hxxps://gizmodo[.]com/download/gta-vi

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
28/06/2026, 03:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://gizmodo.com/download/gta-vi
Sample260628-ejk6cse15r

Score

6^/10

discovery motw phishing

Malware Config

Signatures

Mark of the Web detected: This indicates that the page was originally saved or cloned. 1 IoCs

phishing motw

flow	ioc	pid	Process
450	https://storage.googleapis.com/script.aniview.com/ssync/62f53b2c7850d0786f227f64/ssync.html	3888	msedge.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3888	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134270927082350880"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-125073035-2952146151-721812867-1000\{84177C9C-CFF4-4E7D-8C08-80CDA7165D21}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5748	msedge.exe
5748	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 48 IoCs

pid	Process
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4072 wrote to memory of 388	4072	msedge.exe	81
PID 4072 wrote to memory of 3888	4072	msedge.exe	83
PID 4072 wrote to memory of 3800	4072	msedge.exe	84
PID 4072 wrote to memory of 3800	4072	msedge.exe	84
PID 4072 wrote to memory of 3800	4072	msedge.exe	84
PID 4072 wrote to memory of 4136	4072	msedge.exe	85
PID 4072 wrote to memory of 4136	4072	msedge.exe	85
PID 4072 wrote to memory of 2964	4072	msedge.exe	86
PID 4072 wrote to memory of 2964	4072	msedge.exe	86
PID 4072 wrote to memory of 2964	4072	msedge.exe	86
PID 4072 wrote to memory of 924	4072	msedge.exe	87
PID 4072 wrote to memory of 924	4072	msedge.exe	87
PID 4072 wrote to memory of 924	4072	msedge.exe	87
PID 4072 wrote to memory of 4076	4072	msedge.exe	89
PID 4072 wrote to memory of 3996	4072	msedge.exe	90
PID 4072 wrote to memory of 1108	4072	msedge.exe	91
PID 4072 wrote to memory of 3292	4072	msedge.exe	92
PID 4072 wrote to memory of 4076	4072	msedge.exe	89
PID 4072 wrote to memory of 4076	4072	msedge.exe	89
PID 4072 wrote to memory of 3996	4072	msedge.exe	90
PID 4072 wrote to memory of 3996	4072	msedge.exe	90
PID 4072 wrote to memory of 1108	4072	msedge.exe	91
PID 4072 wrote to memory of 1108	4072	msedge.exe	91
PID 4072 wrote to memory of 3292	4072	msedge.exe	92
PID 4072 wrote to memory of 3292	4072	msedge.exe	92
PID 4072 wrote to memory of 2148	4072	msedge.exe	95
PID 4072 wrote to memory of 2148	4072	msedge.exe	95
PID 4072 wrote to memory of 4088	4072	msedge.exe	96
PID 4072 wrote to memory of 4088	4072	msedge.exe	96
PID 4072 wrote to memory of 3912	4072	msedge.exe	97
PID 3912 wrote to memory of 4544	3912	msedge.exe	98
PID 4072 wrote to memory of 676	4072	msedge.exe	100
PID 4072 wrote to memory of 4520	4072	msedge.exe	101
PID 4072 wrote to memory of 4520	4072	msedge.exe	101
PID 4072 wrote to memory of 4520	4072	msedge.exe	101
PID 4072 wrote to memory of 4856	4072	msedge.exe	102
PID 4072 wrote to memory of 4856	4072	msedge.exe	102
PID 4072 wrote to memory of 4856	4072	msedge.exe	102
PID 4072 wrote to memory of 4844	4072	msedge.exe	103
PID 4072 wrote to memory of 4844	4072	msedge.exe	103
PID 4072 wrote to memory of 4844	4072	msedge.exe	103
PID 4072 wrote to memory of 4164	4072	msedge.exe	104
PID 4072 wrote to memory of 4164	4072	msedge.exe	104
PID 4072 wrote to memory of 4164	4072	msedge.exe	104
PID 4072 wrote to memory of 4148	4072	msedge.exe	105
PID 4072 wrote to memory of 4148	4072	msedge.exe	105
PID 4072 wrote to memory of 4148	4072	msedge.exe	105
PID 4072 wrote to memory of 2180	4072	msedge.exe	106
PID 4072 wrote to memory of 4036	4072	msedge.exe	107
PID 4072 wrote to memory of 3240	4072	msedge.exe	108
PID 4072 wrote to memory of 808	4072	msedge.exe	109
PID 4072 wrote to memory of 2180	4072	msedge.exe	106
PID 4072 wrote to memory of 2180	4072	msedge.exe	106
PID 4072 wrote to memory of 3668	4072	msedge.exe	110
PID 4072 wrote to memory of 4300	4072	msedge.exe	111
PID 4072 wrote to memory of 4036	4072	msedge.exe	107
PID 4072 wrote to memory of 4036	4072	msedge.exe	107
PID 4072 wrote to memory of 2376	4072	msedge.exe	112
PID 4072 wrote to memory of 1648	4072	msedge.exe	113
PID 4072 wrote to memory of 1372	4072	msedge.exe	114
PID 4072 wrote to memory of 3240	4072	msedge.exe	108
PID 4072 wrote to memory of 3240	4072	msedge.exe	108
PID 4072 wrote to memory of 808	4072	msedge.exe	109
PID 4072 wrote to memory of 808	4072	msedge.exe	109

