killmbr | 2703821589862ff2adc92e9de69b8d0d394823e2c7257f6d090b86f27e9e20e5

Resubmissions

20/07/2026, 18:45

260720-xd4pmab13p

20/07/2026, 18:43

20/07/2026, 18:43

20/07/2026, 18:42

20/07/2026, 18:39

20/07/2026, 18:36

20/07/2026, 18:34

Analysis

user interaction
yes
max time kernel
627s
max time network
900s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 18:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
The Hell Virus (1).bat
Size 13KB
Sample260720-xdafsadv9v
SHA256 2703821589862ff2adc92e9de69b8d0d394823e2c7257f6d090b86f27e9e20e5
MD5 a84063c2368024490c57c440b14cc318
SHA1 bb4108eaf19c01d46fae9dc6166816611b1f0108
SHA512 7918c060944f0d2a15021dcfb9be7798ca06a28483eb1fb50b25f694daec6e3d922d09c91448b062c533d28cff0ecb821bc5de75c35b607d95ed28d4ecb9ac64
SSDEEP 192:Pq17N3ODNPiwc205VjF+Ijytxd+7yxpVtLoTKihWn5hhHxGtHfzf+H/0Nz6hcbXJ:q85qwc35O1+7y/LphxxGtHAhubXJ
TLSH
T181529E3236A84E131D3022C59C16E656FCE463F7362AAE21E413C9FB50AEED3725E705
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

bootkit discovery execution killmbr persistence ransomware trojan wiper

Malware Config

Signatures

Family: KillMBR
KillMBR is a trojan that attempts to overwrite the Master Boot Record.
wiper trojan killmbr

Detects KillMBR 1 IoCs

resource	yara_rule
behavioral2/files/0x001000000001c50d-190.dat	family_killmbr

Executes dropped EXE 7 IoCs

pid	Process
4768	MEMZ.exe
5424	MEMZ.exe
952	MEMZ.exe
5708	MEMZ.exe
5500	MEMZ.exe
2816	MEMZ.exe
5704	MEMZ.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	MEMZ.exe

Drops file in Windows directory 31 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1376_1295495191\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1376_1046160194\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1376_252047259\classification.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1376_322921128\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1376_1603693431\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1376_322921128\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1376_322921128\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1376_1046160194\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1376_1603693431\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1376_1910559620\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1376_1046160194\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1376_243452067\arbitration_metadata.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1376_322921128\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1376_1959436097\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1376_1046160194\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1376_252047259\travel-facilitated-booking-bing.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1376_1992102767\deny_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1376_252047259\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1376_1603693431\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1376_1992102767\deny_etld1_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1376_252047259\automation.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1376_383473824\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1376_383473824\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1376_1959436097\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1376_1910559620\crl-set	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1376_243452067\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1376_252047259\extraction.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1376_252047259\travel-facilitated-booking-kayak.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1376_1603693431\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1376_1992102767\deny_full_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1376_1992102767\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4556	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mspaint.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mspaint.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mspaint.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	win32calc.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2372	msedge.exe

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	svchost.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134290467134222962"	msedge.exe

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings	calc.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3986082593-3624157295-3514260330-1000\{44467EB7-671B-4502-9E75-ADF082CBBB1F}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe

Runs regedit.exe 3 IoCs

pid	Process
2592	regedit.exe
2756	regedit.exe
7952	regedit.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5424	MEMZ.exe
5424	MEMZ.exe
952	MEMZ.exe
952	MEMZ.exe
5424	MEMZ.exe
5424	MEMZ.exe
952	MEMZ.exe
952	MEMZ.exe
5424	MEMZ.exe
5424	MEMZ.exe
952	MEMZ.exe
952	MEMZ.exe
5424	MEMZ.exe
5424	MEMZ.exe
952	MEMZ.exe
952	MEMZ.exe
5708	MEMZ.exe
5708	MEMZ.exe
5424	MEMZ.exe
5424	MEMZ.exe
5708	MEMZ.exe
5708	MEMZ.exe
952	MEMZ.exe
952	MEMZ.exe
5500	MEMZ.exe
5500	MEMZ.exe
5424	MEMZ.exe
5424	MEMZ.exe
5500	MEMZ.exe
5500	MEMZ.exe
952	MEMZ.exe
952	MEMZ.exe
5708	MEMZ.exe
5708	MEMZ.exe
5424	MEMZ.exe
5424	MEMZ.exe
5500	MEMZ.exe
5500	MEMZ.exe
2816	MEMZ.exe
2816	MEMZ.exe
5424	MEMZ.exe
5424	MEMZ.exe
2816	MEMZ.exe
2816	MEMZ.exe
5500	MEMZ.exe
5500	MEMZ.exe
5708	MEMZ.exe
5708	MEMZ.exe
952	MEMZ.exe
952	MEMZ.exe
5424	MEMZ.exe
5424	MEMZ.exe
5708	MEMZ.exe
5708	MEMZ.exe
5500	MEMZ.exe
2816	MEMZ.exe
5500	MEMZ.exe
2816	MEMZ.exe
5424	MEMZ.exe
5424	MEMZ.exe
2816	MEMZ.exe
2816	MEMZ.exe
5500	MEMZ.exe
5500	MEMZ.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
5412	mmc.exe
5704	MEMZ.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 61 IoCs

pid	Process
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: 33	3484	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3484	AUDIODG.EXE
Token: 33	5412	mmc.exe
Token: SeIncBasePriorityPrivilege	5412	mmc.exe
Token: 33	5412	mmc.exe
Token: SeIncBasePriorityPrivilege	5412	mmc.exe
Token: 33	5412	mmc.exe
Token: SeIncBasePriorityPrivilege	5412	mmc.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
248	cscript.exe
1376	msedge.exe

Suspicious use of SetWindowsHookEx 43 IoCs

pid	Process
5620	mspaint.exe
5620	mspaint.exe
5620	mspaint.exe
5620	mspaint.exe
2536	mmc.exe
5412	mmc.exe
5412	mmc.exe
5704	MEMZ.exe
1176	mspaint.exe
1176	mspaint.exe
1176	mspaint.exe
1176	mspaint.exe
5704	MEMZ.exe
5704	MEMZ.exe
5704	MEMZ.exe
5704	MEMZ.exe
5704	MEMZ.exe
5704	MEMZ.exe
5704	MEMZ.exe
5704	MEMZ.exe
5704	MEMZ.exe
5704	MEMZ.exe
5704	MEMZ.exe
5704	MEMZ.exe
5704	MEMZ.exe
5704	MEMZ.exe
5704	MEMZ.exe
5704	MEMZ.exe
5704	MEMZ.exe
5704	MEMZ.exe
5704	MEMZ.exe
5704	MEMZ.exe
5704	MEMZ.exe
5704	MEMZ.exe
5704	MEMZ.exe
5704	MEMZ.exe
5704	MEMZ.exe
5704	MEMZ.exe
7944	mspaint.exe
7944	mspaint.exe
7944	mspaint.exe
7944	mspaint.exe
5704	MEMZ.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4556 wrote to memory of 248	4556	cmd.exe	90
PID 4556 wrote to memory of 4768	4556	cmd.exe	91
PID 4768 wrote to memory of 5424	4768	MEMZ.exe	93
PID 4768 wrote to memory of 952	4768	MEMZ.exe	94
PID 4768 wrote to memory of 5708	4768	MEMZ.exe	95
PID 4768 wrote to memory of 5500	4768	MEMZ.exe	96
PID 4768 wrote to memory of 2816	4768	MEMZ.exe	97
PID 4768 wrote to memory of 5704	4768	MEMZ.exe	98
PID 5704 wrote to memory of 936	5704	MEMZ.exe	99
PID 5704 wrote to memory of 5620	5704	MEMZ.exe	102
PID 5704 wrote to memory of 1376	5704	MEMZ.exe	107
PID 1376 wrote to memory of 4884	1376	msedge.exe	108
PID 1376 wrote to memory of 1792	1376	msedge.exe	110
PID 1376 wrote to memory of 2372	1376	msedge.exe	111
PID 1376 wrote to memory of 1792	1376	msedge.exe	110
PID 1376 wrote to memory of 1792	1376	msedge.exe	110
PID 1376 wrote to memory of 920	1376	msedge.exe	112
PID 1376 wrote to memory of 920	1376	msedge.exe	112
PID 1376 wrote to memory of 2900	1376	msedge.exe	113
PID 1376 wrote to memory of 2900	1376	msedge.exe	113
PID 1376 wrote to memory of 2900	1376	msedge.exe	113
PID 1376 wrote to memory of 1940	1376	msedge.exe	114
PID 1376 wrote to memory of 1940	1376	msedge.exe	114
PID 1376 wrote to memory of 1940	1376	msedge.exe	114
PID 1376 wrote to memory of 264	1376	msedge.exe	115
PID 1376 wrote to memory of 264	1376	msedge.exe	115
PID 1376 wrote to memory of 264	1376	msedge.exe	115
PID 1376 wrote to memory of 4932	1376	msedge.exe	116
PID 1376 wrote to memory of 4932	1376	msedge.exe	116
PID 1376 wrote to memory of 4932	1376	msedge.exe	116
PID 1376 wrote to memory of 1124	1376	msedge.exe	117
PID 1376 wrote to memory of 1124	1376	msedge.exe	117
PID 1376 wrote to memory of 1896	1376	msedge.exe	119
PID 1376 wrote to memory of 1896	1376	msedge.exe	119
PID 1376 wrote to memory of 1896	1376	msedge.exe	119
PID 1376 wrote to memory of 1380	1376	msedge.exe	120
PID 1376 wrote to memory of 1380	1376	msedge.exe	120
PID 1376 wrote to memory of 1380	1376	msedge.exe	120
PID 1376 wrote to memory of 5788	1376	msedge.exe	121
PID 1376 wrote to memory of 5564	1376	msedge.exe	122
PID 1376 wrote to memory of 5788	1376	msedge.exe	121
PID 1376 wrote to memory of 5564	1376	msedge.exe	122
PID 1376 wrote to memory of 2704	1376	msedge.exe	124
PID 1376 wrote to memory of 6068	1376	msedge.exe	125
PID 1376 wrote to memory of 6068	1376	msedge.exe	125
PID 1376 wrote to memory of 5672	1376	msedge.exe	126
PID 1376 wrote to memory of 5672	1376	msedge.exe	126
PID 5704 wrote to memory of 1496	5704	MEMZ.exe	130
PID 1376 wrote to memory of 3064	1376	msedge.exe	131
PID 1376 wrote to memory of 3064	1376	msedge.exe	131
PID 1376 wrote to memory of 3064	1376	msedge.exe	131
PID 1376 wrote to memory of 3756	1376	msedge.exe	132
PID 1376 wrote to memory of 3756	1376	msedge.exe	132
PID 1376 wrote to memory of 3756	1376	msedge.exe	132
PID 1376 wrote to memory of 3024	1376	msedge.exe	133
PID 1376 wrote to memory of 5896	1376	msedge.exe	134
PID 1376 wrote to memory of 3940	1376	msedge.exe	135
PID 5704 wrote to memory of 2856	5704	MEMZ.exe	136
PID 1376 wrote to memory of 4900	1376	msedge.exe	137
PID 1376 wrote to memory of 4900	1376	msedge.exe	137
PID 1376 wrote to memory of 4900	1376	msedge.exe	137
PID 1376 wrote to memory of 3532	1376	msedge.exe	138
PID 1376 wrote to memory of 3532	1376	msedge.exe	138
PID 1376 wrote to memory of 3532	1376	msedge.exe	138

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\The Hell Virus (1).bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4556
- C:\Windows\system32\cscript.exe
  cscript x.js
  2⤵
  - Suspicious use of FindShellTrayWindow
  PID:248
- C:\Users\Admin\AppData\Roaming\MEMZ.exe
  "C:\Users\Admin\AppData\Roaming\MEMZ.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4768
- - C:\Users\Admin\AppData\Roaming\MEMZ.exe
    "C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:5424
- - C:\Users\Admin\AppData\Roaming\MEMZ.exe
    "C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:952
- - C:\Users\Admin\AppData\Roaming\MEMZ.exe
    "C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:5708
- - C:\Users\Admin\AppData\Roaming\MEMZ.exe
    "C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:5500
- - C:\Users\Admin\AppData\Roaming\MEMZ.exe
    "C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:2816
- - C:\Users\Admin\AppData\Roaming\MEMZ.exe
    "C:\Users\Admin\AppData\Roaming\MEMZ.exe" /main
    3⤵
    - Executes dropped EXE
    - Writes to the Master Boot Record (MBR)
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5704
  - - C:\Windows\SysWOW64\notepad.exe
      "C:\Windows\System32\notepad.exe" \note.txt
      4⤵
      System Location Discovery: System Language Discovery
      PID:936
  - - C:\Windows\SysWOW64\mspaint.exe
      "C:\Windows\System32\mspaint.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:5620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+to+remove+memz+trojan+virus
      4⤵
      Drops file in Windows directory
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:1376
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2c0,0x300,0x7ffa0b8ac188,0x7ffa0b8ac194,0x7ffa0b8ac1a0
        5⤵
        
        PID:4884
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1932,i,15760933156798445302,4587970191667000464,262144 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=2504 /prefetch:2
        5⤵
        
        PID:1792
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2132,i,7771243898052753839,8193716698400249083,524288 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=2536 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:2372
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2632,i,14286835941434637596,2504798542979442315,524288 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=3192 /prefetch:13
        5⤵
        
        PID:920
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3564,i,7621723435455918887,10145800047991455820,2097152 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
        5⤵
        
        PID:2900
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3640,i,16780226460257128889,8360809109867639178,2097152 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
        5⤵
        
        PID:1940
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4140,i,5137475981901579823,850444939830875369,2097152 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:1
        5⤵
        
        PID:264
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4164,i,4856584165615021288,1544312613246201578,2097152 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:9
        5⤵
        
        PID:4932
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3616,i,14958972475901860055,5753505232419900574,524288 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:14
        5⤵
        
        PID:1124
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5336,i,14005220322191354095,8086412662380321979,2097152 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:1
        5⤵
        
        PID:1896
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3776,i,9202290125602111232,3772704105333001096,2097152 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=3772 /prefetch:1
        5⤵
        
        PID:1380
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4396,i,8707330145158600252,13326892870235889135,524288 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=4580 /prefetch:14
        5⤵
        
        PID:5788
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4388,i,12098689807568468633,9461610336146815177,524288 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=4548 /prefetch:14
        5⤵
        
        PID:5564
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,8189369714874058895,4057221653697419555,524288 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:14
        5⤵
        
        PID:3324
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,8189369714874058895,4057221653697419555,524288 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:14
        5⤵
        
        PID:2704
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,18020199184328503199,336900377687568807,524288 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:14
        5⤵
        
        PID:6068
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6468,i,6741210909605676458,1936032654555270834,524288 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:14
        5⤵
        
        PID:5672
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=3624,i,5587833957132616058,14275366391774231885,2097152 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:1
        5⤵
        
        PID:3064
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6780,i,10494724953448996645,5376037491396648123,2097152 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=6808 /prefetch:1
        5⤵
        
        PID:3756
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1280,i,3535041429822675160,13232289187079703786,524288 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=1424 /prefetch:14
        5⤵
        
        PID:3024
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1436,i,4171560147666359528,2012635467319882126,524288 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=1300 /prefetch:14
        5⤵
        
        PID:5896
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1444,i,10843025386443775407,4071812556900906979,524288 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=3772 /prefetch:14
        5⤵
        
        PID:3940
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=1256,i,8479955572347700341,15957942439518613658,2097152 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:1
        5⤵
        
        PID:4900
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=4360,i,3855864925822410398,477990468813970307,2097152 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:1
        5⤵
        
        PID:3532
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7104,i,14727844389868112763,8412580594551572774,524288 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=7108 /prefetch:14
        5⤵
        
        PID:4956
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6180,i,2540608100488394736,8795989100295842786,2097152 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=6648 /prefetch:1
        5⤵
        
        PID:2432
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7156,i,2322845242681216778,4675217612713025332,2097152 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=6540 /prefetch:1
        5⤵
        
        PID:3420
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5080,i,11382034673496354230,11931134619322236384,524288 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=1296 /prefetch:14
        5⤵
        
