hxxps://docs[.]google[.]com/document/d/1EFUS6sZak1JZXtwkiO64MmZkCkcKsUof3qtnA_EsTqQ/edit?tab=t[.]0

Resubmissions

08/07/2026, 17:15

260708-vstrvsev3z8

08/07/2026, 16:48

260708-va698scx3m4

Analysis

user interaction
yes
max time kernel
678s
max time network
677s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
08/07/2026, 17:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://docs.google.com/document/d/1EFUS6sZak1JZXtwkiO64MmZkCkcKsUof3qtnA_EsTqQ/edit?tab=t.0
Sample260708-vstrvsev3z

Score

8^/10

discovery

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
294	3568	powershell.exe
297	3568	powershell.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
290	raw.githubusercontent.com
288	raw.githubusercontent.com
289	raw.githubusercontent.com

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setupact.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	UserOOBEBroker.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileCoAuth.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2312	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	WinStore.App.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	WinStore.App.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	WinStore.App.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	WinStore.App.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WinStore.App.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	WinStore.App.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	WinStore.App.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134280045587422505"	msedge.exe

Modifies registry class 29 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windowsstore_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\trust\CRLs	WinStore.App.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\MuiCache	WinStore.App.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windowsstore_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Disallowed	WinStore.App.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windowsstore_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Root\CRLs	WinStore.App.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windowsstore_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	WinStore.App.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windowsstore_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\trust	WinStore.App.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-226940941-599731907-2645636698-1000\{5ED38C24-635B-4A6F-88FE-50508A202008}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windowsstore_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Disallowed\CRLs	WinStore.App.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windowsstore_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Root\CTLs	WinStore.App.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windowsstore_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	WinStore.App.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windowsstore_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA\Certificates	WinStore.App.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windowsstore_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Root	WinStore.App.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windowsstore_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	WinStore.App.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windowsstore_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:"	WinStore.App.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windowsstore_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA\CRLs	WinStore.App.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windowsstore_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Disallowed\CTLs	WinStore.App.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windowsstore_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\TrustedPeople	WinStore.App.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windowsstore_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\trust\Certificates	WinStore.App.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windowsstore_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\trust\CTLs	WinStore.App.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windowsstore_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA	WinStore.App.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windowsstore_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Disallowed\Certificates	WinStore.App.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windowsstore_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA\CTLs	WinStore.App.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windowsstore_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Root\Certificates	WinStore.App.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windowsstore_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	WinStore.App.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windowsstore_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix	WinStore.App.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Install-Microsoft-Store.ps1:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
4112	msedge.exe
4112	msedge.exe
3568	powershell.exe
3568	powershell.exe
3568	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeDebugPrivilege	3568	powershell.exe
Token: SeDebugPrivilege	2380	StoreDesktopExtension.exe
Token: SeDebugPrivilege	716	WinStore.App.exe
Token: SeDebugPrivilege	716	WinStore.App.exe
Token: SeDebugPrivilege	716	WinStore.App.exe
Token: SeDebugPrivilege	716	WinStore.App.exe
Token: SeShutdownPrivilege	716	WinStore.App.exe
Token: SeCreatePagefilePrivilege	716	WinStore.App.exe
Token: SeShutdownPrivilege	716	WinStore.App.exe
Token: SeCreatePagefilePrivilege	716	WinStore.App.exe
Token: SeShutdownPrivilege	716	WinStore.App.exe
Token: SeCreatePagefilePrivilege	716	WinStore.App.exe
Token: SeShutdownPrivilege	716	WinStore.App.exe
Token: SeCreatePagefilePrivilege	716	WinStore.App.exe
Token: SeShutdownPrivilege	716	WinStore.App.exe
Token: SeCreatePagefilePrivilege	716	WinStore.App.exe
Token: SeShutdownPrivilege	716	WinStore.App.exe
Token: SeCreatePagefilePrivilege	716	WinStore.App.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe

Suspicious use of SendNotifyMessage 18 IoCs

pid	Process
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4752	OpenWith.exe
716	WinStore.App.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 3624 wrote to memory of 1956	3624	msedge.exe	80
PID 3624 wrote to memory of 2312	3624	msedge.exe	81
PID 3624 wrote to memory of 5448	3624	msedge.exe	83
PID 3624 wrote to memory of 5448	3624	msedge.exe	83
PID 3624 wrote to memory of 2200	3624	msedge.exe	82
PID 3624 wrote to memory of 2200	3624	msedge.exe	82
PID 3624 wrote to memory of 2200	3624	msedge.exe	82
PID 3624 wrote to memory of 5264	3624	msedge.exe	86
PID 3624 wrote to memory of 5264	3624	msedge.exe	86
PID 3624 wrote to memory of 5264	3624	msedge.exe	86
PID 3624 wrote to memory of 5156	3624	msedge.exe	85
PID 3624 wrote to memory of 5156	3624	msedge.exe	85
PID 3624 wrote to memory of 5156	3624	msedge.exe	85
PID 3624 wrote to memory of 4660	3624	msedge.exe	88
PID 3624 wrote to memory of 4660	3624	msedge.exe	88
PID 3624 wrote to memory of 2328	3624	msedge.exe	89
PID 3624 wrote to memory of 2328	3624	msedge.exe	89
PID 3624 wrote to memory of 6056	3624	msedge.exe	91
PID 3624 wrote to memory of 3900	3624	msedge.exe	92
PID 6056 wrote to memory of 4848	6056	msedge.exe	93
PID 3624 wrote to memory of 4056	3624	msedge.exe	96
PID 3624 wrote to memory of 6100	3624	msedge.exe	97
PID 3624 wrote to memory of 4488	3624	msedge.exe	98
PID 3624 wrote to memory of 3528	3624	msedge.exe	99
PID 3624 wrote to memory of 3528	3624	msedge.exe	99
PID 3624 wrote to memory of 4112	3624	msedge.exe	103
PID 3624 wrote to memory of 3448	3624	msedge.exe	104
PID 3624 wrote to memory of 3448	3624	msedge.exe	104
PID 3624 wrote to memory of 896	3624	msedge.exe	105
PID 3624 wrote to memory of 896	3624	msedge.exe	105
PID 3624 wrote to memory of 896	3624	msedge.exe	105
PID 3624 wrote to memory of 3904	3624	msedge.exe	106
PID 3624 wrote to memory of 3904	3624	msedge.exe	106
PID 3624 wrote to memory of 2120	3624	msedge.exe	107
PID 3624 wrote to memory of 2120	3624	msedge.exe	107
PID 3624 wrote to memory of 2120	3624	msedge.exe	107
PID 3624 wrote to memory of 5720	3624	msedge.exe	108
PID 3624 wrote to memory of 5720	3624	msedge.exe	108
PID 3624 wrote to memory of 5720	3624	msedge.exe	108
PID 3624 wrote to memory of 4432	3624	msedge.exe	109
PID 3624 wrote to memory of 4432	3624	msedge.exe	109
PID 3624 wrote to memory of 4432	3624	msedge.exe	109
PID 3624 wrote to memory of 1000	3624	msedge.exe	110
PID 3624 wrote to memory of 1000	3624	msedge.exe	110
PID 3624 wrote to memory of 1000	3624	msedge.exe	110
PID 3624 wrote to memory of 6108	3624	msedge.exe	113
PID 3624 wrote to memory of 6108	3624	msedge.exe	113
PID 3624 wrote to memory of 6108	3624	msedge.exe	113
PID 3624 wrote to memory of 2688	3624	msedge.exe	114
PID 3624 wrote to memory of 2688	3624	msedge.exe	114
PID 3624 wrote to memory of 2688	3624	msedge.exe	114
PID 3624 wrote to memory of 4336	3624	msedge.exe	115
PID 3624 wrote to memory of 4336	3624	msedge.exe	115
PID 3624 wrote to memory of 1180	3624	msedge.exe	116
PID 3624 wrote to memory of 1180	3624	msedge.exe	116
PID 3624 wrote to memory of 5212	3624	msedge.exe	117
PID 3624 wrote to memory of 5212	3624	msedge.exe	117
PID 3624 wrote to memory of 2020	3624	msedge.exe	118
PID 3624 wrote to memory of 2020	3624	msedge.exe	118
PID 3624 wrote to memory of 2020	3624	msedge.exe	118
PID 3624 wrote to memory of 5872	3624	msedge.exe	119
PID 3624 wrote to memory of 5300	3624	msedge.exe	135
PID 3624 wrote to memory of 5300	3624	msedge.exe	135

