hxxps://gofile[.]io/d/pUj4Ug

Analysis

user interaction
yes
max time kernel
699s
max time network
701s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
27/07/2026, 09:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://gofile.io/d/pUj4Ug
Sample260727-lynncsac85

Score

6^/10

google discovery persistence phishing

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
26	api.gofile.io
29	api.gofile.io
23	api.gofile.io
24	api.gofile.io

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe

Detected potential entity reuse from brand GOOGLE. 1 IoCs

phishing google

flow	pid	Process
413	1348	firefox.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping868_208574012\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping868_208574012\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping868_208574012\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping868_208574012\llm_user_input_extractor_config.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3632	msedge.exe
4228	msedge.exe

Checks processor information in registry 2 TTPs 28 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134296198136534240"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2746394149-3500112804-1243524366-1000\{206B9BED-A646-48C5-9D0E-81C39241164D}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2746394149-3500112804-1243524366-1000\{B8FED123-9E56-4232-A8DE-040691BCB080}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\MuiCache	AppInstaller.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings	OpenWith.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Skedule-I-SteamRIP.com.rar:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\python-manager-26.3.msix:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3976	msedge.exe
3976	msedge.exe
868	msedge.exe
868	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3252	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 51 IoCs

pid	Process
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1348	firefox.exe
Token: SeDebugPrivilege	1348	firefox.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe

Suspicious use of SendNotifyMessage 20 IoCs

pid	Process
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe

Suspicious use of SetWindowsHookEx 34 IoCs

pid	Process
492	AppInstaller.exe
3252	OpenWith.exe
3252	OpenWith.exe
3252	OpenWith.exe
3252	OpenWith.exe
3252	OpenWith.exe
3252	OpenWith.exe
3252	OpenWith.exe
3252	OpenWith.exe
3252	OpenWith.exe
3252	OpenWith.exe
3252	OpenWith.exe
3252	OpenWith.exe
3252	OpenWith.exe
3252	OpenWith.exe
3252	OpenWith.exe
3252	OpenWith.exe
3252	OpenWith.exe
3252	OpenWith.exe
3252	OpenWith.exe
3252	OpenWith.exe
3252	OpenWith.exe
3252	OpenWith.exe
3252	OpenWith.exe
3252	OpenWith.exe
3252	OpenWith.exe
3252	OpenWith.exe
3252	OpenWith.exe
3252	OpenWith.exe
3252	OpenWith.exe
3252	OpenWith.exe
3252	OpenWith.exe
1248	OpenWith.exe
1348	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2788 wrote to memory of 4864	2788	msedge.exe	80
PID 2788 wrote to memory of 4228	2788	msedge.exe	81
PID 2788 wrote to memory of 3048	2788	msedge.exe	82
PID 2788 wrote to memory of 3048	2788	msedge.exe	82
PID 2788 wrote to memory of 3048	2788	msedge.exe	82
PID 2788 wrote to memory of 4240	2788	msedge.exe	83
PID 2788 wrote to memory of 4240	2788	msedge.exe	83
PID 2788 wrote to memory of 1400	2788	msedge.exe	84
PID 2788 wrote to memory of 2152	2788	msedge.exe	85
PID 2788 wrote to memory of 2152	2788	msedge.exe	85
PID 2788 wrote to memory of 2152	2788	msedge.exe	85
PID 2788 wrote to memory of 1400	2788	msedge.exe	84
PID 2788 wrote to memory of 1400	2788	msedge.exe	84
PID 2788 wrote to memory of 2992	2788	msedge.exe	88
PID 2788 wrote to memory of 2992	2788	msedge.exe	88
PID 2788 wrote to memory of 2992	2788	msedge.exe	88
PID 2788 wrote to memory of 4220	2788	msedge.exe	89
PID 2788 wrote to memory of 3788	2788	msedge.exe	90
PID 2788 wrote to memory of 4220	2788	msedge.exe	89
PID 2788 wrote to memory of 3788	2788	msedge.exe	90
PID 2788 wrote to memory of 1824	2788	msedge.exe	91
PID 2788 wrote to memory of 568	2788	msedge.exe	93
PID 1824 wrote to memory of 5488	1824	msedge.exe	94
PID 2788 wrote to memory of 4632	2788	msedge.exe	95
PID 2788 wrote to memory of 4632	2788	msedge.exe	95
PID 2788 wrote to memory of 4632	2788	msedge.exe	95
PID 2788 wrote to memory of 2436	2788	msedge.exe	98
PID 2788 wrote to memory of 2436	2788	msedge.exe	98
PID 2788 wrote to memory of 2436	2788	msedge.exe	98
PID 2788 wrote to memory of 4416	2788	msedge.exe	100
PID 2788 wrote to memory of 4416	2788	msedge.exe	100
PID 2788 wrote to memory of 4416	2788	msedge.exe	100
PID 2788 wrote to memory of 5052	2788	msedge.exe	99
PID 2788 wrote to memory of 5052	2788	msedge.exe	99
PID 2788 wrote to memory of 1708	2788	msedge.exe	101
PID 2788 wrote to memory of 1708	2788	msedge.exe	101
PID 2788 wrote to memory of 1708	2788	msedge.exe	101
PID 2788 wrote to memory of 3064	2788	msedge.exe	102
PID 2788 wrote to memory of 5576	2788	msedge.exe	103
PID 2788 wrote to memory of 2748	2788	msedge.exe	104
PID 2788 wrote to memory of 5820	2788	msedge.exe	105
PID 2788 wrote to memory of 5820	2788	msedge.exe	105
PID 2788 wrote to memory of 3976	2788	msedge.exe	107
PID 2788 wrote to memory of 724	2788	msedge.exe	108
PID 2788 wrote to memory of 724	2788	msedge.exe	108
PID 2788 wrote to memory of 724	2788	msedge.exe	108
PID 2788 wrote to memory of 5544	2788	msedge.exe	109
PID 2788 wrote to memory of 5544	2788	msedge.exe	109
PID 2788 wrote to memory of 2620	2788	msedge.exe	110
PID 2788 wrote to memory of 2620	2788	msedge.exe	110
PID 2788 wrote to memory of 4112	2788	msedge.exe	111
PID 2788 wrote to memory of 1744	2788	msedge.exe	112
PID 2788 wrote to memory of 1744	2788	msedge.exe	112
PID 2788 wrote to memory of 1744	2788	msedge.exe	112
PID 2788 wrote to memory of 5664	2788	msedge.exe	113
PID 2788 wrote to memory of 5664	2788	msedge.exe	113
PID 2788 wrote to memory of 5664	2788	msedge.exe	113
PID 2788 wrote to memory of 1452	2788	msedge.exe	114
PID 2788 wrote to memory of 1452	2788	msedge.exe	114
PID 2788 wrote to memory of 1452	2788	msedge.exe	114
PID 2788 wrote to memory of 572	2788	msedge.exe	115
PID 2788 wrote to memory of 572	2788	msedge.exe	115
PID 2788 wrote to memory of 572	2788	msedge.exe	115
PID 2788 wrote to memory of 2480	2788	msedge.exe	116