        PID:620
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=5472,i,6986679754015928803,17668709376524407219,2097152 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:1
        5⤵
        
        PID:2668
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=1424,i,3477900298211986257,17999930440471474369,2097152 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=6632 /prefetch:1
        5⤵
        
        PID:4340
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6608,i,14325716738942595593,9738177404299116820,262144 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:10
        5⤵
        
        PID:1352
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7196,i,1294633343341676366,8293359187917435769,524288 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=6572 /prefetch:14
        5⤵
        
        PID:5316
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5080,i,6359194715678919480,1712334283545802533,524288 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:14
        5⤵
        
        PID:4276
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5040,i,17095536530338605991,8017060681290657346,524288 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:14
        5⤵
        
        PID:700
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4588,i,5744929894297068030,14910637025638832195,524288 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=4560 /prefetch:14
        5⤵
        
        PID:568
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,5985289793851186256,9375094972556307712,524288 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:14
        5⤵
        
        PID:3364
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=6584,i,9512237015713461610,4981213710562386127,2097152 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:1
        5⤵
        
        PID:248
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=7456,i,4572991423399113827,15853555465264365511,2097152 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=7448 /prefetch:1
        5⤵
        
        PID:4920
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=7640,i,8609891879026269854,1401632477129109664,2097152 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=7664 /prefetch:1
        5⤵
        
        PID:3164
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=7736,i,4954150391570615942,4157643135192455772,2097152 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=7376 /prefetch:1
        5⤵
        
        PID:484
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7436,i,6977014194022212972,5548565441662907858,524288 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=7860 /prefetch:14
        5⤵
        
        PID:4964
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=3636,i,12012430242761019751,7426007049377657699,2097152 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:1
        5⤵
        
        PID:3948
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=4544,i,6335454752560553578,383095727072403035,2097152 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=7920 /prefetch:1
        5⤵
        
        PID:3456
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=8004,i,14219054270612636158,15228218076113891158,2097152 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=7776 /prefetch:1
        5⤵
        
        PID:5480
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=7516,i,10533696773990232208,4605748985858061022,2097152 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=7396 /prefetch:1
        5⤵
        
        PID:3044
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7816,i,14500527790517163209,16532216420424875824,524288 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=7632 /prefetch:14
        5⤵
        
        PID:2824
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=7828,i,3517980470029349634,10774012127290992728,2097152 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=7860 /prefetch:1
        5⤵
        
        PID:1100
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=8068,i,10969472287412285507,3838382663915657799,2097152 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=8044 /prefetch:1
        5⤵
        
        PID:916
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=7596,i,749264820677850803,1525404641326898267,2097152 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=7216 /prefetch:1
        5⤵
        
        PID:7124
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=7460,i,4369459023442618495,6169237894461694328,2097152 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=8200 /prefetch:1
        5⤵
        
        PID:7140
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7780,i,10817784748480008799,9156065711596650077,524288 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=7560 /prefetch:14
        5⤵
        
        PID:7032
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8396,i,16074120967810267916,7043244377430839080,524288 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=7508 /prefetch:14
        5⤵
        
        PID:6500
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=6040,i,16368204345462404317,13475111598276411778,2097152 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=8416 /prefetch:1
        5⤵
        
        PID:6912
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --metrics-shmem-handle=8372,i,546725541160281373,13791811920614286283,2097152 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=8436 /prefetch:1
        5⤵
        
        PID:6888
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --always-read-main-dll --metrics-shmem-handle=8600,i,5663340561820114239,10114446137946150254,2097152 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:1
        5⤵
        
        PID:2508
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --metrics-shmem-handle=8656,i,15790175364034946530,14136124311107288897,2097152 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:1
        5⤵
        
        PID:3588
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8504,i,357712324088097885,11739991407889099386,524288 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=8492 /prefetch:14
        5⤵
        
        PID:2456
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --always-read-main-dll --metrics-shmem-handle=7508,i,2117814062776928575,4838610000217403401,2097152 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=8848 /prefetch:1
        5⤵
        
        PID:6432
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --always-read-main-dll --metrics-shmem-handle=8864,i,9615112321992747550,12320493598366972492,2097152 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=8440 /prefetch:1
        5⤵
        
        PID:6476
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --always-read-main-dll --metrics-shmem-handle=8788,i,10313113929902138693,2044628509912255194,2097152 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=8724 /prefetch:1
        5⤵
        
        PID:6804
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --always-read-main-dll --metrics-shmem-handle=9012,i,11826711701860647217,13519723816633379974,2097152 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=9004 /prefetch:1
        5⤵
        
        PID:6564
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9000,i,12706226527015147324,14157361956859005179,524288 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=9168 /prefetch:14
        5⤵
        
        PID:4492
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --always-read-main-dll --metrics-shmem-handle=6136,i,12974773535170521871,14832909245806949812,2097152 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=9176 /prefetch:1
        5⤵
        
        PID:3556
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --always-read-main-dll --metrics-shmem-handle=7816,i,17716054008996942750,2721491356664614605,2097152 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=8736 /prefetch:1
        5⤵
        
        PID:6464
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --always-read-main-dll --metrics-shmem-handle=8824,i,14562381552865553101,18283535388100406039,2097152 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=9316 /prefetch:1
        5⤵
        
        PID:2504
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --always-read-main-dll --metrics-shmem-handle=9092,i,16081259928514088380,13242954353706285602,2097152 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=8864 /prefetch:1
        5⤵
        
        PID:6284
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --always-read-main-dll --metrics-shmem-handle=9508,i,2362400876486695593,4698307019981577663,2097152 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=9284 /prefetch:1
        5⤵
        
        PID:4488
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --always-read-main-dll --metrics-shmem-handle=8440,i,17884637352136140952,16262533500714924805,2097152 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=9556 /prefetch:1
        5⤵
        
        PID:4064
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --always-read-main-dll --metrics-shmem-handle=9108,i,4847454779256344833,3207315398939098736,2097152 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=9480 /prefetch:1
        5⤵
        
        PID:7040
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --always-read-main-dll --metrics-shmem-handle=9584,i,10927897549236914802,8781975542855745537,2097152 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=9676 /prefetch:1
        5⤵
        
        PID:4648
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --always-read-main-dll --metrics-shmem-handle=9356,i,9035835867598291731,331050333613052324,2097152 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=9524 /prefetch:1
        5⤵
        
        PID:6888
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --always-read-main-dll --metrics-shmem-handle=9496,i,5458072854236795076,10425484387318771736,2097152 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=9464 /prefetch:1
        5⤵
        
        PID:5536
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9612,i,15055255488144150665,15887797763453633282,524288 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=8384 /prefetch:14
        5⤵
        
        PID:1564
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --always-read-main-dll --metrics-shmem-handle=9596,i,7518416685142817160,4717604144200772742,2097152 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=9608 /prefetch:1
        5⤵
        
        PID:5732
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --always-read-main-dll --metrics-shmem-handle=9868,i,8074949726505032326,4858510226489107270,2097152 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=9900 /prefetch:1
        5⤵
        
        PID:3288
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --always-read-main-dll --metrics-shmem-handle=9384,i,3187119705283263440,17652930656819851500,2097152 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=9432 /prefetch:1
        5⤵
        
        PID:5260
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --always-read-main-dll --metrics-shmem-handle=9660,i,127336701754451687,14605108334843938236,2097152 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=9648 /prefetch:1
        5⤵
        
        PID:1324
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --always-read-main-dll --metrics-shmem-handle=9932,i,16317573747169630801,10818744492666782995,2097152 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=9420 /prefetch:1
        5⤵
        
        PID:6740
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --always-read-main-dll --metrics-shmem-handle=9988,i,251177922473131409,1422450896527456376,2097152 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=10216 /prefetch:1
        5⤵
        
        PID:4048
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --always-read-main-dll --metrics-shmem-handle=10364,i,10462058522593196811,1738168067402441394,2097152 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=10088 /prefetch:1
        5⤵
        
        PID:7132
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --always-read-main-dll --metrics-shmem-handle=10432,i,17224677622715810549,14086819750273380551,2097152 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=9876 /prefetch:1
        5⤵
        
        PID:5820
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=10352,i,11609430274565348990,5241832626810945897,524288 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=10540 /prefetch:14
        5⤵
        
        PID:6944
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --always-read-main-dll --metrics-shmem-handle=8288,i,5899282240298146323,11467111443350690803,2097152 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=10580 /prefetch:1
        5⤵
        
        PID:6236
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=84 --always-read-main-dll --metrics-shmem-handle=10592,i,18301499645542242368,9318838971479269067,2097152 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=10264 /prefetch:1
        5⤵
        
        PID:6228
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=85 --always-read-main-dll --metrics-shmem-handle=8312,i,5873981032422083532,4619732364462002757,2097152 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:1
        5⤵
        
        PID:6664
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=86 --always-read-main-dll --metrics-shmem-handle=10828,i,8667878281596106232,7139601648018387965,2097152 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=10840 /prefetch:1
        5⤵
        
        PID:4048
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=87 --always-read-main-dll --metrics-shmem-handle=10628,i,2966636573798918852,13755032249096016184,2097152 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=10656 /prefetch:1
        5⤵
        
        PID:7424
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=88 --always-read-main-dll --metrics-shmem-handle=10984,i,1386554789033425431,14518611375709321374,2097152 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=10764 /prefetch:1
        5⤵
        
        PID:7464
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=89 --always-read-main-dll --metrics-shmem-handle=10792,i,2012802758464779288,4136898012786281707,2097152 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=10828 /prefetch:1
        5⤵
        
        PID:8136
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=90 --always-read-main-dll --metrics-shmem-handle=10868,i,1480213305897788584,1832988173050589082,2097152 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=10928 /prefetch:1
        5⤵
        
        PID:4744
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=10540,i,2232322329093566169,17898049025096548728,524288 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=10972 /prefetch:14
        5⤵
        
        PID:7456
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=92 --always-read-main-dll --metrics-shmem-handle=10420,i,17322803321206314833,4431560767721579312,2097152 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=8244 /prefetch:1
        5⤵
        
        PID:3088
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=93 --always-read-main-dll --metrics-shmem-handle=10856,i,3643799534805802343,2341397211524590545,2097152 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=11056 /prefetch:1
        5⤵
        
        PID:7332
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=94 --always-read-main-dll --metrics-shmem-handle=11088,i,9627726286756462024,264761610088288413,2097152 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=11084 /prefetch:1
        5⤵
        
        PID:7796
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=10704,i,9206199325930767399,13221921417622127825,524288 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=8216 /prefetch:14
        5⤵
        
        PID:7248
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=10972,i,11010418214397090467,15957403218590147125,524288 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=10092 /prefetch:14
        5⤵
        
        PID:7292
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=97 --always-read-main-dll --metrics-shmem-handle=11396,i,5217004456878433446,15032019478657280941,2097152 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=11416 /prefetch:1
        5⤵
        
        PID:8076
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=98 --always-read-main-dll --metrics-shmem-handle=11552,i,12837448326930751706,3685737806333824192,2097152 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=10420 /prefetch:1
        5⤵
        
        PID:4924
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=99 --always-read-main-dll --metrics-shmem-handle=11600,i,7499933209432093491,15091000098414761330,2097152 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=11544 /prefetch:1
        5⤵
        
        PID:7700
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=100 --always-read-main-dll --metrics-shmem-handle=11028,i,16451332387345831527,13833344339948327116,2097152 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=11472 /prefetch:1
        5⤵
        
        PID:7964
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=101 --always-read-main-dll --metrics-shmem-handle=11204,i,17437206008589972823,16455748829577798967,2097152 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=11156 /prefetch:1
        5⤵
        
        PID:7992
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=102 --always-read-main-dll --metrics-shmem-handle=11940,i,2116819432480708363,7946601968293469961,2097152 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=11872 /prefetch:1
        5⤵
        
        PID:9148
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=103 --always-read-main-dll --metrics-shmem-handle=11428,i,18064275105367837286,13921158027211994820,2097152 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=10992 /prefetch:1
        5⤵
        
        PID:9188
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=104 --always-read-main-dll --metrics-shmem-handle=11884,i,1339562526862487274,352959607961088944,2097152 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=10256 /prefetch:1
        5⤵
        
        PID:8328
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=105 --always-read-main-dll --metrics-shmem-handle=12120,i,17756324972936646962,13792082960175710746,2097152 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=11020 /prefetch:1
        5⤵
        
        PID:8596
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=106 --always-read-main-dll --metrics-shmem-handle=12212,i,8252775139798911850,16678810771710392865,2097152 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=12248 /prefetch:1
        5⤵
        
        PID:8588
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=12284,i,6647064267215570726,16602985779397314063,524288 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=11204 /prefetch:14
        5⤵
        
        PID:3424
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=108 --always-read-main-dll --metrics-shmem-handle=11928,i,8153335443987302728,15253482747256986617,2097152 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=12456 /prefetch:1
        5⤵
        
        PID:8024
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=109 --always-read-main-dll --metrics-shmem-handle=12184,i,8220044858752343390,16807390273563741364,2097152 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=12204 /prefetch:1
        5⤵
        
        PID:8936
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=110 --always-read-main-dll --metrics-shmem-handle=11820,i,1977253702288525073,13181004599807332432,2097152 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=9520 /prefetch:1
        5⤵
        
        PID:8860
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=111 --always-read-main-dll --metrics-shmem-handle=11036,i,10185016205818008399,16753392773435267726,2097152 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=12620 /prefetch:1
        5⤵
        
        PID:8704
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=112 --always-read-main-dll --metrics-shmem-handle=12100,i,14458155208489622018,11427717722515301654,2097152 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=12692 /prefetch:1
        5⤵
        
        PID:6616
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=113 --always-read-main-dll --metrics-shmem-handle=12168,i,12371635026252693948,17076331650761685097,2097152 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=12352 /prefetch:1
        5⤵
        
        PID:8432
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=114 --always-read-main-dll --metrics-shmem-handle=12324,i,12353039747780236245,11747116378834688802,2097152 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=12396 /prefetch:1
        5⤵
        
        PID:8412
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=115 --always-read-main-dll --metrics-shmem-handle=12664,i,5994198525015138101,8322071151966191057,2097152 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=12328 /prefetch:1
        5⤵
        
        PID:8284
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=116 --always-read-main-dll --metrics-shmem-handle=12176,i,2624000588422110951,5552721484582693594,2097152 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=9588 /prefetch:1
        5⤵
        
        PID:7860
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=117 --always-read-main-dll --metrics-shmem-handle=11896,i,1542082405445043689,869083631255685758,2097152 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=12956 /prefetch:1
        5⤵
        
        PID:6644
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=118 --always-read-main-dll --metrics-shmem-handle=12884,i,9477781052665523125,11796483265023322430,2097152 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=12180 /prefetch:1
        5⤵
        
        PID:7376
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=119 --always-read-main-dll --metrics-shmem-handle=12748,i,6181564464664208643,3694807233285058682,2097152 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=13012 /prefetch:1
        5⤵
        
        PID:2828
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=120 --always-read-main-dll --metrics-shmem-handle=13372,i,5240172908858821136,49052172113919902,2097152 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=13360 /prefetch:1
        5⤵
        
        PID:9212
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=121 --always-read-main-dll --metrics-shmem-handle=13280,i,2989474198743942852,10394738227254619373,2097152 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=12392 /prefetch:1
        5⤵
        
        PID:3396
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=122 --always-read-main-dll --metrics-shmem-handle=13012,i,14051933849404328388,9921640832263897076,2097152 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=13336 /prefetch:1
        5⤵
        
        PID:10052
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=123 --always-read-main-dll --metrics-shmem-handle=11008,i,4862046602510015521,713939758455423165,2097152 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=13008 /prefetch:1
        5⤵
        
        PID:10060
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=124 --always-read-main-dll --metrics-shmem-handle=12748,i,12119597413849542283,10894008170573497806,2097152 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=13860 /prefetch:1
        5⤵
        
        PID:3576
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=125 --always-read-main-dll --metrics-shmem-handle=13940,i,14434912396367572409,7008559171468960123,2097152 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=13932 /prefetch:1
        5⤵
        
        PID:9472
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=126 --always-read-main-dll --metrics-shmem-handle=14108,i,9420391639205264476,6583265144479367301,2097152 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=14132 /prefetch:1
        5⤵
        
