f40d8b8ebc629649f1b36384a1e8fd5
SSDEEP 192:sxRWRQzyMqZjK1Ml8w5cB1R/fts04PZbTumbfNoA8pX5lWhzc/g6+WNNaxOH8D/e:sxRWFHm1R/fts04RbiMEpn/5jI/tiejm
TLSH
T19A72EA066534597BCDDBD219FA45BF63D6F81563F6805E48AAFC8A0C04EAADC210383F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 20KB
SHA256 03fcb35511644d842073c8e950df94505b6584748fd2f39e50b7a7c30f7d4f44
MD5 233dae2556f11f626e901ea5633e0cd2
SHA1 bafd2d6f08cd96d227e0179b405d7feb8e5fa9d5
SHA512 c714dcedef67f551081a06c0b7f74a8f9faf48e4dbef2d2c8a8e6a38f64a661bf3432c96ad442843303b0e42ba2b31378984632d4669d20086ab33e91fcbb342
SSDEEP 384:sxR7n1FG2m4R/ftsrBRb1gx7Ui/5uo/ukieMdyFp6:s31Xm4R/fQB3gpZ/51/Dp6
TLSH
T1EE92FA1665244977CCDBD615FD15BF53D6F81023EA454E48AAFCCA0C04EEAED221382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 22KB
SHA256 3192b357df5d751822686fd83be5c5d7526c45a9f76b70ecf043f5d7848095ae
MD5 aa38ddcacb50c02f9d475eec1620e3a8
SHA1 ffbc57c92fe5cd8c8e81ddc2f2209afabcdbedd9
SHA512 103ded5440f6c6e3554c5338d0c62f8bb7a17f73a1d9e361ee3542730c260363b6ab25fb82c1f46956cf858438a9fbb77ea80ae6ea7404e3825337366f2f266b
SSDEEP 384:sxR4nS4qem4R/ftsrBRbbDgfcy/55CJZfCyieMjpRm2p6:s+Sfem4R/fQBxD7y/5svPCpRNp6
TLSH
T139A2FA525520897BCCDBC519FD21BF62D7F81463EE515E4CAAFCCA0C04EE6ED261282B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 22KB
SHA256 adce63ee2b24aa8efa2e1cbece452a2ac1005bf8824b1a35e82342aeffece6a2
MD5 fa5fd7763f929b9bcb6094681f2e98ea
SHA1 0a79e2170f1454b976da73ccc80f6048b745d0a6
SHA512 85ec5cfed48dc6ee24626001f3adbf23cadf6640fd58b9a9ccede0debce19cb3ab4b3440736f07e55ac1d8f98d1924d3b57ee767f087d7848553536657ee6bd8
SSDEEP 384:sxR4nSFqem4R/ftsrBRbYDgfq/55xfMsieMjpRm2p6:s+SUem4R/fQBKDL/5HlCpRNp6
TLSH
T171A2F95295208977CCDBD519FD21BF62D7F81423EE554E4CAAFCCA0C04EE6ED261282B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 0194d440f2b1ba53558bdb91f9c4157a032645ba130e7f6188068c8d2ba3e8f3
MD5 15940249a93ce539cfd3012bf16bab2e
SHA1 e6358a13660da31349c4d988c8b916d32b1a5132
SHA512 aa4cc6f436b12c8e4445d3408176dac1eda7dda3ea492f4ec1c1eea6c53d2258a6b91524090e01a3e788c9780b11ea56561d8f2f35ebf4948284240685994970
SSDEEP 384:sxRWFG2m4R/ftsrBRb1DdOOQDV/5uo/ukieMdyFp6:s6Xm4R/fQB3DdO7/51/Dp6
TLSH
T19F92FA16A5249977CCDBD519FE55BF52D6F81423E6414E48AAFCCA0C04EAAEC2103C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 33dd98e0921bbac29f21fbbea3f71f7d7f82ef0537394a8e7f53d047e4746360
MD5 b7fcd0cc168bd1a48eb467e8f8226400
SHA1 1a93e64b5d5c89fb0011e93dcd71c98f92724945
SHA512 b6db22b17a36eb3c19e57f72e7c5cc11238e5bf84ed80c285ee741befff42d0c85c4ea2830c6ab2d34be4eb0a7fd71364a32476da31d1d10ba31f695aff67469
SSDEEP 768:BawEOlWgfDfEN8F1+UoAYDCx9Tuqh0VfUC9xbog/OVJLfaDro68Inrw8kJPK:BawEOlWgfDfENu1ja8baw68Is8kJPK
TLSH
T1B9C2FC2B640CC77E4F845E5CEC3AAE976DE801CB9B984D5447EA490C03C7BEB521A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