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://docs.google.com/document/d/1EFUS6sZak1JZXtwkiO64MmZkCkcKsUof3qtnA_EsTqQ/edit?tab=t.0
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2b4,0x7ff98cb2c188,0x7ff98cb2c194,0x7ff98cb2c1a0
  2⤵
  PID:1956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1824,i,17272180541859990926,11161604687240876519,524288 --field-trial-handle=2124,i,1068161004114937333,15689586666893131521,262144 --variations-seed-version --mojo-platform-channel-handle=2152 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1560,i,1807959124069856766,17765551817663367920,262144 --field-trial-handle=2124,i,1068161004114937333,15689586666893131521,262144 --variations-seed-version --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:2200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2428,i,10724901240207490935,14762116540852926624,524288 --field-trial-handle=2124,i,1068161004114937333,15689586666893131521,262144 --variations-seed-version --mojo-platform-channel-handle=2432 /prefetch:13
  2⤵
  PID:5448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3476,i,2828851591480308705,7386658966988025083,2097152 --field-trial-handle=2124,i,1068161004114937333,15689586666893131521,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:5156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3480,i,8321859531122808450,7524492950424706817,2097152 --field-trial-handle=2124,i,1068161004114937333,15689586666893131521,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
  2⤵
  PID:5264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5204,i,17377369537656060558,16890035869611138936,524288 --field-trial-handle=2124,i,1068161004114937333,15689586666893131521,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:14
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5192,i,2900416625024809598,16900122404357123891,524288 --field-trial-handle=2124,i,1068161004114937333,15689586666893131521,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:14
  2⤵
  PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6040,i,1575032373225303306,15712389935920728017,524288 --field-trial-handle=2124,i,1068161004114937333,15689586666893131521,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:14
  2⤵
  PID:1596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6116,i,10567975967805313222,8369702361021026337,524288 --field-trial-handle=2124,i,1068161004114937333,15689586666893131521,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6056
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6040,i,1575032373225303306,15712389935920728017,524288 --field-trial-handle=2124,i,1068161004114937333,15689586666893131521,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:14
  2⤵
  PID:3900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5004,i,9473647773781161502,8465942591209205378,524288 --field-trial-handle=2124,i,1068161004114937333,15689586666893131521,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:14
  2⤵
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,4966912292301073402,5481646318316834353,524288 --field-trial-handle=2124,i,1068161004114937333,15689586666893131521,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:14
  2⤵
  PID:6100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6204,i,15295387555431250398,2828400075774394561,524288 --field-trial-handle=2124,i,1068161004114937333,15689586666893131521,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:14
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5560,i,13818325912009462624,9197540692565277220,524288 --field-trial-handle=2124,i,1068161004114937333,15689586666893131521,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:14
  2⤵
  PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5028,i,11687260777025979131,4312503997216783381,262144 --field-trial-handle=2124,i,1068161004114937333,15689586666893131521,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3180,i,1141797704983208679,1303084089656715477,524288 --field-trial-handle=2124,i,1068161004114937333,15689586666893131521,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:14
  2⤵
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6300,i,13678869432778181536,13697537730850627744,2097152 --field-trial-handle=2124,i,1068161004114937333,15689586666893131521,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:1
  2⤵
  PID:896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6468,i,1690686820140941086,13704417719714545815,524288 --field-trial-handle=2124,i,1068161004114937333,15689586666893131521,262144 --variations-seed-version --mojo-platform-channel-handle=6628 /prefetch:14
  2⤵
  PID:3904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6416,i,12465289498093490527,13456258986536101678,2097152 --field-trial-handle=2124,i,1068161004114937333,15689586666893131521,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:1
  2⤵
  PID:2120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6852,i,10185705708526126813,10562965252302030178,2097152 --field-trial-handle=2124,i,1068161004114937333,15689586666893131521,262144 --variations-seed-version --mojo-platform-channel-handle=6832 /prefetch:1
  2⤵
  PID:5720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6964,i,15875462627325570482,9420083977699133094,2097152 --field-trial-handle=2124,i,1068161004114937333,15689586666893131521,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:1
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6404,i,6726095077167161521,7330740027835738852,2097152 --field-trial-handle=2124,i,1068161004114937333,15689586666893131521,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:1
  2⤵
  PID:1000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6792,i,1004697643975189549,4983724684139384525,2097152 --field-trial-handle=2124,i,1068161004114937333,15689586666893131521,262144 --variations-seed-version --mojo-platform-channel-handle=6804 /prefetch:1
  2⤵
  PID:6108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=5996,i,12198784196415476262,16780509223891724477,2097152 --field-trial-handle=2124,i,1068161004114937333,15689586666893131521,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:1
  2⤵
  PID:2688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6196,i,16279651068829774869,7320750885411986413,524288 --field-trial-handle=2124,i,1068161004114937333,15689586666893131521,262144 --variations-seed-version --mojo-platform-channel-handle=7156 /prefetch:14
  2⤵
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7004,i,17551145496109394695,16903332448953170017,524288 --field-trial-handle=2124,i,1068161004114937333,15689586666893131521,262144 --variations-seed-version --mojo-platform-channel-handle=7380 /prefetch:14
  2⤵
  PID:1180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7068,i,4046339420740167714,10596337760984694597,524288 --field-trial-handle=2124,i,1068161004114937333,15689586666893131521,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:14
  2⤵
  PID:5212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=7568,i,8368676069261222490,9536001653697367254,2097152 --field-trial-handle=2124,i,1068161004114937333,15689586666893131521,262144 --variations-seed-version --mojo-platform-channel-handle=7648 /prefetch:1
  2⤵
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7764,i,1243807947114535304,4772382635007507945,524288 --field-trial-handle=2124,i,1068161004114937333,15689586666893131521,262144 --variations-seed-version --mojo-platform-channel-handle=7792 /prefetch:14
  2⤵
  - NTFS ADS
  PID:5872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8112,i,16912832868478406047,13156606419749789982,524288 --field-trial-handle=2124,i,1068161004114937333,15689586666893131521,262144 --variations-seed-version --mojo-platform-channel-handle=7912 /prefetch:14
  2⤵
  PID:5300

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3248

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2644

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
1⤵
- Badlisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3568

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4752

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5688

C:\Program Files\WindowsApps\Microsoft.WindowsStore_22605.1401.13.0_x64__8wekyb3d8bbwe\StoreDesktopExtension.exe
"C:\Program Files\WindowsApps\Microsoft.WindowsStore_22605.1401.13.0_x64__8wekyb3d8bbwe\StoreDesktopExtension.exe" /InvokerPRAID: App /registerStoreTelemetry
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2380

C:\Program Files\WindowsApps\Microsoft.WindowsStore_22605.1401.13.0_x64__8wekyb3d8bbwe\WinStore.App.exe
"C:\Program Files\WindowsApps\Microsoft.WindowsStore_22605.1401.13.0_x64__8wekyb3d8bbwe\WinStore.App.exe" -ServerName:App.AppXc75wvwned5vhz4xyxxecvgdjhdkgsdza.mca
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:716

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:4672

C:\Program Files\WindowsApps\Microsoft.WindowsStore_22605.1401.13.0_x64__8wekyb3d8bbwe\StoreDesktopExtension.exe
"C:\Program Files\WindowsApps\Microsoft.WindowsStore_22605.1401.13.0_x64__8wekyb3d8bbwe\StoreDesktopExtension.exe" /InvokerPRAID: App
1⤵
PID:2592

C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:4816

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:2388

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c17dc8315075bb661bddf6b1efa879b9a3c39af13982f986bd287f5bc861cbdf
MD5 9573474710d1de6302a0d98890d2faae
SHA1 618b9f2079a97625be399f6137e46655659ecff9
SHA512 a345b915a4191d30d0da665ea4f78297c0cd671a5767e05c415403efb649110868fb279d22dc496792452c325e19b00f5e579f6e014a4488c9a4d6fac83d1c46
TLSH
T118D012273B0DB054E7A9C2729613C7921BB6646174434B01E315C95C99B54D412D6183
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7b9dac8593d827b7b825086ba5eeec776b808b8429eb90a6b645c319ec8f1435
MD5 c16a98ebe36bda7f5aece00f9ac1d0d0
SHA1 ef2e2a8775d1ebc0124f0ba983b6f20777919000
SHA512 148affd9dbe6aaee9070c22e41bc916df527cec5741753ca2733855f500e4eef0a257445d281d79c2449f8265c41b54dd53ffe57650802594b1211b0db611349
TLSH
T1ADD012273B0DA054E7A9C2729613C7921BB6646174434B01E315C95C99B54D412D6183
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 16ffcad7ff87472e7117b5c81fb9906ad0ae1c0afb3628bb1d218a6d3fd0237f
MD5 a839ff81828750bf164d7d3ddb012886
SHA1 40fc8a9afb2e6ba563b798bedbe01226b86ef5d9
SHA512 1709ed687ebf4a8710698fea9dcff3530b9a3263970e1b31fca37af732097314fed8335650b64a53a6d0905885b7db117b4fbfebc8e728ff4f1998a1ceb85a04
TLSH
T1EEE07D851ACAC32E9E89E48BC37C630C82C23A5AE6C87F7F5710C4883401480ABD39E0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 add6ef16a308fd5b2f3b62b798057f695e92cce88f6df7b5fdf40cc41ed3b5fe
MD5 160eb4a268dce536ee8430c7e57ff37b
SHA1 ee31b71dac0bd1cf9a6c9d9ec4b60066903680b3
SHA512 cba3c908238624012b287a8030b20707fa72c3470290c6307bfd14223caa3e6d8801466e40be521ebbc24288c5f3dcd29b01a96418fdc92f11ec6f88ba2f3574
TLSH
T141E026881BCAC39FBA50A44F416D930CD2C13A5B9AC8AD5F2702E8883402080FB939E0
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 4356ad8476ea8cd2ccc61c5f7176815a3a68bc93a63608e64addb3f703613e19
MD5 ca1e4efd4bef69c69f8878dcdf1eb886
SHA1 213a89f26444e091195336b3c9727897f418bbc2
SHA512 2bcee0782d1c55e50f8499ffca048ccd841d5404597a0ffb4b8bdee64b9ea5756ca037a425c578cb655dcb200005593fac809893afe2802d6e282357f46f065e
TLSH
T193E02BA6CC219C3B18FD272A60655785E70513575F41990F3B3CC1088FF063A4646C5C
MD5 SHA1 SHA512 TLSH