        PID:9264
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=127 --always-read-main-dll --metrics-shmem-handle=14096,i,10961539905929384918,7538602868604940607,2097152 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=14140 /prefetch:1
        5⤵
        
        PID:9280
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=128 --always-read-main-dll --metrics-shmem-handle=14244,i,17652872978257740944,16234287496003843794,2097152 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=14308 /prefetch:1
        5⤵
        
        PID:9808
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=129 --always-read-main-dll --metrics-shmem-handle=14380,i,1767195284582182938,17708664313003723951,2097152 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=14400 /prefetch:1
        5⤵
        
        PID:8972
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=130 --always-read-main-dll --metrics-shmem-handle=14480,i,16088147292890783804,6931094300440738757,2097152 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=11020 /prefetch:1
        5⤵
        
        PID:10224
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=131 --always-read-main-dll --metrics-shmem-handle=14464,i,17670410153432255882,11866078184138806136,2097152 --field-trial-handle=2508,i,6958614562579082698,956436225399525426,262144 --variations-seed-version --mojo-platform-channel-handle=14552 /prefetch:1
        5⤵
        
        PID:7672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=the+memz+are+real
      4⤵
      PID:1496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=skrillex+scay+onster+an+nice+sprites+midi
      4⤵
      PID:2856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=skrillex+scay+onster+an+nice+sprites+midi
      4⤵
      PID:1536
  - - C:\Windows\SysWOW64\mmc.exe
      "C:\Windows\System32\mmc.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2536
    - - C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe"
        5⤵
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:5412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=bonzi+buddy+download+free
      4⤵
      PID:2932
  - - C:\Windows\SysWOW64\mspaint.exe
      "C:\Windows\System32\mspaint.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1176
  - - C:\Windows\SysWOW64\notepad.exe
      "C:\Windows\System32\notepad.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=batch+virus+download
      4⤵
      PID:3292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=batch+virus+download
      4⤵
      PID:2852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=facebook+hacking+tool+free+download+no+virus+working+2016
      4⤵
      PID:5900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=facebook+hacking+tool+free+download+no+virus+working+2016
      4⤵
      PID:1248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=internet+explorer+is+the+best+browser
      4⤵
      PID:708
  - - C:\Windows\SysWOW64\notepad.exe
      "C:\Windows\System32\notepad.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=the+memz+are+real
      4⤵
      PID:7108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+to+code+a+virus+in+visual+basic
      4⤵
      PID:6856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=montage+parody+making+program+2016
      4⤵
      PID:2504
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+to+send+a+virus+to+my+friend
      4⤵
      PID:3532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=internet+explorer+is+the+best+browser
      4⤵
      PID:3216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=batch+virus+download
      4⤵
      PID:6332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=internet+explorer+is+the+best+browser
      4⤵
      PID:5484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://motherboard.vice.com/read/watch-this-malware-turn-a-computer-into-a-digital-hellscape
      4⤵
      PID:1756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=is+illuminati+real
      4⤵
      PID:436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=g3t+r3kt
      4⤵
      PID:3284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=skrillex+scay+onster+an+nice+sprites+midi
      4⤵
      PID:6592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+to+get+money
      4⤵
      PID:3216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=is+illuminati+real
      4⤵
      PID:6236
  - - C:\Windows\SysWOW64\regedit.exe
      "C:\Windows\System32\regedit.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Runs regedit.exe
      PID:2592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=mcafee+vs+norton
      4⤵
      PID:4048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+to+download+memz
      4⤵
      PID:6692
  - - C:\Windows\SysWOW64\calc.exe
      "C:\Windows\System32\calc.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:7840
    - - C:\Windows\SysWOW64\win32calc.exe
        
        "C:\Windows\System32\win32calc.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=montage+parody+making+program+2016
      4⤵
      PID:7392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+to+code+a+virus+in+visual+basic
      4⤵
      PID:8116
  - - C:\Windows\SysWOW64\mspaint.exe
      "C:\Windows\System32\mspaint.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:7944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=mcafee+vs+norton
      4⤵
      PID:4340
  - - C:\Windows\SysWOW64\regedit.exe
      "C:\Windows\System32\regedit.exe"
      4⤵
      Runs regedit.exe
      PID:2756
  - - C:\Windows\SysWOW64\control.exe
      "C:\Windows\System32\control.exe"
      4⤵
      PID:7544
  - - C:\Windows\SysWOW64\notepad.exe
      "C:\Windows\System32\notepad.exe"
      4⤵
      PID:4340
  - - C:\Windows\SysWOW64\regedit.exe
      "C:\Windows\System32\regedit.exe"
      4⤵
      Runs regedit.exe
      PID:7952
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:8084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=virus+builder+legit+free+download
      4⤵
      PID:7780
  - - C:\Windows\SysWOW64\control.exe
      "C:\Windows\System32\control.exe"
      4⤵
      PID:7656
  - - C:\Windows\SysWOW64\explorer.exe
      "C:\Windows\System32\explorer.exe"
      4⤵
      PID:7852
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:8580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+to+get+money
      4⤵
      PID:9132
  - - C:\Windows\SysWOW64\Taskmgr.exe
      "C:\Windows\System32\Taskmgr.exe"
      4⤵
      PID:7976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=minecraft+hax+download+no+virus
      4⤵
      PID:2384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=half+life+3+release+date
      4⤵
      PID:8756
  - - C:\Windows\SysWOW64\mspaint.exe
      "C:\Windows\System32\mspaint.exe"
      4⤵
      PID:6376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=vinesauce+meme+collection
      4⤵
      PID:6900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=best+way+to+kill+yourself
      4⤵
      PID:7988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=virus+builder+legit+free+download
      4⤵
      PID:4244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+to+code+a+virus+in+visual+basic
      4⤵
      PID:8424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=mcafee+vs+norton
      4⤵
      PID:108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=is+illuminati+real
      4⤵
      PID:9576
  - - C:\Windows\SysWOW64\calc.exe
      "C:\Windows\System32\calc.exe"
      4⤵
      PID:9948
    - - C:\Windows\SysWOW64\win32calc.exe
        
        "C:\Windows\System32\win32calc.exe"
        5⤵
        
        PID:10012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+to+download+memz
      4⤵
      PID:5236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=dank+memz
      4⤵
      PID:10192
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=batch+virus+download
      4⤵
      PID:8504
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://pcoptimizerpro.com/
      4⤵
      PID:10148
  - - C:\Windows\SysWOW64\control.exe
      "C:\Windows\System32\control.exe"
      4⤵
      PID:9608

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
- Checks SCSI registry key(s)
PID:2072

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4880

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2840

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3096

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x0000000000000494 0x00000000000004A0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3484

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
1⤵
PID:7316

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
PID:6624

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:7236

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Windows Command Shell

T1059.003

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6894a79f-d52c-4cda-9527-7a116bf4e0ae.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6894a79f-d52c-4cda-9527-7a116bf4e0ae.tmp
Size 392B
SHA256 88df02a50876f2b84059c628ca901e475d47db9403fcf07d5c93349976d89202
MD5 6cea39a5107247b3eb8aa7f55e2cb41d
SHA1 aa8e1f0292a48994a25868e5903182e7d2ebe5f3
SHA512 776612876ae624f64e31a830d2e720291d50ab93f807e826d7313b36029a3b9644d006e440b9e40a96cb623a6b558ebe665a6fadf3399e2679a4c239ae95ed83
TLSH
T126E01C07F35180FFC0290B3000A32B26ABE7882053F30B230A11A2203CA33902E30AD0
MD5 SHA1 SHA512 TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 8bd193269cbc0101b18807144d6cd741576381f849ecee6df4fd3079b1e2a2ea
MD5 7f4cc8bd47cae9e9cfcbdc3a9dea31d4
SHA1 6406135db9fdcf767dc9e78333ef0cb8dfd551a1
SHA512 894acd81265a2f42a77360eaacfcdb7e50c7d9b0a2718871318cc1ab538e27cb24b8d3dba4cdc1a6de030a8f0012aac3b2f7e8fbaaf939ef83c5f7ce1469a61f
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7S:fwUQC5VwBIiElEd2K57P7S
TLSH
T1A2B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 18a644ba613d5b4137dabc346f57eca622b6888922eaec751025ab3c0a002fd5
MD5 5eddc74c05def624cfd47ea0a7e304a5
SHA1 b5f795fcc3846bb781e66e0373fce119975b2659
SHA512 1c777d774c154e89b80817ce7344495d83eecf133c36e0ad7c60dd14d76e628697535cc3fc379ca4eeb776f3bea5096f94d0fd76a2394ecd2e52f5ca8dc0053f
TLSH
T133D09B5672455C4CD641343224E55217E3008821654546194353F0768DD668717ABD9A
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 da739d58d61b2ac7b5d9bb7ad60982cb15b364d9c7c9297fd0c9719c271cd985
MD5 2d2e0ac0da9a175b4b6a8be7c9d51cce
SHA1 ff15c8a5ff11faefae3f7491c7968a2163702b81
SHA512 0ae78f15909f04e1a81109917b8eeb5b8062a49558d8a40f15c02076b087f36e82b88b329e9d984fc68c62cb15408123b9db7f705f2745bfefc30b5aa2e164e6
TLSH
T1EAD09B5A72455D4CD641343224E55217E3108821754546194253F0768DD668717ABD9E
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 352B
SHA256 278813af0d158a0e5097d4f93871360f112dac6f005246ebb1aec25c9374f88c
MD5 520d1b86a896617480b1d68d4b8e84d3
SHA1 67acf339b3cc62f4bdbd794fe138fffcf92e3591
SHA512 cdb5ff41b01aeb43dfa1d5e0d87737a0287278db5808674023c17719ef5c5fe9b3170ce38f5fbae678e62f66c294e8a80e58f7cbc7e92de4fb485a0436918022
TLSH
T111E0261A22D4C2AC81049497C87DF37E4151F10AE6CDD4DB320FB5FD389490053E97C0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 373d0cee2f3d1a9a5c3b698a9bcc2a7826b14deaed45633257dd9a7546aebfb2
MD5 653e68b6250afeb34323427ed6f2686a
SHA1 d387ffadd5cea16c61239fc28e7342d5347819a0
SHA512 ef31fa67f848dff9277582c67f6a5f097ceb849ea8bbed36e06b14ae7b8d3d9300a5ea43a1dc8d89c48f0d637f104bac98c525bbfc33d503ae2e233f8199160d
TLSH
T11CE026C405CAE26EE245B44B42AC578C8291360EE6C87ECA2B0AC4A43041540E3FB791
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 158B
SHA256 9348d432e06f74d951db7f8e1614fd5c17a944bcfe3da81a90e03707060d50aa
MD5 0c322daaa89f4064e13b86d401d8f364
SHA1 3767156ca999aa0aa2ddba1717fd2a641f2ce31a
SHA512 7d9a9595bcf9d305ed1f98e30e00e9fecd5ad5b1b76ebb2c6a30cf2cfb4abc6fd1a7d96dbcf51fcf947e2af0a3a831987f34be39a13c1e7dcb5d7b0361db1455
TLSH
T12AC08059BD4C845FC28018BE5726F000176055519417D6570650FDD032407A01F2D264
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00005e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005e
Size 38KB
SHA256 7165713d3e1a610399471a5e93d5677508f62ef072c1151e72273bf4bd54f916
MD5 9436affc97843765a966b3568fa7e5ec
SHA1 7bfda74bb30589c75d718fbc997f18c6d5cc4a0b
SHA512 473ec3a843c33e18d6d194651fe11353fcd03a7959225faeabf8c77484155ea6a7bccb72dbaf2093ed53c408faa3be9f6fc907f7a5ddf8223375f9d09b504456
SSDEEP 768:eUEh2+iKBVQbBhu8vjenqz2Ez6Y/AxHLEaP72sV9qKYbDblXqhP8qwFSE3uk:eUEEoBVQDjeQaLnP2pfZTqgSEB
TLSH
T11703F112148F7FA1C244F224A4EFE416ACC3F565ABA15E6980B8B7C7010E3C657A46FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000060

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000060
Size 82KB
SHA256 7a6f21721cf7a54d8c517ee4b13105dd9cebefd69c73df6b5b0bcbe6cd17f493
MD5 8148326fce587535de762f006257955a
SHA1 8ff00d217f6d5ab1d78ff1028ccb099a0863275f
SHA512 9ce3f942d4f916b7d98618d345f389dad1cea9aafb65e31e3c9fa1730c3b50d84ed815fce9405b2ffec468e4ce361129ad6ad80c97398520a6c8db3b0fb8b30d
SSDEEP 1536:TP1iF3C+CyRfnF9Hsa5YtplkbEEoIbw8i/6E09P/QOz+DWWpro05F5aUXADA3P:z1CbCyt7K3kbEhF8iCTP/QsrWpHT5aWH
TLSH
T1308312F21CF1AE1573943CC9AD09213508D7EDE54CCE6AC0FE19693C21B29B73A1E628
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000062

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000062
Size 436KB
SHA256 0b320d2cf00e9215763a5377904e2301b2edb7a5d299bd319259714cf8bcd9a9
MD5 38e965609b7e0769e6754549cfa3c2fd
SHA1 8ef9e62fa3ae6d8b371f5a9e9344a6cdf31515fe
SHA512 18cff962b979abf3e3d06261422f35502463a0e196aa0cf801cadcff8833a83f20c9e9f22fb3133041e406fdf2304088a0a5eaa4bbb8aff07ab15a0c1b46b0e4
SSDEEP 6144:HT+7EhQjYpz+XUGr9+7Km54TxcjJJEWv6p0qOJ7kuKtAiDL6GnkES7+S8HBWzDi2:6vj0iUI9EKFEJdU0p7riDxw7L8oviJ3c
TLSH
T147942367DF08D99BDA158361EA30EBDD1158EB6EE00A3CC844BB462CE54C0F9F6913C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000069

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000069
Size 513KB
SHA256 8ac3cdcf2d6abc1e29d9cfb7b520ce59ed2a64d32707e4c701b9ba0bbefb6c26
MD5 cd2b8ab9169b92154b57bd6e4e29876a
SHA1 dd8efb56b6d0f47579da295a0bc9a4f7e8f40236
SHA512 72572497fcf596879a97e366e6e52a473621bcbe9778c936a98850d6253fe211b88be3d10ab133e96eaea9ca0f89196b4ca67cb746d9f7d100b6eeb6327c46f5
SSDEEP 12288:WoR3XDMfKu/NfCs1MPkZxWCrbVR1PVzN1577WVx/3LjOR9y1WZsYN:WoWfKu/IFOxlrb/xVp1l7WVxCjiYN
TLSH
T1E6B423329773F8053F6A895342BDDE9E43699091A281C7B884D9F035D0F2FBEA1754B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

00df775de4068bd0_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\00df775de4068bd0_0
Size 354B
SHA256 8c51a0a85a96112ceb3a84d5bb5c96394ebc67aed8f8ee22a80a16b3ec00d80b
MD5 cfa1d5b38fae835cfdab093ead41ee74
SHA1 3adbdaeeceef9c932af8effa1b04d20bef9de6a4
SHA512 2852886d52d931ce126ba86818d82cb85d8a39d17c09a2307224d7c797fc5dec912854252a0d563ec5d7b290fb8cba8112115a47f2f85383a5acbf23d9562da9
TLSH
T14BE0C6838A001E4EE6A6B1F1CBE83160E222A21C0C6C40D6C009B9BB066E8625F3CA48
MD5 SHA1 SHA512 TLSH