623cd082b6202da0_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\53fefb07-db1f-4dd8-b29e-0526e535d89c\623cd082b6202da0_0
Size 60KB
SHA256 f059dceb3b1f4eb58187069f4f6fb8218b38c7c4ae48710eedacc840229a0a52
MD5 9067dd80caf604eaf3d86215fa60e5f9
SHA1 05ecfd8feed2eb1133607e08d411e1f9b9942795
SHA512 19d7c76f11faa760eb87d0426814243abf6357e99dae12af377e6a4d80624d47d4f959f9266dee9ee842bea80291bbb41e5b30102254efe3116264f893718066
SSDEEP 1536:UhVUMZ++BHKut3JHjvGEs7RONVIqtQgWn/HHHPwqpzGo/T:Vr+0ghGEEROfF4R/T
TLSH
T1505329A3B2626135C7AD21D1A4967F01F12B17461845C9ECF0AC66953F18ECB63B3BF8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\53fefb07-db1f-4dd8-b29e-0526e535d89c\index-dir\the-real-index
Size 72B
SHA256 a14c4e3236e4a05e309c8260d15479b72b3ea1766752c215d4e53dc82d8febf1
MD5 f24295e5c9f71966b639eaa2f6395797
SHA1 c36de588822ee39b6a3b4e7c38d09f79fb363fac
SHA512 9bb741b130f76ca8747f7db84a437beaafef2e445dc969ed67d92c25c2baca51a87cf289987c34fadd46cd98aded70a816b0a3b7c5a340e1f1592fa01e6db53b
TLSH
T102A0025443E10407C12316F115D2077153508810B110920640A6028CDC50461558300D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\53fefb07-db1f-4dd8-b29e-0526e535d89c\index-dir\the-real-index
Size 72B
SHA256 3b387cf67b8a3f769feba1d145107ee1c585db473fa4d31ede78deac20527c06
MD5 a4a3ec54524250f30e75b4d3de36af56
SHA1 955f9fb520ebed2b9da9b31b5f386feb4f28902c
SHA512 182c23a56864be1d9b0334f225bdb729ac2e9600bb6da4f35ebee5c0770fe2b7e623b590e05896bb899a2979c8f0cbd4494a0651282834459a1c3d89c4aebded
TLSH
T1F9A0027C03C41443C0032AF1359A875122524F100213175951940345CC90DA6876B50F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\53fefb07-db1f-4dd8-b29e-0526e535d89c\index-dir\the-real-index
Size 72B
SHA256 c440659083a7cde833af65ee44f11075c0a0650f9256156de8440ceff9afbef3
MD5 4f637cd419631e1b7a8a221578d16cc7
SHA1 1f686ead5d9e653bde162dea8604b4bccd5c2f6a
SHA512 11b2f98ae96076a43e7b77067f98ac313088d4f94e9a30ece6d31c093c29a7b5a604fced80ad14030a7b54fd2128c5d59956ee12d4eae66e29cf011e4b27e8d2
TLSH
T109A0027C43C60803C00312F177A6935126244F24430317854590028DC852D5A894B00F
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\85bc1450-0116-4284-a5b9-c74abe9d43d7\index-dir\temp-index
Size 3KB
SHA256 80e904b34dfa6370a0b48db412e4e2ccde23d0217f87fe72b18f83f834d27351
MD5 d99a915f4e659435525ced3ef352b67b
SHA1 bc55f6e49c216849052714aea5e6ea01f3ca7980
SHA512 ce79352d1aaea661ff8bb982a8b21a5cc8c6ec6103a58d89f578e48b62c8cde8d9cb857589b6e280d83b85868a6f3196b95b61912211851b226a814da6af65d9
TLSH
T17151B89E9C871B0BDCA816B374F604882736A9DC2B998E0324FC9538ACC7639196C75D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\85bc1450-0116-4284-a5b9-c74abe9d43d7\index-dir\the-real-index
Size 2KB
SHA256 233a9006a8d4cdbcec221e18c0cc95207c4aceeec44d91eb960c3e93b8031484
MD5 1b2525e5dfdd840ace9cfa90eca13f1f
SHA1 569023d77fcd72490719f9748006110ecef49f36
SHA512 239b6119488ff91a4a26eea6f003bec73a934f703f146a024aec7a6dbb9e0a14a12ddd3badbf96ea24e046088bd228aea88997a8cee0f82f73d5ef4c9baec7d3
TLSH
T1A941869A8CC2275BCD64097235B1148C2737EADC1F8D8B4774FCA538ECC7625286466C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe583cf4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\85bc1450-0116-4284-a5b9-c74abe9d43d7\index-dir\the-real-index~RFe583cf4.TMP
Size 2KB
SHA256 72e8c000b8354c989224ebe478980804d4f56a40e14a9865b032d5e267e51bdb
MD5 79ba540628defda448f7279c71b71668
SHA1 e51ae5a94929d3f3f4e3a9fb68080c2c43b2e5a7
SHA512 c10e7cf3a02e6953a4eba2270d60bcc226e502609213c647b6f515ea17041bab1ab9ba01c26594493e3baa2b114b5bef8e80014e91de30276a1d16f513f08f69
TLSH
T1434185655D826B2BDD2104329A81105C333FF5614E489F0B30F8C238ACC37783CA85ED
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9b4460eb-3af3-455f-9b12-8b3ae68f1e0b\index-dir\the-real-index
Size 72B
SHA256 4f72a7a901d65e6c8d326ed8f77fff0042490d4b10e982d78a49ace2471fa097
MD5 9f7513c0a3a13133008b984f12141dae
SHA1 4894b9d98a0d4761f2c7aade462180a7caad98c2
SHA512 84adc93ae0a930fb53646b39963c4716fe5e307c41c2ed29134efb79846c4e8981a47b798d952674e4252f68346cce0be4bed1955ddf2a8337c8b71bf74b2d93
TLSH
T1DFA0023005D59345C01146F15182C19037E49D351203430EA0D0455D88519EE5542454
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9b4460eb-3af3-455f-9b12-8b3ae68f1e0b\index-dir\the-real-index
Size 72B
SHA256 71b4e17defda01ff2877b0166c1d7550cef294a077bc96433e212f7e2773b1fc
MD5 637baaaf3a1a0dce96af69ac57a3bf54
SHA1 e28f2599804d0d199a762321e1b06570456cecfe
SHA512 77bf80e0f009f60a1721ff083a9e24bbbbf1bbe3819dd58fcc653eb829567ec169d2603a637502b762f5fa0b383ea26420555b53881c38444e3eea73f1beecf1
TLSH
T1EBA002250BE5C346D00306B0D986D95033A45C150102971D60E0055588616D8555218C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d57a34a7-7f37-4813-8532-1dce2e0b5480\index-dir\the-real-index
Size 72B
SHA256 e3f422cb5e292a9f002e43f5485251db1b96ae525a191d95edfe3442efa97b2d
MD5 45b329fa03d5ce30cadc92df21c8656a
SHA1 a7529e3fa00d1756fd99065f978df99f9cbb2c9f
SHA512 d78b8ff103801f312f6ec6d1e70f910b81361573ae4943033789ab8da5b265f656171076cd57556db95407c165672357b4464279de2cdb4e70159d80ffc7ae95
TLSH
T117A002209744E641C2149F70504F2640F2519D1079230E0547D2F16489EC2408917000
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d57a34a7-7f37-4813-8532-1dce2e0b5480\index-dir\the-real-index
Size 72B
SHA256 60ac7c9d6e936b6e43a5f71f4c99a7186aeaf8ed0ad471ceef6fd4c955fd48e3
MD5 9f5099f0872e33bb8febf497c3b337bb
SHA1 4739501c6f3e09aa2cdd3c6424c780ca35777410
SHA512 363e11c30e986d72ff2a8164dd0861f8d1418761b6ed1f7ae98db4d04c8f592f666d67cdd59e2d902050ae4943df58dcbd1308f5de038f258467849427493966
TLSH
T142A0021D51480715D658DBB610818340A2105F95ADB24A4245E2114488E6D40824B028
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5ab5d4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d57a34a7-7f37-4813-8532-1dce2e0b5480\index-dir\the-real-index~RFe5ab5d4.TMP
Size 48B
SHA256 e2a486ebd97e10190f0b983c630a696c6e19e6837429be15d5036dff7a663e75
MD5 53ac0eb02ff666eb52e522351ae3301b
SHA1 460d28769fdb77a82ead99405747295374faac74
SHA512 d20c6d1d763f285270d46eb09be1218caf9cde49c7b8f42f2f4b29ac16e8e5d5ee5fb5325986d39d81e5b770ea3f6a54c9173159a1b9825e89b9f8417e88659f
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 e55658e3f37b4f9057561aa31bf944a81d0432395202935270241e03e7e4dc45
MD5 e787bd93b3f3a3b70791a9673abe014d
SHA1 b0345721ccc178ae32e90da1cd3d1a08a71e9473
SHA512 32f63b8d281598c69e545da6ec66ba00101ccb9bb69f90398a3f5e810659ab5fa0989f922864fbecff6634947b5a6b2561e35f8bee184e1bcc6b944b08af9087
TLSH
T157E0C6B72CB3A410F8AFCBE5283180E90004F8A88604FC6F206AFAD300F03793059C2A
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 476B
SHA256 74df9d95f615bd7dec1524e9ccc14f7064f7935d7faf0323af57c1489c6dd622
MD5 26da87b66fc98b66af2409d6f950e45b
SHA1 728bbc0ed00c8dd8f2a3d1c9c4ac3a74bded66a2
SHA512 219afdaf32e10ab19097a1fe2ef0a5e647b16554ff1c3891c6476775375c674b9187521e04c2e37af068b32fc1efed9c8bf5a890f67d81024322444604a6cefa
TLSH
T1D2F027771EF76404F8ABCBF5147210E54114B8588520EC6F209AA6D654B136E2099C66
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 2cf9123aabfca25d5c62ded3dd5e0da9832f8034fa0f312e4e02000a258793ca
MD5 25512880ccdcdb50b20aa98b49f7040b
SHA1 ea6bf4cde6579a0ff1f359e474bc114b8d3b9892
SHA512 11e923e138e166ef8131706aa83bd92cf2dae5cb928749f6d814a5719a31e79302a10b793fb1d6f3b3239bcf01570a2d2443df9da360e0786d1fddc61bf31462
TLSH
T10CE068B71CB36414B86FCBE4183140E90004F4688614EC5E105AA6D310B03692055C2A
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 476B
SHA256 6954121084612a0b981e5e9f2eba683473817da6e5f6711b8a48c179ea427757
MD5 e3f5213f0b64a26e6e982ef170f96634
SHA1 4383e69ae137da8ab9d582bd43f86420f851cfa2
SHA512 df37cf63a95628ef9f6335b58665a15b4f17a376a7209cc5310a1f7e14e3cb5f6729605e04a262c921e68ae9385a22ed7db2fd36b0ec3dbb9100da676408f29c
TLSH
T148F05C771EF76404F8ABCBF5147210E54114F8588520FC5F205AF7D654F136E209DC66
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 481B
SHA256 fa6a15e179f3be815d8f354a30e971773add2edb2792cdc282d740a48bcd5e91
MD5 477f47ba221060785109d83777154715
SHA1 ae25c26efd07df6185e8041d5821b32c06b0fac6
SHA512 1ac33e63becd8b5dd37b09784aefe0f5738cc7ed10ade96764b4eca6a351e0a94ac7517f7ee0faab5c75a3d1137ffec565bbdff7a51a2688ce63fed3db820a31
TLSH
T187F027772EF76804F8ABCBE5547250E54414BC588511EC1F205AB6D694B136E205DC66
MD5 SHA1 SHA512 TLSH