Submit Download

f_0000dc

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000dc
Size 162KB
SHA256 77c59e48ea238223363e72f125f7ddb96edc5648bcd83e371149c2b9ce50350d
MD5 798d76d70ad60f549d1b1bfa80135337
SHA1 f62cb1a351c6d806c63f6bb916899786492c12e7
SHA512 9b6c22d5c0778c7a98c0460ff0f8e3dd29f21d8ade4024388c3a59711f72729c1b59b65232dff2e3754831a65fa6c393f16e4cc4a426026aaf6cf8ea436c0da4
SSDEEP 3072:0Q4u1wUMQEcy7yGFJHHUAxW2eqhfbs4bKonlPGSlcggXVxlGh:0h8wUMQET97UZyhfb/lzQFx0
TLSH
T1C5F312B093AECE995F08CAF65012EC5567CEACAC188E1A4DFDCD67214B0F73071898D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000df

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000df
Size 128KB
SHA256 0825f050d4365e786b136532ff665fdc5f7aea536174b37028c57f0ae48b269f
MD5 48ecc5d2315ff123241c0b4d0f34a91a
SHA1 6a12e180f691280512127d28abef74f9e2fc045d
SHA512 beb7516b76184ef936fdeb482bfcc2a2777c1e5460a78531847542b6ca077980a6297d4e26f7bf230c528cf8b6d44f8be1cbff47da093193b67a5e16efe34698
SSDEEP 3072:FEJlk41bN0vbRuAygSqCc8KpEsILReSHW2Hkv:FE+5yg5Cc1pEsIsgQ
TLSH
T1B2D31674FBC3D781CB072ABDA43C3E730B5511D221C90A1B4A636D52A544FBAE62763E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000e0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000e0
Size 128KB
SHA256 85b6a6ec3ff4d947c9859904da096dee0e8412646ced7ddc983c1fcb8d2e485e
MD5 7e4c208669d74bfb0e73a225e9db01cd
SHA1 414362330cf8ebc23cf8adf54a76d2214e3e425e
SHA512 137e9b79fff86a63f99eb5730edf327467c95a5acfdd63104e09985dd2dbd69ef0ffa1ab10f0ed1ef718fbf541f5004f4a51403e7f62de9f3943ad74f00687c1
SSDEEP 1536:sxJENA1yEiM78Qr/q0FkbClOAopWxWDpHm4YxWvhJcnnYZyn2zwKU7h:Ox1yB280/dkbCJopWyltceh8j7h
TLSH
T1DAD37070FBC3D781CB432BBCA43C3E730B5501D162D95A1B46636D16A584FB6922BA3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00011d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00011d
Size 62KB
SHA256 df670e09f278fea1d0684afdcd0392a83d7041585ba5996f7b527974d7d98ec3
MD5 c813a1b87f1651d642cdcad5fca7a7d8
SHA1 0e6628997674a7dfbeb321b59a6e829d0c2f4478
SHA512 af0d024ba1faafbd6f950c67977ed126827180a47cea9758ee51a95d13436f753eb5a7aa12a9090048a70328f6e779634c612aebde89b06740ffd770751e1c5b
SSDEEP 1536:Q9pfnSa+E9Az52gNbkYtUtqvUhZRHuLdrx07LXz:uhnSpE9A1EY6tBPix07Lj
TLSH
T1695301D4670EE2A579F2CF23BF59C5C00803162D8E11AA68FFA063878D8430BA793D1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00011e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00011e
Size 68KB
SHA256 90e39936fa4a20f0fcdafc8ce17bd53e662b5ac7fe4c810b28ed5356b9da6d02
MD5 8b512e3b59cb89f3f306e9e69f799ab1
SHA1 e0a1c29cf12aa60249c80da1600a2d7778984788
SHA512 d5b39e2618e5cfcde62a34552aa24def071b21cea9913296d33edafc7fb024426ebc8e92550b40f0bb3231c8ddb2945538a7e6c0d4f308c7cdac7d5e53745b87
SSDEEP 1536:phILhlQU1HUf76Z+AGYguWv0KxwhT30N7Xw1RJiuwPy+R3zP5:p6Lhl/1HX9GjuW8KxwhYRXw1z+55
TLSH
T1FC6302008F370176B188A8D9FD49E3B6CAAF58E0914BF595020B188F7F5F8D1A55D2BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00011f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00011f
Size 19KB
SHA256 af18b3681e8e2a1e8dc34c2aa60530dc8d8a9258c4d562cbe20c898d5de98725
MD5 1bd4ae71ef8e69ad4b5ffd8dc7d2dcb5
SHA1 6dd8803e59949c985d6a9df2f26c833041a5178c
SHA512 b3ff083b669aca75549396250e05344ba2f1c021468589f2bd6f1b977b7f11df00f958bbbd22f07708b5d30d0260f39d8de57e75382b3ab8e78a2c41ef428863
SSDEEP 384:/Und3PKicut4yiFkC9RWzlJpa2/CKYOyDJmCZyXJTW4PO821GyLjSoBwNeS:0UizQDYlJpaQCKYOyDJpI5Kx821DS3Nz
TLSH
T13692E1670BCE314E422EE25FA316A51733E41BE1EFE49640D6AA70D81C38DA243179D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000120

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000120
Size 63KB
SHA256 caecff4179910ce0ff470f9fa9eb4349e8fb717fa1432cf19987450a4e1ef4a5
MD5 226541550a51911c375216f718493f65
SHA1 f6e608468401f9384cabdef45ca19e2afacc84bd
SHA512 2947b309f15e0e321beb9506861883fde8391c6f6140178c7e6ee7750d6418266360c335477cae0b067a6a6d86935ec5f7acdfdacc9edffa8b04ec71be210516
SSDEEP 1536:tLQFdWY1+jAIuhc5s3JBP2ffX195jJqu1H5g60:qFdv+jA/cizOfTdRJ260
TLSH
T10E5302D829DC2DF4466490C19420E379C6FACED8E4485B6F5B2A2E0DF78DD7527C7242
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000121