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://gizmodo.com/download/gta-vi
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f0,0x7ffa7cd9c188,0x7ffa7cd9c194,0x7ffa7cd9c1a0
  2⤵
  PID:388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1800,i,15093204827125364352,3833365781041259399,524288 --field-trial-handle=2164,i,7244744294236404264,16280045716765711581,262144 --variations-seed-version --mojo-platform-channel-handle=2852 /prefetch:11
  2⤵
  - Mark of the Web detected: This indicates that the page was originally saved or cloned.
  - System Time Discovery
  PID:3888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1592,i,2613909872762843885,7926472723091419562,262144 --field-trial-handle=2164,i,7244744294236404264,16280045716765711581,262144 --variations-seed-version --mojo-platform-channel-handle=2160 /prefetch:2
  2⤵
  PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2204,i,145480365993259919,893399421007867505,524288 --field-trial-handle=2164,i,7244744294236404264,16280045716765711581,262144 --variations-seed-version --mojo-platform-channel-handle=3048 /prefetch:13
  2⤵
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,5324630821183846230,9046598961962765945,2097152 --field-trial-handle=2164,i,7244744294236404264,16280045716765711581,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,11738349334024925046,10612407870899814166,2097152 --field-trial-handle=2164,i,7244744294236404264,16280045716765711581,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4128,i,11956333949508387144,17728829708152125240,2097152 --field-trial-handle=2164,i,7244744294236404264,16280045716765711581,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:1
  2⤵
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4160,i,13792412393891763925,7404066364146287799,2097152 --field-trial-handle=2164,i,7244744294236404264,16280045716765711581,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:9
  2⤵
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4192,i,17317442281722658181,5312006673789535197,2097152 --field-trial-handle=2164,i,7244744294236404264,16280045716765711581,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:1
  2⤵
  PID:1108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4236,i,12094323336561134032,12779364730924756780,2097152 --field-trial-handle=2164,i,7244744294236404264,16280045716765711581,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:9
  2⤵
  PID:3292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4520,i,7498969107320062144,11893981077133141928,524288 --field-trial-handle=2164,i,7244744294236404264,16280045716765711581,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:14
  2⤵
  PID:2148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4508,i,14755969869096472832,2258657448871198413,524288 --field-trial-handle=2164,i,7244744294236404264,16280045716765711581,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:14
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6116,i,16233802624242268583,18139363695203560783,524288 --field-trial-handle=2164,i,7244744294236404264,16280045716765711581,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3912
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6224,i,14064174604772117862,9414511653880642666,524288 --field-trial-handle=2164,i,7244744294236404264,16280045716765711581,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:14
  2⤵
  PID:1688
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6224,i,14064174604772117862,9414511653880642666,524288 --field-trial-handle=2164,i,7244744294236404264,16280045716765711581,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:14
  2⤵
  PID:676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6576,i,2679623054913528338,13749955891193924506,2097152 --field-trial-handle=2164,i,7244744294236404264,16280045716765711581,262144 --variations-seed-version --mojo-platform-channel-handle=6568 /prefetch:1
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6404,i,9550993511023988561,1828175000779495215,2097152 --field-trial-handle=2164,i,7244744294236404264,16280045716765711581,262144 --variations-seed-version --mojo-platform-channel-handle=6668 /prefetch:1
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6856,i,5572631141997645195,4494046165964903329,2097152 --field-trial-handle=2164,i,7244744294236404264,16280045716765711581,262144 --variations-seed-version --mojo-platform-channel-handle=6896 /prefetch:1
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6860,i,4981924807724821739,3101595396062613311,2097152 --field-trial-handle=2164,i,7244744294236404264,16280045716765711581,262144 --variations-seed-version --mojo-platform-channel-handle=6848 /prefetch:1
  2⤵
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=7036,i,11702283416256793499,1564682045875943868,2097152 --field-trial-handle=2164,i,7244744294236404264,16280045716765711581,262144 --variations-seed-version --mojo-platform-channel-handle=7040 /prefetch:1
  2⤵
  PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=7328,i,2791237952144611543,4054944868895587634,2097152 --field-trial-handle=2164,i,7244744294236404264,16280045716765711581,262144 --variations-seed-version --mojo-platform-channel-handle=7484 /prefetch:1
  2⤵
  PID:2180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=7340,i,17154845612148650358,6149315778004671153,2097152 --field-trial-handle=2164,i,7244744294236404264,16280045716765711581,262144 --variations-seed-version --mojo-platform-channel-handle=7512 /prefetch:1
  2⤵
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7352,i,15576708876391823705,12521710855673135909,2097152 --field-trial-handle=2164,i,7244744294236404264,16280045716765711581,262144 --variations-seed-version --mojo-platform-channel-handle=7572 /prefetch:1
  2⤵
  PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7372,i,10886013514482124555,13972837055792715508,2097152 --field-trial-handle=2164,i,7244744294236404264,16280045716765711581,262144 --variations-seed-version --mojo-platform-channel-handle=7628 /prefetch:1
  2⤵
  PID:808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7384,i,10717896594623550574,1150053849005072783,2097152 --field-trial-handle=2164,i,7244744294236404264,16280045716765711581,262144 --variations-seed-version --mojo-platform-channel-handle=7568 /prefetch:1
  2⤵
  PID:3668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7416,i,9891464551107451880,8393101922927147499,2097152 --field-trial-handle=2164,i,7244744294236404264,16280045716765711581,262144 --variations-seed-version --mojo-platform-channel-handle=7620 /prefetch:1
  2⤵
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7420,i,2695771460419534113,10220785821997871222,2097152 --field-trial-handle=2164,i,7244744294236404264,16280045716765711581,262144 --variations-seed-version --mojo-platform-channel-handle=7664 /prefetch:1
  2⤵
  PID:2376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7396,i,911883648684635973,6080077739569226561,2097152 --field-trial-handle=2164,i,7244744294236404264,16280045716765711581,262144 --variations-seed-version --mojo-platform-channel-handle=7608 /prefetch:1
  2⤵
  PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7432,i,8851455102216161443,11736424362718109528,2097152 --field-trial-handle=2164,i,7244744294236404264,16280045716765711581,262144 --variations-seed-version --mojo-platform-channel-handle=7684 /prefetch:1
  2⤵
  PID:1372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=8188,i,11817718865396555014,2874475304555640767,2097152 --field-trial-handle=2164,i,7244744294236404264,16280045716765711581,262144 --variations-seed-version --mojo-platform-channel-handle=8652 /prefetch:1
  2⤵
  PID:1832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=8960,i,9961061860977202097,10274305826598565482,2097152 --field-trial-handle=2164,i,7244744294236404264,16280045716765711581,262144 --variations-seed-version --mojo-platform-channel-handle=8388 /prefetch:1
  2⤵
  PID:5244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=9196,i,11451358331562344212,2836280856703568526,2097152 --field-trial-handle=2164,i,7244744294236404264,16280045716765711581,262144 --variations-seed-version --mojo-platform-channel-handle=9156 /prefetch:1
  2⤵