Submit Download

e1e02cf343164d5f_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e1e02cf343164d5f_0
Size 324KB
SHA256 59568ef5afd69f493b23c35dee501853d115f57da172f26a6829c2524031435e
MD5 942e7d992090f32898015c385fcbd946
SHA1 3ea5c0f40a40997cd857a98219758345f707e62d
SHA512 dcded9563877ff7c1e576e1df6e58b3e6dda48d48406d41b58ade504f27d64e01b3fe6be79bc397671c8575d8777f33c7e1eaa2963a862001d30d7beda378b45
SSDEEP 6144:3h846vMyYXbe2xNUUZFO1i/kFb4vQKzOtKbLf9rki1jMrZ3PPBgjBPIwjqQuN+/T:mQjreuQ+7D4G
TLSH
T1D764B791A7CA6AAECF3B93F94662CE577231405D2FC3930722E0D7352C292E58E55C4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 bbeda1fcb41485c51fba4927d755cc6237dbea08452d9597850ccf9bbc684e39
MD5 fe152726c9751f877f1f787394550925
SHA1 e35c5e13ed18109555b11f8d056c8b4ec3c21446
SHA512 76c6a80f1b5c4a7cfad387c2dd0e0cb417b821deddc7e237cbff7cee3fc6f6c17d6f09f4ce4cc8ec6989e132d96f921c5258908c631154aef55e7e9fdcc4b11a
TLSH
T11751924033EA29FAE76845F6D5A376C9F3F144A428072E20D2571D790BB2F085CF1117
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 6929c62fc4b7472d24976968a92ada814534144a7b0fa74598841ac66cad29c3
MD5 5cc2d14452b8cedd10fc3d3e823ed562
SHA1 f8651a923be992d9711db42cb46f5a6c8233564d
SHA512 65f7c8faacf1cca3af47fadaaad604c2ab329c3eb2bf4e55ba6e889a2413846e46837195cd0855c009b5e946f005439456d4ccab564ab84e94093b9177201600
TLSH
T14A51924073EA29FAE76846F6D5A376C9F3F144A428072E20D2571D790BB2F085CF0257
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 8ae799d9a0d0d301254ddd65651f8cb92e8288e0f3f2edbd485dad51a044424b
MD5 228de1e479065e46229a8b07156bd17f
SHA1 4c7f37b219b9e7e4e8a29171c116f9ccd1b4e78d
SHA512 674930c8f5cfd4f6edf5af9813fb490c3e137c24f6ab7ed47a13719d7bf314c36619f0858b6a9b45d0c904a820bb1ed494b266d4d7db6d389e57426c8aba5529
TLSH
T1C451934033EA2AFAE76845F6D5D276C9F3F184A429072E60D2971D790BB2F085CF1257
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 975bfe8d436f3abc2bdc7d9e6a066f0daacf6efd3a6581d9d3e66f8d63e535d0
MD5 18716bfe240f5b660473974ae4fbd76e
SHA1 d295bbb1e7c7bccc8bc27d89bf77958c863174b3
SHA512 14ceed48463e2bc74727f4b9ad4688dfd6b8a883ac23bb2981ac34db1ce323125272150401e5584f79c15d51418018e7a12a1dedcfdf093c387e79035d28c42f
TLSH
T16E51814033EA2AFAE76845F6D5A276C9F3F144A429072E20E2571D790BB2F085CF1157
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 55c09860a6d200155a73cd26f6d72d6d1fda6a9c6cb4f774f6892a6f3008a367
MD5 caeb334db6c4b7078d3ce4e99096f621
SHA1 2c26316176b4b55cd26442b9483c25c0739f4984
SHA512 3bc9d2973abbd5b9cd6ac26b1d9a0e02461fff7b9d0e317a00b10166131458ad52e0bef7205416d0128921f7ead204bc4e4803311d6a7f1f8ff8b26ba5eaf485
TLSH
T15F51924033EA29FAE76845F6D6A376C9F3F144A428072E20D2571D790BB2F085CF1157
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 0e2ca227646b0ffe1d75aebc8509f7afc00386ce447468ef35670ef6390497ef
MD5 ef701f0668c52448f14f790a7282d09a
SHA1 77aa0495b000f9df8381e66107c62169e9c9bb4a
SHA512 a3f7cc4445a74cb73a5480ffa10270131f3c5362a44e74a5a4f98d4a5c599b1a68ca6734c1e9b2a9194ea8e0fcd656bb39afac18d5b8dc65739eaa293c161c78
TLSH
T13A51915033EA2AFAE76846F6D5A3B6C9F3F144A428072E20D2971D790BB2F085CF0117
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 b21f8e3d35baae351d897b216e53547dc21d5e0e4e3988452fac41c5ebe8fa4a
MD5 66dbf5edfe5b1c834fc7f3afd07b7315
SHA1 3ba74cb1b4d5d604cefe8cc9ea22edd62c29e026
SHA512 49e8dfe763676096a68908230a91ba825785f0338d3710c2f08d18994a667fa2c5b2104cec502cb1db858f9f6f1112b137ee6e8b565cce7918b82c32943aa311
TLSH
T15451924033EA29FAE76845F6D5A3B6C9F7F144A428072E20D2571D790BB2F085CF0117
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 2f965c2081ae68f6f9c3248515cd19ee8704d902f2665b39b0dc121768c1453e
MD5 9ffd528e1e34fba522f991bcdc3ee16e
SHA1 ea138ad6367672ff5d17420f11c5ed8f8eb0ea5e
SHA512 be362912836e5b745dd2e401f95bb7f3be816e5ef9238dfb133a242a7ae24d4be83654c19133af79c209cf6fe8c9c5ebc3f68a90899b36e4bbed7f513d0a2b38
TLSH
T1B551924073EA2AFAE76845F6D5A376C9F3F148A429072E20D2571D790BB2F085CF0257
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 bd48f7632343476cd5badf1444fff4d7bb86e0e48c0876b85f26ef4232ea29b3
MD5 9381528cc27dfbb8f96cbb4fd3c065f1
SHA1 13742de1b3f2302ebd327cc648f0f12a29c700b8
SHA512 8ad85d051516a9cb8d8236a3d259737f3ef4d5a2c6ccf2625c5dc2ce5e1e576a942f46c7462f869fccef348d5058b81d1927ecbce155277bafa099f046786a9b
TLSH
T14651924033EA29FAE76845F6D5A376C9F7F144A428072E20D2571D791BB2F085CF0117
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 a43704ca9382ccea82f599da89ee41aa385bc4da2e5ec7ab74f4475ba0d88b37
MD5 f03f8b5df0b2fcd4bed6bd6b0fd609ec
SHA1 d85b7458e2490fb35bad85c68200e3eb66b9f66e
SHA512 8faf93da04a8bb5840500abb1710fdbbf67c1a686b28db27d35fb369d01cbd14ac81268cfb1f29c745800caab7cd0340e924b2782047e43fb8e5f185e7fae9d1
TLSH
T1C451914073EA2AFAE76846F6D5A3B6C9F7F144A428072E20D2571D790BB2F085CF1117
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 a0d3de8c0357b0f1aaffa686a0e0bf6868f59c8c00566b7f1d054c71f8690a95
MD5 7ee3ffee55771d66938f7e226eb09d16
SHA1 a22b650852bce38cd96cb09d9bc40a9c0f84429e
SHA512 9c402e9880f4cbb9f68d04f4c05526aebb2352f18f2efb921de4bee17b8eeb2d441077bfca7f0d2f2e8cf58a92ec1519a363cdc501025c027576e406821c440a
TLSH
T19051924033EA29FAE76845F6D5A376C9F3F144A428072E20D2571D790BB2F085CF0117
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 7678cf16ad3b104ed221ffa41093b03c6677f1567288028d1be81b5a9963c14a
MD5 debfcb180d9c0c876f2a26f0db938de7
SHA1 8085c2e89125206ca38054370e1b49205307650a
SHA512 dee3813db2b9084e50b81b79877f9d1f401c148fe263a74bfef727f4e60f69c380b644e2f2cd559714a8ef4313d15da947b8e6dbe5fd99a2cd3ab25aefb82406
SSDEEP 192:DW113klUiR4N3pJJaDaBST1xnEnMj4QnknQkx/Qj6nG/jppE:DW113klUiR4N3pJJaDaBST1xnEnMEQnK
TLSH
T135F1DCF3C7D8852ECC5156F49B257F1FCE1D0918422C3E6B88D9AE5BA3D2871E204A5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 1b3af64f7fbfde7aa52b3613781e57d1a3419ed8774b342e18aa7d84681fbc38
MD5 33bb582fa710a6af031460e058c49664
SHA1 76bc4be77a17012469fd64c395c0e4dd1993fc46
SHA512 be7036d898871088887f0b51eb83f5f277783a8ffeffe7007ac8806df78c7d6f95017d8b9c53206197a314632d47d792ea1f85c600e6b835ac905fbba309ffa9
SSDEEP 192:DLj4zr/iY/YEYvYotaDaBSOTKEGOMMlwH5Kn5n80q:DLj4n/i03sJtaDaBSOTKEGOMAwH5Kn5W
TLSH
T1F7E1AEF3C6D8862ECC5156F497257F1FCE2D0918422C3E5B88D9AE5BA3E2871E20465F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 64dabaf66a2dec9b1a9363d35789220f6e33505d77f190200f30992d87769950
MD5 e5e418a38062b60bbb921d5f4b0ff022
SHA1 d9fe28d42f7d268e6a4bdc41ea65209319d96824
SHA512 ac38f7fb9dd7b05b7770e4c6b2c8ffbba90322203232ba218c6e81b0c898089068d60c0911bbd7fa8b183a35705682fcfbcc23c868c508ba873e18a09ba2c9da
SSDEEP 192:DLj4zr/iY/YEYvYo0iaDaBSOTKxn5nzS1nxnAMqHVwzBq:DLj4n/i03sJ0iaDaBSOTKxn5nzShxnAZ
TLSH
T13CE1ADF3C7D8852ECC5156F49B257F1BCE1E0918422C3E5BC8E9AE5BA3D2871E20465E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 9de362def534dfd3701fd20e20892a1dfa2bf30506a1a3e8b2673d394844e3b8
MD5 15c46e3cfb8ce49b2e361ae60ab40a66
SHA1 ada371f3163a242f1bc6e3b511f803542877a81d
SHA512 76b7c97cbdace29dc5a6cddaaaf1ebd96877d02fe8597d747676dbb192ed12b352e75fd6c2d47c7a9f269726d39abfaf87a45e4ca3b1e8a4e165d55ce697a36f
SSDEEP 192:DWk11nklUiR4N3JPaDaBST1NxnmOnUGj4QnknvvuBiLnWtMu:DWk11nklUiR4N3JPaDaBST1NxnmOnUGT
TLSH
T150F1CCF7C2D8852ECC5156F49B257F1FCE1D0918422C3E6BC8D9AE5BA3D2871E20465E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 5cf1131b8494a2229f082a749950be4b3ff37d52d56a045f953aab01a8706133
MD5 de459cf64f0ab53e6154ba3abe46be13
SHA1 ecd9ac49355a9385ee9b672b6877ad72264c023c
SHA512 a3bb351193a01e342d9fd56b7a6f694116903c05fb535e510f5a838032e23c3ce76c8714cc0071d3396da46b0ec168cdb9ec104afc2693b5bbc87890df881b0e
SSDEEP 192:DWk11nklUiR4N3pIaDaBST1NxnEnMj4QnknQ8eWXsDEPDXDq:DWk11nklUiR4N3pIaDaBST1NxnEnMEQp
TLSH
T1B4F1BAF7C2E8862ECC5156F49B257F1FCE1E0918422C3E6AC8D5AE5BA3D2871E10465E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 6de0d9e57de4f0d1caa365dc2f1912295e87fdf5f211a24a482fab7918d13b34
MD5 72411d890de354caf449576aa699bc63
SHA1 77707fb124b016cd821adf1c6dfa19b9d409d8f0
SHA512 76e8402b5259302fb436bb5643589d0accf5b2d26e1eaaa085329980ec862d5c47f4afd5286615edc4b065a4bc9155fd7c95939101e796a4aacf86f67e121e90
SSDEEP 192:DW115UiRjN3pwZIaDaBST1xnmj4/nQFNRv9Z5rnVrnXnqDv:DW115UiRjN3pwZIaDaBST1xnmE/nQFNE
TLSH
T18EF1DDF7C3E8862ECC5156F49B257F1FCE1D0928422C3E6B88D5AE5BA3D2871E10065E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 c8ea6cfd82fa775ef9c8054c0b578827a756b8263fd0f58b5e4da5a9f05817e0
MD5 3faf05ba0066a5a6118ffd853004fb11
SHA1 fe1eda6bb3f394c55c738b50c8358d39547a5e0a
SHA512 3265af1b3638aa98bdc413ef2eaa0293d6dc6479273121ce1942139370fa0a09b9940dbff948aa044efad1486f80f807f76de3364652cc102cfbedb7c4359557
SSDEEP 192:sxRILORLLyM/jK1Ml8wCb2/frdsgD6IZ/ABuFezoA8pEIGIvOIL/g6+WNwI7IDzk:sxRFF8S/fJsgD624W7/5U/n56
TLSH
T1BA62D816AA345D3B8DDBD219B951BF57D6F81473A2905E44AAFC8E0C00E7AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 bc042f2a9c6f2167912f683ffbbd9de0c5c6ae310ed3987c22569ef59c2e7f3f
MD5 347f67465790ecf9a5ae133380f3a30a
SHA1 3bc3c7c6ec761969d98bd57bb907542986adf47f
SHA512 140ce753a8f1afb4eefa54d45f4c25f5d2eec06e30af6a561910ff4aaa8146504509fa6706d22ef5a80d363366dfc762c1edbfdad6638d237a6a3919ef5dd2a2
SSDEEP 192:sxRIcORLLyM/jK1Ml8wCb2/frdsbwD6IZ/ABuFezoA8pEIGIvOIL/g6+WNwI7IDo:sxRqF8S/fJscD624W7/5U/n5i
TLSH
T1D062D816AA345D378CDBD219B951BF57D6F81472E2905E44AAFC8E0C00F7AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 30KB
SHA256 4ac3815b19888d32a1e65d2696ebc0409b39e849c1289f725db37c3a95093e0a
MD5 1c5fb803ccf82deb486291ebc96cd679
SHA1 9752879c25df6ebb2cdfa09c3f1d729ac5d44802
SHA512 6eb6f9b9cdc9c00f6c14c489f73e04797e08d369160bc4329cb2417d9e3cbc43b1596e3ece5382940506695c41acef739c906a2491504b84a41a4453f452bdd4
SSDEEP 384:sxRinzFqYS/fJscDS66s8qMpRiYnazAW8pZS15posJWeT+X24fg/WUTrZhWjIc:sQzUYS/fPS4Mnc7WeT+X5Y/WUTb6h
TLSH
T1C1E2F906A924C8779AC35D18B43D7E73D6EC50526285CFDA5AECCE0C01AE5FDAB07827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 7590da53289b90cf7cdb864719d85893d5d81da97fa8c76bbe89b82417859ebe
MD5 ad54a86111fa22c947b0e620b57fd1f3
SHA1 e976eb87af21e1be0b0c76179bc3067ad315d043
SHA512 851d7cf04282f0c98dc3484a3e3a126d7d55294ff393d5604de4feed8a9f55af493629cf48aa8247c6b3f45e25a3d8b6131857d082fcf518baa2268967b32acb
SSDEEP 192:sxRIcORLLyM/jK1Ml8UQbdCb2/frdsbwD3IIZ/ABupezoA8pSIBIFIL/g6+WNwII:sxRqFqYS/fJscDY24a1/5BdWS5c
TLSH
T14C62D816A9345D778CDBD21DB551BF57D2F85473A2901E44AAFC8E0C00F7AED621382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 30KB
SHA256 91a49a81432331e39dcd6948eb91a1546318d96c9cf7f0920a3e9a3546bacd05
MD5 0a9fc398066e71a11a1fd21a3537c130
SHA1 3f4eb005786d21ddfccd9803d03dfb2f4220b8ac
SHA512 f8506676fbcd7060811ef450884e89765dc77834e7378b3054c0b9f2b2d54904f6a57e82699b8ae35a3e1192dbcd4ce4c1773ca52fc4a06fbce689ccbebb8cc1
SSDEEP 384:sxRBncFqYS/fJscDS66s8qMpRiYnazAW8pZS15posJWeT+X24Z1/WUTO4hWYIc:slcUYS/fPS4Mnc7WeT+X5j/WUTFph
TLSH
T1A8E20906A924C8779BC35D19B47D7E33DAEC50526284CEDA5AECCE0C01AD5FDAB07827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 764b17b74ce9408948cb7438b2cd12b0925d36ac7f20081d9b8ab2075b0a18e2
MD5 d0e0ba9806a0ed6d4a863566fed92ec8
SHA1 3dd72fdfe11949be534ec8457211699e1efbb5f9
SHA512 387c1b16733abdcf4aa58eb69dc690e6574c3508d4f3a471e4552156290255f18bc681b444480cb0ad6b982122d1cd19e763618beecfce6ee921387194d0add9
SSDEEP 768:40D76DrQD83F7pLuL7J0DbWgQ6DjfPQDF8F1+UoAYDCx9Tuqh0VfUC9xbog/OVqD:40D76DrQD83TE7J0DbWgQ6DjfPQDFu1k
TLSH
T1C4E2EC3B680CCB7F4F404ADDAC29BD9A6DE801CB56D8899447EA880C03C67EF56165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0c259ee3-ec75-49af-a8ff-a5f337b654d2\index-dir\the-real-index
Size 240B
SHA256 f82e76da361599060403c1f27196b645ff4737833d89387ddad2e8aa20917676
MD5 cc9cd1ca507d9bccf86ec63248b1daf1
SHA1 570abdd6f0e768249b09ee0d356bd564103b490f
SHA512 fbc80fee6e1c86f528253c1d011c3eaf282f379b15296f530ca262f7013664aa999a7416037c2e35d2f6bd5b59e9e98f8a51ae45f97a339aa6bb99d46ae499cf
TLSH
T1C2D0224A8C6259A1EA12983244733968233302FD20026E1100BC1409946142C4146009
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5eb3ec.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0c259ee3-ec75-49af-a8ff-a5f337b654d2\index-dir\the-real-index~RFe5eb3ec.TMP
Size 240B
SHA256 2d44d3503dc85fdcdb6d7403dbfe57d31ee9b07fa598980b55bc197508f706b1
MD5 5f64a4fbe35adc3c7d3ba52cd6069fa8
SHA1 45e90fe7feea0b4f42a43c0a4647ddf0db4b14c5
SHA512 e41f66740c6134460c6454d1a728f4b79e85dab3c18daf36fb7cac5c97e1b3d4c3e42617fa263190f44057ba8bd26bd05bd8ebd59cf028576c5e0b50c4b7c1a7
TLSH
T159D0C0DF4460AEB0CE0718353003310933770C202411EE3140F4140F04300FC818600D
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 1037389d7b9fc8e8eeef9660187fedfec62165a0a9a0b635cabe68134a393d90
MD5 8a6673398855e0968ee1030aae3f42f0
SHA1 1237e6fb7bbdd8db2e0fa763c201116a608c2878
SHA512 9425580c2f2b5862d05e47b3c82ddb51527b95e8ce87aec6cb0661533bbd69f797649cde04805074e7098b9bd06e61ac9593eb313c566dda505f75a21643d848
TLSH
T1F1E0C0FB2CE71818EC7F83D32571C67101017828D508EC4E111692C340B5365A89AD31
MD5 SHA1 SHA512 TLSH