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000121
Size 38KB
SHA256 4392ddde86f22a921269feaf788a13509946046047df6926017041ff33d0293e
MD5 04bd0131c5ce154413f71d20017679e6
SHA1 a83459180dca62eb56edee213409f83e12fa6172
SHA512 5818141afbbc45553e72fc106699d9357437f1c2751751dab4f51ad7127e92a6ff85fb67905073addfdec5dd581c8c22ffc8dd6b85919d6a1d72550ebda5376c
SSDEEP 768:hrGgBfBZrOcgLWz/irLn2nTXzHXP0JsdgCQL1/UAv73nWEjvvuUwp5:hrGA51OQ2naXzP0Jsdns73WEaz
TLSH
T1170302AD7D526331E7FB684CC972AA1340C424498063CB1FBEFF098E9D44A4FE056A23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 e6ff0061bd3d0f55331554007f513c6509f6aaa42d6b5772b3a778bba74f7c47
MD5 956ef1f1573c23a0707d6e61c05dfd86
SHA1 b03083f39e03f22b64733b93a66912aa85a7c25b
SHA512 9255d888f00c44ba6f26adaadd048526202d1709e42b39e8af1893d813ee6d0672f11ee45be864926702a4ef765ea5be891b7a5f1ebc6cecd0894164cfafaaf0
SSDEEP 192:8Nm7mKWaqEbraY+q+DWLH+gBu/G2eePHzMCaX8cl35M3A0L8eynHChDSq3D97eGv:ZdSA1X3wbku
TLSH
T10DF10D2EBF8747A2DB6D953A05D25A99FFBCF4A7454B1F820F8047FA50CA3D24029426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 85e1585f08690e7e584038dc67eb063c4ea0cddba86418534939a6bac9d738a9
MD5 8bd03549b9011945b5890f3384a3f9f9
SHA1 af56aaf6319d8c8a0ce1594afb16c398387d871e
SHA512 b43027ec44561d04022779d753e0cacd359996e58fe72634d0e4667b0c0b79dffb4cb660ddd3e353b60599524c43966106413e5cbac78892d46f48eae5f65fda
TLSH
T1DF51C77D8E8B5A75E35E023EA0E04904B33CF6D75E8B0FC14DD09AF8D44EA5B056D819
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 10KB
SHA256 73f314605aa6e852cedce56d2ff88dfb90c12683d65f6311ecbfe40cbebce1fd
MD5 31464f72202f31e4218be262bec92101
SHA1 40c21f2b5973919ba1147fd4fb8b3540c44c7c00
SHA512 ce78f1433bc8f8a8c47d3152c4a21e3fcb85a7b9971f0800286e20c963a92bc0a8f417ceaec8b0252bfde930b80e8dafddf166a7a2df801806b9dad56d5d9f7a
SSDEEP 192:QRm7xxFKPEqg9raQKc+3WLH+gcj8x+n0PRzMCaVUf8cl35gdV3bghMWs8nHThDgW:7hSFAXydB2g8DA+
TLSH
T1B922A61EAF8746E2DB3D933F47D1099DBABCA097454B1E818F80C7FBD2CA3964069415
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58a0a0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58a0a0.TMP
Size 2KB
SHA256 0accb12bff2083a47470ce0b900404b02dadd7d00b5b819e549a808105a0dc33
MD5 b4b2ab3d8b286cd38525b5097d2abcc4
SHA1 47b13e9cdfd39efff8a4faac0f5e0ebf54f7e161
SHA512 6030fd2e124da05d8a006e8e81a722665595c1ca25db1b4b1a210da1509904027f1f324caaef896d4a953f309a77eee2ddadf97155f765de6880bd11839aef8f
TLSH
T1D451E6798E970A32E352033CA0E18901B77CF9EB8E830FC24DE10AFDC40EA1348A6059
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\000003.log
Size 31KB
SHA256 28074383ebd24b4fe12badc555a8fdd4bae10bc8e0fbb3772b6901ff49399719
MD5 3fc7b8a00c2f526dfd37472aa16269fd
SHA1 2cd5d25054540c51551095be2af60f73485590f5
SHA512 44773c72f574e6cefdc7a1501a6ba7220fa440f77c660dd1f87bb0751485eaa0f09391a94eacff464ffb1d4e35f0fbfe80658dfc22ca1738d5d23074e84a654b
SSDEEP 768:JuCgHAPlyaWao4mjR0Jx7/0kM+MA0iLFd2rxRBblMGOGAC0Pe:MAYRmxzzd6xHJ
TLSH
T1E7E25761B5F9120AF27B5F7BA9B617925CBABE462D04DC1E5860620D4C32F40CD73B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\LOG
Size 383B
SHA256 ef5931ea815669f987089a62f64b022ee7345fc5d778632b071363f8055f1ef4
MD5 b51d004ce413e2c138efa9c8f9930a17
SHA1 0ad21fa354b0986e5dc67dd330bb527598634a8e
SHA512 4a941c91dfb84fc46b4e16d67d48c60e157259cbbd1bc280b71a0f7ce8fc96a848f86a931eb3ee7b24426dab7bf922f3ee320e07235711e2e8e86a54e74e17cc
TLSH
T1C0E09B785BCDC51FB5541097413DBB4A92E33A5E968C6D871B0CD464B581144FB6A2E0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\LOG
Size 383B
SHA256 b631b3d2c0ac52f056df83ea073eb37c3fb12da11bed1c216ca8d20f8d278b4c
MD5 09d56de989341f99846dfb2735f9575c
SHA1 7c4b755c4738d9495b62dc73f7692f8c1d974704
SHA512 525c0a6f9f302292d4cd7c2128074a561e7872f4a5756eb2a2f9d5b0070a5f660e16bca4898f93788fb3164b1010a76591b4048f0091a4d93219bbf17d36001a
TLSH
T153E02BB859CDC61FB4546467026EBB08D2E3BA0BD78C7C526B0DC894B442140B76A6A0
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.bing.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 d554b799ef92d1918e4879c75fa3d0155d0442922d4dad7e7f090ab62099ce1b
MD5 487ded2914be12e554bbc15f0f59f54a
SHA1 70fa8659077a7b91b01e0a79f82d6f331e360127
SHA512 a5d2f9013eacddd1d0b6e18f9a4fa6cef92ae877bb07fab4874b8f62602fda9a511ee0e54cc2ef8e7dd5c932c896e29656525022712a50ff4346e080190232ba
SSDEEP 192:D1b69VkRiAdz47kaaaij61nkk/YEtnARm/f830TGLSHBR:D1b69VkRTdz47kaaaiG1nkSYEtnARAfB
TLSH
T1DCF1BCF7C3E8812DC80156F49B15AF1FCE2E1624431D3C6A88D4BE5B93E2871E25575E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 73e19898d910dcdb57ad01e95ebc50ae5d3bf5c31364d3e0ae9d534034abb97f
MD5 fb8264f55f7934a677077153e8f1eaa6
SHA1 7734f8023822b161c365082c0be315f3e45f75bf
SHA512 77c3825758ddc880b6e682158a44ce46f6ceaa3141c0e540571b5d2c88431dd3f248ecd9b9a1219949b1dfab4872d025142d45fa0e0776db4295c92dbc1aa564
SSDEEP 192:D1b33Hl2A5PMjYOSNKFAkmc/aaij61nkQzEiuIdRdNSrKH57Tjtcx/GtgvmmrmDJ:D1b33Hl35PMjYOSNKFAkmc/aaiG1nkQt
TLSH
T1F21268F783B5822DDA1196F0DB05AF1F8F290114432C38BA89D47E57D3E2472E156BAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 11KB
SHA256 dfa159593e4b680e0a37113209d8b0ba9b0f56e36667e32696ef189fd3654c0c
MD5 fb9f13f596d294f8d7786de17e117acc
SHA1 d7f45a1a60c8f6391105336f6f031e385bb8422f
SHA512 78e3ef954298331c539dbfaf16c5c3918c461dfb4760d40b0b7af1cf4d97675dbac0d0ca8d15ae36f9fbf22b2014f674954db11aa98a390c729e20e81a08b42d
SSDEEP 192:D1b69VkRiAdz47ki8PP6N7aaij61nkk/YEtnARm/f8+SHKkH57TQtcSOGD/2QyTH:D1b69VkRTdz47ki8PP6N7aaiG1nkSYEw
TLSH
T1F432A9F7C3E9822DC91156F4AB19AF1FCE2D0524432C3C6A88D4BE5B93E2871E15179E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 f2b3194e993801aeef5403b1e3abdd75a0ae25b1579929bf16bd0307c9a94e6b
MD5 ac6f5f7d19f7ef4a61494ddd8573bc3b
SHA1 ff266db02c8cccbb4f4cc3468a12b612c1ae75ff
SHA512 e62e535453649d563e8f53dc76e520345290b982292f810ebf26b9614d361166eafc6fb852b561aa2552c8e6bdd27ab78fb1a466757cc44cb8ecea1b92650a4b
SSDEEP 192:D1bY33Hl2A5PMjYO8PP6NHm/aaij61nkQzEiuIdRdNSrKH57TQtcSOGD/2Qvmrmt:D1bY33Hl35PMjYO8PP6NHm/aaiG1nkQy
TLSH
T10022A8F783A5822DD91196F0EB05AF1FCF290514432C3C6A88E4BE57D3E2871E156B9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 4bfce8ba8b972a8f64478607c915649f37c922233bb74c4a15fa595f1dbce6d1
MD5 28abfc242e049875f1aeaaeaf4848282
SHA1 dd2ba38982d2ffe5dfae281db2fb1dfbfb2eb628
SHA512 86d8132e7df587666cabe701f507b09f59e90c844732017516efc6d8e466d6f015862582a796a5df2d2824de6ea9f4e51434242932a631d7ae691ee756664824
TLSH
T110D022371701B0F9F96C3EF980AAAC8FCB3720704883EDD412E099AD26358BC25076C1
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 75b7800d138ba3d1f86ff0017e7f95868e57dca4843f3f4da094a7162273177b
MD5 f6b651cdb0b890300cdf0599f28cc794
SHA1 aef3f85b4f12c77d1e80bb3a08a498dd19a42352
SHA512 e15a32b27387ee0f3a06ffde2b7176054cb39f8fb615b60d86512ffc45cd5f964c451680cf8c284f991a9b00686685cb02efb1348935907e5470d0594ef54c14
SSDEEP 192:sxZZQUnTRFyMqZjK1Ml8UQt8OK/f8scbuKTGvweb7CGodp9bNm/W6+WNfSkSbIrE:sxZRnTWqWOK/f8scSUqci/bbZ/5YfF+a
TLSH
T1C682FA066928497BDCD7D229F9457BA3D6F81573DA845E4496FCCA0C04E6BDD2203C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 e54674a4de485d4ee132b30745b979f237aa93196f21e2ea3eebc5fd01f98353
MD5 ba0f77c81abae39710553c02b93e40bb
SHA1 d3b121f47bd182601d2674f85f390f5f488f5005
SHA512 6052608ce55ecaff2202275440aef42a7d8f2857fe654bce132beb33b35c71ca39d04fd457dd3a6067a4a65e921b160bffdb14276b51cf407f3ac75ef588cd21
SSDEEP 192:sxZ3RFyMqZjK1Ml8UQtFK/f8scbuKTGvwozodpEm/W6+WNfSkXY0hboZ06Ig5b+a:sxZ3WqLK/f8scSUR7/bbX5+fF+a
TLSH
T1D172F8066A385977CCDBD219F955BFA3D6F9156396805E449AFCCB0C01E6AEC220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 b74bd5570221ae99a090eefcb0ab68357c85cd836c6b9b6863289512a106e46c
MD5 2d5809c7f6f46b702ea8dc8cd480825b
SHA1 552f903670a827408c7a923c9196a4c218f23a07
SHA512 45800f04f41ade1ae0d2769d032e5741f004c007ed3aefe0033856792677375096093c17c14df43828454ae5014842841a235407b6802d1aadeebe1ef2cb4e62
SSDEEP 192:sxZ3RFyMqZjK1Ml8MFK/f8s9bsKTGvwozodpEm/W6+WNfe1/Y0hX6p06Igj+OJ:sxZ3WdK/f8s9IUR7/bk/50fj+a
TLSH
T17762F9066A3859778CDBD319F955BFA3D6F5157396805E449AFCCA0C01E6ADC220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 20KB
SHA256 9f5ae3d5651c8d63b5b5ec9dfdfdd011b731fc8d995590ec40ce070526286d34
MD5 b59e514f9c38684cd7bce8f42df1f5e3
SHA1 0aa37b805f3f03284b082d7fb2575e8c299a8da3
SHA512 b3a442cdaad4a04564cb89ec3fdbaf38df6d1cdb9fb8bcf19d1deb6cbae32ea8eb4a61b7e2514bca2ff63999b5f1c6a2dfe88ded7916ed1524a2b609f09c7038
SSDEEP 384:sxZRn7Wq3m1K/f8scSUUHZ3/bCZnf5/fF+lh+:sJ753m1K/fMSUU9/bU5/C+
TLSH
T166A2E9036524897BDCD7D219F9217FA2D6F81463DE545E4CAAFCCA0C04EA6ED221282F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 21KB
SHA256 6afae4877410447739a140f49d2a3a3bc56c51bd454d58074bd83b4f411447f1
MD5 edecae18f66f172f4772e02ec49c9e99
SHA1 d50f90122d3afbdd85b75bff45808793b9587425
SHA512 0c59bea2ec89fab44bde7e8654f43ea9261f19420283deb0d96d124729410676bea9323b9fb7854ec706ae5f7e98c50ca289040180db984f9b50a82d28b2342f
SSDEEP 384:sxZRn+Wq3m1K/f8scSUjHZ0/baZdH5zfF+9+:sJ+53m1K/fMSUjK/bS5z6+
TLSH
T151A2FA4365248977DDD7D619F9217FA2D6F81463DE805E48AAFCCE0C04DA6ED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 bb38d2843fac1676545fd1dbf46602eafc3617f0c3745aa49a1031db89ab22d5
MD5 c258ab0ffae4e902108528daa451bbb7
SHA1 94e44101cf4854bc8266cb0bf62310392e8e9398
SHA512 3ec692d2f7ea16ccdd85ca60febe9a9af8d14ee54e97dc94bcb3cae8992bb419a44865ee591a8d960ffbbb2f42a725ba3cb82349855708e5bfdcf7a2377fc549
SSDEEP 768:wQAKq8y028bWRmj1QWT8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3L4Ll/f10EMEroSO:wQAKq8y028bWRmj1QWTu1jaKL4LpfiEC
TLSH
T1FFE21B3B284CCB7E4FC44E9CED276E8769D802CBA7588D5447FA494C03CA3EE511A59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