  PID:5324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=9160,i,10233234539714509903,16749188699672275873,2097152 --field-trial-handle=2164,i,7244744294236404264,16280045716765711581,262144 --variations-seed-version --mojo-platform-channel-handle=9124 /prefetch:1
  2⤵
  PID:5332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=8992,i,3315641896084317107,11487498402682639114,2097152 --field-trial-handle=2164,i,7244744294236404264,16280045716765711581,262144 --variations-seed-version --mojo-platform-channel-handle=9268 /prefetch:1
  2⤵
  PID:5340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=7348,i,13381123433680545664,13948153836141891227,2097152 --field-trial-handle=2164,i,7244744294236404264,16280045716765711581,262144 --variations-seed-version --mojo-platform-channel-handle=9264 /prefetch:1
  2⤵
  PID:5348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=9220,i,11045553850557393547,12808711901253104338,2097152 --field-trial-handle=2164,i,7244744294236404264,16280045716765711581,262144 --variations-seed-version --mojo-platform-channel-handle=9408 /prefetch:1
  2⤵
  PID:5356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=8292,i,13825817782859184121,17116328855814455047,2097152 --field-trial-handle=2164,i,7244744294236404264,16280045716765711581,262144 --variations-seed-version --mojo-platform-channel-handle=9852 /prefetch:1
  2⤵
  PID:5660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=10012,i,11802549628842052277,6861090915985039778,2097152 --field-trial-handle=2164,i,7244744294236404264,16280045716765711581,262144 --variations-seed-version --mojo-platform-channel-handle=10056 /prefetch:1
  2⤵
  PID:5672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=10028,i,1258336428362574428,3767827620626405443,2097152 --field-trial-handle=2164,i,7244744294236404264,16280045716765711581,262144 --variations-seed-version --mojo-platform-channel-handle=10060 /prefetch:1
  2⤵
  PID:5680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=10036,i,13742468778927724566,6970302341120784882,2097152 --field-trial-handle=2164,i,7244744294236404264,16280045716765711581,262144 --variations-seed-version --mojo-platform-channel-handle=10072 /prefetch:1
  2⤵
  PID:5688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=10512,i,17321722844944256895,2981271637720628257,2097152 --field-trial-handle=2164,i,7244744294236404264,16280045716765711581,262144 --variations-seed-version --mojo-platform-channel-handle=10456 /prefetch:1
  2⤵
  PID:5724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=10528,i,15700780799773079578,11078678786186539211,2097152 --field-trial-handle=2164,i,7244744294236404264,16280045716765711581,262144 --variations-seed-version --mojo-platform-channel-handle=10580 /prefetch:1
  2⤵
  PID:5740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=10540,i,1841425029542847909,10937536003939873542,2097152 --field-trial-handle=2164,i,7244744294236404264,16280045716765711581,262144 --variations-seed-version --mojo-platform-channel-handle=10588 /prefetch:1
  2⤵
  PID:5748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=6740,i,9979632350943003901,9895473409499815534,2097152 --field-trial-handle=2164,i,7244744294236404264,16280045716765711581,262144 --variations-seed-version --mojo-platform-channel-handle=10568 /prefetch:1
  2⤵
  PID:3880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=7220,i,10033817850565960281,1535189807397368658,2097152 --field-trial-handle=2164,i,7244744294236404264,16280045716765711581,262144 --variations-seed-version --mojo-platform-channel-handle=9264 /prefetch:1
  2⤵
  PID:5528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=6900,i,218842917735407502,13169335004827065360,2097152 --field-trial-handle=2164,i,7244744294236404264,16280045716765711581,262144 --variations-seed-version --mojo-platform-channel-handle=6896 /prefetch:1
  2⤵
  PID:5972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=8772,i,8115787156483458490,11014307523713953477,2097152 --field-trial-handle=2164,i,7244744294236404264,16280045716765711581,262144 --variations-seed-version --mojo-platform-channel-handle=8928 /prefetch:1
  2⤵
  PID:5760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=10988,i,1944662572531708670,6641630992980824241,2097152 --field-trial-handle=2164,i,7244744294236404264,16280045716765711581,262144 --variations-seed-version --mojo-platform-channel-handle=10596 /prefetch:1
  2⤵
  PID:908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=10636,i,3384215502176731302,17959516119871847763,2097152 --field-trial-handle=2164,i,7244744294236404264,16280045716765711581,262144 --variations-seed-version --mojo-platform-channel-handle=9008 /prefetch:1
  2⤵
  PID:412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=9316,i,3247926990208341600,6749278932085775125,2097152 --field-trial-handle=2164,i,7244744294236404264,16280045716765711581,262144 --variations-seed-version --mojo-platform-channel-handle=7728 /prefetch:1
  2⤵
  PID:5872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=9340,i,4763808407020472217,13009156479576559551,2097152 --field-trial-handle=2164,i,7244744294236404264,16280045716765711581,262144 --variations-seed-version --mojo-platform-channel-handle=9300 /prefetch:1
  2⤵
  PID:6036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=7248,i,13886675539632848308,1706050260563101445,2097152 --field-trial-handle=2164,i,7244744294236404264,16280045716765711581,262144 --variations-seed-version --mojo-platform-channel-handle=9356 /prefetch:1
  2⤵
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=7236,i,11067434352535666076,13344346467688972681,2097152 --field-trial-handle=2164,i,7244744294236404264,16280045716765711581,262144 --variations-seed-version --mojo-platform-channel-handle=9128 /prefetch:1
  2⤵
  PID:5372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=6688,i,4606036970549862962,14772417028420355079,2097152 --field-trial-handle=2164,i,7244744294236404264,16280045716765711581,262144 --variations-seed-version --mojo-platform-channel-handle=7844 /prefetch:1
  2⤵
  PID:5224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --metrics-shmem-handle=7176,i,7938751516924914123,13023240700895427541,2097152 --field-trial-handle=2164,i,7244744294236404264,16280045716765711581,262144 --variations-seed-version --mojo-platform-channel-handle=7184 /prefetch:1
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8404,i,5649776419198304957,12446200961947961585,524288 --field-trial-handle=2164,i,7244744294236404264,16280045716765711581,262144 --variations-seed-version --mojo-platform-channel-handle=7408 /prefetch:14
  2⤵
  PID:4128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8416,i,3708204849199770436,7257532897672604511,524288 --field-trial-handle=2164,i,7244744294236404264,16280045716765711581,262144 --variations-seed-version --mojo-platform-channel-handle=10472 /prefetch:14
  2⤵
  PID:272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8452,i,1116463407482865792,9780238078685610623,524288 --field-trial-handle=2164,i,7244744294236404264,16280045716765711581,262144 --variations-seed-version --mojo-platform-channel-handle=8056 /prefetch:14
  2⤵
  PID:2604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --always-read-main-dll --metrics-shmem-handle=8708,i,13217911709272760548,17095039175483637960,2097152 --field-trial-handle=2164,i,7244744294236404264,16280045716765711581,262144 --variations-seed-version --mojo-platform-channel-handle=7812 /prefetch:1
  2⤵
  PID:5700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5368,i,8259307743555614689,4652657376020142367,524288 --field-trial-handle=2164,i,7244744294236404264,16280045716765711581,262144 --variations-seed-version --mojo-platform-channel-handle=7160 /prefetch:14
  2⤵
  PID:2376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8404,i,3732728036197883993,6922307348043513586,524288 --field-trial-handle=2164,i,7244744294236404264,16280045716765711581,262144 --variations-seed-version --mojo-platform-channel-handle=7640 /prefetch:14
  2⤵
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=748,i,12704652922506332801,10891660134004835482,262144 --field-trial-handle=2164,i,7244744294236404264,16280045716765711581,262144 --variations-seed-version --mojo-platform-channel-handle=6540 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5748