Submit Download

5b19324826785ed4_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\5b19324826785ed4_0
Size 255KB
SHA256 16f986887d6083a08169ada3ccb3059f7299c7feaa6b488ba96c1f8ab337ece9
MD5 54cca4a8fc133dd541deee03e8941686
SHA1 155132375dcbb8e0228cb4ee07c1c9b1549ba0d6
SHA512 2b7935c2a80222404aeda7d9d9974805f7d8dfed3390a2233eb95a0fa6117657492a59c94f6c36a03e98e73014813e03f60befac11012b600540397d89dca9a9
SSDEEP 6144:3V9EIq23Suk6aYaE/6LAn3GyEiKkZmcIPi8+o4b+JQ9odSKn:3V9ET7v6jaAEEjIPi8+FSJ5SKn
TLSH
T1AD448E723300E53FA8278EA5E67E7F0D3825F217DE2705B8D6E4E9358BD6DBA1012548
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6194b417e1bd369f_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\6194b417e1bd369f_0
Size 1023KB
SHA256 56c62ccf5def4a4398f6ede599b4eb9cb546ee6b46926bdcbc8a9e68055bb4d9
MD5 4d7d677f30b555875628f218bc7bd22b
SHA1 eb51e0d2f7b6ad5cc4998fc4cc8352ed4601ece7
SHA512 0919f098098ea9b802764c414342dedbbc72197e5133b1037bada347b05451a2346ecb78e1730011bf5fe7f769014498f41efa3334c87dbb1cd32c3661f59397
SSDEEP 24576:HZf5bDY1+2dPObPSa4wlDRcCxekVGMKIz:HZFDY1+/PSa4wlDRcCxekVGMKIz
TLSH
T16B253CD873A2B463A375F1A4426F42C7F2AEE892B449886CB598DCD12E74C5540F7F38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 6dc2f45484b7e2dc88127e4500fe52b8212f4be34765a1704e0e33b793cd5e49
MD5 be51b27ffd234e7400736ab0633b1b3c
SHA1 e14ed34051f0759ac56508ff829254d27700b3b8
SHA512 5d406a901c8a691dd190e281696d66696cbe5e9cc0e4d7c0a2d9e478ebb2f2aa224b89648aeed7580508835fb66d74b4fc14d993804205a5f9d1fe2be1e99863
TLSH
T18DB0220880080C22C20803F8C3F30A0A3AA33C000B03A80320C0002B8020B838323082
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 32aff825cd06bc39d436ae89e08dd674a4e6e9679eae93a06e4f1e827ddf34a0
MD5 f0932404f169a3b380054080f1695227
SHA1 eb097dd86d4b6a2da6870a2a94623d6d856ab10f
SHA512 0ac4bd0a0b81bc847934be9458d0b7a72cf9f74a2e6d106d34545fc5a4858732d5405a3254351757adc3c6f8944054a3a2c01405044cc6bb69208091f4ea064b
SSDEEP 96:KRgBg+gPgrgZg7g/gLWgPgMg6ggTgLK4gyggdgLcgBgpgkg3g/g4H5WnjRzHDW3M:CgBg+gPgrgZg7g/gKgPgMgrgTgxgygg0
TLSH
T1E39179C1317A43403C7E691985F5CD6F86C2B867705AA46B3BA841B94FABE434DFC8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