Submit Download

ba23d8ecda68de77_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\ba23d8ecda68de77_0
Size 117KB
SHA256 221ccc92317c9f5e6f956c1431c39c3ae89aad8f7034bf2bca66a3f5829746ff
MD5 7e44e57d808aafdf713d46cbb31e12f2
SHA1 ea9f8bf31722bf9605d230943d25672d8bfa060a
SHA512 7d0166450e7fc2cb52a96f5bfea8516741b2dc93b409cb164153abba45f5b8351e7abb48e29514fd11487fa69e9a5781a4a145a8e9f7502c3b449a822da27afc
SSDEEP 3072:d/J9B4xPCL1uOsetdmL/UFp0+Wux0gL/dL/oL/PL/8L/1oxG:d/zBmL/UDHWux0gL/dL/oL/PL/8L/CM
TLSH
T1F4C39933769D50AB0E8ABAA45056B50392BC6467B8449038F254A7FC15DBFB013FBEB1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ba23d8ecda68de77_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\ba23d8ecda68de77_1
Size 201KB
SHA256 84a209b04f51cf27a48aa0b49ba4b2303ee3fafbad262f13c02680a5ae223345
MD5 405c70d1a097e550202879f76f20c816
SHA1 e1450222ac2a07062e385fe9afda3a4897528a50
SHA512 ec0ff3e83e2779008c0755dec05a0107d512654d990db682bd6c55e753b402a09dcdfbf0385cbf70860327d8a8fce5d0af1467f5d75469672c63ffccac3e6225
SSDEEP 6144:Atk54uMMuGUThBG5Str8fPRzxwAyL/iZdp8zy4hERIWwB5KKAJcvL/OL/5L/KL/P:iRL/sXoAJcvL/OL/5L/KL/XL/Tnn02
TLSH
T1FA141A22235521AFCD5993B913239A17B7B44006BEC3D3699581A334186FBF32FDF962
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 db42bc685ce9202e9900222714d241ab21aec40ebdd7e854d3be939c68ac8f49
MD5 5444f36a750663e7d744edcfd61254da
SHA1 448500052cffee421443478877a118fe3445cfa5
SHA512 e1d4c4bdd371884eede28d1eca4bd3c03be05e05392720206f2e178a8d00a8cda78cd2e7f4c088b940752907c7190630b1b79a108de515fcf9879c0856f68f84
TLSH
T149A00213C594005DC4040774B05A52986713CE314E06321184E7D654AA519825373104
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58ed78.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58ed78.TMP
Size 48B
SHA256 39991ee92a0a5cb173af7a9605c2251c344fc58013508a126c141a8caa19915f
MD5 c8b1ffb186f487783930f8b5ab675eaa
SHA1 98c1c44ffbe2590ea84d6f6b1a3f5538711c06b4
SHA512 bf6870669a41467e672370b6593d22664015a9ea46193c71ac28fb97df691603291b3e691da20a79a1f4b927091c2c885e7d359e66843e9d0670c98148880dc1
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 110d49d77aff33466d8055486c8f1dcf561adf089a3945edc89b77fed7295db0
MD5 5ad2f37a0ce67735b2aa4bec33aa0862
SHA1 15a2deeba0d7635003f2c5ec178c317649bdc348
SHA512 a782c43eefa30888418e3d765594976524910b0812d690f6de0e80d444062d6bb5bd00a01d408cbe3990d64faf20a08d1c86ac67ea7b9ef69945b5cce9166128
SSDEEP 384:cdYt3tEJdTHLGHaR1xBprW9d6T9bLzwJbBRrn+gI4XIj++OT48TWe7seP27m:cdYt3tEJdTHLGHaR1xBprW9d6T9bLzwN
TLSH
T111B22815793E234138BE290CE1A5961F674230B3301AA63B3BBD60E64E67E015FFD9D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 e09847010bf6321586930183eaab760b1bb13110398687ebc82c96556db81adf
MD5 9c59c9a774efd582668c697143c78315
SHA1 4e61582cbea8f7c913b2cc45239e29e1b1b820cb
SHA512 74c696218597e02392fdbd2a933391ccbb745401280175a398454f96e5f470fded47cbb513cb1f8dfa3d89c057fcbe2768c635c16eeb70f5f9641c8d49aad517
SSDEEP 384:nhiFKtNn/s3n9SD8Ns8TUNTUlIRoTfESur0+eRTCfxVZkuPRC+rzSfL8Lk1IzpxF:IFKj+9yBwgUETFeKVZku5CiuIvT
TLSH
T1F6E2C4F298D7C977D8AE4B97633D6D029ABCC153B5885984FBC85D4CCC8A1BFC20A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 24cb1eb059c8f89d347b7cf2c28d59042acee29c5eb9c6cbe35cd4a7d33e505a
MD5 1d150c9f75ef8ab547020b753b37163e
SHA1 e3a8f58e9e23943e44ed6974f48685588c982249
SHA512 b821350fc223aeda2fac355ad54cd8dab2ccbea7f5f501aea474ab4b2933e5371207311552b158c8e872cbb424ecfc5201b059e1d57b7cc16a22b58b0ee9d09e
SSDEEP 384:nsiF1tNn/s3n9Sy8Ns8TUNTUlIRM6hESuYze9TCfxVZkuP8CaV8Lk1Izfx9i:XF1j+9nBwgSYECeGVZkukCzvi
TLSH
T199B21932D8A4CA6BECE64BD5B30A7A079EE04163D5CC6AD8DADD5D4C00DB1ED130BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 d01587d7ab2f747de9677a00c3da2d58fe6efa658753259813df98dc3352867a
MD5 ba4eb868fa32565ac0498931d42ca2f5
SHA1 b6e5087c9ba98091b8ccb5de179d2bf7bccf73d4
SHA512 3dc74a5828d425e945e9555b5bf4ac650b8f3e5fca2fbeb51a584d3e4fb8ddb70adb8b24c723d6db52682db3675d6612e1bdf9c0b7560831318286b1ff9b8d42
SSDEEP 384:n2iF1tNn/s3n9Sy8Ns8TUNTUlIRMTfESuA0DeRTCfxVZkuP8C+rzSfL8Lk1IzpxF:dF1j+9nBwgUE4OeKVZkukCiuIvT
TLSH
T1E3C22932D865C96BECE64BD5B70A7A07AEF0026385CC6AD8DACD5D4C01CB1ED430BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 2630b6a57f1f61e4117b7464bc0080f132c44f5bb90ab32e6e071da49caf600f
MD5 061ca0ac37267809c5d17a706abca52f
SHA1 32692bf6c160f835d5190d23e4e8bf887d39d3bc
SHA512 392ee8744adeb0b92946a7c158818ad584a08ad07baf4d462f6392b7457415f226ccb31c6cf0d28f132b3912dfe0b2cbd1a6d868ddc279079e3f3bec76eb6070
SSDEEP 384:nhiFqtNn/s3n9SY8N58TUNTUlIRoTfESu800etTCfxVZkuPOAC+rzSfL8Lk1Izpr:IFqj+9NAwgUE0re2VZku2ACiuIvT
TLSH
T102E2C5F298D7C97BD89E4797633D6D029ABCC153B5885984FBC85D4CCC8A1BFC20A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 52a9d4b2c499429c6bff22d1a081afe2476916fb54b2de4f2da56deba11dc3c6
MD5 694c83efed7e2f5e9233f2450a71b821
SHA1 ba7acd8dc2183db864a18baec39b8d4ed05f6de4
SHA512 fb30b275c0c8ca9a1de932055630485f308f940b9d3b2519fa709907b22e9e5ad1168bd405939b8d48712efefad15fa98ac526388b6a139ef3834d3446fbfe1b
SSDEEP 384:n7iF1tNn/s3n9SM8Nq8TUNTUlIRzhESurCxTCfxVZkuzYITGT0I5ui8Lk1Izmx9b:WF1j+9l7wgrEWqVZkuzYi+0Rwvb
TLSH
T10DC22932D864CA6BEDF65FD9B70A7647AEF001A3D4D86AC8DAD81D4C00972DD130BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 9954040b301532dee43c4b98167a4316faaeeca738c03e5284aaf8a1e900cdbf
MD5 f1fdd8d4ec48a0f85645f8bc8f74482b
SHA1 d9e1301f9c1f1d8b8cdd4967e87c62e22ac3f0e2
SHA512 67181ab71d0c2fab5edd12eac913c81e67865d038d95da938653b1ae2f1eecdfc5d656ffc2a66f89f207d636e82eee08f1b5cf65f002e073804b237f6df1f6e1
SSDEEP 384:nhiFEtNn/s3n9Ss8N58TUNTUlIRoTfESu300etTCfxVZkuPAC+rzSfL8Lk1IzpxF:IFEj+9NAwgUE/re2VZku4CiuIvT
TLSH
T1B6E2C4F298D7C97BD8AE4797633D6D029AFCC153B5885984BBC85D4CCC8A1BFC20A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 c274c51e724416f63a238803fb898375d81bc5f4bb66e819fee4f4eb0fac4c6f
MD5 c1dca0756453060f1b11882b200c555a
SHA1 ad9bef9d5e143ab3e5d264470aa1d01bd85b9e80
SHA512 a887a7aafbf6513f720f8f38f7261b500c8ed3f6bef01ba43d7e3a1be974477126393dc66a8bb3b6482e9489a7c11e3b7d5580130370cd170e037ef512141b10
SSDEEP 384:nhiF+tNn/s3n9Si8NH8TUNTUlIRoTfESuC00etTCfxVZkuP7C+rzSfL8Lk1IzpxF:IF+j+9ruwgUEKre2VZkuTCiuIvT
TLSH
T18EE2C4F298D7C97BD89E4B97633D6D029ABCC153B5885984BBC85D4CCC8A1BFC20A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 68702e7215daf903d7ab63c8391ca26e5943c45536dbbcdf4df731ab489ff49c
MD5 75e487b3998643233178c6bc1b7f0e4f
SHA1 051564f0fd2b39cd75e668ce4e348277d10de592
SHA512 d0f26e0fa29587bb95c9618a8fa717ff071bac0813ae0d12ddfd9c11a1c2101f213553fec202f0e8f12db6b8c20ba1a65c5c29d23f3aa988155d7267257d8813
SSDEEP 384:nhiFxtNn/s3n9SN8N58TUNTUlIRoTfESu100etTCfxVZkuPaC+rzSfL8Lk1IzpxF:IFxj+9YAwgUEtre2VZkuCCiuIvT
TLSH
T100E2C5F298D7C977D89E4B97633D6D029ABCC153B5885984FBC85D4CCC8A1BFC20A819
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 ba4ba45c1e71a1aca17d17e17679ee460cdd019a8a529d342a62013dc6f09819
MD5 61be8557b41950344033caa630c4b44e
SHA1 375c5d64f3d9fd034c6478272368205dcc76a7c6
SHA512 f8fc3ca6df86cd13e7bfd2a7cec0c447eacec1bbe5b1a099dca41de0538e431b8e65441d1bdf4825b4ace539a1c1ae59c554e45c1884bd3cd76848ea545396c9
TLSH
T139E00217D20081FDC83C03314447163016E7405001F601051C15016428133101FB0FC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 53c2934ea275dd8e2e47268820de9bfd4febb701a2114e9bbf2ffdd033ffec12
MD5 0f2feeb4eccf48df41278fa5894b0ff8
SHA1 9eba1450f766a9a4b304eb2be699e98d32691833
SHA512 807b554c85dd8e717ba9df37e589ca16a8442d6e3e89c3d17849dd6a5ccf11d4622f4a0fe4b7af8216dd3292fdfde217d8ea81e412284d858fce79db96d2867e
TLSH
T1C4E00166D30081FEE83C033644871B342AFA406012F701961F2602A878327503EB1FC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 56b024347930dc465b021d3c0b823bf5d969e572d9d81176536f8ec3f6b0a3fc
MD5 59310b6a37bb06121fd9a1c86b52acde
SHA1 50bd756a5418b72b9060b2ff3af8d4a577e28b05
SHA512 2522e1a273ac0230279c34c59ca8d9b7a6ae2262b0851ffb5bbbfef514215c300eeb5dca309617d27c274fa3fe9fbec61deede5848db6aa81a731b04eb75f428
TLSH
T119E00166D30081FEE93C037655871B343AFB406052E705961F2606B978227903FB1FC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 5f46847410b26641b1a7f5ee4d0a01c9924ebc088e2959484652329942f26de6
MD5 ddfb7334fe32df4d5e8c1eaa7c8bcc5a
SHA1 b154003dfd392d77e5e239c23b1db172d0ea3559
SHA512 887f7c263dcfab2eedd7d9ac15a7ed93c32f0cc67f072a44ceb8dfd7913a7a4f06968add72744e2a3f98416781246a0729f0c9bd06663de6e2123037d8c96099
TLSH
T1B4E00256D20081FDC83C033144471B301DF6405011F601451E25016874333103FB1FC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5864d0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5864d0.TMP
Size 392B
SHA256 5b528f043b73b0a7ab51a8bff3aa2ef6254ff20dcf6820f677f07573d83a01b8
MD5 f769d3ee9e7f5d6a8c4bebd8680b42cb
SHA1 59665e2de9d06e7255825acfa88c7e3ac7e2642c
SHA512 9fab663a786872cfb9f39b544bb8001abb77e810de0454cc0ce302f79daeccb16a6710eec394c40403fc7d758565f6b032005864fc77683e7e9a521196520ab3
MD5 SHA1 SHA512