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://gofile.io/d/pUj4Ug
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x240,0x244,0x248,0x23c,0x268,0x7ffbda6ec188,0x7ffbda6ec194,0x7ffbda6ec1a0
  2⤵
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1760,i,12744216715484014617,18257334835180730361,524288 --field-trial-handle=2320,i,12586458851228692982,12506115680257369392,262144 --variations-seed-version --mojo-platform-channel-handle=2432 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1540,i,13247596818429083482,3439515707629627276,262144 --field-trial-handle=2320,i,12586458851228692982,12506115680257369392,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:2
  2⤵
  PID:3048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2132,i,1210731009391052767,5942273246200122717,524288 --field-trial-handle=2320,i,12586458851228692982,12506115680257369392,262144 --variations-seed-version --mojo-platform-channel-handle=2440 /prefetch:13
  2⤵
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3552,i,12628494324295286577,14251720125922877175,2097152 --field-trial-handle=2320,i,12586458851228692982,12506115680257369392,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
  2⤵
  PID:1400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3572,i,9892491899700864394,10605529582203736790,2097152 --field-trial-handle=2320,i,12586458851228692982,12506115680257369392,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
  2⤵
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4908,i,13002826499308665826,14228412650916150491,2097152 --field-trial-handle=2320,i,12586458851228692982,12506115680257369392,262144 --variations-seed-version --mojo-platform-channel-handle=4924 /prefetch:1
  2⤵
  PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5040,i,2934037503481097533,418369357173371025,524288 --field-trial-handle=2320,i,12586458851228692982,12506115680257369392,262144 --variations-seed-version --mojo-platform-channel-handle=3756 /prefetch:14
  2⤵
  PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4728,i,10928963670662181240,3297506854175863242,524288 --field-trial-handle=2320,i,12586458851228692982,12506115680257369392,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:14
  2⤵
  PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5724,i,38292313916137611,15693420188555907113,524288 --field-trial-handle=2320,i,12586458851228692982,12506115680257369392,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1824
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1104
    3⤵
    PID:5488
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5728,i,376284876555503221,8778748307640505481,524288 --field-trial-handle=2320,i,12586458851228692982,12506115680257369392,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:14
  2⤵
  PID:3044
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5728,i,376284876555503221,8778748307640505481,524288 --field-trial-handle=2320,i,12586458851228692982,12506115680257369392,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:14
  2⤵
  PID:568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6008,i,1408618318098718129,17831576998192477220,2097152 --field-trial-handle=2320,i,12586458851228692982,12506115680257369392,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:1
  2⤵
  PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6516,i,6263952743071975437,11282937979966325692,2097152 --field-trial-handle=2320,i,12586458851228692982,12506115680257369392,262144 --variations-seed-version --mojo-platform-channel-handle=6564 /prefetch:1
  2⤵
  PID:2436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6132,i,16329251437450279585,9517965347300970727,524288 --field-trial-handle=2320,i,12586458851228692982,12506115680257369392,262144 --variations-seed-version --mojo-platform-channel-handle=6692 /prefetch:14
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6116,i,9894428198356716542,14253670955440607376,2097152 --field-trial-handle=2320,i,12586458851228692982,12506115680257369392,262144 --variations-seed-version --mojo-platform-channel-handle=6732 /prefetch:1
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=7012,i,3159115922418546746,16342188510869526761,2097152 --field-trial-handle=2320,i,12586458851228692982,12506115680257369392,262144 --variations-seed-version --mojo-platform-channel-handle=6536 /prefetch:1
  2⤵
  PID:1708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7116,i,538844864476604647,5994097482720482317,524288 --field-trial-handle=2320,i,12586458851228692982,12506115680257369392,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:14
  2⤵
  PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,3874179283650711494,4592189606187061038,524288 --field-trial-handle=2320,i,12586458851228692982,12506115680257369392,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:14
  2⤵
  PID:5576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=752,i,10522698128911582722,2588978948362850196,524288 --field-trial-handle=2320,i,12586458851228692982,12506115680257369392,262144 --variations-seed-version --mojo-platform-channel-handle=7092 /prefetch:14
  2⤵
  PID:2748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6736,i,12590129928190706971,10043406547267232516,524288 --field-trial-handle=2320,i,12586458851228692982,12506115680257369392,262144 --variations-seed-version --mojo-platform-channel-handle=6692 /prefetch:14
  2⤵
  PID:5820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=568,i,10173740445431406211,733360308241554385,262144 --field-trial-handle=2320,i,12586458851228692982,12506115680257369392,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=5164,i,17608011710336708334,16816727918335546847,2097152 --field-trial-handle=2320,i,12586458851228692982,12506115680257369392,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:1
  2⤵
  PID:724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6000,i,18096502668538602215,18376124562710272908,524288 --field-trial-handle=2320,i,12586458851228692982,12506115680257369392,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:14