af08b984-381b-4127-89f9-098d41a9ab4c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\af08b984-381b-4127-89f9-098d41a9ab4c.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 9e0be5ef56de904880260070ead9cafd6beedfeafc1917de88fa1b8d94392e27
MD5 2ba490a497f300ac617d77ca883104b3
SHA1 15f0642bd9cd6b607954992da0012fbfb86728bb
SHA512 26b6c2375b7e43661726d386d5eab64edf617c4d18172ab2dcb88a70eb1f55a6dc976fbdf59a81340ed3d69c4795fe2df69a8df04ba732f10b2816eb8aaaea27
SSDEEP 768:rrv+4UNbdG3n8yRDTd+ZXff0ieX6+qTko0u229a4vsTlb9Ml:rbsbU3AQvVTVKa4kb+l
TLSH
T1CF13C031F8298E7349A6D684B10775877EB921B3C6C40F58D9EDAF4C065B4AC2B0F927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 50KB
SHA256 b1b7236895f8b7c67c6157efe59dde21278fd7ededc71eed204d126bca75868b
MD5 8d3d2503e3312fff651b63ef0afde3cd
SHA1 e698713b874e4bda18d2de60454b627937d97382
SHA512 0e6b5127c25112e9e9e213659b195e754a41ecc807dca22634cab45615dcbd5e7e38c779c75f42f4b9db73baaae93b0be99af13d4ed367bc41b237efb3c07fe8
SSDEEP 768:tF0rv+4UNbdu3zwgDLfnZXff06eX6+qTko0u229a4vsTlb9Ml:gbsbk336vVTVKa4kb+l
TLSH
T156335BF1A8D78A37C8AE8783633E6D465EBCD163B5884984B7D85D4CCC460BFD70A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 45KB
SHA256 50dffb72bc44f728931573958f58046351f5f0f20cfda15a0955205e86fb4c46
MD5 7efed621a59073362e993085a06731b0
SHA1 fb7d6d124034a2e0a21bb32283892528bc7f8473
SHA512 30f17846fc0e5019ecd7a7c73f9e390b5f66611573ac3b065e19beef5643877476f1cdcc9c0c006ad2aba0533617ebe661e01638cec24d8ad3bd6b9960807647
SSDEEP 768:tFnj+913BwgoI3nZXff0neX6+qTko0u229a4vsTlb9MW:m913RJvVTVKa4kb+W
TLSH
T15D2349F598D38A77C89E8B87633E2D468DBCD163B5885A84B7D85D0CCC461BFC70A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 45KB
SHA256 534d3dd559daa873fdc75a3ddc4ab41be4e1203609776e8282378b4304ef79c9
MD5 8e83d8742ee454f31ab069347dfef131
SHA1 8eb7393dabdd4b3e1bc65a0c531144081413345a
SHA512 49f23dbdf494d7693b3f598d91aff0e7f7c832956cab4ba919f2edc0becfa794b2826746400b2e31c7b562db0fc75a2521f86d45953d86f9f49f376415b620a9
SSDEEP 768:tF8j+9g3Kwg3J7onZXff0xeX6+qTko0u229a4vsTlb9MW:v9g3rjvVTVKa4kb+W
TLSH
T1EA2339F5A8D38A77C89E4B87633E2D468DBCD163B5885A84B7D85D0CCC461BFC70A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 45KB
SHA256 7a0ca1ddbac6aab715133714d2ef9c15493de132fdc26236c7c13f1650541a5c
MD5 7b39f5c244d6314fb07825ef2b7a17fc
SHA1 b5756d58c4bfbb439929766a30e2250771226712
SHA512 325c5699938c4063a84a5906d1b8231ba04179ca09b15661d6fd58095ac8ad3dfe6c7f1f63f69d8e47909c2f910175f1cf722ea5bcd73b6f76c2002dde9ef3ee
SSDEEP 768:tFzj+9E3Kwg37lonZXff0KeX6+qTko0u229a4vsTlb9MW:a9E39avVTVKa4kb+W
TLSH
T19E2339F5A8D38A77C89E4B87633E2D468EBCD163B5885A84B7D85D0CCC461BFC706816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 08a2880a8aa90a98860cd0b3c4b27c5e4f527d82beebc7399bcf2aa3d2547aaf
MD5 7a57168a07661f8c38a4cabb94d182d7
SHA1 7bdf6c03fbe74c2513526e8efbe5235c660b7e01
SHA512 7bae75a0e69145b9109965d297b1b76918453ef74a46f09c73a6f0123a7e446ef0e89c8635ea37c62955b3a49b1ce7e043759448386b52ac59659e3452f9f0d6
SSDEEP 768:prv+4UNbdG3r7VDTd+ZXfIeX6+qTko0u229a4vsDJeVH1SdW:pbsbU3SvvVTVKa4UEH1h
TLSH
T18B03CF32E8658A778DE6C784720B75473EB92163C7C80B90D8ED6F4D425B5AC270BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 51KB
SHA256 11a1865afa6dd8e9a3ba30bc55096530476c8e3a2074cbaca1e0e4ffc1612de0
MD5 af802b81bb126f420769e83835540a45
SHA1 dd9dd217bb297264acafbc791d33aa13146a01d2
SHA512 f908b3f0764701aa6ce40ccf56312e5a8fed3c5daac662b4031ed6f5dd8c8f489fdfb3be115a9137cdacc0bb4681cf1c4398a26b44779501af447f0ab30d83e0
SSDEEP 768:tFtrv+4UNbdd3BwgWN/nZXff0MeX6+qTko0u229a4vsTlb9Ml:hbsbn32UvVTVKa4kb+l
TLSH
T1AE335BF1A4D78A37C8AE8783633E6D465DBCD163B5884A84B7D85D4CCC460BFD70A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 51KB
SHA256 6633a6c0ae35401be694100a8e5aa329d9ba8d9e863af20f20e0dabbfb8d3d21
MD5 23e690a332d9ae73b47455298ec0c907
SHA1 bab148cc86041981a5aaddbc7a1d7df253fe017b
SHA512 f24a7686fda1d426ed39ca0ba8e4f25583519d223d350aab8081699bc3738cfbe15f9575248925581e6e8fea37ca47532d876401629313c52812799836a82c48
SSDEEP 768:tFQrv+4UNbdu3BwgW5onZXff00eX6+qTko0u229a4vsTlb9Ml:cbsb43hwvVTVKa4kb+l
TLSH
T1A2335AF1A8D78A37D8AE8783633E6C465DBCD163B5884A84B7D85D4CCC460BFD70A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 45KB
SHA256 87854911cb493c6f892d09a47ad11d97e1098fc5550de3ea6f9a5c67a1b057a3
MD5 dc3bb9aa127337082344d1223475fbc5
SHA1 8b171d7a8fe99037165b9bd22f6d0ba1cd7d0dd3
SHA512 1e4bf05db281a0af66014d419ae2b7ec7d188b140b67aa5397bfea0f5d11f30f319cade0977965bc343dbd597e39c9bcc714efd24f7bb56bc6661db1a57ee7e8
SSDEEP 768:tF3j+9k3Bwgory1nZXff0AeX6+qTko0u229a4vsTlb9MW:u9k3PMvVTVKa4kb+W
TLSH
T1592339F598D38A77C89E8B87633E2D468DBCD163B5885A84B7D85D0CCC461BFC70A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 45KB
SHA256 b2fc60b170d9d5d86416c89a4dab60ce1f7e51c3bbf69e12bb39c5778491f2c3
MD5 5c423dd2df2587cc9fa123346a959088
SHA1 0090414984da95129e32229722f47b8ed06084c2
SHA512 cfc9f121bb4fcdf247880f58e56c4a6dc5196be52b7659c89185ff9fd94eddcda8e0826ebdd2ef846cc3c848f32fc0af4fac5eb3e8bde430fdeed8eb820b1bec
SSDEEP 768:tFFj+9k3Bwg3xH1nZXff0ieX6+qTko0u229a4vsTlb9MW:E9k3xivVTVKa4kb+W
TLSH
T1722339F5A8D38A77C89E4B87633E2D468DBCD163B5885A84B7D85D0CCC461BFC706816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 45KB
SHA256 7105b74e72702d0a47131292f19c3257843472b7462c64be4ff2393f33788aa3
MD5 34d15579a04576bb9115f36c306b7f48
SHA1 ae52b90cf3b0a897e27e54e49484edb31d54f632
SHA512 3e4cd065911e56c43f2f4fe9fc2f03438fe71c090e0bcbc91aeaa6f1f6d43cf04dd79198860494f191cf4cbd93579c7f92d138c22c797975d5ae303a64b0e718
SSDEEP 768:tFvj+9t3Bwg3TL1nZXff0leX6+qTko0u229a4vsTlb9MW:O9t3/3vVTVKa4kb+W
TLSH
T1E62339F5A8D38A77C89E4B87633E2D468DBCD163B5885A84B7D85D0CCC461BFC706816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 b2d19dcc61bfbc6287f9f69fd188ed86c4f5671a8f21e2d94848a0325f6f4ccb
MD5 7fcd7126d65ac53fa66ce1e73090997f
SHA1 cb33d500e46a1b6e33238cff9788c4c7605051b5
SHA512 9bca0b25936c366b8f43133e2f565d17695e338c88f70796708254cfaf05a08d7d0d1db5f1e2c8579625fcaa4ca3f56924bdb0dc6ba6905dd80789f0513c9ea5
SSDEEP 768:1rv+4UNbdG3OO0DTd+ZXff08eX6+qTko0u229a4vsTlb9MC:1bsbU3/svVTVKa4kb+C
TLSH
T19713C031F8298E7349B6C684B15775876FB921B3C6C40F98D9DDAF4C061B4AC2B0B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 50KB
SHA256 695b8b8d440b7ceb49b6db37c2126d4b629d2ca3c102df5eb669b22df0d982a9
MD5 a64630daa031797a7d761c22ebbe69b6
SHA1 193a70c630c7960933057d95414ce973fead81ef
SHA512 d86edcc33d4c2ec918fde88e6811e16203f7bd61465f35f07988b12d454876d6a94c23412fddc4f0e24575bfddfe425e6f4ef424dfbcff692480ca41fcc60d56
SSDEEP 768:tFxrv+4UNbd43gwgTU1nZXff0IeX6+qTko0u229a4vsTlb9Ml:lbsbi3rEvVTVKa4kb+l
TLSH
T15A335AF1A8D78A37C8AE8783633E6D465EBCD063B5884984B7D85D4CCD460BFD70A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 51KB
SHA256 5c1487c1a1781bed6a3b34f45c93d03b758effd33456b6b950d9c510b1c9fe63
MD5 4aabadd84b2ce0b39ddb89dd76389676
SHA1 f6ef6d8b5a44a5a3ee7091cfe527ea01e418f802
SHA512 5f39264d002f5312fa681602631ef6815479a767cdd3fdff248fc1d50cfa5f9a13b1baf9d05d0c8db4fc0fb00c66084ebacb747bd1908872687c44f4ad674f20
SSDEEP 768:tFRrv+4UNbdQ3BwgWdmnZXff0NeX6+qTko0u229a4vsTlb9Ml:lbsby3BzvVTVKa4kb+l
TLSH
T1C3335AF1A4D78A37C8AE8783633E6D465EBCD163B5884984B7D85D4CCC460BFD70A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 51f28fd1731309c50c4206783537d7b2bf69f46ae7febc28276d429c9d0bad69
MD5 2ed065f7a599e81349c3ec5f3fec7389
SHA1 6a2f45df0f4afac111a78d7f6a57dcda89664cd9
SHA512 b01a18f673982107e9d4cb103d00c3a3e8166dc8b65569ca9e590c5b2288a151a910a0e845648661812a0b318f112c07e1a708f40176e83a31973b44be54be24
SSDEEP 768:tF9j+9b3BwgoqinZXff03eX6+qTko0u229a4vsTlb9MW:89b3y9vVTVKa4kb+W
TLSH
T16F235AF598D38A77C89E8B87633E2D469DBCD163B5885A84B7D85D0CCC860BFC706816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 45KB
SHA256 239635c9de86323b22ed73314efdfa238a5aee2c337d730bde3a0efed68f7762
MD5 9e2f43b4f5be7a4f2942c1877ec936c5
SHA1 010b6e4b709d043044aac4f017de675aa1944d85
SHA512 7fc1155b733a6b0987b46c454724c7e85631b9f2d962c56774718295afe5c5450bfb73898fb5a006c98b38da8b8cc3db37f54266231a9655dd24455c4fe1a8f9
SSDEEP 768:tFKj+9o3BwgobWnZXff0IeX6+qTko0u229a4vsTlb9MW:19o3XwvVTVKa4kb+W
TLSH
T1512349F5A8D38A77C89E8B87633E2D468DBCD163B5885A84B7D85D0CCC461BFC706816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 8a5aba1e4c7148b7e8ca602094c3427444598f8058040cd30aa8a3ec7fd5be29
MD5 cd25648c05e0a29d4e601c8b3542c35c
SHA1 76c3b97460085da41e34439fe14938d66d415b29
SHA512 9efcd718ab67baf849e5c36b5adca700a0cae7da4fcb988c494cd604abe1d6712e5b92e4963be6188fa4fa04e0c85a3e9c1e824bd27b366b5ace44424f6742bc
SSDEEP 768:tFtj+9T3Bwgoq4nZXff0LeX6+qTko0u229a4vsTlb9MW:c9T3KlvVTVKa4kb+W
TLSH
T15E235AF5A8D38A77C89E8B87633E2D468DBCD163B5885A84B7D85D0CCC461BFC706816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 45KB
SHA256 b7b63f3a2c99efebe503834b7bd4317768c2dbe314c06f5739257dfb97fd71f8
MD5 b5e38bfd50ad9c9983ef983ec1a58fe4
SHA1 88b8c10d4882a6ad07b700d0bbcb3984d4c0e760
SHA512 eec20f8253c334d138d879fa6df6961cbc032f246cd8942e8e2c04e04edb3c3cb7ed1c259eab76b09fa192e3d2b2691c0e863d409aad37fd4b649043f79702df
SSDEEP 768:tF3j+9G3BwgotnnZXff07eX6+qTko0u229a4vsTlb9MW:29G3MdvVTVKa4kb+W
TLSH
T1762349F598D38A77C89E8B87633E2D468DBCD163B5885A84B7D85D0CCC861BFC706816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 45KB
SHA256 27730c5189567af6d4ff6e8e9ff21ca0c8d97aaab8fa507e2edd87440d708188
MD5 af0b759bef16a45538e9a3b265f18cd1
SHA1 2e851f02c17fa82abf636af998c92b2291e9a987
SHA512 004afbc60a5cb6ad2f0288d80d1accb291e35c6c4903d4cfff6072514d9230fc231c3137ee2315c8a106014d0a800922ebebb2cee2247bd7d309a5463a7d6de4
SSDEEP 768:tFGj+9b3Bwgo2xnZXff0GeX6+qTko0u229a4vsTlb9MW:x9b3puvVTVKa4kb+W
TLSH
T1FB2349F5A8D38A77C89E8B87633E2D469DBCD163B5885A84B7D85D0CCC460BFC706816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 45KB
SHA256 78a07aa2a3786335ca8b03c061a28bdbe92aa74aede228e9097f97bf4e222b01
MD5 84cf2010607fc45a74ec10a8a2c7e739
SHA1 c025b9fd1c710a6c2a101af289645fd449ebdd56
SHA512 2c62b5d8e3fb4ac25b407d60528554903c69055c910bfefe0fd727e12b8a14e2e91c8216155f78a903b35425decd87c5ff0b980a6865996b5163381e27fbf3bc
SSDEEP 768:tFHj+9S3Bwg3cHonZXff0YeX6+qTko0u229a4vsTlb9MW:m9S37wvVTVKa4kb+W
TLSH
T1322339F5A8D38A77C89E4B87633E2D468DBCD163B5885A84B7D85D0CCC461BFC706816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 45KB
SHA256 ebf493f5c8b202ab51ecff1942060d4e55b56b5ecf7dc40c0b7d45b0d0b81499
MD5 0884817316a49dfdc30567ce03619c89
SHA1 f1b49cc784965c3c001cbe894a6b4cf23de42d9e
SHA512 50bd17554c5e1f5ced7e0f121ecfd3b7ff80670993768aef34fe8f55c90c57f24957ec29912aa4355b2e4cc225c7a2cd7f718f767ad9b2d7a54b33723268ebb5
SSDEEP 768:tFSj+9k3Kwg3lponZXff0SeX6+qTko0u229a4vsTlb9MW:99k376vVTVKa4kb+W
TLSH
T1D32339F5A8D38A77C89E4B87633E2D468DBCD163B5885A84B7D85D0CCC461BFC70A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 45KB
SHA256 9a5b17e501a223447163565fd6fd9654be572da191527ac010550952d5c38c8c
MD5 94e6abed430bc884c495db7f20f009b9
SHA1 1c7a4d40f6390aa0510fc9eb2835881b45187cd4
SHA512 4f33b4053f0fdfa0fc0b5a70d00f1461fdb73ab207387cd2a843c913d61f98a7309e6f06ea555e28e30c51d8c28f0771d32ca8ec8a646178ddea6fce8eee05ef
SSDEEP 768:tFJj+9F3Kwg343onZXff0qeX6+qTko0u229a4vsTlb9MW:Y9F3m2vVTVKa4kb+W
TLSH
T1812339F5A8D38A77C89E4B87633E2D468DBCD163B5885A84B7D85D0CCC461BFC706816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 51KB
SHA256 24b65af275c845917b2281262476f552c56b660e90312a761534e93202d9e610
MD5 1f8d0c3b6a3f64a28de3c5d4f2ef12b9
SHA1 cbaef8d5261a9dae3f8ce19e44a93d06ac2bc78f
SHA512 c3e427ccc2829a33b4fa855d8070aa36ef22989798d2e8c55025e7091d2c03f62e6ccf1f61693967f5f4ca1d7a5aedf526e3aa952b93fb9d045558dd741bfeec
SSDEEP 768:tFRrv+4UNbdQ3BwgWdmnZXff0NeX6+qTko0u229a4vsTlb9Ml:dbsby3BzvVTVKa4kb+l
TLSH
T1D6335AF1A8D78A37C8AE8783633E6D465EBCD163B5884984B7D85D4CCC460BFD70A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 45KB
SHA256 8ecf35975f93d308179439c44d00e9ff69cd9483d74d47dad9da08c29447ed21
MD5 83c61d4fa3109955ef9222a2dddb8648
SHA1 395ad931e8c4967233f3d45013636306d04c7ba2
SHA512 1a24f91fc0a3face259c6f41a03da2ba48ceb9e91bddb67dd7517a9fb26ae8790acac0a6f49c96994fff0d7168654b2847d0a1850b5c9c2ee7e1e5d304ac177d
SSDEEP 768:tFej+9o3BwgobWnZXff0IeX6+qTko0u229a4vsTlb9MW:B9o3XwvVTVKa4kb+W
TLSH
T1BE2349F5A8D38A77C89E8B87633E2D468DBCD163B5885A84B7D85D0CCC460BFC706816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 45KB
SHA256 21bc28be7511f5088bcc06793cee0da540f8ecd2876a51ac594e2d075844ca2c
MD5 50817d9ce8c03994902c5f12c0a92049
SHA1 901fb4a221d5ab6492924100d7933046e88bfd57
SHA512 2d99b396d970ebee6a9f434d906729170ed1f136aad18ab4d99008e0394c337afc863b6563242e1858240f1793f5425034b7b3d1061cc40a8b9dc256a2326c60
SSDEEP 768:tF1j+9V3BwgoNDnZXff0UeX6+qTko0u229a4vsTlb9MW:U9V3KgvVTVKa4kb+W
TLSH
T16B234AF598D38A77C89E8B87633E2D468DBCD163B5885A84B7D85D0CCC460BFC706816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 45KB
SHA256 6c98de3850230b2433367d1e87aec8b6ad4c428584abf6014eb92de33888b574
MD5 818328816731cf8765f7f130d009780e
SHA1 cfbb77f499bfdacc7041a6b4a50e652688b5b666
SHA512 861c9b01fe69aa21766d88a90e920044227ab135f68dd60227e46172f26b163cc79b86b6dc03660cd4d8209f08b404012ea2420bddf2d1dd65e960b79e266095
SSDEEP 768:tF0j+973BwgoFw1nZXff0/eX6+qTko0u229a4vsTlb9MW:f973/xvVTVKa4kb+W
TLSH
T1C12339F5A8D38A77C89E4B87633E2D468DBCD163B5885A84B7D85D0CCC461BFC70A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 45KB
SHA256 e88e12f0b48aa4ee91db24568b26dfe8517951b30e6fa32d8686d9ccc09cbec2
MD5 7ab6f4c6c14a35cbd82e6f7266b97619
SHA1 c506eb12b719289a4219e4f3806e8a289d1bbb3a
SHA512 3b639a3119f9a3b82ef26f5b578e30692fe7a511f579bf479928787cf38dd726a2dc2d4eaa34edfe15b98668cff15de51ff0e8f5bd67c3044683442c4a90ee44
SSDEEP 768:tF0j+9l3Kwg3NxonZXff09eX6+qTko0u229a4vsTlb9MW:H9l3T7vVTVKa4kb+W
TLSH
T1EC2339F5A8D38A77C89E4B87633E2D468DBCD163B5885A84B7D85D0CCC461BFC70A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 50KB
SHA256 fd9add4f4c866596e0dd961e1cfac0712b9917069f4f165c697d1778996d39e6
MD5 4f595973a50d32369a9ece507a833b83
SHA1 bfd64bf968930c6e9edbba67d50fd154091e6c4f
SHA512 cd47ec850aebb6bff66eaa1f52059b712b9cd2ffcf8946e683877c17a8a2de81ae62fd121978f5404959c8f3a929c8218e1c3354bf7d7a79d4529e4b96f3b12f
SSDEEP 768:tFbrv+4UNbdJ3gwgTuqnZXff0deX6+qTko0u229a4vsTlb9Ml:vbsb/3mfvVTVKa4kb+l
TLSH
T14B335AF1A8D78A37C8AE8783633E6D465EBCD063B5884984B7D85D4CCD460BFD70A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 707873860c5499b8b0fbcdacf297ca216f1dcb263e8c1f1fcafeb32f73c12726
MD5 7edcc8eab297fa93fb04ea31bd9bda97
SHA1 ec52dc78e8b84ab1b0160f839686c85ea34cbe67
SHA512 2ba052cbc8222218623f851d58d8f719e130fc9c1c74975d8b099bcc3d2ee75ce96b695bd92c4186a20805e0d3e52a8828276db1747e1e8a6771e4dee7c13f81
SSDEEP 768:tFlj+9h3BwgoS0nZXff01eX6+qTko0u229a4vsTlb9MW:U9h3oTvVTVKa4kb+W
TLSH
T1152349F5A8D38A77C89E8787633E2D468DBCD163B5885A84B7D85D0CCC461BFC70A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 45KB
SHA256 8be2f5fddc9bd693b79540476e33ab8740116e0465cac5f9d247229c6e7707c7
MD5 4a07fb7da73ebe4863fc5b1ac2ea938d
SHA1 23ecfbfb6a12539bdccf01458e33b825af6a41bc
SHA512 3c7a78c7d51e3cb654d0974d014d54d8d7a67d17b12bcb1ecc2e6dfc60dba268fd829bff5633920ea905392b52412fd07b88eb8f89de36e17d6644d826f2c83a
SSDEEP 768:tF4j+9F3Bwgo/OnZXff0beX6+qTko0u229a4vsTlb9MW:D9F3TtvVTVKa4kb+W
TLSH
T115234AF598D38A77C89E8B87633E2D468DBCD163B5885A84B7D85D0CCC461BFC70A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 45KB
SHA256 16548c2556101429cc1d59a32bebc3330d202404aa80739f52d6832a918b73bc
MD5 7aba6611383e326aa34b298176bdedb7
SHA1 0540724c6e42ecc3b8dffbcee7c1653c62fc4fc0
SHA512 ba184e0b3d140031337a0053fc9686f379434e1b8007d3da7cc2753b1935e11c16388d86061a7d7c496f0469e70d747943e8243a19caa398b68db28711fe0ece
SSDEEP 768:tFrj+9P3BwgoYhnZXff0DeX6+qTko0u229a4vsTlb9MW:69P3n1vVTVKa4kb+W
TLSH
T1342349F598D38A77C89E8B87633E2D468DBCD163B5885A84B7D85D0CCC861BFC706816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 45KB
SHA256 fa1f64aa1cb695ffebdc5761eae3ca5867c73f19b4eb3267be943cc11c4cefd3
MD5 2299068361e3e4efc7bfb8515cafc5e5
SHA1 ebff7f022587513e210e0d5d91a4fadc7109cb4b
SHA512 4be00bd00b4d6e1bb892dd85f0a79b8c3ffc00f0d7caaa5664d6890245888694d21243fe84bc4b46db29ab7aab6a90b5528ab317d7b3c534ec99793f4433f498
SSDEEP 768:tFEj+9j3BwgosNnZXff0KeX6+qTko0u229a4vsTlb9MW:f9j3nWvVTVKa4kb+W
TLSH
T1DA2349F598D38A77C89E8B87633E2D468DBCD163B5885A84B7D85D0CCC461BFC70A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 45KB
SHA256 4f62f5fdc4a92340dc23cee170105ec30fd71eb41da51b9984657583bb30da0e
MD5 c319e04979fa6bc33dce94b6e60cfc1d
SHA1 aa55e3ba16edce3467ce49c03a4d95cecd7b6cf5
SHA512 dfbcd2ed403cfc5f8d5284cb7f2af14240acb3df86d0971fb4d6455c476f0f6e10c4f39650015ca0109f3c50a3d896a77a677cb4de2a3692f30a9008dde1ac92
SSDEEP 768:tFij+973Kwg3BfonZXff0roeX6+qTko0u229a4vsTlb9MW:1973xwHvVTVKa4kb+W
TLSH
T1AD2339F5A8D38A77C89E4B87633E2D468DBCD163B5885A84B7D85D0CCC461BFC70A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 45KB
SHA256 a9957d3ca2fa8dc61116e748fc514a83b06ba7b3ee2897c7b6ab33f127c33187
MD5 2bac7c1e0ff8e599daecbad4da74f1f7
SHA1 a0424717a32a57a4183c3a85aed300b226e3a304
SHA512 c352632d743e10b111d9995774961efc88443d3c5b6a7ec608635e6eac775a577598506734f11283ef81214a1e5a6980393f3a17af6016fbff6a3ea30460fbf8