623cd082b6202da0_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\2c60ff2a-c337-4df0-aaba-fe27b78528c8\623cd082b6202da0_0
Size 61KB
SHA256 17afdc12e774b3950f3e290c44c0200fa1c0850173e898a3072e4a5745d6ea7a
MD5 197d9ddbd6dad1b68674e0f90405b6a4
SHA1 7f9674d6d69dd60e97639720b19405ad60bc73b2
SHA512 91926ad252da8473335a76d014c354bf452abd8cecd0d2a9d974ab6a879b5aba6295259901a6bfa54060b103eb91005ac0010611e34239260a0661629393ffe7
SSDEEP 1536:4yJjKJ+BHKut3JHjvGEs7RONVIqtN2mJTq+y5HHPwqpzGi/7:DM+0ghGEEROfFML/7
TLSH
T1715318E7B2626035CBAD21D1A49B7B01F12B13461845C9ECF0AD65913F18E8B57B3BF8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\2c60ff2a-c337-4df0-aaba-fe27b78528c8\index-dir\the-real-index
Size 72B
SHA256 1d7ead24aef4660714b85528198386dff7d2fbe4ba8eeea48cb608777b3dddb0
MD5 672d6596cfcc8b3324fa9e51bf33376b
SHA1 e371620d496c26a9be0055689618029382dd5584
SHA512 fedbae3327128352a413494b5c35acca14091ed1185384d974c238d75d8587e9bbdf8694deb9aad8dad8c3afeefef457e82c59c5df97c6b740cfa23655edc2a4
TLSH
T10BA0025406843401C4C756B265E20175A7105CA1C2011335D7A5204DD8E8780414140D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5bad34.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\2c60ff2a-c337-4df0-aaba-fe27b78528c8\index-dir\the-real-index~RFe5bad34.TMP
Size 72B
SHA256 4a17dbbcc18f16c60a98e512e055cf23258c83b1807b62eb94e9864bd45ded54
MD5 3d226916a0fa81fd0bac15f220341d45
SHA1 08004d62116c25c6ab397a5fa829bc774326f919
SHA512 65c0e6f2c206bc861081c4a6e124b479d7ca2939b39e550bcdf16dccb0e565163b18630445b8649db4bbbf1ee0f68a8b77663b1603ac51aff86280d7fe8f192f
TLSH
T111A0021043810006C81256F1155713452300DA911100A31740910084CC935C08EB100C
MD5 SHA1 SHA512 TLSH