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2680

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 adf1ac7ef6ad2f467814611b23b5905d27bfbc301c113cc0f42faa887b0cf867
MD5 43cfaffeaf5c46b9eadeebb1347c22e7
SHA1 d96f3ed6add4b5fd08b00be076bd99ac8c96b6d9
SHA512 d9c942c219d1021105ade146c164fb4fff35ac9acd0e85af945085e82c7ecd2ab6e92dbb4acf30d22ebeb0b2a7a9788fcf0f1d01f75408a2ec7523fc3c62a603
TLSH
T1C7D02B2177CCD800C0E30031C018931041A800C4642BCA45B0B0842D580B030B3CC047
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9268c81dd8afa6fbdc34d051a638b4dce94ab92618da951ddb0bc7dc51433fef
MD5 861a6fce0d87692d2b4a1303e56f1a25
SHA1 7a516cdc72a0f568ccf931e78fc08ead146d8e52
SHA512 9a9d6e902af9bba26e1ef6ceb054ca9a19ea9e7ea145a221d8fbe629d7b20cfc76340fd3acdcccde9af66986da13da0c4d8c84cd8ce7106f1212135992e9ce44
TLSH
T166D02B21B7CCD400C0E30031C018931041A800C4642B8944B0B0842D680B030B3CC047
MD5 SHA1 SHA512 TLSH

Submit Download

6ccff42a-20e2-46aa-9bae-9a4b881ac41d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6ccff42a-20e2-46aa-9bae-9a4b881ac41d.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

9b2d0131-c1aa-42ab-be9d-b7ceeb9e05f4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9b2d0131-c1aa-42ab-be9d-b7ceeb9e05f4.tmp
Size 13KB
SHA256 60fc3a73f5c2dd628cc24c6212a23366d36ffa6fa8d225c97cc9a6b099c9cbca
MD5 c3fa2cb28042771e2661ad0abf5edda4
SHA1 014b66ed742ee9c6ec0c561961070c2f24a5f615
SHA512 b6a0a073e1da384263f5f2eeac01ea88b9ccb23d8a5fbf0ac8e7f75ee3733449e950c4bb7610b9deda2a87c7c58ce4c40a8a839b5b9f7b879c324cebc023f625
SSDEEP 192:sxZnRqAyM/jK1Ml8M8Og/fjsvEQfdpEqRY/W6+WN300To/Y0YHTxx+7Ig5TJ:sxZn1EOg/fjsvEkjy/b38/54af
TLSH
T17352F8126A3459B7CDDBD209FA41BB63D6F9157292901E44AAFCCB0C02E7BDD225381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000085

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000085
Size 29KB
SHA256 9ad71709bff5e717f8978703f0fc77605fbf3f487be619cd9d640f8f08686c71
MD5 4f4dcbe994affa0a923778ff1572f237
SHA1 1c4bc4ce554e46911efeef4a81759cacbf94ed9c
SHA512 53ee44a11db5af6965bc621e0760c520b5677568efb4ce9c0d4ffb86f51dd8482582b8e21bbc138ac2262757ae742cae35a06c0f50d995008652b3c4ff9f84f5
SSDEEP 768:gRmF6mCpSkNsqO58skS5Zo9SG5mG9IqJj:aseXViV5Zo4inJj
TLSH
T186D2F1980986B3A88DC14036AA8FC14C658CD6F7DB658DE4FD24078D2FBBB057170929
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000090

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000090
Size 22KB
SHA256 7476553a0c442bad7a88d2fddaa49acb67819516d4db4db372cff48112cd74e6
MD5 e5a1d90c4e66119b065592499d865c6d
SHA1 d26c04c242747c06b0dab83589e88c090a5e2e40
SHA512 09ababbf05ee82dde234c956e5d733eb0d1ce19e96f4464ba85eac1cd39fed227c2dee0e449f8c362084557fe06195bee8c08595bd957792b56fb1a225910e00
SSDEEP 384:IA2t8ns7JBRNvrczQFnCsbGSn3K6u6PqJTJ8CSpJ6l5GMoEYMKv6kUdgzhIp5WyP:I/7JC0FnCsCwuGqJTmCSI5K4amuhMVP
TLSH
T1C8B2E012B6AAB1ABBFB2435401AD1667F8389D090BB5CD652B404CD2F96332F85FF650
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009f
Size 73KB
SHA256 5f66ef35f19e1bc8bfad52e2139ad510998e759dbb99d825f7876b8c3cdbdee6
MD5 3cacf51428fa145226351f4db893235d
SHA1 e65afd58ec5d9e1aada6996d71482ddcf9f9827e
SHA512 20df0266b4f3f351d860c174140c8f8f730a97b47f4e1fcf71e28503e03a460ff6df97614e48142bb52ff71e5d4d285da3c6401330287a50d7cdfa551448d23e
SSDEEP 1536:kkCI+9iACUcDsSByHXFtZiqVU3/+hnVVtRq+1z0hpTI+AuXkx+R+jy:W9BtcDRyVt8gnVVtRq+J8TI+XUxlG
TLSH
T1AF7302753BBF4E1A45D6FCC453E344184BF578AE6D65EE9F62A3C90EE831C46C00A292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000c2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c2
Size 454KB
SHA256 ac7c9fea0303bc05eed1bedccc9a12dd1c980248a1bc54e83fd529b82392e3cc
MD5 6a74f161c75c9237bf72fe51f29f2771
SHA1 874b08d900e51098cd20bfcf377ed6d91325e0e5
SHA512 834bbc3e56f8d2b2f4aa521d3eec651f10962f1c479a3b941ee6bc89850b4ab15de9cb998b6c38542928e00cfa69a0f3c34ed76d1816e4b7e53c5681931006b7
SSDEEP 12288:DojjNgp8bXbyIlOjMC0aeukVqJ7MScUMcBsrfMpm:Do/upVpo1aeBoCEeF
TLSH
T14DA41294EFA020AFC96983F121D2C37377F52A225717938B9089B6621CC67E25F7D8D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000c7