Submit Download

LangDLL.dll

Path C:\Users\Admin\AppData\Local\Temp\nsnE349.tmp\LangDLL.dll
Size 7KB
SHA256 b797e5a7de359c0c934cddef8e9d3a78e6d3d68e6ac83d2ddad915770cbace53
MD5 48125e63f130d69025cd2bbf9f3b0c4b
SHA1 e3923a75ed00cc53e2f0b3c1843598c7c1ede79f
SHA512 5b411fc88035eafee2eed3c4e1b8c14fdb09ed09ca275ec1492d7a72dcf9cf55719dc34e63c00ca64162a455339658efc958dd2abb6dfe8a363f2f24ff3bd5be
SSDEEP 96:BLIwtgI+Wdk6guTxZlx3ojaVgmR6wP3LtrlKVNtEc+InoAhrEoUK3EMbqKh:J89uTvlx4jhaX3Lt/ch4oZ3x
TLSH
T1B5F1C70E6AC010BCFD6FC23A8D3A42157BA1F521076568DF269321553EE4FE76E356C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsoE608.tmp\System.dll
Size 23KB
SHA256 4bc489ab81c6f1d7e9cc6c2e8a3157183e7b0ee5199b4c6e8044aa32da2dea1b
MD5 8213548feab7394279d2712fc12126f5
SHA1 1ada5c813c36c66789b256da1ccacd9b85a97b4f
SHA512 3b5f96cca356bbac7a87bd2695e1b95b1c8fb6c3f059e8a9ac11724708c8aaad4f7e3e404a9be1c7354b03414b18123916c2b4772ceb033a91a8c48ee724e2a8
SSDEEP 384:ecybqzYqKbo39DihgonO/U1j/HCD3Zn/MUcD9RSSvUW6OEY3yW:lybqzfko39D6gUOMhKD3ZnkjRSSJ6O
TLSH
T1DAB23C0B3AE5047DE446C13EE6671226F6B27C412B11E4DF2761B13A3E75BF01B39698
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsoE608.tmp\nsDialogs.dll
Size 13KB
SHA256 7ecc85cfcc4bde6146ed8e0067341b1a56306f94893702ee772bda8725712aeb
MD5 ff6b5961a43ba8c36434c9e707d4e6a8
SHA1 f73efb0ad4f4e9f5c716df5168f4168c2cb01ad9
SHA512 fc1da79bd1725e240f0eb259e2ae7cdd976e33f8c9b64083c9420d9a64aa2bde9251294d8cfeb70e5b93d73517c26594c04c8ebba80d9529235b02d52b0a72b3
SSDEEP 192:hVoR5bH/o9gAXCI6KW0fnFdFlCaYQZUhU+Cg8++9KdYI:hVQZ/omAh6uvLFlZX++9Kd3
TLSH
T1C252D7132AC100A9FC5BC17B99BB55228ED5F6100B5131DF026662463D72FE57B3D9EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp-b1m.xpi

Path C:\Users\Admin\AppData\Local\Temp\tmp-b1m.xpi
Size 1.6MB
SHA256 47541dc0f588d682ecfbc5e0f015b609aa8b8eee1835208d979274639afa3009
MD5 becdc0ce367363a9204dab515b49aa55
SHA1 b9b8d053404d10c524ad03724421c280837992bb
SHA512 0f0229b653e20b7b1b01996e41917c28a12c81ac4598f4ef4b3f9872a2b014e3ef78436f708e26cc12db9ed2288632458ed96bfb52f2e227f262eb77e76b1d97
SSDEEP 49152:HOOq65vVFNdpyDy7rdl31AGgq9MK4U2w5cls8E3:HOO77FN30y7hR1AeMKRfas8E3
TLSH
T1037533CABC353D1EC537E53F6B805075C9489F02147EBA02224DB8C43E527569BFAAD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.exc