Submit Download

4f2277ea2139c475_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\673ba0b2-ba38-4e02-b05c-f1c84ab818bc\4f2277ea2139c475_0
Size 61KB
SHA256 2d947d2142de14a6f24c09d669c4ae182dc6fce6acdd9d262e463c5f035a58f7
MD5 1ead83616c67852d1014e2b0b2ecd399
SHA1 858f0e49c922bb8b0b80f0cea137d6152eb9ebe9
SHA512 5ddbf876ce863854c81e2fa9d21cafff9c3251b6c774a94c48dc2e98fc844e7a1cb98ee0124b5d656deb27b2b0c52520229e2b7068ff1021b997dae1a20bc7b6
SSDEEP 1536:cMy9j6r+BHKut3JHjvGEs7RONVIqtNIoHRAQIzHHPwqpzGk/R:cru+0ghGEEROfF0R/R
TLSH
T1565319A3A26260368BAD21D1649B7F01F12B17461545C9ECF0BD66913B18ECB53B3BFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\673ba0b2-ba38-4e02-b05c-f1c84ab818bc\index-dir\the-real-index
Size 72B
SHA256 952aa324cbcdf738d36966b19674bae06876e1e2477f11f4df95fc10bdb75fde
MD5 d59dd9c8426e4dbed5fa369ee388439a
SHA1 d5f3455498bcb3f46e436cf3728dc0983e899cec
SHA512 52de91a509a25a3a67b4503dbc46b885159b5959e8853b25e7bcd227fc232495b2131a9803b59ff27be54d9e1450a5d318e0e38b3d77b0c7ec661712dd847abc
TLSH
T10AA00260155C3841C01D06B262C2117063546C954102932555D0145EC8F539C860608B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5ba8cf.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\673ba0b2-ba38-4e02-b05c-f1c84ab818bc\index-dir\the-real-index~RFe5ba8cf.TMP
Size 72B
SHA256 db442d8a94058f25c2e550be69d9e40d19bc6de848baf2d606c475374bd77270
MD5 0dfb16c140a47117760d4b64118b3350
SHA1 858a07a5342e0f0d0b7deae35988eaa42226f412
SHA512 95427112afce0d3cde79ea25a08e09b5f1cacf7e653ba990ab3f5f2606ff60eb7d71823dedc40a4ae7728ef08094156b9788fe842a3e3ae1bd13670345efeef8
TLSH
T140A0026442550042C0084F7A658D52913304EC665403431788D425969D654584E52454
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\84929e18-7031-4aed-9651-196b2ec11ecb\index-dir\the-real-index
Size 2KB
SHA256 dbbd02a59a654b6b82f1aa43cabee1acced1b749d04a5509926b9f6054d0cae1
MD5 f966d280484a6fb9dd73384eb0d46f83
SHA1 fe84943a0dae84446aa2cf7bc09d0dad66684e08
SHA512 965144ef1f629598cd48424e520be2c7fb6a25232cf79895a5995d1efcc792d16bedd729faafcd53d78cdb4be04c41aa637783491139ac734cf19269806fb6e1
TLSH
T17451970E8C86575ECC6C517365B614C03B3964CD26888A4724FD513CBCC7A3C1D9627A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d2e24a13-b865-4769-9d8b-172ab3dd289a\index-dir\the-real-index
Size 72B
SHA256 ab82d36086b4fd08f9696c9ea89b463db60ecbf3d7e514d659f2c502ed92df66
MD5 b21c42233ca35b63c904e654f5abe9e6
SHA1 3c898fb00a143716e230158baab45906dde3ba6c
SHA512 44750d94e72214bbfea49aff8b1cb5361ad14b9f0ac5c5ef152343e66d82ec855028d7a06ce45a55eb75fff9bb2b183082cc38c41705541c33cc9a44db555f60
TLSH
T103A0026483949252C90C83771153524433358C545353C602C7E0E67499646688341154
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 476B
SHA256 ddc1a7a48b023619d33fa5c8e3a457e0ea3f4da72f4eb92a3cb23d16714c455e
MD5 86703b683746beda1e019276889c4a46
SHA1 8a28ddcfc0afb2a8c95259709545e7da89b598d6
SHA512 2567068414be09ddab373466a30ecb17aeeab1553fc26041ef806e0772115832be0d0a01ade90e638c53241f8fa84fe1059ca0d7ec7127c6edd0342fef86a9a3
TLSH
T151F027F73EF72828F8ABD3EA6871806501013C54D564FC9F246AB69750B131825ADC61
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 9992eda8efa7fa976104ee082ff7d74377fcafe6435c3b25377583f282841e2d
MD5 a1005e7bab5bfcf2e422a114e8a7f409
SHA1 8949ddd918dd38c5f3ed87e120021a04e552392f
SHA512 f11105bbd5d8e68614ba6840700a8925e9635c94fe3fd8a92b439b34f233eadaefa9ffe30b9b388b880dc720f45323b404a9513b51be1893e3461781f18822ec
TLSH
T1D2A002508A4DD10DEE4406F164BB5184735048D9161AA20184AED5EC8CF32C055F1225
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 25KB
SHA256 525e71a7314030018b1ba24df69c03c5a025ba510ca39fc8f1e9b2acc0c1cd78
MD5 872cca8c04b4691875c42fed94ab924f
SHA1 1e8770e0bfb43b0ba85f56c10d8898ba0eac57fc
SHA512 941afad7ed690a9c89ceb700f8e38b719214ca576289c64cf211375440796f12f4eb1a634823bb6d81cfd4695d5fe21c4e00529708d489a22ae078c5093d6838
SSDEEP 192:GD9R5VJhn/iVJnZFGVApBPisTE/3oNloNPSF53pVWFQ5xfSsD0PnY9JFlPtv0F5M:GZLVDJjEDPV0/Zd+hunU
TLSH
T1CAB2480236BA42423C7D690C93968B674A42F1633069ED3F7BB900B65E27E115EFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 dabfafd6b7d5d41867b85ebd880a3e302db434eaeb1300ff0b8e65174ea24b12
MD5 d1b497a5909722c32c99294e4d1deecb
SHA1 d7414e651b660afac8b704beb2907af7e862b7e7
SHA512 4b0c16c3738191fdf4be6e71fe61dddb83790cf1fbf2813be6febc178a94bcf978dd043ba9806abc420a631f9501781280faab3292a44373a09a0a5c6649dcbf
SSDEEP 384:n6HiFKtNn/s3n9Sg138NLT8TUNTUlIRGPm3ek32nn9nthA4Jfb8GHg6k0vUScjmp:6CFKj+9H3QTwgsKekmhsGHgCU1j+j
TLSH
T1BDF2C4F298D789B7E9AD4B97A33E2E529AFCC15379481984B7C81D4CCC861BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 5a885520a0e3dbf74b3110558c6012b5409fa9598425b325b995f7cf66fa0e49
MD5 5eb3756342a0a64c8191f42573527b23
SHA1 0883e973d1e4ff3005f59e78a5d8af23f2ea9f40
SHA512 66cc58d0ddd7e28e99b2855d69d7a0fa777826c24541484157046af9e8b9a1deb33f18b39b81204a8ab60812f051f8533c62d4fc7f3ab8f743f8709abf3bf94e
SSDEEP 384:n0iFhtNn/s3n9Sg38NU8TUNTUlIRGPm3ek32nn9RYhA4Jfb8GHg6k0MUScjmwSnj:PFhj+953XwgsKekm4sGHg3U1j+j
TLSH
T1A4D25A32EC55C9ABADE64ED9B70A7653DEE001638A8C5EC4DADC5D5C00CB2DD430BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 708dc4e82c721a42fed35575e91e60854b814fed691ed05b377ddd930b0bc1cd
MD5 35a9dedfe9803fefa3e79be400802f03
SHA1 15220099e212d85ab95b50fa3173625b5ccf3247
SHA512 4120acb6e31ef3555fb34d5cce8c0307e131901912f79528acbf54b20af1de25acf3b718ce90e73d295ad1a1642da5e6942819483c65c07b10491f3c8ca1731a
SSDEEP 384:n6HiFhtNn/s3n9Sg138NU8TUNTUlIRGPm3ek32nn9RthA4Jfb8GHg6k0rUScjmw6:6CFhj+9H3XwgsKekmzsGHguU1j+j
TLSH
T147F2C4F298D789B7E89D4B97A33E2E529AFCC15379481984B7C81D5CCC861BFC306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 fb62e2068c36f8bd14b00c9f40e31061b4a114766315a102edf3114f039ec228
MD5 657d24bd0c23d78f460256372f5cce89
SHA1 1ed5ecf2dbb89ae1da5acea365a54f3b0399c1f0
SHA512 03d204b47876e5c07b2c5662d5b087a2f5ff2398b1c4326390c2da7dadb45e9497d5fa89d56e559733f289d2457f4b6b47d9926278184721053ff97dbb3b8486
SSDEEP 384:nsiF9CcmyWCs38No8TUNTUlIxBPm3ek32nn9efN4Jfb8GHg6k0dUe4KV8p0bWtyi:XFccps3nwgPKekmkfGHgkUI8p0e
TLSH
T188C24A36E854C9BBECE64F99B70A7603DEE04263868C9EE4DACC1D5C009B19D574BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 ccb023d690a8c42e6f86ae92898bc08dad0a412c9130ad46335b7c39984660b5
MD5 e69dd98ef2e6408e9ce8065265799515
SHA1 dffdd5118721673f580824ee400824e20ec2faf6
SHA512 32b8a6a324c33420823dff9e9b669820bf98cfc88ee9fab097ee27c1a51052befd8fe7e804bf7d9ab0a861f8e1ee25663cbeb2024c1be5082b997518bd0f1c18
SSDEEP 384:nCiFhtNn/s3n9Sg38NU8TUNTUlIRGPm3ek32nn9RYhA4Jfb8GHg6k0MUScjmwSnj:JFhj+953XwgsKekm4sGHg3U1j+j
TLSH
T1E5D25A32EC55C9ABADE64ED9B70A7653DEE001638A8C5EC4DADD5D5C00C72DD430BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 b7e56611452d591774f413761769906aa03d605fb10c0b2aea8ca5de6d9033b3
MD5 39d7df623e80a21ea94b8bc3ac5bdccb
SHA1 8840a839a13e4e07f877f9021c4beb2319e7450a
SHA512 2ddf7bc1d904762c31d78eb7cc0d139a1faa143b26c77cd663e2d109633c42f9bbc4bdabea7c62c0bfae58eea8cf98316671acccb699dff9a4036f4a3a5aa2a9
SSDEEP 384:nCiF1tNn/s3n9Sg38NU8TUNTUlIRiPm3ek32nn9RYhA4Jfb8GHg6k0MUScjmwSnj:JF1j+953XwgsKekm4sGHg3U1j+j
TLSH
T197D25A32EC55C9ABADE64ED9B70A7A53DEE001638A8C5EC4DADD5D5C00C71ED430BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 60f47a4b4c63a445a1d3c8adec6da72fba1e60281aebb54331bf7c84c6d0f78d
MD5 e76d481bac38acfc861a00e5957c9ccf
SHA1 047187789e10d1044302e3271da790c97a38ce45
SHA512 37bc5398b5d420f63a11e19b0135b52255f02778e43eb6b5e790b934c1f51ba25467c624a54be22d4dc3234030693accbee1a0fbcb9eea9dafedfb46209a79a8
SSDEEP 384:n6HiFWtNn/s3n9SgV38NLT8TUNTUlIRFT9m3ek32nn97MhM4Jfb8GHg6k0sUScjW:6CFWj+9P3QTwgpKekm+QGHgVU1j+j
TLSH
T18DF2C4F298D789B7E99D4B97A33E2E529AFCC15379481984B7C81D4CCC861BFC306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 82eff95476d6ba9aafb497a9723c5283bd55186ab10a56643ce63a182638869f
MD5 647259637bd927b9f19570335be619b9
SHA1 b73d356c9dcb22ad0685826b9e1a9cb0e0224b2f