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c7
Size 32KB
SHA256 eff9dfe4ebe815c15fa6087a8b712ccacea7a59dddcb55a5c819293252d73c32
MD5 cba69340542e691fa9e4b30334a07507
SHA1 4af443e83868d3a18fc9ad853e58eaf39bb065f7
SHA512 4f8d78c0ae8e04e27dfbcef602d3d46cdefd8f01085cc549edd35805d775065c4f78b75da617adf5f8f699a9edf7fa69db7c267917e5f9cb967e59563f905227
SSDEEP 768:wOsAPzChBrMSp8DxHnpmf3ILP1KpbjtXPgYVkutZ:lsArKDqtO8KZtXPgYXtZ
TLSH
T17AE202DF0C15679A01C371AE6A7C6024EBB3E07B3035CA1B1E764CD250B6660E5DB8BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000c8

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c8
Size 96KB
SHA256 11de5a5aa3d08f69e1db14ac9c5347b7d09b8ec8fa89a4dd48a53ac13bfc3af2
MD5 601873d8a87f7b6dc6d2be569d361b63
SHA1 90ddce036c5ac461fc0e2ad6d2549625f35fcad8
SHA512 8d0aa2ed004fd07ff6c8cf0b2f96bf2addadcc481e811d3070d206a2862ebd154f857021dc0186eff184667914b6e23239b3886e18521bbe109e9c70df09ea1e
SSDEEP 3072:TY9ViJr6dK5Zi9YhM9Dic9o4EKgg3Wn41QA2kCISlb5:EeV6dmIx9lSg3c4FCIgl
TLSH
T18DA3020ABF4FE1AE46B742548AB607CE7A906241D0369997871107CEB1F78FE5C183D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000c9

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c9
Size 67KB
SHA256 9181129b7f21ceae21a9074758772987bc3847786152978513e297a35ff5c09d
MD5 7b79a79d550f942d8363cf61a7753d0a
SHA1 d7eb775e1c44f0b687ee5ac35e97f50c97073859
SHA512 06a9134a5a5db0162d279f0f7539386436e5627ff11bd44477ea15a53202d0a8f7494d72b0f7c4da36a4fd504b528952765ba7a3389507e14734808356cd551a
SSDEEP 1536:Ajk25m17rpXnlvVaQM+8SJzkN9Vx41p2Q4d6R+:AjkF1nVnlVaQM+HJzUphD
TLSH
T11663026F1CBD722D55DE07B96227B878FD480243FC901A8DBED702F897AA6CA51C3244
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000ca