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

data.safe.bin

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\datareporting\glean\db\data.safe.bin
Size 82B
SHA256 0c6c1246ff1fcbf1ac16dfe53be24ee7891de62a4bfedeeb632faa7caee262a8
MD5 fafab26d61e6b9bc313fa05b3fc05aef
SHA1 d34798881e7916868b10321126ad51ed75dae09d
SHA512 92e04ffe3531b5fa71a51707d7d0e69bfbd9d75eaa57f54f208f0b083701cd8aca591be08d8d6e1e3d4311c647aa94545920ebde4e1c1628dd30cbe86c6ca14b
TLSH
T1C7A004C0C7F0D400FC43373F50004304034D55100571D003C4501310F0375351D35C03
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\datareporting\glean\db\data.safe.tmp
Size 82B
SHA256 84e58efe7002b3979bd085be539f0b77c4e4088cf36871d2064b955cf8e49c41
MD5 d761cff9dabf6f4fe73363c79fcc9afd
SHA1 0c21d46130d5fefa768b28034c87139463b367ea
SHA512 b6f5cb36e9ba3a698045aa5e46f567864bce095b43d5fa0b1cda3893d8a8f196903f35b2971d127a6c41d1e3550ddc40f969c619a403dc30c6b795c4e983fd00
TLSH
T1BEA004C0C7F0D400FC43373F50004304034D55100571D003C4501310F0375351D35C03
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\datareporting\glean\db\data.safe.tmp
Size 82B
SHA256 9934d47707fb909b6149196f695ca44da83dca6280ef5cf374ce80d3267f4e75
MD5 2f8f6019e86cdd4d6c0bf4c31f7a2f08
SHA1 9ebb64b2ee0c23be87300b30fcdcd3c1a1384598
SHA512 e76569de7ae00bc6f4c99e1e1d5d1ef781d7d552067dc30dcd39ccb7c1890e34acff7fda5a9bbbcb9e73fa57c594ffe3b5f2cc460d6f93c5c97a7b97ea95bda7
TLSH
T1AAA004C0C7F0D400FC43373F50004304034D55100571D003C4501310F0375351D35C03
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\datareporting\glean\db\data.safe.tmp
Size 140B
SHA256 81ce27925b916f8b057e9aba8362add473086d8b40be440d3e1d95fc596f405c
MD5 5038a4d8721559cb4b0cf14e201aef5c
SHA1 1be47a9bc789d24186c38e03fa34a736fa95d774
SHA512 1b848a984f9f8b6696e87b43870a337ce2b9622bcc22111a75e891d59a5b58b36a44969dbf38b6e6025221e27f1087430eb1670ebaf9f517e0cf0b8a85945946
TLSH
T12EC01280E7A19804E4455237000003120344581100E2E6039014520494779243C78C09
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\datareporting\glean\db\data.safe.tmp
Size 82B
SHA256 b9382d692c3cab8780b86342e5fff6ce78d5b62969767fb57643f4f3b700fc49
MD5 1c2b435851c9e749d7b1488ec1fddcfc
SHA1 85af71ae8ac6549f4f9eba6930d0602e6ef1645a
SHA512 897693f470dc8aad437fc895e4f195ab3717b89a0d5971d7ffbcf961881cfca0b78bb338370f7eda6a6e48fb2f102ce0511f113c2743c7de995149f2f9e2edee
TLSH
T121A004C0C7F0D400FC43373F50004304034D55100571D003C4501310F0375351D35C03
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\datareporting\glean\db\data.safe.tmp
Size 82B
SHA256 39447608973367d2f9deccd6b21b3bf4bda73b7405d0d153845b180a5ceae6ef
MD5 765cfb03c5a36cf59417ffe8d584751c
SHA1 536531c854be4b293fe029c06c7b48a452b7d8c0
SHA512 09b1df574279fdd1db7f7a7a342610c4d28b451ffe6aa73b875b08335a43a3de0e8eef5d0411ef8521ccac5e7bbca789941f988abea2a11ead2264735b46cb4b
TLSH
T16BA004C0C7F0D400FC43373F50004304034D55100571D003C4501310F0375351D35C03
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\datareporting\glean\db\data.safe.tmp
Size 82B
SHA256 ab3444dda5066eb5063be04eb18906e6f558b01ec92f80aab38e2a9ead5b7a84
MD5 e335604ba411753ad562fe9b65ebd9d9
SHA1 a9c01e731003b58e911d0e54ea9b682fa10c91ca
SHA512 c1114b28224a939010d495ab17670c5c43a2f126fe0a6e1b96a09c4396e65d6dcb3d20580b8de9713cd8799fcbc323c33b683f8122b02e02c59efb24510d9cc2
TLSH
T1CDA004C0C7F0D400FC43373F50004304034D55100571D003C4501310F0375351D35C03
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\extensions.json
Size 37KB
SHA256 1640a743d163084c554da26797258dd1b25f5c82a566021dba71b8a5037222a9
MD5 88641f9e2e9d217d4164ee0a934d981c
SHA1 bba717d2052166f2e7a1920aafa8c53460c5c148
SHA512 ad52c1d1863cd180a2c5c6c8f4ec9480012cb80d3036b2f0b1e83ead7b39c4a10d71f6ac5dd9ebe1dc6717ccd7c0bd7a5e146b38c075bb0045301857d2fd2943
SSDEEP 384:PGqXY1ln8TOk/ofsmPAjg2Ej/7GoT8L4HaL4H2L4H0L4HMF/8Sq3nRFvlNH15bp0:Pjg8CpD2RJ4I4c4O4s27rldbdIvVd
TLSH
T15F039639498D9F291F492AC2282BBCC465AD836FD1AC9C33B89A4F1C05F437D467B11B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extensions.json