  2⤵
  PID:5544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5188,i,14563084895061601543,11338650109006428318,524288 --field-trial-handle=2320,i,12586458851228692982,12506115680257369392,262144 --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:14
  2⤵
  PID:2620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5748,i,6237123183435734759,8651395765572511648,524288 --field-trial-handle=2320,i,12586458851228692982,12506115680257369392,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:14
  2⤵
  - NTFS ADS
  PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=2596,i,243916348963640891,13291486465936631015,2097152 --field-trial-handle=2320,i,12586458851228692982,12506115680257369392,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:1
  2⤵
  PID:1744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=7264,i,7849699284167480425,14492068903156365779,2097152 --field-trial-handle=2320,i,12586458851228692982,12506115680257369392,262144 --variations-seed-version --mojo-platform-channel-handle=6472 /prefetch:1
  2⤵
  PID:5664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=7400,i,12641206139989654834,3243576021855903395,2097152 --field-trial-handle=2320,i,12586458851228692982,12506115680257369392,262144 --variations-seed-version --mojo-platform-channel-handle=2024 /prefetch:1
  2⤵
  PID:1452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=7428,i,1756793677753023471,18368075292725108366,2097152 --field-trial-handle=2320,i,12586458851228692982,12506115680257369392,262144 --variations-seed-version --mojo-platform-channel-handle=7560 /prefetch:1
  2⤵
  PID:572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=7756,i,10368726275180235275,16279989610849577546,2097152 --field-trial-handle=2320,i,12586458851228692982,12506115680257369392,262144 --variations-seed-version --mojo-platform-channel-handle=7744 /prefetch:1
  2⤵
  PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=7976,i,9492630007574778686,6035826940164867577,2097152 --field-trial-handle=2320,i,12586458851228692982,12506115680257369392,262144 --variations-seed-version --mojo-platform-channel-handle=7172 /prefetch:1
  2⤵
  PID:6120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=6588,i,13490379848858294144,15310878117913130997,2097152 --field-trial-handle=2320,i,12586458851228692982,12506115680257369392,262144 --variations-seed-version --mojo-platform-channel-handle=2716 /prefetch:1
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=7928,i,6625812442213128139,14981363971932388923,2097152 --field-trial-handle=2320,i,12586458851228692982,12506115680257369392,262144 --variations-seed-version --mojo-platform-channel-handle=7504 /prefetch:1
  2⤵
  PID:5804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=8104,i,17712563883502961407,5784106197232207280,2097152 --field-trial-handle=2320,i,12586458851228692982,12506115680257369392,262144 --variations-seed-version --mojo-platform-channel-handle=8100 /prefetch:1
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=7804,i,7768958397301697727,12066270960926858584,2097152 --field-trial-handle=2320,i,12586458851228692982,12506115680257369392,262144 --variations-seed-version --mojo-platform-channel-handle=7824 /prefetch:1
  2⤵
  PID:112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=6336,i,6805453999272253039,16813101351059373492,2097152 --field-trial-handle=2320,i,12586458851228692982,12506115680257369392,262144 --variations-seed-version --mojo-platform-channel-handle=7464 /prefetch:1
  2⤵
  PID:6104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=8068,i,2770350156549044646,1349106329980058308,2097152 --field-trial-handle=2320,i,12586458851228692982,12506115680257369392,262144 --variations-seed-version --mojo-platform-channel-handle=8128 /prefetch:1
  2⤵
  PID:5292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3332,i,15959695242201303532,18063043751727005898,524288 --field-trial-handle=2320,i,12586458851228692982,12506115680257369392,262144 --variations-seed-version --mojo-platform-channel-handle=7492 /prefetch:14
  2⤵
  PID:5604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5060,i,5727387072250573363,8424687103307763852,524288 --field-trial-handle=2320,i,12586458851228692982,12506115680257369392,262144 --variations-seed-version --mojo-platform-channel-handle=7960 /prefetch:14
  2⤵
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7796,i,9160775949864063843,8389385100772656105,524288 --field-trial-handle=2320,i,12586458851228692982,12506115680257369392,262144 --variations-seed-version --mojo-platform-channel-handle=2716 /prefetch:14
  2⤵
  PID:760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=7848,i,6859197561563510700,7708935160558395036,2097152 --field-trial-handle=2320,i,12586458851228692982,12506115680257369392,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:1
  2⤵
  PID:5312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=6484,i,10045376361666966075,6428289282136232343,2097152 --field-trial-handle=2320,i,12586458851228692982,12506115680257369392,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:1
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=8264,i,14986784937728170919,15582540331519854724,2097152 --field-trial-handle=2320,i,12586458851228692982,12506115680257369392,262144 --variations-seed-version --mojo-platform-channel-handle=7568 /prefetch:1
  2⤵
  PID:2544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=7648,i,17604484130718767879,11845542642795560471,2097152 --field-trial-handle=2320,i,12586458851228692982,12506115680257369392,262144 --variations-seed-version --mojo-platform-channel-handle=7348 /prefetch:1
  2⤵
  PID:2312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=7252,i,9037728278595739842,648303678352806201,2097152 --field-trial-handle=2320,i,12586458851228692982,12506115680257369392,262144 --variations-seed-version --mojo-platform-channel-handle=7992 /prefetch:1
  2⤵