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ca
Size 401KB
SHA256 38033735ff4ff2ba4762f13ed6c52ff85aeceacadb2612dbf998c5bf79ce6cbc
MD5 037c3af77fa83e73e12729e3ca855f99
SHA1 d4fe4062376213d010bd4baa93331ad18b1cbde6
SHA512 0bfc554b7b318e97a1b9d733e2c436056d4d1b3c01298e2c8cb5124aa7eeda3944bb1a4c71ef3f5578584f71bb6dc61478f56437369e11392799841089ec0a0e
SSDEEP 6144:034q4Tbu7QaXFNQgG3HdOMvUnLToAKm84XBwHwX8qFFVATEvOjHs0BkQ:034qSbu7QaXzZd44LTm4RTX8qynwmkQ
TLSH
T1A294238B514BF27DA3CA4C16F643DF60F041395E8A42E9B7DCB7C84259D0AA90F1CAE1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 10KB
SHA256 b0e85c81a42b5e7f9dc8f617593f029a904c362e926d13a6d2bbdc32eb309e1d
MD5 52aa8db4e38039ae9052f6da13cce798
SHA1 15d7fc6a1e2f8c3080be24b8b57ec484c47a05fa
SHA512 6c237aedf0e833c58b2538f286c65d143a8f297a4b2712fc71dadf1b22eefdbbc3c736729353f7028f21cfce9d449c9002755ed70af1115c218a353d3a0c13ba
SSDEEP 192:0+Z0C+yT7qk0m8ErpHBT59lJZVTpfAnO72RVbjhsP8PnuOUvempYZw7LtftjURtm:0+ZRFT7qBm8ErpHBT59lJZ9pfAnC2RVC
TLSH
T10E22FD108DE228A9DB035EB1C6D61F83F775415437AB1F2661F4F43DA0A72938B728A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe593fbe.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe593fbe.TMP
Size 3KB
SHA256 b109acc7afe0abd66c4a0461a7770417a8009e01d87cd94fd8c5203296134804
MD5 57f36e04932e5baba8a72b8052641b64
SHA1 d6fcdb19d9c8b18d476afbb3c241ad40c59de22b
SHA512 49f3ad3af9d26214f61e79c162cdbb21d2080015ffa3ebacae841012e64b9716cea530406088ca5efb38a34a1b6a301660dbf22a13052b4fcb9cff397487ef43
TLSH
T137712825CEF2B871E35101F1D4A39BC378B584B9AAF31EA121F4847D22A7A118F26474
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 41KB
SHA256 45f88767653c446a37668113d2f3a129beb89d20a63020fafa1872f16114790f
MD5 50c25c294ab83600b03831c02663e573
SHA1 e55198d05959ec42d01415554370ef9c2611f616
SHA512 bd7d360702b40e94eed69c7da328c279559758a8a8ff7a68bf226dadb1e660d1a8f4ccae680d6934fcc2a81df8432188b921f3fd19a72a8e85a1b4c1ac31734b
SSDEEP 384:DrQC39eVp7cFgq6fBeFJL+Be5oGjq/TeC0koVT7fztQrjicJdx4bOQcnfEY6VMF+:+KkHDLMOQXvjxbVPF+LcvvAe4e
TLSH
T16313EBF787F4426DD81262F56B182E1FCE6D1825432C38368AE9EF0E93F5572E24164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 fc46e94e03af06fab1b2c8d1249e8cc6f5dcd3d9eb330016ce5aba2345dba30e
MD5 70eb578b95f2f2b4c41aff494a2b11de
SHA1 a30804f578433072b32facc0f9e0469ae9134ad5
SHA512 cabb697034543f4ea4b216a2406b397dab269b13c0bcb74bf2ddd14f0c4af502510dc38d2e68f81a050db036a8da558b773ff055b8cd70422c8cea772aa41173
SSDEEP 192:sxZXQUnHRqAyM/jK1Ml8M8Og/fjsvEQGQbM+dpj1qRY/W6+WN300ToqMz/Y0YITQ:sxZbnH1EOg/fjsvEVNOUy/b38R/5laf
TLSH
T16772E802763409BBDDEBD219F902BB63D6F815A696944E44A5FC8B0C05E7BDE2213C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 ff6888728006257472a8fad3321bafa59b7d74359e4511ab4cb7f9fc498f82b7
MD5 94c486e4dfb22500be38134c36353351
SHA1 5dc5e298380f9dc297e481c97700149147761088
SHA512 898c21c088f33ad5dcf9b59e9e853dd3279975d5423d199bafb7662c021b39c0eb5a63232390f3a2e782550194fc7ca30438c21b7238e52dc673d1e836ecf470
SSDEEP 192:sxZnRqAyM/jK1Ml8MFg/fjsVpyhdpEn/W6+WNUTo/Y0YwPxx+7IgrJ:sxZn1dg/fjsVp8y/bv/55a9
TLSH
T1755208126A345977CCDBD209FA55BF63D6F5057292940E44AAFCCA1C01E7BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 9e53d6d102ff012cd54d526dd4f3eac2fc07083b7ad1a9a0b033d888d7263eb1
MD5 1145d5ec9d044c0969862798c0796002
SHA1 2e551f1e0c06be0a364f9734523d03ceeea76ddd
SHA512 14a85e641c74f1ec27973423f4f5ccbea4ade23099cb77465c7244d7aa16f9859d3189f1f0086644f960715884426fa1e9043fd5142b851e3c0342ed95aeac6f
SSDEEP 192:sxZXQUnHRqAyM/jK1Ml8UQl8Og/fjsvEQGQbM+dp91qRY/W6+WN300ToqMz/Y0Y+:sxZbnH1qeOg/fjsvEVNOOy/b38R/5eaf
TLSH
T12472E802753409B7DDEBD219F902BB63E6F814A696944E44A9FC8B0C05E7BDE2213C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 35a356897e9e0c8597d1ca2f42c602fc672686006ff5447fe5cafef033f0aff2
MD5 be4ea90b3cd381380c4c188bf1b1e779
SHA1 253b333b50f91b2653c9d78ea88cf8bde8be0267
SHA512 128718a8c543bf3b9e8945e4d8ddf44f5def467f7d0da9a7dab003e22deef964811be542e9ac660c4a3c0b391f68a3f266ad8adb618a8385192179e85d496307
SSDEEP 768:IJl1j83r2pmWRmeKQBC8F1+UoAYDCx9Tuqh0VfUC9xbog/OV33ALl/C80/17rocc:IJl1j83r2pmWRmeKQBCu1jaK3ALpCN/k
TLSH
T1BAE22C3B680CC77E4F844E9DEC266F966ED801CBAA684D5447FA494C03C73EB512A49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b38f76fc-0bdb-4056-95ec-6b53c77ee934\index-dir\the-real-index
Size 3KB
SHA256 62f31f62379085fa27bbb9a6418f514ceff569473c947a4f2b1bdc6edb63e55c
MD5 24a9d2db8cbd92ef602798176e2efc44
SHA1 d2fea4e44e8e93eb9dcb2d820e9911d3c89c8b65
SHA512 fc8c72ffb5f6f982e87e4d510b1cba93f9a257f3e112e67bb79fec47c95e81ee8acdd662d7d45d8c54eb15b703a8229d7057f308874e3ffd36402572be4a8c7a
TLSH
T1D851B55D8C871B1BED68567314B6148823B934DC1B888F273DBC5138B8876291864368
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\db051936-6c70-47c1-b269-fb19c118fa19\index-dir\the-real-index
Size 72B
SHA256 b4d5bb3f18801802271f0406af990dc2c1c42ff006c4c93cfaf58233bbc065bc
MD5 d13e901d5d65849a356e1d7461050a03
SHA1 0848cdc9f02e5d9b4c03ee63703b4a445d5c20ab