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\extensions.json
Size 14KB
SHA256 8b2fffdfab5cd08d3dfef21c564eab1d5f065b0b1c44a804c73acc37439bae45
MD5 c0b850bf442402e38c23493588129c0c
SHA1 84e8398b6ee23f3dbfac4c3805ac475700007ea0
SHA512 0f5cf8678bd338e8ed2cbcb43e601e375e2359e74249085fbf7083727d0fa457e68a06bb2f1662133bb4f8bc642fa56814d390df0bfca582dee1e14e104d2c1f
SSDEEP 384:PGzXY1ln8TOk/ofsmPAjg20j/7GoT8L4H3:PWg8CpD2BJ4X
TLSH
T1F85274385D989F79294566C75937BC88606D879BD19CCC33A8AB8F0D25F423C8B7B10E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\prefs-1.js
Size 6KB
SHA256 5da230dbc38c4a4952ef51704c926d366714f9fb308c584d4c70a1532a5a11e0
MD5 c15180a9236395ce8cd5e0ebe957a38d
SHA1 9fa55a0967fcc3aba627debcb01cb12ad1587fb0
SHA512 89ec539355413647f7b98d03959038df9cd963005be66290fa7440a17af0d614d11c230aec183cb92ed3cb11942db7a9df2ec964500aa87809eda1548ae2bd5b
SSDEEP 96:xH0TnqGqwY2UKzCbzvzBzjzPBbPpn/Hi25EIjt/Tv+XPBw8OIaYiWXGS:xRwY2RzCr9/HVN/TgPBw8OIqC
TLSH
T19BE1DE3891488F7F29B676BCAC64487192B2053B7BBF68C610B64095150CF7487FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\prefs-1.js
Size 6KB
SHA256 41b8db07d61fbc18880c123509ee3305fc676d8d338bfdd6a0f5070251f2c4fb
MD5 18a1e430944ad95d432ba6d26bc4e43e
SHA1 1f0d0f60d5bfe82b5f4fbe449176c89b8c85ee00
SHA512 3efef8ec9d280422735e82e24db45fe28a9c22548da14cb994525c044337b0ea01e48ae16ddc564260b38f50e287475e837f8e1bdbc6ecfedc22a252741db2c8
SSDEEP 96:xH0TnqGqwY2UKzbbzvzBzjzPBbPpn/Hi25EIjX7/Tv+XPBw8OIaYiWXGS:xRwY2Rzbr9/HV37/TgPBw8OIqC
TLSH
T158E1EE3891488F7F29B676BCAC64487192B2053B7BBF68C610B64095150CF7483FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\prefs-1.js
Size 5KB
SHA256 e88db149799eafd432bdf0a27dd048c2b41255833b3d915fdff8a3a0fd36e600
MD5 2cc1da0bd3c44a56b6e6044aec2f4b41
SHA1 1514c45b16fe3f1545f850d7b8b0a9b772a04752
SHA512 96d39f5ef33ec0e360e70866bc132715710705cbe887b249672e53d09c94fd75dd9cf9c60508b04ebd3ab9c49dbf0dde2772064c8b5b36fd36a7adca84975f11
SSDEEP 96:xH0TnqGqwytbzvzBzjzPBtPpn7Hi25EIjimCBw8piu:xRwytrz7HVCmCBw8pl
TLSH
T105B1026891488F7F64B6377CAC654C7192B2053BBBAF68C610B640C4150CF7887F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\prefs-1.js
Size 5KB
SHA256 fd49b8870d6bd73e8f7154e60aa1dfc6500363167819042e079dbfba635ceec7
MD5 11706e8b171bb785f6ec6a1283ee6899
SHA1 27ed8655974c704e1b500681e80f274070644a9f
SHA512 ef23b740b1a3df341f60732d4a190bf0d988176eaec122ef6713d17c5d90f34710bde33216b7ea3e973d42822705b948c2cb0d8c64f8c17bbc428e1ef7534552
SSDEEP 96:xH0TnqGqwY7bzvzBzjzPBtPpn7Hi25EIjiOCBw8laYi8XGS:xRwY7rz7HVCOCBw8lqA
TLSH
T172C1F07890488F7F29B6377CAC64497152B2053B7BBF68C610B640C8150CF7886F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\prefs-1.js
Size 3KB
SHA256 c5ebbec0e7ad57fe94fa0c8eb7f5e5e567f675ade60f89e1dba20f4bac978a28
MD5 b635b40cddb33032ba1d691ff9accf09
SHA1 81b786cc41e8e0e4b622500af160c13c2a243de3
SHA512 ff8cc54d258fdeb71382e0cd59208d0730fe0b6973063d3f2f89175bbed8cdcf1ed67f9ccc2a82aba4bfd976eb825431a573a1f05ae306272fd9bcfb79bf25b7
TLSH
T10A611168A1848BBF59B5376DAC594871E3B3047BBBAF788610E54088150CF3883FA5DB
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\prefs-1.js
Size 6KB
SHA256 2d55eb058619389b38f6bc44f7693e700880d38fafb3b7693ddec35eea02c32f
MD5 96599e667b2eaeaf5f71de93aae2158e
SHA1 cd9d827d53c6559be99b6e705e1eeb380b3c292f
SHA512 9401d4cf8c8304c6f6233f26083ab6e2a5844d6e6c47112865306ad6bcde48b24454bf364367158bda4dea29fabadd06559c34d3714e4a21ef799a26a1c3ae1c
SSDEEP 96:xH0TnqGqwY2UKzCbzvzBzjzPBtPpn7Hi25EIj2tvHPBw8OIaYiWXGS:xRwY2RzCrz7HVWtPPBw8OIqC
TLSH
T175D1DE7891488F7F29B6767CAC64497192B2053B7BBF68C610B640D8150CF7482FA6DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\prefs-1.js
Size 5KB
SHA256 ff52ccd9c7900a43473e2d2a397d9ab8b921501e8ea2cd2d5bed8bf9d74614ba
MD5 be0498fd59c6fb98089a0b15af5ac3a7
SHA1 ca894ba1b3927d5e1cd1ce6d13bd27403dd6800f
SHA512 1d24df2d2afcf2eabb6db87462bdf9e5fddc0d5d46aa6cedaf00244b3bb66d43fd20941eba8eac27a98b2e7c18b1b8d5da5ee34b386326837e6b1edcc8bc8456
SSDEEP 96:xH0TnqGqwY7bzvzBzjzPBtPpn7Hi25EIjimCBw8liu:xRwY7rz7HVCmCBw8ll
TLSH
T16CC1E06891488F7F28B2377CAC65497152B2053BBBBF68C610B640C8150CF7882F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\prefs.js
Size 6KB
SHA256 d1d3c212b5015a22615a2bbbacffae35e36f804cffa223fc49cb46b14059f64c
MD5 d9190f3ecdd7288ba9370c0de3ada424
SHA1 f2bded0a2afc28d1259727d67893cb376b3ea94d
SHA512 196ed1d3e7f14569d70a379c2e68471300624d1fb503b69104f5db1729c46237288693568734ca2382dbc5365d05080f03e594be69a0f37e9cb754316296a08f
SSDEEP 96:xH0TnqGqwY2UKzzbzvzBzjzPBtPpn7Hi25EIjiOPBw8OIaYiWXGS:xRwY2Rzzrz7HVCOPBw8OIqC
TLSH
T163D1BD7891488F7F29B6367CAC68497152B2053B7BBF68C610B640D9150CF7483F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\prefs.js
Size 1KB
SHA256 4974b660cf0a7cadf0d1f44b5e84d5271e7f944afd2e62e0b818d09108bf41e6
MD5 87889c23483afb3cee9ab1d09cdb7bcb
SHA1 da4d76571c9ab373f7e98ab737d6623fafaae088
SHA512 9dfe8fce358a940d63eaa2368d3204d5c7498d626c3ebf69cfb73e3dfca18d0da6b2079f4c5a07ee763262530b5b6957a77500c43e590dbf38b8e98cd49c8e39
TLSH
T1E021D2A949464FAF61F432BCEC0641A0D3B20136F76F688211F840850118F3443E79EF
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.js

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\prefs.js
Size 3KB
SHA256 9deede8f9c9170c031e8709add4108ba748055b39a0af834049a04afe71fd673
MD5 0c7dafb91a8750e9febc3ea798cbc6b7
SHA1 1a7353129dbe4f268cc3ecaf7b80015d1d2d58d1
SHA512 fcbf991980ff0c1d26b159f453fbe383b6fda649a4590a30249637fd45af4ea9895c0c805e0fe6e015d42d7f5447aa8971751edd0f8360b032c33f5ecbf01cef
TLSH
T1AC512478A5488BBF59B5376DAC594871E3B3007ABB6F748610E54088150CF3887F65DB
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.js

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\prefs.js
Size 6KB
SHA256 d8c5d79d181f50badee294c56914949078231f96948dda49bddd3d46ea672f17
MD5 090be0b4d93d6cc13fc9d9beddea4081
SHA1 0f616a8fa673b2a2cecbe6e374cc8571f548909f
SHA512 a5bcecad789ca0cea80ebd8e3cad65935aeecc118f1c78e404909423f9a49ba42c27b66f54f7d48cc7519ff9fc53f1fc6a3d4afc46ca89cecf6176deb1420f1c
SSDEEP 96:xH0TnqGqwY2UKzzbzvzBzjzPBtPpn7Hi25EIj2tvHPBw8OIaYiWXGS:xRwY2Rzzrz7HVWtPPBw8OIqC
TLSH
T1ADD1DE7891488F7F29B6367CAC64497192B2053B7BBF68C610B640D8150CF7482FA6DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\prefs.js
Size 5KB
SHA256 50eb4720de3c5310d2eb796d4ffd737d0426ed72608b1db5c5b79b9963fc5587
MD5 0836a567da580edeb355dc57676d15f9
SHA1 fcaacabf8253f5836afd4a898353f173e62633d8
SHA512 630ee858e49b119aa59486aae66c4eea2fb1fc53df48bddf696a4988a29241c5c9d4affda2167ca6c3dd4ce558d93bc247e6f6a2c89894cd77d96f7dbf2908d1
SSDEEP 96:xH0TnqGqwy7bzvzBzjzPBtPpn7Hi25EIjimCBw8liu:xRwy7rz7HVCmCBw8ll
TLSH
T124B1EE6891488F7F24B6377CAC65497152B2053BBBBF68C610B640C8150CF7886F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\prefs.js
Size 6KB
SHA256 77b11c02aea677bfaee1f8e5995ce42272d4863e5c9b089fcd312f65432d2c1b
MD5 4615990d52178c051e26b0571e886116
SHA1 62081516a108f32fe8cc25dc91a7ad055320b4ec
SHA512 f859e6f6ecceee39539b38e16077926aef863481f3cd41da026066f94180de08c424b19bcddcd7a8b238e73231863db8e64e2109a874d80e6b4315d9e3182309
SSDEEP 96:xH0TnqGqwY2zzbzvzBzjzPBtPpn7Hi25EIjiOPBw8OIaYiWXGS:xRwY2zzrz7HVCOPBw8OIqC
TLSH
T1E1D1CE7891488F7F29B6367CAC68497152B2053B7BBF68C610B640D8150CF7483F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3647222921wleabcEoxlt-eengsairo.sqlite