  PID:492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=7580,i,10849771440822027183,12883202679759710250,2097152 --field-trial-handle=2320,i,12586458851228692982,12506115680257369392,262144 --variations-seed-version --mojo-platform-channel-handle=7708 /prefetch:1
  2⤵
  PID:2664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=7668,i,12306919244625453220,11456718042863941337,2097152 --field-trial-handle=2320,i,12586458851228692982,12506115680257369392,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:1
  2⤵
  PID:1224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=7812,i,14538353897264119714,12230158462570175336,2097152 --field-trial-handle=2320,i,12586458851228692982,12506115680257369392,262144 --variations-seed-version --mojo-platform-channel-handle=7496 /prefetch:1
  2⤵
  PID:5756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=8132,i,17440656888206072841,487918527921454299,2097152 --field-trial-handle=2320,i,12586458851228692982,12506115680257369392,262144 --variations-seed-version --mojo-platform-channel-handle=7020 /prefetch:1
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=8252,i,11820207381336826583,1115489537924116396,2097152 --field-trial-handle=2320,i,12586458851228692982,12506115680257369392,262144 --variations-seed-version --mojo-platform-channel-handle=8040 /prefetch:1
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=7244,i,3060547085465935120,5471485165750416324,2097152 --field-trial-handle=2320,i,12586458851228692982,12506115680257369392,262144 --variations-seed-version --mojo-platform-channel-handle=8248 /prefetch:1
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --metrics-shmem-handle=6836,i,9318939910595010454,13092640303117790019,2097152 --field-trial-handle=2320,i,12586458851228692982,12506115680257369392,262144 --variations-seed-version --mojo-platform-channel-handle=8068 /prefetch:1
  2⤵
  PID:1092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --always-read-main-dll --metrics-shmem-handle=7568,i,14647324372711307085,619562020933287671,2097152 --field-trial-handle=2320,i,12586458851228692982,12506115680257369392,262144 --variations-seed-version --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:2008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --metrics-shmem-handle=7096,i,18024288243522732919,12729981364354254932,2097152 --field-trial-handle=2320,i,12586458851228692982,12506115680257369392,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:1
  2⤵
  PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --always-read-main-dll --metrics-shmem-handle=8460,i,12865709816245552922,8164662654858535015,2097152 --field-trial-handle=2320,i,12586458851228692982,12506115680257369392,262144 --variations-seed-version --mojo-platform-channel-handle=8452 /prefetch:1
  2⤵
  PID:3236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --always-read-main-dll --metrics-shmem-handle=7356,i,17752827788844285889,1367370870803517636,2097152 --field-trial-handle=2320,i,12586458851228692982,12506115680257369392,262144 --variations-seed-version --mojo-platform-channel-handle=2028 /prefetch:1
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --always-read-main-dll --metrics-shmem-handle=8392,i,10791946229765665324,12816197655691319927,2097152 --field-trial-handle=2320,i,12586458851228692982,12506115680257369392,262144 --variations-seed-version --mojo-platform-channel-handle=8264 /prefetch:1
  2⤵
  PID:5896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --always-read-main-dll --metrics-shmem-handle=7468,i,3241669625400380378,11592760933303155380,2097152 --field-trial-handle=2320,i,12586458851228692982,12506115680257369392,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:1
  2⤵
  PID:1388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --always-read-main-dll --metrics-shmem-handle=8008,i,14867457753191193159,1447342083414106370,2097152 --field-trial-handle=2320,i,12586458851228692982,12506115680257369392,262144 --variations-seed-version --mojo-platform-channel-handle=6772 /prefetch:1
  2⤵
  PID:1892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --always-read-main-dll --metrics-shmem-handle=8024,i,9013521948947834582,4250491763436597025,2097152 --field-trial-handle=2320,i,12586458851228692982,12506115680257369392,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:1
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8768,i,17384019903565312775,13585890794667402451,524288 --field-trial-handle=2320,i,12586458851228692982,12506115680257369392,262144 --variations-seed-version --mojo-platform-channel-handle=8784 /prefetch:14
  2⤵
  - NTFS ADS
  PID:5608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --always-read-main-dll --metrics-shmem-handle=7968,i,15598329911016357215,17331196069142083723,2097152 --field-trial-handle=2320,i,12586458851228692982,12506115680257369392,262144 --variations-seed-version --mojo-platform-channel-handle=7880 /prefetch:1
  2⤵
  PID:5148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --always-read-main-dll --metrics-shmem-handle=7112,i,1129062964446662442,5256416692032674920,2097152 --field-trial-handle=2320,i,12586458851228692982,12506115680257369392,262144 --variations-seed-version --mojo-platform-channel-handle=7784 /prefetch:1
  2⤵
  PID:5632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --always-read-main-dll --metrics-shmem-handle=8104,i,11049938574471349151,1429788992853527225,2097152 --field-trial-handle=2320,i,12586458851228692982,12506115680257369392,262144 --variations-seed-version --mojo-platform-channel-handle=8152 /prefetch:1
  2⤵
  PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --always-read-main-dll --metrics-shmem-handle=7552,i,5928428834379814413,13126917165029442122,2097152 --field-trial-handle=2320,i,12586458851228692982,12506115680257369392,262144 --variations-seed-version --mojo-platform-channel-handle=8772 /prefetch:1
  2⤵