SHA512 de7cd7044f4c98f39312b0c11f2e2b6e132fbec5bba8eee1f754522bf0201551eff628de49f8220589a96648363c3a08d9feede64eb020ddf81c16731e452e7b
SSDEEP 384:njiF9CcmyWCs38ND8TUNTUlIxBPm3ek32nn9BHQLs4Jfb8GHg6Wwe4KV8p0bWtyi:OFccps3QwgPKekmPowGHgXwI8p0e
TLSH
T109B25A35EC68C9FBECEA4F99B70A7A03DEE01263859C5AD8DAD81D1D009718D174BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 1be0359ec427314f383c51fbecc6f06fb473b1d6724442c7f503c24abe6a4269
MD5 3f19eee9fbcb97d28567b9027c5886d5
SHA1 1614c0c724b9bfd814ff3cdb936452345de66ed9
SHA512 f5d399201b5bf2cc690ed65df594a074d3c0afaa824474fba566f97562ebfe7b006843d84d78833099f231a7d5bbdbd5c91b74dd1eed9497fd6d983c047c80e9
SSDEEP 384:n6HiFitNn/s3n9Sg138NLT8TUNTUlIRFT9m3ek32nn9FMhM4Jfb8GHg6k0uUScjW:6CFij+9v3QTwgpKekmgQGHgnU1j+j
TLSH
T133F2C4F298D789B7E99D4B97A33E2E429AFCC15379481984B7C81D4CCC861BFC306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 aa2213631e7544db3d0bb2b7f2bc6d8bec791625fcbb22f9822faa79e39a9f59
MD5 ce72ef3eb78e072118c320d516f8024d
SHA1 bf4178724cd138e407965063d5bac3a76d8f2d22
SHA512 fb9bf46c4dc0f2a15be587fe3e56085f9362fad2cd88dd3798881a06a8bda3872f9156688fa4c347e20bbc4c0ecd179c7a0e018bb4af1b964f30c16ee5daf248
TLSH
T18AE00912A640086FD079173542D32B20BBF6C1691BB347575B31417A6D373002E26BE2
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 b44c8de0128bdc342bb83feda28f8897b1841ca6eefbbce0a240821c5352c490
MD5 491b4e387a318a76f1bbecce89575685
SHA1 7a03a2b016645f25e64136711ead1aed86af1437
SHA512 ec300a9f89a5710816fcae0e4e0ae53ea91030172c20a8d03d10a77096c072178b342246b48367a11f7c0d43082ae9e94906cf71c06f24a76f95497c8f736c6e
TLSH
T1CFE00203A300046FC075033101D32B3037F6C1291B7343164A2141741D233002E15BE1
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 de80f79d8704b7b31c7acbb046d1eb7ad6b4d757fd82e030f6e60659339b0912
MD5 d71d8e1d03c900dd442784e0e9c8cb5b
SHA1 c59914ed66c34a58043ae84e93843fc2839b49bb
SHA512 87dbe0ced23442925043ccde3e8e03294fe1ff0ae6b8bd09edbf941fe35d7ac74a8a1436222ad17ca6168e94eebc8a5dc31c27fae8feaeb557abcac9875577ca
TLSH
T1E6E00912A304046ED479033501932B203BE6C1291AB346165A2141692D233002E25BE1
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 0e939bb7026a9c5bd91fc7a45f5835ede669a780635ca900125dc150de75f660
MD5 e6923e1ae702fddef2067be9aff60f3d
SHA1 7a3fe3116c119e4e98f47902e3a9682dee51d6c5
SHA512 c39ec53edf0371139dfb3af011e3ab61c615b89d560e234b0f25420670db38586d67fa9553ba6eea7a079db6f49536ef50bc96bbda5abf2d699ed4d0180bfd30
TLSH
T1E7E00412A640086ED0791739429B2B20BBE6C1A91BB386565B31416A6D373012E26FA2
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5b609b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5b609b.TMP
Size 392B
SHA256 a9bc6df5e8c835f0a682e1acf6d9f0353a5641689f1d1bdedabc4991c9b4d0ea
MD5 ac37acd4d324a2659826c71c768263d2
SHA1 f82fafdaaf19fcee74833b3299c55a7f635af68f
SHA512 69d022d3326e6f7bb130f7207a3799519807629fc480b64791ea79962c0b67e92bff3ec095fdf2bebd49bc2e70558a2e313c0c5e3f80671d5e3d6999b6c6900e
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\LocalCache\perUserCache_0\index
Size 5KB
SHA256 226979f482e5a87dded97b1d0136e07194ea75a14394d936d4a28bc09884b977
MD5 3c86ec17fe273787c9bcc125df8ddc0b
SHA1 c91f045db32ba7cfda10fa53f0e9713e73a11405
SHA512 97f075cb1fa1f2d94c714c926960eb1092d692ceb16ed22ddb79e0f6a7d2ad6eaffc1c07f6f30217320a368a9c22076bc1c8b4bfd4bdfbc891fc932f8126763a
SSDEEP 96:UMUeTlwZYcjByS2UeTf9Y14jPmQYp7nrUeTzMErZpjKZECUeTA0MouIuluIuU7kQ:vpW1ybinrZOZvUxUxoe55ABBqxc
TLSH
T1F3C101FDB300A9FEA056C193BF317E6CC1A17EA2A086806B41D15CDE574CA542FB2D9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\LocalCache\perUserCache_0\index
Size 13KB
SHA256 f6282de7344ad8a5a86a4ee9a0ca4598d2dd4891c1900249061307b1654ecaff
MD5 32857e8c7189fb521953abd501e7a7f4
SHA1 03d0e19befc6c445801183757cd54be7f573bf3b
SHA512 b604246af798787c2a2e38e2756bd9b031940ca5e48a264f1fe9f4d8128dae6ecd65393e099ffcabe33ba8564797d1f8592d17102c9d7de6e1304aaee738ebd2
SSDEEP 192:vsx0oGUZkpW1ybinreiI6ltgZOZvbKegRUxUxoe556NXKABBqxKPDMnWiFZPj1tt:ol4qxUxo9Ti
TLSH
T1C45231EDB300A9FEA152C593BE307D78C1E0AEB1A086C13641C54DDE568C6656FB2DEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\LocalCache\perUserCache_0\index
Size 17KB
SHA256 dbd4780d2067c0d1f1e731569b7a35957bbe03da9cb491f8c90f248613357315
MD5 ff592dc0964721b4c38d9b55c1990f37
SHA1 437932f654031ecfc8c1de78c7aa766332e5a382
SHA512 a57f68640cfd9ac4358c0f2973888a7a0b2bf548bd9b97859f6db2c79996b61da2bf64e49b258c6a11cf4b05c69d54acfa386502b20990a43de994bfc8e648c1
SSDEEP 192:vsx0oGUZkpW1ybinrLiAgPeiI6ltgZOZvqpPCIpWZAKMwbKegRUxUxoe556NXKAF:oZQ4CpxUxo9rd
TLSH
T1FE8254EDA300A9BEA152C0D3BE317D78C1E0BEB16146C13642C54DEE564D6652FB2DEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\LocalCache\perUserCache_{Global}\index
Size 2KB
SHA256 a04f90ef98b624c55b509181dc39ff448db2f37415733a1b2553c7e494708883
MD5 2d03fe002ba24f05d3ea8eef0dbdf00b
SHA1 e51390d83d12196e916190ca7f7165c6c9b53d76
SHA512 6c730f60fc0544db0260006da149ca96fb3902e78e1b38a8eeda0d18525368859e041b4fccfe10a936eea929b802cafbbe134137d57cf6d653687670c79aa140
TLSH
T12651A4CF9A23E8C499D73517B5A8FC0AD931F6F2209F45A9EA071AA5030B0623D831D4
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\LocalCache\perUserCache_{Global}\index
Size 5KB
SHA256 b8eff3b4aeadbc12c43b8df0c53278e09e6e3677770163f39a9f6d4b46e0d344
MD5 2711033f45cc1d7a48565832fb59426d
SHA1 31a6a06f6c230965f72c939cf1a27fd908ead487
SHA512 1b0a19cbd1ddc31905ea3ca0bc8b54b285e5ff0fd92c9e33728b24c3b2a35845b1f736545322f62f1cee74631fb1784a566bb2f015a4af6e138d3b33a3bf085a
SSDEEP 96:UmF2+q0qhcx05C7L+057DL+gCmzLgbvpNxfJqkj6obeb7CdLzklH0AioTLc0Kyw5:DF3qXhcm5r05yg5YvjxRqkGEU7XlZiZt
TLSH
T1AEC151CF8F33E88499DB6917A8EDF805E561F66210DB4AA9DA471DF4030B0636D832E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\LocalCache\perUserCache_{Global}\index
Size 8KB
SHA256 b28e6fa8742ccce5855963833c71293df6c6f0b380443b11e28c5482873e5189
MD5 edfe04584ffed12ea4554b48c3b766ec
SHA1 b2a8471f6e3f4d11f5ba6d75ba8c138de3ec97b4
SHA512 f6525501bb458d92bc07f0e7950d7a38fd61e72378f5699b8ef3daf51ff7d751e3e6846e54512009d1ccc2bef39faab695a65e36f3b168c2d3cc7301d58dbe9b
SSDEEP 192:vyAF34gOXhcmdXvr05yg5YvjxRqkGEU7XlZifenN0S0VzKdeCkONCQEQlo0/U6EV:BFgKSQ5N2Tq1bVWtCBYJ2U03Po
TLSH
T1680243CE8F3398C469D7652BB9EDFC08E462F26214C74969DB875EA447470736E832D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\LocalCache\perUserCache_{Global}\index
Size 11KB
SHA256 5d47eff8bf98cb022ed5d54f16c98ce521f2ede507f3a396eedd339a48911538
MD5 5cc2316984f7529bd2ac325afe8a7e61
SHA1 6cf2e3c7f04817e49254efb216333ff62255193e
SHA512 205993170588ae44a65b68e8f8c5df1e5f4a05d86daf7ef43232cbc65ade49ac845e8757224656abeaa11f12aa0cd242b26da255b3d529ddc45261648a612535
SSDEEP 192:vyAF34gOXhcmdXjA5svHr05yg5YjNLjxRqkGEU7XhUSNHcZifenN0S0VzKdeCkON:BFgKuQ5NwTq1bGvWtCBFwEoX2UF3Po
TLSH
T16B4241CE8B3398D479D7651BBA9DFC08A462F26224C74E79DB970EA807471632E473D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\LocalCache\perUserCache_{Global}\index
Size 13KB
SHA256 3a1631673ac5eb27a2a559a70ef485fcd7e633d1047eacd307792daa7c5d9df0
MD5 81ae1cd42825ef95362f910f869045af
SHA1 ccb48c4f382637053706090e7865d112c888e43c
SHA512 42eca7e0c062f2eb4b56faa75f9b7e2829dbcd732b9ba82124d177077a3d67b5206786a699b61b32d567699ce2fd5b8b693ef42831df961ecb2069a9ed028852
SSDEEP 384:MoaTq1VFPxznCuUYbWv510oXPbt3KX8m+:naTeVFZznb9bI52EPx3I8B
TLSH
T18B522FCE9B3398C078D7551BBA9EFC08A562F26224C74A79DB970EA807471632E472D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\LocalCache\perUserCache_{Global}\index
Size 14KB
SHA256 1fc99a801cd7497c228d10a1e0b2fb08e4c865397870830e1d44ec0b4a4fde61
MD5 0d70708e9df4f974b1785893e14fbc8b
SHA1 466c19d347f63acfa2461f3c1b604ef58b1b585c
SHA512 f5b0a1e8fd05d94959e7ee896bbf34261eb8f838f12cab7960fc1b3700c553c9a817d20e23d21427b4dd30fa4f87f9325de46ec40588d0149811b9aa653072fb
SSDEEP 384:MoaTq1VFPzxnCuUYbWv510oXPbt3KX8j+E+:naTeVFbxnb9bI52EPx3I8j4
TLSH
T1EB623FCEDB3398C078D7551BBA9EFC18A562F26224C74E69DB970EA803471632E473D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TileCollectionCache.dat