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\storage\default\moz-extension+++96ee9173-a164-4c2d-9682-02abf6b2b340^userContextId=4294967295\idb\3647222921wleabcEoxlt-eengsairo.sqlite
Size 48KB
SHA256 0fa29339fa37222a8e6c214a7780e031bfebef94a2caab3e0b51c149fc815529
MD5 4318659953eaf1eb13157ab89e3c0ead
SHA1 7b2ae56bccac627666b62f945d38b7aa2678881e
SHA512 493cccfbd7db05cd277c156f1766b3a12f9ec1f725172ffd1d1382c8b8fb6065c722a4484c2acc3720e5340b08f6c18f59a0616a8d2219e80dc81fea3a748285
SSDEEP 48:T9OA65g7LV6CM5znpgBlizb5pxVgnO9zxV+LU7mY2wzY5QcEVdyEirbm:J16S6CKnqlizbxV+2xVeU7X2B0T
TLSH
T1DB23718E3F07E911C53AF0B178A08D51B85E311D13222AD579D0D9E4C8F215AFD5F9B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

profiles.ini

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profiles.ini
Size 103B
SHA256 11dedeb495c4c00ad4ef2ecacbd58918d1c7910f572bbbc87397788bafca265c
MD5 5b0cb2afa381416690d2b48a5534fe41
SHA1 5c7d290a828ca789ea3cf496e563324133d95e06
SHA512 0e8aafd992d53b2318765052bf3fbd5f21355ae0cbda0d82558ecbb6304136f379bb869c2f9a863496c5d0c11703dbd24041af86131d32af71f276df7c5a740e
TLSH
T15DB0120B231CF04308312E15244902F6C8201C1C7011B01551C4110D3343D1334CB661
MD5 SHA1 SHA512 TLSH

Submit Download

cached-microdesc-consensus

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\cached-microdesc-consensus
Size 3.3MB
SHA256 853f6829f29450b1eafeec2a83329c2c7e8350907591a2ac3379340ae0314bbe
MD5 5ac94c8642df67b48324945c6565b3fa
SHA1 c46400efb4f28fa76059ba2db63e41605076c935
SHA512 31823599affabac8f169e9bdad37561c108696aeeb8724fdfb4108a5e3ed260f58bea590f1f3ac591e73b08cfa119e363972415ea2c4d75ec55d2d522ec2e048
SSDEEP 24576:yLLoNvzRWiuQM+0SfIdQeeeFBq0968wJ2U:QMtWiuhw08B
TLSH
T12DF544EE97124EEED22609DBE510FB7BF33F2725C2486B94296F88F97209091751093D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cached-microdescs.new

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\cached-microdescs.new
Size 11.7MB
SHA256 778d677680e097eecdf74dd9a96de88d5e6808658e1e5ab74a1fc6bb05ce403e
MD5 fe2932e81782c9564b66b5b489af8186
SHA1 14658e62d82679c8e2b014f2fc1f096445001fdb
SHA512 e76c871aaf4f393b7041098bc715075c01c8eed7d5353f0ed116fb7d695fb8c76dba7a86dd29265e51138b6d2e85d8f5f2bb59f72762afb694b13b1671f00b51
SSDEEP 24576:PtViSHhVw8V38/NwlVNtkyjVYVhVvVjQVygHVF3V5BVp4V8RzdubEVrKy1VVVx0U:PVenWDKCIEhau5
TLSH
T101C6AEDA899B10C14E05E7CDEC1207C7DF144A3E4B5041A172AAB5AB7F3329FC65EA39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dependentlibs.list

Path C:\Users\Admin\Desktop\Tor Browser\Browser\dependentlibs.list
Size 55B
SHA256 612e53338b53449be39f2e9086e15edc7bb3e7aa56c9d65a9d53b9eb3c3cc77d
MD5 a515bc619743c790d426780ed4810105
SHA1 355dab227f0291b2c7f1945478eec7a4248578a0
SHA512 48ecd83a5eb1557dfabfaf588057e86fb4b7610f6ece119d6d89a38369d1c9426027520ce5b6d1cc79a4783b9f39ac58afb360cc76e05bbe8bbbd5128c5d395b
TLSH
T1C6900252006F40226145A5A1684D890C80186146DC9101901567260E16259C008D456D
MD5 SHA1 SHA512 TLSH

Submit Download

firefox.exe

Path C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
Size 1.7MB
SHA256 735a81ec47a3d0fef5269d720b952499472774c96ae0bee8c9e926b246e57526
MD5 31a45e23f2b88c80607757bac44467e7
SHA1 d89772fa54fbffeb225014744ffdb67d1dfb051e
SHA512 0b5466b0129c87f7609f7d3a5288bc0278bbf6273aca5e1aff0f6b083ec8c6cf04aaf11ec5a4f6528502f44322dd630aa32d335086be2163a42b1a78213947f4
SSDEEP 49152:LKhZgvFKvPv1VV5kHsdA1Cyuha8QXXXXXRXXXXXpwwE:mm98kHsdA2U
TLSH
T103857E0FE39502DDDC69D1B1864A5221FD357EB18B90A9CB9B643B212D366F09F3E708
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gkcodecs.dll

Path C:\Users\Admin\Desktop\Tor Browser\Browser\gkcodecs.dll
Size 8.8MB
SHA256 8cc275694a7800a61846e2f18a1b53bbe55e47e2d82c404f34f2d0cdadda7ed2
MD5 c64a075141bec97c0445abed1eb5b8a9
SHA1 d60d2bb4f27506829f416ffd64b1c6d0d70407d8
SHA512 64322e04eb85505872c5c6733acb97023e971ab2aad57414722d2da6287b284ac5c9049f578ede8a9724c38456f2fc7ea71a00126be2f54ed0a5ee8c4c44b821
SSDEEP 98304:9Ll0fF2fvaYQ86PFP+KxOn9y1Oyf+KzHD2tPTSYHqT7gy7piZ:95AFYaYP6oSXhyGYHqT7gy7
TLSH
T16A967D8EF26351B8C51BCC74427EAA22BD18385E83155AF727D956343BB2BC06B39F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lgpllibs.dll

Path C:\Users\Admin\Desktop\Tor Browser\Browser\lgpllibs.dll
Size 344KB
SHA256 ee8cceb1944cce5037ac6ef5642a7e3eea1fcaf4fd192522da8c07dc1db75a2b
MD5 1167a1a7e49d2f327dbdc13991e4c41e
SHA1 3fe514cae8cceff4d59f91f5075ee6e85693e4a0
SHA512 752af9bf48efc0f84247b10957485293cb408ee05f7df3b1dc9c5f3d892b5b4feccea1f814582cb03ae315b7c812609ec832c480490e97725ca42d3f2a34faec
SSDEEP 6144:hymb9XEzTpXVtf6ARArqIOkV2uXzv8dHlDmk2zH2RhzBuc:cmBEfpXVwARgOAE
TLSH
T170745A42E9840879E87BA53892ABD719CB7A3C8407A59DCB07A067117F2FFD422FD750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mozglue.dll

Path C:\Users\Admin\Desktop\Tor Browser\Browser\mozglue.dll
Size 975KB
SHA256 5f4296e395dd0f0c2b5c674e418761d952d4ee118616634ec5678e4c801e35a8
MD5 e79d1e9eb5ce20c078472ce360b2729e
SHA1 801dddc6e45f7d8db3ebc8e0f840cd2bb30cf107
SHA512 845c745dd3b64a89b6e25b24a16f0bf44ece785e18e413b82e968d42545044738503c2a5366d235d3341af0ae231cde4d926f8f32ac735247fda71498229ab51
SSDEEP 24576:Mhww5heJx1ZdoDZalUaEKnB4G5F8RRBWzQFZzzzzz82:kww5hef1iZalUaHf5F8RRMEFZzzzzzR
TLSH
T163258D07E29640EDD82AD2B8935BA232F971FC451B24B9DF069097212F75FE0673EB14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nss3.dll