  PID:3236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --always-read-main-dll --metrics-shmem-handle=7776,i,16341869780866424113,13842686379559749472,2097152 --field-trial-handle=2320,i,12586458851228692982,12506115680257369392,262144 --variations-seed-version --mojo-platform-channel-handle=8276 /prefetch:1
  2⤵
  PID:2908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --always-read-main-dll --metrics-shmem-handle=7568,i,371651353653404865,7584771450511310589,2097152 --field-trial-handle=2320,i,12586458851228692982,12506115680257369392,262144 --variations-seed-version --mojo-platform-channel-handle=8492 /prefetch:1
  2⤵
  PID:5612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --always-read-main-dll --metrics-shmem-handle=8012,i,6219566773653519542,9532644999128226016,2097152 --field-trial-handle=2320,i,12586458851228692982,12506115680257369392,262144 --variations-seed-version --mojo-platform-channel-handle=8460 /prefetch:1
  2⤵
  PID:1864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --always-read-main-dll --metrics-shmem-handle=8676,i,17204300164378746007,10681859018989079269,2097152 --field-trial-handle=2320,i,12586458851228692982,12506115680257369392,262144 --variations-seed-version --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:1764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --always-read-main-dll --metrics-shmem-handle=2596,i,721805101376043357,13687520226669671390,2097152 --field-trial-handle=2320,i,12586458851228692982,12506115680257369392,262144 --variations-seed-version --mojo-platform-channel-handle=7496 /prefetch:1
  2⤵
  PID:472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --always-read-main-dll --metrics-shmem-handle=8180,i,5903675844273769662,15249257386527676116,2097152 --field-trial-handle=2320,i,12586458851228692982,12506115680257369392,262144 --variations-seed-version --mojo-platform-channel-handle=8108 /prefetch:1
  2⤵
  PID:5560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x264,0x7ffbda6ec188,0x7ffbda6ec194,0x7ffbda6ec1a0
    3⤵
    PID:2172
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1836,i,6631847217607391977,11045529138261852820,524288 --field-trial-handle=2004,i,6823031704530128391,4500257180403093909,262144 --variations-seed-version --mojo-platform-channel-handle=2032 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,559944146323684148,1387478473677423076,262144 --field-trial-handle=2004,i,6823031704530128391,4500257180403093909,262144 --variations-seed-version --mojo-platform-channel-handle=2000 /prefetch:2
    3⤵
    PID:5612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2484,i,16154380765307999169,4329318263997309404,524288 --field-trial-handle=2004,i,6823031704530128391,4500257180403093909,262144 --variations-seed-version --mojo-platform-channel-handle=2532 /prefetch:13
    3⤵
    PID:4360
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4428,i,16828959177342378460,8472400704866504246,524288 --field-trial-handle=2004,i,6823031704530128391,4500257180403093909,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:14
    3⤵
    PID:4776
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4428,i,16828959177342378460,8472400704866504246,524288 --field-trial-handle=2004,i,6823031704530128391,4500257180403093909,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:14
    3⤵
    PID:1224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4632,i,14305518315774824937,7546975316341547479,524288 --field-trial-handle=2004,i,6823031704530128391,4500257180403093909,262144 --variations-seed-version --mojo-platform-channel-handle=4652 /prefetch:14
    3⤵
    PID:236
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4640,i,16049881398289272692,8937317769547536938,524288 --field-trial-handle=2004,i,6823031704530128391,4500257180403093909,262144 --variations-seed-version --mojo-platform-channel-handle=4724 /prefetch:14
    3⤵
    PID:3424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4644,i,7449634235997269570,9669247489599801353,524288 --field-trial-handle=2004,i,6823031704530128391,4500257180403093909,262144 --variations-seed-version --mojo-platform-channel-handle=4632 /prefetch:14
    3⤵
    PID:3504
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4684,i,18021094047105600730,2885148242476460153,524288 --field-trial-handle=2004,i,6823031704530128391,4500257180403093909,262144 --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:14
    3⤵
    PID:4344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4764,i,1031398121858548682,17055965191761876362,524288 --field-trial-handle=2004,i,6823031704530128391,4500257180403093909,262144 --variations-seed-version --mojo-platform-channel-handle=4648 /prefetch:14
    3⤵
    PID:2300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4860,i,8188211897591361941,7826583359410766174,524288 --field-trial-handle=2004,i,6823031704530128391,4500257180403093909,262144 --variations-seed-version --mojo-platform-channel-handle=4916 /prefetch:14
    3⤵
    PID:3304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4300,i,3571288642194911620,13829457870415668168,524288 --field-trial-handle=2004,i,6823031704530128391,4500257180403093909,262144 --variations-seed-version --mojo-platform-channel-handle=4964 /prefetch:14
    3⤵
    PID:5800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,7506920823523318077,5240907374467042085,524288 --field-trial-handle=2004,i,6823031704530128391,4500257180403093909,262144 --variations-seed-version --mojo-platform-channel-handle=4952 /prefetch:14
    3⤵
    PID:5956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4456,i,13258912762036772033,14213368920702543042,524288 --field-trial-handle=2004,i,6823031704530128391,4500257180403093909,262144 --variations-seed-version --mojo-platform-channel-handle=4676 /prefetch:14
    3⤵
    PID:1624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4984,i,12234583192481128013,16329769500512704027,524288 --field-trial-handle=2004,i,6823031704530128391,4500257180403093909,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:14
    3⤵
    PID:4692