SSDEEP 768:tF6j+9w3Bwg3ZJJonZXff0PeX6+qTko0u229a4vsTlb9MW:t9w3pC5vVTVKa4kb+W
TLSH
T1072339F5A8D38A77C89E4B87633E2D468DBCD163B5885A84B7D85D0CCC461BFC70A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 45KB
SHA256 5c6133a2e3fa142683ac1193eede12316608e791526fef15d4e43a377b90c851
MD5 7fae40906c697fd2b0401cb8cf5a1dec
SHA1 085d975b8cc4820ab5ecbde2cf6efbafa878e3d8
SHA512 ccb550728b5b3eee2102971fbd3f2736a5de6cb4acf4e0050c21c8cef5b1842b4cfde1b5cc018ef45958ed0926aa65f4681132aa4daea2fad7c5fdf4ff654712
SSDEEP 768:tFcj+9c3BwgoW8nZXff0ZeX6+qTko0u229a4vsTlb9MW:v9c3EjvVTVKa4kb+W
TLSH
T1F92349F5A8D38A77C89E8B87633E2D468DBCD163B5885A84B7D85D0CCC461BFC706816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 45KB
SHA256 f4b9fd4a236fededb10a0cc1693ffc79cb1950c39ac1fb516b33465a34c5a3ab
MD5 899b4e6e9c6ad19607a70e0f165e86c8
SHA1 d424564a6bb37a37b04920d99f92a3454b224d09
SHA512 c431ba8f60f3418aee95f166cc4a78c8d8b5ce3d58157487f40b92b5908ecabc0965edac80b350ce732b224c9a987f9b4ebca587ae2dc0013d0cede5e65f70eb
SSDEEP 768:tFWj+9Y3Bwgo5QnZXff0CeX6+qTko0u229a4vsTlb9MW:J9Y3zOvVTVKa4kb+W
TLSH
T1B3234AF598D38A77C89E8B87633E2D469DBCD163B5885A84B7D85D0CCC860BFC706816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 45KB
SHA256 1b08f38c63c03fe29aa4eaaf2077e0676ea40fa8f2b6048a2fa64aab764bdd05
MD5 b1db91d1d8c86945319790270a750a15
SHA1 dea10a3e1d075204f597434a40e394444b21eca7
SHA512 daa95425415ff8c646010efd77b7fd4db3b6bbd0186955838e5028514680f6b54ffafc51b7346079c7fede1255e774b56ccc75193fc817cf536d1d5f8b2c42d9
SSDEEP 768:tFHj+9V3BwgoRfnZXff0XeX6+qTko0u229a4vsTlb9MW:G9V3UJvVTVKa4kb+W
TLSH
T11A2349F598D38A77C89E8B87633E2D469DBCD163B5885A84B7D85D0CCC460BFC706816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 45KB
SHA256 f0aab8705dd75b4af0923193d92255b6a032e913432556f5b7f19753df901809
MD5 5894bba83453064312109abfadaa8c92
SHA1 b401ddbe075d2842b463cce8be24ed0ae0b5964b
SHA512 9946ce8fff676ad84a91d56e7933a5bb8f3e5a9d7191cf3139be4c14e582772792ee0f1545fbbfd4b744b5dbf1cbf3f3531d8dd200acff45879dbd4f10a5ccf6
SSDEEP 768:tFuj+9x3BwgoBbnZXff0feX6+qTko0u229a4vsTlb9MW:Z9x3EtvVTVKa4kb+W
TLSH
T1EA2349F598D38A77C89E8B87633E2D468DBCD163B5885A84B7D85D0CCC461BFC70A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 45KB
SHA256 501fb60ea55a7459be1576b4a174782b84c667336b6bcfabd3c7338a2e5e0b11
MD5 7f226cc1624675c74fa64499d1180d50
SHA1 94f3393f4cd5a76179db0dc91fbaed2ad3891bdf
SHA512 272c5986c4bd528701c4019d3a79d4f1bffaab6b97b53b09f55a8dfb4fa6f70df3e0b342a3e240aaa8646044d0f3b91e57b8cfd048959777163cee7d4e80078f
SSDEEP 768:tFOj+9N3Kwg3DJonZXff0AeX6+qTko0u229a4vsTlb9MW:Z9N3VAvVTVKa4kb+W
TLSH
T1632339F5A8D38A77C89E4B87633E2D468DBCD163B5884A84B7D85D0CCC461BFC706816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 45KB
SHA256 b93c0970a2cef905533af224079bba1392840fc26d5683c069558f54722eadac
MD5 7c3ff2aaedb37e35042b056c6c45f849
SHA1 71916bf3b98b6053fbccf61f4097dfecda82819f
SHA512 a8631229c5754bf116ec6d70d575651c473d4fb523d72a15d8a7fb66df4e6427b6887c8a18434f9aab63cc95a1b44d0cd435f6cdee8ebe1aad1f0d2b682a3b48
SSDEEP 768:tFxj+9n3Kwg3AbonZXff03eX6+qTko0u229a4vsTlb9MW:Y9n3IFvVTVKa4kb+W
TLSH
T14B2339F5A8D38A77C89E4B87633E2D468DBCD163B5885A84B7D85D0CCC461BFC70A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 45KB
SHA256 80b9e161caa66b3860cfab7dc36181555bc7925e3e7ab3b027857b25bfb59df3
MD5 f06ce78bf125f9ef5257a69539136a94
SHA1 0f5c0ad194cc8ce9f26fc351f96c03791722ebeb
SHA512 d8eea78eed926082921d8f15b8d82fc6c00c9577f6f0676dd816ccf7ff8970c32e55084a4d54166af8826792101a7af295df783925c0ba6948959ab19ab7702f
SSDEEP 768:tFTj+983Kwg3MZonZXff0peX6+qTko0u229a4vsTlb9MW:q983U/vVTVKa4kb+W
TLSH
T1442339F5A8D38A77C89E4B87633E2D468DBCD163B5885A84B7D85D0CCC461BFC70A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 96c93c8df291e9691622ff5cf93ded6408e5e145c2d28b3b4207379552515819
MD5 5fe563127eb881c6423ae98ecb5f5c1b
SHA1 86fea8feb38b47775aefb561b5c47d81b0cbe7c2
SHA512 11d2336e1879dcb531240ae7e477b88dd85f15798072efa5b648bd65c5abdf9b54d8d59a2bbb241475605739540e55bf1edbd0b086dff100d86e1cb96eb12eb6
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 9f710baa7a66fb89e4447366a170eea4de827e0e421466ab3bbc7a4774c787f5
MD5 8f998f7690218e82ce36addc544136c8
SHA1 f6a6eaf7061c370fb9b5f2619d9c43ed5ef54efa
SHA512 b267af8d4df22bf33bbf62ec8660be45f41e30fed5956bcd38845b85b1787d661e805296f2e20f6ef1e92f940acaf299502d780fc52781e26e7ec37e9f320e2e
TLSH
T171E0E806E31180BEC4290B3140A32B26ABEB882042F20B230A11A2203CA37A02F30AE0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 14d19ff8443ab747a20fb346d37250ab565bbc8a1105db69d72abfb50eb0cc37
MD5 c595cbe044eaab32875015eb7e69ec07
SHA1 8f28814eb08c6e9090b1a7a2beba306cbb1df3c0
SHA512 280f114920205286a0c4c074ca2f00339513c9927bc16bae2c087bcd0bda2d010522d7737e329e630ff8d7e7b362bcceeb69a791a6dcbe2575e22f853aad0d35
TLSH
T13EE00105A350507EC12D033411872F306FE1C01402F203174730016C6C333007F70E40
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 6ea0d1d90853ab8e85214ad1b00b0fce8226880afc72e82554d31f4e2b22d810
MD5 5d5548d799f02bfc672625cffb8423da
SHA1 ad726f884c1c329fd12dc7da85475dffc1cd18d1
SHA512 e66e02daeecedc8332396f05c1f7335c85fec7d606e9de5f019affb51331fee901856b88c36865f31c5d11201b88d0c0bebb3bb88aafb8648c1f5820f5db7526
TLSH
T195E00945A354413EC12D0B3451876F305FD1C81102F203674370015C7D377007FB4E80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 ad5825318c76daeab7078d44b4b641a627b9b790e72bb65468421f4f2f61cd8c
MD5 4f67a650d9f656ccddb9874184475dd2
SHA1 7beef07bf2b05d0d589e8e502ff20cf578c86c35
SHA512 44aaad198ca3e144df1d95ea2d8aaaf45f89e62274d91866c628a153a6ed9b994b82da0c1087b521250c0a9b2a752ec2947bcff5220923d5fd3f48bfc4773a09
TLSH
T1D2E04881E341403AC0290B3001C31F202FE2C80002F20763037081AC7D733003F70F80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 eebf40b3d8e3c4087f632023c5dec2d45673d999bbcdd92b5f5f3a0ff0d2a1ea
MD5 ebefb20075d33652c20b7e21f5049aaa
SHA1 2d7088adfb56d2c9e08a6979d881e58963001cd6
SHA512 b146fc99b0dbc26373a3780375227c26f0beb4b34929a674bdcb16264000bd42e7aab5eb791e688e358cf8dac540f52e9030ee63302a4256ef18817248ff0fbf
TLSH
T143E0EA46E35640BAD0691B7445C71B25ABE2C51112F20B67077195A97C773042E31F80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 9b582120b7f33612481a87d4de617ba877ee831839e8e62e20af60392fa816d6
MD5 ad745b8b3f11266aa68caf857e873a72
SHA1 21daedcf6b10caa5ee03f6f9211143603ef4cc3b
SHA512 0098da63c458b8934c41b2847a4a2ef1f0342758870ab5cae421c82608043a1a48f7146132780083d1c5644e9aa1316a06b297c212c503254574652a30389a32
TLSH
T108E09582A34250AEC0381B7440C31B20ABF2C92003F30BA30A2092A87C6B3002E31F80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 9a5121c2e0f3478a41451b52d3da09cff992f42237c4286fc05870eaee6061b0
MD5 9e286c5d1cf1a43e0d806ba3d547dac2
SHA1 2abb196256573d6b367d0d4aee9c16062d54579f
SHA512 de46bb92889aa959e4ca4a0c5d5cf1cdeec0038821e001b86b6a416c82852063b83c9fdc0db4b5c25b1ad664f7f68979e5bb1cd4a9547069533a5d515f92656c
TLSH
T150E09582E39280BEC1741B7540C31B20BBF2D92013F30B531B21A668BCAB3142F70BC4
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 23a3b6cbf46f851c9a45e0fde92e330e11ef206a427713a4dfea097d0ab8a0f8
MD5 8ddd4a225b40516d3da300cb774e4971
SHA1 c87979f3af0d7f56e21f84baba37e9603d44ef14
SHA512 3a2fc61908616202f1466a92772f079d5d02ff720e7490ae37beebcabf766e7eb410bbce7451562e0e79e1644b1fdf4b8f25141d133db04466764caed14267ca
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 1b42f759b7cf5ec8072db5c4f2d73abfb8468c41ce644d29651c955fbb6640ba
MD5 aa21721dc631799ab5f0fdc5804ab5db
SHA1 d72341ffb44925d7278a832b2670583a3bd579cc
SHA512 7d2c4ea9555e61fd4d4659d6314793f109382e3ef83794c162c76ed7e83800e231a68cf3d32cce06804d581588eaa605b6ffcda07783f3c865bae8e5af30ad3b
TLSH
T1B0E00141E282403AC0290B3001C35F206FE2C91012F20763037085A87DBB3402E70F80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 853d78e91cea28daa29e6a3df5354212676adfb1f11a3244cc9f355694daa7fb
MD5 b1aa82f7b85a51d359f557ddcd9a0334
SHA1 495a62e99d367c93eb965e85b336ad34ed59e707
SHA512 e0af27d36ae1ecf19761e2aff2ddbbecfbe54c6a99ecfc5446fe19582cda4c0e218ea323417fad4ac7c6c79881302f252959e42f10df1cfbf0a721b725f3b016
TLSH
T156E00141E382403EC0290B3005C74F20AFE2CA1012F20763037085AC7CBB3442F30F80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 7b956236343a2740a33b2d8448143c2652a9823b876952b33372d4f010e74934
MD5 e2233499fb15c5202cd15c41ec431019
SHA1 aba583fcc0660453150f908d34fdd33b6319e9df
SHA512 7d9d4d957f04f49fa790ecff2163b47c01af737b7c84d448f43257307747b49d84acd08282ccbfd1df20764e91535c8f236f039c534624455bed3bb80adf1336
TLSH
T1B7E00146E382407AC0291B3045C72F20AFE2C61112F20B63037296AC7CBB3042E31F80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 3eed0742eb4246a46fb18b30e3b149b7a9cdd721a663529fa9af7bd65809ea99
MD5 ab0b4b8e420c6d9623aaf04fe310531f
SHA1 64c1215357d2f0f646d131cbe3d57059d89c2a3d
SHA512 3e5d0ef5b9d58e59ed29bcd63632efa738d04e1ef63c78469ba01af17214db7094e780fe044c946ed7ed6cb58d8722627b5c58820ec4bd507bbd01675b73d030
TLSH
T1CFE0EA47F35650BAD4691B7445C71B25ABF2C92112F30B670B7195A97C673442E71F80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 93ae08cfe8f3ac78edc9c0ac4c06f36cfbe5f19b1fdbf5ee3d2029ca7395563d
MD5 7e10b4cbee55c1e04a9852f8cee7fd35
SHA1 157f9b6c21e7bd8e8060e78383899f630d856f9c
SHA512 bb0aa2dad0b3b7fc38093d1bf328f9c043186346eb80c100e876e3484b856d84325c60c28c6cb790047f1476912cbbb573b150c5e56097883b6c8822bb02b678
TLSH
T1B3E00145A354413EC12D033451876F306FE1C01102F203574330016C7C333107F74E40
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 d9ed8564837895a06e970d8fafb057056258a15ecf17f9cb0261db3c647ec7fc
MD5 994815594204e51dc5c7c867b91a37e5
SHA1 7542c6600536aac6f4d15ab8f6e9776983eee640
SHA512 0e71e7651962321773ff2a178286b944d000839953d0a7444bb317c0c88c5c88f863622e74e370394edab9c325ca1175fb0280c7ba38406f38852a8c44f13072
TLSH
T104E00085E351512EC12A0A341587AF316FE1C81516E2036B437001687D377007FB5E80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 055d7751f386cb83efae352ceb2b778f809080e9ab65ad0b1eb07dad9423a4bc
MD5 e2af65b00922e64f53ef2545d025dd1c
SHA1 ed20446b1462345d45202935ac5c1037d446f5d9
SHA512 ee8ca7d4ab77760483b874839fa0fb72ed70f8cd10c8f5bef0edded71d3c03b86da2c3e7d7f8ae4f4a64de19003452bad09b961281b8b1e5b8310441f0195154
TLSH
T167E00485E355413EC12D0B345187AF306FE1C81116E203AB437001587D367007FB4E80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 b5b5aab1ab496c5fbd47f5c069b9f3314c9c105250b72d744f1f6284e938c261
MD5 ef98950047617cdb64f95e77540383a3
SHA1 5b45f29b544833dd881a0a827107963e5ff64fcc
SHA512 ad246aa58d792522bac3ac653633cb66f90fbda38ca73a84fff68ec8ef48e90b1e3bf2d346c8e562e6d03bd4f58fe08c4cc2a3f2e84971e2d48a1c4062d76cce
TLSH
T18AE00186F39640BEC02A1B7845C72F24ABE2C61112F20B63037296A87CBB3042F31F80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 a4b6a6564dc8792912ba6a43e97acc9b760e25c197cd9bae1568a552f20a83e6
MD5 dd99331e20e5d74b2f081c31fc21d8bb
SHA1 f06ce9cff1292b4603d0ea28ebf4cd48520b2f98
SHA512 ee33487c4765250845d3118c7a73a275281f60cce2da376d69e798210e513bf1026976e96bfd54d65e8d49294d3b2db0875cb8079bc060dbe7e1d10b62117b10
TLSH
T113E09582A35250AEC0741B3044C31B20ABF2C92003F30BA30B21A668BC6B3102E31BC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 063aff37ba11dd390d2402eb0bed73b23260469e5855589f61c6edba6367ff75
MD5 30262db1edafc405d11ba4f10d96705e
SHA1 8402cdaf5f13d41aca883d5763219412ee0c9c35
SHA512 1fd66e7fdf17ef54063f5979347e490a66d670957bd352e961bf955a2c8994a4f18bb43310663c6f268d04a6de3f1649af5a45410f6e79a96addaf869419af8b
TLSH
T10CE00086E351507AC12A0B7416876F316FE2C91416F217AB47B081A8BD377007FB5F80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 87e910c4d0cbd035a4671f00f2fb43e2c14cb79000389cc83a6b16153a95731f
MD5 857b43a29edeea5093302c44577c846f
SHA1 238bef8fec0d7dafc1bcec6f6ad381de494e4d08
SHA512 f6aa0ad636dd7808b5ec8ff4647e820de75c02d57a33418acb00c1b2e2292876a0726cb26117df1c0d51621f748a37e268dfcb5711f94c53afe1c04d12464472
TLSH
T1CCE09207F35180FFC17A0B3540D71B25ABE6892013F30B135B1166657C973942E70B90
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 4d2d051dce8782cb1023f1aacaa2d76f2d9ff96f55a34ae107d36fd77edcd5c8
MD5 e77ab0aeac1836ef74511496cf71c03b
SHA1 e765bec9046e0ac55f0537ec1940b6f19779ca1b
SHA512 504350db42aa48661ecce04929ada55bf7077c5899b6ad04fc771d63ee67f4a5b8a39d20f516fe7ec73f0fc3e6eee742ab4d418eb09735e88ad15aa89c9e1108
TLSH
T1D6E09207F75180FFC17A0B3540D72B2AABE6D92153F30B235A5566657CA73942E70F90
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 5c96eefb8f4e929a5902760ed639c38258016b75f4d7ee90bb344b847ef45b27
MD5 1b00f2f5e6f2ea372c17c72bec859f1b
SHA1 d78094ee7e35d126f6ad782246ed184f29d17c51
SHA512 0b94f7c44cf33d843c868104d01ee5d1400edf8e655d1298f3bbbaa25c1337014569ff3f78a1afcf7f3a1dd486dafd26f388ee0df5f0dfd3b15252e68c5167f7
TLSH
T1D7E09247F35180BFC1751B7540D31B20BBE6D92013F30B531B2166687CA77542E70B80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5ae9e4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5ae9e4.TMP
Size 392B
SHA256 f4bfeafc48b572d08ae7315a901d2ec108a9247966b03c021b70246031ca1eb9
MD5 428eae89a3708e29fbbd4ba325f3eb40
SHA1 76dd498ea2afcc7b03dfd976e96952b2c7f1bceb
SHA512 0687852b429286976abb9f0021a9e711b4af7f58b47acff4f8f6e63f6c00880cabf228cb9b159239b21efdc39acd2782f79887a9cb6ec30e5d9a01de710904f5
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 612B
SHA256 98d9b184e4c7220b5aaf7ae412b0c1b3f32e3dc4933afcf852538b8082017b9e
MD5 c20138f2b92ee0645ce99eebc563daa6
SHA1 8e20392ea25dec3d3cef957c8ebbe1a0c589ea3b
SHA512 151098a27cb44d715d48210b12b95a9d1341beb7ca1de3096edc0434ba70c3d274e446604c7692d7a4d92af7b41872166747a30fd452fd0279407a6993fc02c0
TLSH
T15DF00CD28C3E21C2C5EA0F7ED04B2AF884D46507F0887439088DEAD4C17A80F118247E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 732B
SHA256 a5548ca519cf47ecb420c8f1299a8a50517fa463459a704ef2ff17c4db35117a
MD5 b2c40634bbfa57be0d4fad8adfbd6ccb
SHA1 6f8b9ba2f40d9aa42d217ed2bc6dbcdedd1763ad
SHA512 3cfbef4e4a4a7d8fa1530c69ea34fbc3b84627888361a9d201b21e6ead15f5d4e51fea8bc95edd07415b6d2d06a3c19beb1bcea3195e05a6d8af4939b95f77b5
TLSH
T1220110D29C7E26C2C5AA0FBFD08B26EC44C4A516F098747A1CCCF9D4823980E148243E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 972B
SHA256 590065152acec5cf42dffc28eb04749514feaa899eb2ae04edce7d38a148fbda
MD5 30ae49636160992413baf749cf492c9d
SHA1 93edd7244143177356c931699cb8a266bad04660
SHA512 b986d2486431c75ee9ea0acd7d891c2d40042dfe9185910eedc52db52d68de586df47518bb97647f325416a600eb0e7b794c9d5db9242f3417882791a266829e
TLSH
T11E1114D25C7E26C2D5BE0FBF90877AEC44C4D616F194347A1C88ED94417981E154147E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 2b7c607fd6a639934c6f7311f36aa760dd4a600f84b9f8e2d066832856488091
MD5 a36353281ee63c90e6d74b67255fe9ed
SHA1 f8aa66a70fe63c5f2aae1964243c68b3617d9c57
SHA512 9950368809a0ccd2b7cadae6c5ad4af6b981a19210a81b38ebe99aa0a683ffdc822d6bec67c6e4cf1ddbf1d47b71b7aeae4380c6552f5d5b6298fb649949ae69
TLSH
T1D3312FE25C2D1AC1D0BE0EEFE48B29EC84E8D216F19434392898ED94567D91E258087F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 9107e613905835c00077a499d2faa20bb70b974e6309d1f2f33ae52933318f07
MD5 2012d4de563c653f56f62ccbf46db598
SHA1 fb24881003593f1ceb79019e52ce5ee9e94c889c
SHA512 c03d6584395c1c97c75af7dc6df57df358d3957035521bb6833c538679683aebe0410bb12586472b84dc98111e703984dd37868464fa9c66fdafb423e763b555
TLSH
T10CF00E829C3E25C086E90F7FE44725F840C46517B0883879088DE9D8813A40F11414BE
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 757c40068c8b44526fedddbae76f4ef49d46e6f99e9c5b6ac7daee04f31c52bc
MD5 d3c09492385327b4a73e8682955af55b
SHA1 240fab0985703fee85cf6f4073e03764bdb8aa5c
SHA512 09a4d78749d0d19904aa74f079fa2811f4b5de2b62305c89fc775606945a876578959e3f95cfb06258b2450dae9c4ed8a80ecdef86debcfb139ef6a47615ec6c
TLSH
T15A11F0D25D6D19C2C5BE0FAFE0877AFD40D8D216F194707A1888ED54427991E114147F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 852B
SHA256 142a7cc7a4933a976aae32a9d04e1758464486092207243f09edbbad51f1d934
MD5 95fe84d83629d03e0bc6e035f44a5cae
SHA1 2af304ef821c70f2d00b47a3e3872c17d33e40e7
SHA512 266ac6fd03731d757bebdacd0d27aa0326e022f9791d7892445f595285b17def95b722da875c974360a7567be530324d0d91a3310008958cbca0f09f04676301
TLSH
T14E0112D25C3D26C2C5BE0FBFD08776E844C4911AF19474BA1C8CE994827980E208243E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 7ae3abeff1a7ac2b396b3e38dc9d2900c37a4fa3623cd6a74cdc34b502978149
MD5 d7023fa4d2528dc28cb0aaefeff697bf
SHA1 a9d914b66ca62916a33ca38b55ff971687cec7f8
SHA512 a12e587ee1c0f13ff6b3da22343b7611d6985799073cd0898decd626042b0e3a69747a3419b461a74ae1dee8d439eef7f39e61fafbf6bc2d3be40d501161b36b
TLSH
T13221FEE26D6E1AC2D1BE0EBFE0873AEC54D8D21AF1D4347A1888ED94923D91E154187F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 21075672ed04fcc0ad86c96036a015a0479bc539f9eb22ed2ee07d5f51ed51d5
MD5 a8b716843d7c8f9dba996daed984824f
SHA1 0c96d6d123c2416eb76b7da62e37d23071beadb7
SHA512 5d339045c75561891f8b131b85aa5713a39f0c762a24cffd19d9577849262e259f66a06264e6b97d4d7a2b39170891003f4bfd55c6f8d31f9da107ab6548e117
TLSH
T1DE21F0E15C3D2AC1D1BE0EBFF0873AEC90D89216F5D4347A2898ED94823D91E158187F
MD5 SHA1 SHA512 TLSH