Path C:\Users\Admin\Desktop\Tor Browser\Browser\nss3.dll
Size 2.6MB
SHA256 a9f5d36c78bd6118c9df8b137bebade5efbb156bc6fd620a8ba31075d746c22a
MD5 26eb6aaf3be358ff9907fcf861ac97c2
SHA1 080b35495ddf4163d5cbd9df8c650aa0a7a59cbd
SHA512 04477901a51d263274b891d1f853346ffe5df881e6f9c633c6c6ea112ff8efcbc4bdb2e58c0e609e2de59ce191e8be16b0985e9e972c750d856c0766998a38ab
SSDEEP 49152:oyVU5jBgkDG32f477R3GdjTjuFmi50ArjdNtrnStrMiaHslHmSWlK+saOXhhhhhM:oyui3HoeV50U9K+s/hhhhhhhhhhhhhhL
TLSH
T114C58D13F29610EDC42AC2B5974B5632F9B2B4054B246AEF52A0CB353FA1FD06B3DB15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tor Browser.lnk

Path C:\Users\Admin\Desktop\Tor Browser\Tor Browser.lnk
Size 809B
SHA256 96f8d31facc296e4c0676cd52e27bf5b26bc521a0e78e89e3f6624cb3460387d
MD5 a043c3419c9b1507fb2b47757995b416
SHA1 8feba2425fd3da5ea545642af645973925aefe2a
SHA512 51b3b7517ac36e72cc05cd4f08666b187e86253b901d76a93b06973565743e034d57f570eb8121de0dc987ab2a0f7194f4aad5255b68627f5f4cc45487f8e4b9
TLSH
T1F00123410BEF1A12F6EA857382F36379E272FC014E49518EC35DF606193223DE928B83
MD5 SHA1 SHA512 TLSH

Submit Download

memory/552-3895-0x000001EF45D00000-0x000001EF4607C000-memory.dmp

Download

memory/1420-4213-0x0000027448100000-0x000002744847C000-memory.dmp

Download

memory/2188-2145-0x0000024994700000-0x0000024994A7C000-memory.dmp

Download

memory/2488-4229-0x000002C9B6A00000-0x000002C9B6D7C000-memory.dmp

Download

memory/2840-3079-0x000002573C700000-0x000002573CA7C000-memory.dmp

Download

memory/2968-3898-0x00000294EA000000-0x00000294EA37C000-memory.dmp

Download

memory/2980-3376-0x0000018FAA800000-0x0000018FAAB7C000-memory.dmp

Download

memory/3056-3766-0x000002B3A1D00000-0x000002B3A207C000-memory.dmp

Download

memory/3384-3893-0x0000017B93400000-0x0000017B9377C000-memory.dmp

Download

memory/3788-2146-0x0000021664600000-0x000002166497C000-memory.dmp

Download

memory/4040-3576-0x00000179F4500000-0x00000179F487C000-memory.dmp

Download

memory/4908-2902-0x000002308E800000-0x000002308EB7C000-memory.dmp

Download

memory/5024-3375-0x000001FE96200000-0x000001FE9657C000-memory.dmp

Download

memory/5416-1987-0x00000224CE8C0000-0x00000224CE8D0000-memory.dmp

Download

memory/5416-2128-0x00000224C7980000-0x00000224C7A7D000-memory.dmp

Download

memory/5416-2224-0x00000224CD980000-0x00000224CD990000-memory.dmp

Download

memory/5416-2057-0x00000224CD260000-0x00000224CD270000-memory.dmp

Download

memory/5416-2062-0x00000224CD270000-0x00000224CD280000-memory.dmp

Download

memory/5416-1958-0x00000224CD280000-0x00000224CD290000-memory.dmp

Download

memory/5416-1959-0x00000224CD280000-0x00000224CD290000-memory.dmp

Download

memory/6032-1985-0x00007FF95A980000-0x00007FF95A981000-memory.dmp

Download

memory/6032-1992-0x00007FF95A770000-0x00007FF95A771000-memory.dmp

Download

memory/6032-1991-0x00007FF9591D0000-0x00007FF9591D1000-memory.dmp

Download

memory/6032-2117-0x0000023BB4800000-0x0000023BB4B7C000-memory.dmp

Download

memory/6140-3839-0x0000018640300000-0x000001864067C000-memory.dmp

Download

memory/6188-2147-0x000001B016200000-0x000001B01657C000-memory.dmp

Download

memory/6212-3892-0x000001AAB7600000-0x000001AAB797C000-memory.dmp

Download

memory/6216-2148-0x000002B449F00000-0x000002B44A27C000-memory.dmp

Download

memory/6260-2149-0x00000194D7700000-0x00000194D7A7C000-memory.dmp

Download

memory/6420-3510-0x000001FC36C00000-0x000001FC36F7C000-memory.dmp

Download

memory/6492-4228-0x000001F41F500000-0x000001F41F87C000-memory.dmp

Download

memory/6732-3700-0x000001D700000000-0x000001D70037C000-memory.dmp

Download

memory/7076-3099-0x0000027ECB600000-0x0000027ECB97C000-memory.dmp

Download

memory/7204-2789-0x000001D8ED600000-0x000001D8ED97C000-memory.dmp

Download

memory/7376-3722-0x000001C71A300000-0x000001C71A67C000-memory.dmp

Download

memory/7404-3840-0x00000224E9600000-0x00000224E997C000-memory.dmp

Download

memory/7432-4214-0x00000243DF670000-0x00000243DF9EC000-memory.dmp

Download

memory/7480-2954-0x0000021006100000-0x000002100647C000-memory.dmp

Download

memory/7524-3897-0x0000023044B00000-0x0000023044E7C000-memory.dmp

Download

memory/7596-3984-0x000001D761100000-0x000001D76147C000-memory.dmp

Download

memory/7764-4218-0x000001C9D3000000-0x000001C9D337C000-memory.dmp

Download

memory/7800-3262-0x0000029318F00000-0x000002931927C000-memory.dmp

Download

memory/7868-2848-0x000001AEDB200000-0x000001AEDB57C000-memory.dmp

Download

memory/8040-2973-0x00000203D2A00000-0x00000203D2D7C000-memory.dmp

Download

memory/8044-3191-0x000001E603000000-0x000001E60337C000-memory.dmp

Download

memory/8100-2708-0x0000021647D00000-0x000002164807C000-memory.dmp

Download

memory/8168-3896-0x00000250DA300000-0x00000250DA67C000-memory.dmp

Download

memory/8244-3894-0x0000020AAEE00000-0x0000020AAF17C000-memory.dmp

Download

memory/8272-3985-0x000001D1F1600000-0x000001D1F197C000-memory.dmp

Download

memory/8300-4041-0x000001EC78B00000-0x000001EC78E7C000-memory.dmp

Download

memory/8316-3978-0x000002836F600000-0x000002836F97C000-memory.dmp

Download

memory/8356-3983-0x0000018FADA00000-0x0000018FADD7C000-memory.dmp

Download

memory/8720-4217-0x000001F9C5100000-0x000001F9C547C000-memory.dmp

Download

memory/8776-4219-0x000001814C900000-0x000001814CC7C000-memory.dmp

Download

memory/8824-3995-0x000002180D200000-0x000002180D57C000-memory.dmp

Download

memory/8844-3977-0x0000018D03C00000-0x0000018D03F7C000-memory.dmp

Download

memory/8872-3909-0x000002DA04100000-0x000002DA0447C000-memory.dmp

Download

memory/8904-4136-0x000002AD46300000-0x000002AD4667C000-memory.dmp

Download

memory/8976-4222-0x00000186B0F80000-0x00000186B12FC000-memory.dmp

Download

memory/9076-4204-0x0000027656C00000-0x0000027656F7C000-memory.dmp

Download

memory/9092-4216-0x000001C11D100000-0x000001C11D47C000-memory.dmp

Download

memory/9108-4205-0x000002995BC00000-0x000002995BF7C000-memory.dmp

Download

memory/9204-4162-0x00000261A9C00000-0x00000261A9F7C000-memory.dmp

Download

memory/9208-4042-0x000001B459100000-0x000001B45947C000-memory.dmp

Download