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2268

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5952

C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstaller.exe
"C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstaller.exe" -ServerName:App.AppX9rwyqtrq9gw3wnmrap9a412nsc7145qh.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:492

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:4848

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3252

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5360

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1248

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4668

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:1864
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Drops desktop.ini file(s)
  - Detected potential entity reuse from brand GOOGLE.
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1348
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1984 -prefsLen 27097 -prefMapHandle 1988 -prefMapSize 270279 -ipcHandle 2064 -initialChannelId {f54989b4-5755-4e1f-b7a2-4ecb2fa6d678} -parentPid 1348 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1348" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:4108
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2432 -prefsLen 27133 -prefMapHandle 2436 -prefMapSize 270279 -ipcHandle 2444 -initialChannelId {3ae4ab08-5a31-4437-a2c4-0fb9bcfc7015} -parentPid 1348 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1348" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:2028
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3824 -prefsLen 27274 -prefMapHandle 3828 -prefMapSize 270279 -jsInitHandle 3832 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3840 -initialChannelId {1bb32a0d-449e-46d0-ad97-36decfb25e62} -parentPid 1348 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1348" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:1720
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3984 -prefsLen 27274 -prefMapHandle 3988 -prefMapSize 270279 -ipcHandle 4020 -initialChannelId {ea2a75b8-096c-4a81-8b28-f9591f9605dc} -parentPid 1348 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1348" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:1712
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2640 -prefsLen 34773 -prefMapHandle 2704 -prefMapSize 270279 -jsInitHandle 2908 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3188 -initialChannelId {99627e29-d2ed-4f2a-9b81-eccfcf37fb1d} -parentPid 1348 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1348" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:3852
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 2900 -prefsLen 34929 -prefMapHandle 2904 -prefMapSize 270279 -ipcHandle 4880 -initialChannelId {47bdbea2-4700-4270-b012-299b3aaf1a4a} -parentPid 1348 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1348" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:5056
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2748 -prefsLen 32900 -prefMapHandle 5048 -prefMapSize 270279 -jsInitHandle 5052 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5060 -initialChannelId {38a341ae-c4f2-4333-869e-9e8423fc8b56} -parentPid 1348 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1348" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:1980
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5284 -prefsLen 32900 -prefMapHandle 5288 -prefMapSize 270279 -jsInitHandle 5292 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5296 -initialChannelId {57c12c74-84f8-429c-a800-5bb01b423b65} -parentPid 1348 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1348" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:1932
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5548 -prefsLen 32952 -prefMapHandle 5552 -prefMapSize 270279 -jsInitHandle 5556 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5564 -initialChannelId {0f556ece-881d-4783-8ec2-d7318b056ffc} -parentPid 1348 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1348" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:5104
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6548 -prefsLen 37412 -prefMapHandle 6456 -prefMapSize 270279 -jsInitHandle 6464 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3612 -initialChannelId {43d1b69f-c698-477b-81a9-3e7beeff7f8d} -parentPid 1348 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1348" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:1828
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 27952 -prefsLen 37412 -prefMapHandle 27956 -prefMapSize 270279 -jsInitHandle 27960 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 27976 -initialChannelId {e1f2b398-cd88-44a1-a6bb-84fa06876553} -parentPid 1348 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1348" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:5320
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5252 -prefsLen 37412 -prefMapHandle 5256 -prefMapSize 270279 -jsInitHandle 5680 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5112 -initialChannelId {6329a07b-de42-41b1-a887-297bdc3cc772} -parentPid 1348 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1348" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
    3⤵
    - Checks processor information in registry
    PID:4000