SHA512 3d332811877e162f5055a1802cebc25cf065204a76b7de2de1fce02742e5b920bf0e3106bc9416e9f1f43185e93b9f89c7eab079b7a0d15d75f323c9a3fc2ff9
TLSH
T1CDA0022402947001C10312B325D64571A3249E95534153655290508CCCF078A699618C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\db051936-6c70-47c1-b269-fb19c118fa19\index-dir\the-real-index
Size 72B
SHA256 a556f43f536e37f713fca5aaa960fb23f1b78934d20e29156df4629ab2196bfb
MD5 1fa562bfe3826fd885e297c0a0a40bd4
SHA1 34a5244be6ffc7337ab85844ff52fdb63289880a
SHA512 3add00f86670abe596dfa4e3a6caff8651546f097c411ea93b23b7587b8b2e771b549a1db9a7204c31357c0f124ff6c070d00fe5fa37b0b4144775dc8a6d7440
TLSH
T144A002140790464BC11A63B115DF13817300C8305101671B59AD2059CC515508D4601C
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 aa6a0166462c6813e6ce19fa878adabfe6a4c19432e5de20d7fe82f214591ab1
MD5 925b3775bd1a129c365ae5ab767e56d1
SHA1 3546fa4f22ff0bd1d58ffca12cab78f32417d302
SHA512 cc883bd39e3fc13138016ecfe43faeab2d25d805555529770a024a1019ca8df04625c656cbc5d5786ba5a65102d666b6e94675594a2655cfd948e5aba4b31a5e
TLSH
T199E068F32DAB9C24ACAF97D20030805001493904C904BC8F21AB87832171350201AD31
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\c7deaef63ee3761df78e4009d08daf305034a541\ef3599ff-d9a5-45b5-ab28-aef3b2a158e9\index-dir\the-real-index
Size 72B
SHA256 008ce1945c7fbe238a31ec8d7a46612d77a18a731daf1fcd2735065f3c6e3d37
MD5 e58d930b90b84b28afb6d536f81e6c81
SHA1 b4d2a6ff0f3e8ed6aa012ed28b13b67a6877560d
SHA512 ad73cf798b3cc4e38a94c55670233cb0c227eb056cbaba76a5663ab679af797e1cdb9f540b602ef4bc19eaee2d5fd4084e376f791470b327a027cdb8765015b8
TLSH
T1A4A0022043965CC6CC5052B0521127C462505C16C0594A2162B514999E70CC2C902001
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58af65.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\c7deaef63ee3761df78e4009d08daf305034a541\ef3599ff-d9a5-45b5-ab28-aef3b2a158e9\index-dir\the-real-index~RFe58af65.TMP
Size 48B
SHA256 353e2aa510f2e5efb384e65732b46f6644513fca8965a508b9d38f9e980a8c4a
MD5 8ebbee17886a598d0efde821afa631b1
SHA1 a257724ab7cafff8c215dad35c223eb5615a829c
SHA512 996f4fc3c388917d60810f85f61614a85a7f25ba6358c389aa42e0d22ec3e66323112689a2fd9b165119be149f82be339eb939e4a2c409f984bd36c3f0104afa
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\c7deaef63ee3761df78e4009d08daf305034a541\index.txt
Size 145B
SHA256 c2f2e7c122e1bd464e109f33fef4ab09143530af89f93d8932db36868e813ae7
MD5 1226d060a539b704975d938fdf704c89
SHA1 0f22a1f7e8af9f0361ae547212bf97fb9e173f94
SHA512 5e21ac1cde878c8d154cdfb55a2cb86fd02a3b7c599eac84409015d529f026dfc1483ef0f7ab94b4831803dc1bee357abfb291f8cd25e3b3dbb7a893f0899211
TLSH
T1CBC02BF3003405400FF0C0C07820F78E8B531B8E82D5BAC05C33640180060134889FDB
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe58ea6b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\c7deaef63ee3761df78e4009d08daf305034a541\index.txt~RFe58ea6b.TMP
Size 149B
SHA256 aaf99efe3b3d57ebb6c4014247492ad3bbd037d98debd34d3ea97b04d74893fd
MD5 76b60bcd38231bcb655178bc18f995b8
SHA1 b4099183d62a3efe56f76d77be3af29a80fd9556
SHA512 2251b0c9a6ae1557813c6c281e26272eac3b521e03b5a775f28ebece7d5846c61402005aa55a46f0b81156fa9852fd20ed7778eeea03b59d9f8ab9c2e68b2bdc
TLSH
T1F8C09BF7117445450FA1D4C0B831B78D9B531F8D95C5B6C05D3379419532017999DFDA
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 647db3cded207aea00918a75886fb342c3f0aae3daf3542a4a3fb2ba7b645edf
MD5 8e4d4916295ba632e2078d572600de56
SHA1 c04c77fd104d589a67a3902ff9962ed572193a90
SHA512 52a68caf4468481087ce9f6f50820cbb240d124884156e638a4001c018c4d9ba9df3e3a800e6d5d1cb98676aa52c12ee515031d3131db74bac90f0533f1b21d0
TLSH
T189A00291DA9A0941F0210270F84601C46324CE10AB09227342B45095B9526418322414
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe592cd3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe592cd3.TMP
Size 48B
SHA256 ec615470c94943b7a1ff6ae6e1e1c085f1461035da34ebb478fb88f8abf34f7d
MD5 6f5302e81b43b1c70d96314fa46b6d43
SHA1 95eb98a63cf7b565b937a88c6cac63acff166481
SHA512 ad4a97a4344861d158711dbe369395d71121f4088cad0668b925457d638042745991e90fe78a90355d5fa861ee44cdf27f7ff4881443c0a7425d0daafc2b5caa
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 312B
SHA256 c4f047f4cc7d187b53b5744ec8b2cbfb68ac7905a6d544d0b89cd37efbbf6844
MD5 adf1c618eff0abfe68a96183df8e1d6c
SHA1 c645eb4503761a08e8634f2cd5b76f2d8206ee7c
SHA512 e7095ea11d8674d65c6a9c439d484e62d3541f99c8fde8a3a205c2bf5b248bad30011a0067517e9918d51415b3c0c68c6a7c4e4336cf98a26d45fa5dadafb1c6
TLSH
T15EE023B4D951482FC8545EF540D188D53561BC1493A1568DB4C14454215D373B522C01
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 0700710aff0051c40b1b96550387ab4716693a93e96dc740bd5867794dd15198
MD5 ab5f0d0b0a9b724839a71355f8f7654c
SHA1 d2a66a32c76d5132422f75310090af6e4b453d8b
SHA512 6e18190fd2d6e88f471e468c4e56a056f339b53dcd7544f01fb5eb2a9b35fda9e5d824c586d0e4e37ee45b96ef00016bd8865850aad13c7bd1c79b82745a3a8f
TLSH
T138A0023129949111C4560E7131D181553258AC200289529660D428A6886C251D645600
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 02e80f1ea61acde3f8eaf9a3eee621b19b7f3e122fec0591e4fd31e8299b3fdd