Submit Download

50effcb8-4a4e-4552-a822-cd76fbcacd41.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\50effcb8-4a4e-4552-a822-cd76fbcacd41.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1376_1526980409\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\x
Size 11KB
SHA256 3c8cea1a86f07b018e637a1ea2649d907573f78c7e4025ef7e514362d09ff6c0
MD5 1882f3dd051e401349f1af58d55b0a37
SHA1 6b0875f9e3164f3a9f21c1ec36748a7243515b47
SHA512 fec96d873997b5c6c82a94f8796c88fc2dd38739277c517b8129277dcbda02576851f1e27bdb2fbb7255281077d5b9ba867f6dfe66bedfc859c59fdd3bbffacf
SSDEEP 192:Ljafl1gt6iUq/l0ZQjGNxYoanyJfjvB0BXmqqTZhXBnaRL9znQ32z8h0:L29mtJUui1any9Bn/RaRL06
TLSH
T12632BF3332B50E131E1037EA9D1BA21B8CF551377B2B1E35D1118EEAA1EED66D283B54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\x
Size 2KB
SHA256 1bc91e05e0d00b4f7bbc119069dc510ca3a36666a0094368c4984596515625a6
MD5 5e291865f5b8f51471307c5c53c0143e
SHA1 00b82f59b32b7ac394221851f2cca41686a34bc1
SHA512 446d3ca47086ec3d1838ff75bc01509a41dd9ba95c783e43025322d2bb2b499020dff19aa19eee7ad9dc1139cfe0fdc13e68fbacdfad311afb53969e67dc7f1d
TLSH
T1DE413B6535F89F43B2235BF2992760C6ACA8E93F788A54991C20CD7500FE82A41C9F36
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\x
Size 4KB
SHA256 45f18ccd8df88c127304a7855a608661b52b0ca813e87e06d87da15259c45037
MD5 214f98cb6a54654a4ca5c456f16aed0a
SHA1 2229090d2f6a1814ba648e5b5a5ae26389cba5a0
SHA512 5f058b05f166e2688df7b3960e135ada25bbcdfbb62a11da3cf9e70c08c51e5589a1e6ca2250318a694d27197f2c5ba1028c443831c43fba2171ca8e072e9873
SSDEEP 96:2OfjuOV4dI3CMQYGtWJQsRmWZu2Ik6iUqLplsQuK0sIF2jGM:Ljafl1gt6iUq/l0ZQjGM
TLSH
T1DB918EB6A5B89D076B4133F59D2B349F6CD4653B794592498810CCB904FFC0A81CAF38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

x.js

Path C:\Users\Admin\AppData\Local\Temp\x.js
Size 448B
SHA256 aa01b8864b43e92077a106ed3d4656a511f3ba1910fba40c78a32ee6a621d596
MD5 8eec8704d2a7bc80b95b7460c06f4854
SHA1 1b34585c1fa7ec0bd0505478ac9dbb8b8d19f326
SHA512 e274b92810e9a30627a65f87448d784967a2fcfbf49858cbe6ccb841f09e0f53fde253ecc1ea0c7de491d8cc56a6cf8c79d1b7c657e72928cfb0479d11035210
TLSH
T148F0DC1CD210E3DD40B3138E2888E6D892872B5D790BF5771554C0CDD027626126EB8B
MD5 SHA1 SHA512 TLSH

Submit Download

z.zip

Path C:\Users\Admin\AppData\Local\Temp\z.zip
Size 8KB
SHA256 44c1857b1c4894b3dfbaccbe04905652e634283dcf6b06c25a74b17021e2a268
MD5 63ee4412b95d7ad64c54b4ba673470a7
SHA1 1cf423c6c2c6299e68e1927305a3057af9b3ce06
SHA512 7ff153826bd5fed0a410f6d15a54787b79eba927d5b573c8a7f23f4ecef7bb223d79fd29fe8c2754fbf5b4c77ab7c41598f2989b6f4c7b2aa2f579ef4af06ee7
SSDEEP 192:egFudZs7gU52m4qi2hvimtucysYSM3lRNm5wy2k89QPaNmCpCfAKgW:SdZs7n52mbFimtuckPXEKyuGSXCfAKx
TLSH
T11402AED2B15ED3C986DAA1BB449D46D221105A2B2F3DA914CF3D83C73C6D3A6744CA1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MEMZ.exe

Path C:\Users\Admin\AppData\Roaming\MEMZ.exe
Size 14KB
SHA256 a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d
MD5 19dbec50735b5f2a72d4199c4e184960
SHA1 6fed7732f7cb6f59743795b2ab154a3676f4c822
SHA512 aa8a6bbb1ec516d5d5acf8be6863a4c6c5d754cee12b3d374c3a6acb393376806edc422f0ffb661c210e5b9485da88521e4a0956a4b7b08a5467cfaacd90591d
SSDEEP 192:sIvxdXSQeWSg9JJS/lcIEiwqZKBkDFR43xWTM3LHn8f26gyr6yfFCj3r:sMVSaSEglcIqq3agmLc+6gyWqFCj
TLSH
T180624BCFBE204417D8F0C57530659234DFBACABA1B968EDF9CF91E529AC4C072823265
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 1KB
SHA256 e815e885e9c032f18b930e5e12ca60103a41e62cd2e5845600bdf858ec61fc60
MD5 17bd194bdc663e15d425504d2c78854f
SHA1 d1bbcd65c3c9409bca0e35eead30b24dcc5f2b9d
SHA512 b1db8ac4777f85c9e05be2ff5a4a00846ce285fa8a5983af522787ebb53aeb1f073c2d03ef53e55052193a8b0ee1a6659b173a0a9e21dc58fbb63c3d55117ab6
TLSH
T1CC31BD82D081AC9FD78B709ACA5520C81B5F98C675F2E0314B6F7E95A0EE249C7E7846
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1376_1603693431\LICENSE
Size 1KB
SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
MD5 ee002cb9e51bb8dfa89640a406a1090a
SHA1 49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2
SHA512 d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c
TLSH
T17D31535723840B9306DA2B4566AEBDC4B0DDC02D7F27AE05186EF394537B52ED8B3443
MD5 SHA1 SHA512 TLSH

Submit Download

note.txt

Path C:\note.txt
Size 218B
SHA256 8e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270
MD5 afa6955439b8d516721231029fb9ca1b
SHA1 087a043cc123c0c0df2ffadcf8e71e3ac86bbae9
SHA512 5da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf
TLSH
T1C3D0A719040784251C7052D17145A5A09B70562D77F626EB74DC690C212700F0B37C9A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/7976-1996-0x00000000060F0000-0x00000000060F1000-memory.dmp

Download

memory/7976-2004-0x00000000060F0000-0x00000000060F1000-memory.dmp

Download

memory/7976-1993-0x00000000060F0000-0x00000000060F1000-memory.dmp

Download

memory/7976-1995-0x00000000060F0000-0x00000000060F1000-memory.dmp

Download

memory/7976-1987-0x00000000060F0000-0x00000000060F1000-memory.dmp

Download

memory/7976-1992-0x00000000060F0000-0x00000000060F1000-memory.dmp

Download

memory/7976-1994-0x00000000060F0000-0x00000000060F1000-memory.dmp

Download

memory/7976-1991-0x00000000060F0000-0x00000000060F1000-memory.dmp

Download

memory/7976-1999-0x00000000060F0000-0x00000000060F1000-memory.dmp

Download

memory/7976-2003-0x00000000060F0000-0x00000000060F1000-memory.dmp

Download

memory/7976-1985-0x00000000060F0000-0x00000000060F1000-memory.dmp

Download

memory/7976-1997-0x00000000060F0000-0x00000000060F1000-memory.dmp

Download

memory/7976-2005-0x00000000060F0000-0x00000000060F1000-memory.dmp

Download

memory/7976-2006-0x00000000060F0000-0x00000000060F1000-memory.dmp

Download