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9cc9cf848cfc6b3cee74946413693dcbab33b7117cdf781cb992582df418645f
MD5 14141a7d178e0786f91c9ad8dacf07e1
SHA1 fabc9c7a5dbbaad876d2bed6abb9152b8422f73f
SHA512 6078f06bf8c4dffcfc7a6f23965bcdf1d0461c3c7e7cfc74c942267c36ac233010e3c1c1630fa84941de31a52daa22eb896e4044ee8d8228e4d836bc3d5dcfde
TLSH
T1D9D023B4783675D3C22C003940D06603321606322993E3421081D80CDE74481E2EECD2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 42f674cda42a883dcc1daff220353b419726d021342be5bfefad4bdb4878bbf6
MD5 3dd50b8bee94ca572956ac96e2ca4152
SHA1 3ca852585e7b4388344678f0fd55582e8eb698f3
SHA512 d80fdaa218ad232580486c92f733407ea9c9cfbd7e27a824bf2a69110c4a009f104ebefde1f1c2a091e9366ee14a7c90622ca423159b968d771ccd4539a08953
TLSH
T1C2D023F47A757813C70B353161C0E613339347706D57F57240A1A01CAE74491D6DE4D6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 79054d3106248f0ce580d1442e78fcc5cc48ea2a5eb3b58c6aad98c7106da4b2
MD5 89a1e1173735f4835befe22b5e8bb285
SHA1 d6f781e38a6443407276a07888372638a8f2106f
SHA512 1f5c9b3554cf3bce4cd1214982a8df00dcc74324e66dbddb67a94598fbc762dc44d06c78c7a30a27a408611eba6e2715e40527ce854f203815d9515ab7dc00ce
TLSH
T129D0C0363A2D3003D3195331E042C703332704701C43E201E110C00C9D784D1D3C50C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6b09340cb22edbf71e0f90763fd435b35e26e3a84e71f4c033073dc564ceacd0
MD5 de82f6df0733dc6e89fad64d305f5367
SHA1 f27019be86cb5f8ddd353a4dc0ef3c6cfe6da7db
SHA512 b2443f684be01ef337dd32e8e1253d69b81d20f7291a2a1fa8998d0f723bb6bc114ee5bce6cc270ceadc8b45e5d854eb59b93ff60a8a13d338c218e132c169ff
TLSH
T19DD0C0323E293003D3055331E082C703333700701C43E201E150C01C9DB84D1D7C50C3
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 357B
SHA256 3fb2dff8efe9bae9b50acf5ba1c791a9139490916620e36d044cb07f6dcbcbda
MD5 7edda9fc9dfea1a55537efaa8f0afed4
SHA1 a76864f757936043149d326dfd776877ad3bfaa5
SHA512 e7cb93a442600c01b562e0feb21c622b4f791ad6d1f31c782d7e2d1301e2dea57c6ff2ba977d060216a2685ed3600ab80b6a6d3c7e345531a5274bbe303a5999
TLSH
T119E0203647A4D1D46301A547F0AFB31C880172C691DC6ADD327EFEB4265394A57710D4
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 268B
SHA256 1bde510a8acdd1d135fbd1d26695a7177a38cad7616e7840b7d88ef57f9430b8
MD5 2445f38166b3efa1b0ad6e117099c9af
SHA1 b3f93bf435f496b755324d28eaa543af6048af19
SHA512 2035296a44e12f4683e79ba3ae34e02da77a1dcb85b7bcc0a7e8be1f00a770d159e4d9feb7582f35800ffa0c18b03c501aace9b79d531548b2faf5089f6c5f8c
TLSH
T177D02B9AFDEC9E8EC7E44ABD57A9B4000A4802A3840B9B1310347EC034956F01E35030
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 8b3579af5c119efa2f93b26aeaf6af7782399bf626ed8785d6847e45c37116e2
MD5 0caf3d169240edcd8a0993f25eeff99e
SHA1 bbec66091936f0507612bec7a97cf4470b5e7b4a
SHA512 ed2613836f34d7255230b7f277a18c724ca5719bc9e2fe6c6d95cc1f4404112d7acacb58c1e4fdb10a312b130be2b033b53afe2e028b954bb1f488d949a570ef
TLSH
T127E02BAEC920AC2718F91B2AA4554B49EA9053676680889F3A3E950D8FB173A468585C
MD5 SHA1 SHA512 TLSH

Submit Download

f_0000d1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000d1
Size 66KB
SHA256 77df21477abc909a61db33e0f54965cdb1588e475d46dee935168b4721f73152
MD5 6c69688b96be5181ec89806cfa8d2b4d
SHA1 3644a8787779e8923fea45158afd682122665301
SHA512 d69d561629563334e5349e8fc844ee492c0e4eb67fed5de624282497c26efa0156d75547e7e47e3aeb7a8cb66a912f641a04b12e8f77e3466ed615bd7cbd36bf
SSDEEP 1536:DgUqrxl8iiX9x05j5QZPF+HX7wuxcDH+DphcgQBH54tA:DYxZRjCZtm7wux5pGkA
TLSH
T1446302B0BD7247F8E2920C4997B1858633681B755ED8B963F4704DDC660DC16BEEB350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000d2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000d2
Size 60KB
SHA256 a221cbf72963df1c02c8bc202b159379f26e3d0d06225a5933209e745040e35b
MD5 b90c0e06b88c09158b13db21c7fc9ef7
SHA1 a4b968f5abcd2addd2d8f2d3e6fc01f4127c95a3
SHA512 430aadb5315738f414c2d4ca0d9e2be42f5242a3b28765993602aed4b34e334d854a88a051e6519877b7ffd8a5bf4ee7276885d6daec541826dba878f8c07f2e
SSDEEP 1536:iw916VqIkIFHzR32SF2Sjm+KW3IS7uchJEsZP8:nngaGzR32ceS7uchJ1ZP8
TLSH
T18C530227CA3085D2572D05004B9EF35A1A6079FDEA09CD7E920157F772ACAACFE20E21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000d3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000d3
Size 70KB
SHA256 7f3c2f41ba202772887270f6817919f1378e026a6fc0d49051196d49f90835f5
MD5 cd529c91748009428e55762656a327c0
SHA1 e200f53f5f585d2c894ee6ce95a546601ab9b835
SHA512 e983850c8361fb36c8fea3ed5b431541558f8a0b1a23248750de3ae003422363069b6d759cb454e7c3629226978035946d6d1e544e843af911e8f36484141584
SSDEEP 1536:lYub8mTQtGjgqvm9hZu5ksa2mxbieBHgop2900ml2XDMHcTNh8zF8xpx6o:lYuwmTSZqvm96sbBp2S0mgXo+g8rxp
TLSH
T12363022466902B77467F2C0B20C818A25DB85B37129A8FECC6C711EEA50F5F1794B7EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000d4