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\TempState\TileCollectionCache.dat
Size 23KB
SHA256 1e7aea02770b4460a14caabd139e3df831786ea14fa1bbe07f843df8c97c4d72
MD5 bf81e1abdd887dfc2161e562d01cd37f
SHA1 442688c6fe573380532b42c7ce58c354d7ca07f0
SHA512 85c4663fcb5e1edb41625b3a5d7b042f78a4d68933b3a3e2cb48443c389124a5336271c36f8f3996b9f4797d01aba220fbc5e3f4a79d97923c7159792f5fad57
SSDEEP 384:xJWJzVca12krtuVm+SglBOVjeQ8RJo3hghFUjUXPW35PIm59+GDa50HIsYAVoc4F:v+zVcWrPl8RJYhgTUjUXP6t9+GDa50Hi
TLSH
T1F2B23B7436F51319F3F29F759AF1A95A643AB866AC00DB4D0122028D0977D92CEB0F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_xuvknhcg.yms.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xuvknhcg.yms.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

Install-Microsoft-Store.ps1

Path C:\Users\Admin\Downloads\Install-Microsoft-Store.ps1
Size 33KB
SHA256 ea370118b190aaef260ece514722130e8104736a8853866d24b7e3296ba7cff9
MD5 eaeee528f7e29997968bbd33e4efc201
SHA1 8b3a17ef77314788ac86dde4b4746c6db75b4cfe
SHA512 51fa54051f8b768c2fdaa9fb80d0c34ff35340959e3dfb792d1f69aecdaf6e148f194e91f9137b9dd556615732cdfe8da07f9e04776bb64650e3f23f76053853
SSDEEP 384:IKhJnZjZnEbTzawJyxNQ8PQvTgBxS6zMx5A9qq2hZW3nQ7Zn9h2Ee:PZtytJyQ8gsB9zV8q2hEG8H
TLSH
T16EF2D7299E90433C5752E2AFAC8D8844FA59917F218819D0B5DCC248BF9166DCA7F3F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Install-Microsoft-Store.ps1:Zone.Identifier

Path C:\Users\Admin\Downloads\Install-Microsoft-Store.ps1:Zone.Identifier
Size 55B
SHA256 2dfb5f4b33e4cf8237b732c02b1f2b1192ffe4b83114bcf821f489bbf48c6aa1
MD5 0f98a5550abe0fb880568b1480c96a1c
SHA1 d2ce9f7057b201d31f79f3aee2225d89f36be07d
SHA512 dbc1150d831950684ab37407defac0177b7583da0fe13ee8f8eeb65e8b05d23b357722246888189b4681b97507a4262ece96a1c458c4427a9a41d8ea8d11a2f6
TLSH
T1CA900297040444480F5535C459DC9418B11E7554CD454688EC5140D6D98409D42E9416
MD5 SHA1 SHA512 TLSH

Submit Download

memory/716-2493-0x000001EB1CB60000-0x000001EB1CB70000-memory.dmp

Download

memory/3568-2103-0x000001E759A20000-0x000001E759A3C000-memory.dmp

Download

memory/3568-2477-0x000001E759A00000-0x000001E759A0A000-memory.dmp

Download

memory/3568-2476-0x000001E759B70000-0x000001E759B8C000-memory.dmp

Download

memory/3568-2467-0x000001E75A080000-0x000001E75A5A8000-memory.dmp

Download

memory/3568-2106-0x000001E759B70000-0x000001E759B8C000-memory.dmp

Download

memory/3568-2105-0x000001E759A10000-0x000001E759A1A000-memory.dmp

Download

memory/3568-2104-0x000001E759A90000-0x000001E759B43000-memory.dmp

Download

memory/3568-2095-0x000001E759A40000-0x000001E759A86000-memory.dmp

Download

memory/3568-2090-0x000001E7594F0000-0x000001E759512000-memory.dmp

Download

memory/3900-380-0x0000026DA1CE0000-0x0000026DA2CE0000-memory.dmp

Download