MD5 1a76b7a87cf1825d7a0f23120f663d87
SHA1 99c47608135e63cde119e4ab5cd10847d5e3606a
SHA512 573646e9948d5b504ddb7205342211faed2727fbf28798f0e0b73e6e60e87e8760ba0f90a5fee850c639792fb05e1acf9e04c441e14c815e9d9c85e2d3add061
SSDEEP 96:KkUgKtemKaUKP6GqgQK1CSEx+NhfTHMvDUX15MK9Z1HMRRhUvSQ7EQySl:6vvDnvEx+NhfTHQDUl5FZ1HwRhUvJ
TLSH
T1A2C1554230BB02413D3E6A08A2B5872A4B8275633529E56F3FA940F54E67E340EFD5ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5941a3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5941a3.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 a5186c1e4aa3942d8d0b1e55b4e8c427c8f35392487acf578a2ab558b76b59d6
MD5 43f52b1ac281cf8c602d610905d6ba5e
SHA1 061493073d2d403187061fb6869e0d9fb2301fe8
SHA512 31a3eecf7341e7a6206efaf229ff9047be8f782c9f50a1cbe8ce1b6caa92ca38d517ff06a488f82ff27655d3983a7a8e2caa0dfd87b81cc4d9f7eeeed19d734a
SSDEEP 384:EtNn/s3n9Sf8NUU6ZsENHunRg6BgX532E8mdH2EX5XVmn15wbAjEO8Gya:Ej+9U9byn+fF5XVmn12bfZ7a
TLSH
T1E9926C32AC385C671ED3D589B44632279FB884AB97C82F54D5FC5F0D02EA39C135AD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 831dea08c88bb78a35707838b3a987cdcd9e71e7d561c9a775506fcba41cc8af
MD5 1d3ef5a206f0423fcc81d7e0fa7ea247
SHA1 85e5ffe8fa2b466c9abfdf3acd8f6a887df0d3bd
SHA512 45f8f4d10e7da3035a5715567e3ed1b8c81073e542f8f146fd39b9ba0e3d7d865ee7e9433565dc490302ce0f92dca098a23a79cdd92c238cdb6f732118b76edb
SSDEEP 384:miF1tNn/s3n9SE8NV8TUNTUlIl0T2sENHunRggK2gX532E8mdH2EX5iVmn15wbAJ:NF1j+994wgLbydKhfF5iVmn12bfZ7a
TLSH
T120C23BF258D78836DA9E8747B77D2D168EBCC067B5842A50B3A84A0CCD962BFC305915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 80d55fef5a10ed705cc567c60a975381ae3611cf3629cc5b8c28e77e75093675
MD5 95984188ba2ab59bbbd32c721f26c573
SHA1 0b37d2854532b1c01a512a0be9f5c69551d0646a
SHA512 aeb6dd41fc7ee6f24ae57ad83b60a5445daa8382f83f6ed25bd4eade62e78f21e8ad3bcaec609466836314aff14977804e177041114bfcfc9a67d444bd188302
SSDEEP 384:qtNn/s3n9Sf8NUU0T2sENHunRgVK2gX532E8mdH2EX5XVmn15wbAjEO8Gya:qj+9U2byAKhfF5XVmn12bfZ7a
TLSH
T1D9927C32AC385C671ED3D589B54632279FB840AB96C82F54D5FC5F0D02EB39C135AD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 46e3d0d709c3959895636f7a76db14b061895093ddf6a4622b926865aadf672e
MD5 d9cf9f51f74f5227237288d6c490c68e
SHA1 2eacf1a96ab0fd1f0ab566f5c12710dcde9c3cc2
SHA512 ee1fa42b05bcd2d27d276a4691cc6ae0a5647deb4bf456574afbd5b2ef2fd5066651e4621c6a6cb3dc888f6eb2d40a276b3a89cfedded5acd0b82d3e8b3bdac3
SSDEEP 192:6GNO6i5fQmiUyrdpO7X5zPr2Ujzormd8o2oajGrzU6:6GNO62hojO7X532E8mdH2dkzU6
TLSH
T18B02E835B868AC778FE39E46B48637175FE4116B9A952F80DAF81B1C009768C1346827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b8f755f64acf1239fd7442502d0bb358f40eb0a93941f6b1fa6e76cd767bf56a
MD5 dac5a9de5303ea5723355ca402ef92de
SHA1 c1cfde986f3694f3804c3e21a66962863c714427
SHA512 a98038363e0ebdc662c38dca1ca5f3a918fbc069626f9ac332c6ecefbc246746ca4311e83b53880b9d457c9e88d568fa2a65dfbea49f5a574b82c0977606f460
SSDEEP 192:LGNu6i5xQmiUyvpz7X5zPr2Ujzormd8o2EX5roTnvGQYqDU6:LGNu62PAz7X532E8mdH2EX5CVU6
TLSH
T15E120A32B878EC6B5ED2E595B08232139EE5416BDA897F80D5FC2B1C01DF69C134AC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 c04626f176ab952f39e303a72d348f4a9d67d57165e2196ce81f30be2d3ec666
MD5 53d22f2fe2b110f9fe59eaf7fe6fe333
SHA1 0f11d26f161a6f1ccf6102065a92dbef63b8920d
SHA512 a007e452104b3519c8c821a08349ebea4e3500910bae31e3ee85d78fabeb50fa1f383989750342d4b4d6271b9ccf602678733b4b544d9f3fcbf8ac701f0d2ac6
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 cacbf7a494efaedcc79486094c79ace6e40c2cde296730e80c641d45da4aa54c
MD5 74012c6d3e88ed89a7b320c170f995ab
SHA1 d727bb147e1b51438418edc67583863c3e2cd185
SHA512 d3c6da541ffac44c7b22843b4c51dcfa50df0efcbab5fcc72548ed9cc90cbf41e44b7cdc451a4cd0736d03df0af84ccf5065b6ae2fdeca1d2879ad76abee2eb4
TLSH
T171E00103E74240B8C42C02B0451317292B92D86510E1035B5D1411842D222462E75EA1
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe58aae1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58aae1.TMP
Size 392B
SHA256 db76bcd023c6fea13dab4417070040c04fbd37f92c1b74e2212465c0439c2897
MD5 c5135e1d575c4b65aaaed9111028b959
SHA1 9cb360718d6be633c74f3c45b2a0cd1135f35dce
SHA512 c5274cc058255a86d11d56408db0685aa56816b1bc8aba8ba2aa3e377c85f124a4d583b4f1071f99f12dbeaaa173e7a2d9d1b24f502fecd56730401c2d75e44e
MD5 SHA1 SHA512

Submit Download

f23930d6-ca4f-42dd-9a78-7e422904f2d4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\f23930d6-ca4f-42dd-9a78-7e422904f2d4.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

ccba5a5986c77e43.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Size 8KB
SHA256 8d90ea9aaf0576a30eb327b4b9a0da93061f5c8f914c025bfbaf7dea94f26606
MD5 64cb0e61bcad44f1d792a79e21ba7b28
SHA1 fa2f5dacb18e0652786b3031657913cc2927dfab
SHA512 94f666d65e8ccea8a3293773c637b22bc418a07cbebde8257ba1087beebb9b4efadf89e4f3e082d574d3611c43f9f551de23420df7475e215f0eb0fadced2aca
SSDEEP 96:xRkJcOTwKJ11TkJcONwSfeNkJrukAMkJnIud:MAF5CBIE
TLSH
T1E10211919BE62553F2FBDAB169B3A341AF36FD018E14C91E814442490C32F05EE79BB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download