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000d4
Size 63KB
SHA256 caecff4179910ce0ff470f9fa9eb4349e8fb717fa1432cf19987450a4e1ef4a5
MD5 226541550a51911c375216f718493f65
SHA1 f6e608468401f9384cabdef45ca19e2afacc84bd
SHA512 2947b309f15e0e321beb9506861883fde8391c6f6140178c7e6ee7750d6418266360c335477cae0b067a6a6d86935ec5f7acdfdacc9edffa8b04ec71be210516
SSDEEP 1536:tLQFdWY1+jAIuhc5s3JBP2ffX195jJqu1H5g60:qFdv+jA/cizOfTdRJ260
TLSH
T10E5302D829DC2DF4466490C19420E379C6FACED8E4485B6F5B2A2E0DF78DD7527C7242
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000d5

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000d5
Size 19KB
SHA256 c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f
MD5 2e86a72f4e82614cd4842950d2e0a716
SHA1 d7b4ee0c9af735d098bff474632fc2c0113e0b9c
SHA512 7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1
SSDEEP 384:eV4Eqc1qgk/XDVGi8m7JEM9TUKPqivdjfommfP974oNF38:eV9qlxhVEM9UKPpMV74kFM
TLSH
T1D692D043765579E9AF1280C82397E6A4EAAD9A88D6C0FD0950F56CBECF708D32261825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000d6

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000d6
Size 38KB
SHA256 c6055b57d5aee320d1e4334dbce0ee8afb0b5e006f0290bc41236930848c11db
MD5 2d888bcfc3a3c36fdec7a01e9d086cc4
SHA1 9b39a3f2bacf2a489f910ea6517d076f95ab5a3c
SHA512 8231c95001a06ecc3274b44640b582f935ec21344b501a622711795c9d89f7d3a08e0c84f859b22ac7af8a37a43bba9dcfc4dd1eb9ff0286c62688c2f53b4f74
SSDEEP 768:msFkD7e9LVxiDhJDi6JPH+0749gFkpIVqNlpnPN50VrEmctTNGiaZqj:RiG9LVx2PDi6o0s9PzN505UJNuqj
TLSH
T1AA03E18C9B5D00A81FDADBF4992E25CD9114387190A1D4F365FAFD450AECBCA13DF650
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000d8

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000d8
Size 27KB
SHA256 ccf6c276c1c99974afd4aad652e992d04558b2b5de68d49eeb0703671ad3552b
MD5 43837d6af7bfd84c9e18976517196c77
SHA1 85513bd8b4ffe85e75bf48aeac645675cf336be7
SHA512 ce02549b8c2bd26af32c05a7bf616388ffb22fe6e1b1c2fdeb074e580157eea792c837a07a8103dd452938351ea5b72e0fc6c652dd857ef2e7bc215aa1f214db
SSDEEP 768:3UQtRWt3kbzi963SqCdKGKDUAoohrFayPgSzHj:3UoWWb+ISqC4GbAo6fFzHj
TLSH
T1A8C2E1A4D4223D81593AC301EC8FAFE9059A31C8DFB52E9E79605FD11A46E1D26A2C73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000d9

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000d9
Size 18KB
SHA256 bb9d93a0303927571a52619e67ff95fe57e8b6061d664b5160ce7526db726a41
MD5 97491e0b9d95f58891eeb5076e86a8df
SHA1 0ac878af9a9428d017d477ace4f6781b4d310745
SHA512 7ac2022f2198c64ca94e75ea9dc91c21866a4d1ca989d1cfd8de5db74318d1b630ab8b0abcfca851ea51e5066d2e24a0d80343f95e6b2331e4c7420f0c44f7d6
SSDEEP 384:mEnloBUKvj+jo7zanBXoucVn2Z/gUQnnnhDXXJ5t+:mUoiKvQszMpc2Z4UChE
TLSH
T16D82D0BEE8B7725E9F0C18574252F74873186BC6A69A4E9E703951FEE4C41BC484FC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0f54957f594985c3_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\0f54957f594985c3_0
Size 2KB
SHA256 fc349bed2a24c73d68dd2c83d27b3f477542fb567b2d05ab2ab634e03ae0c915
MD5 3d7adb32f55158cadbbcd099ec936677
SHA1 babd10066b99932711b489679d6a8e86b69309fa
SHA512 211a2a1882f45bb9ab2c3dec7895749af82db5b61feb522a90dadba20ed48fd8721d6bc228ac8b02541a83a54a2731d99dcd82a07499dda62f8064ebadbf01b8
TLSH
T1CA5153A1ABE17E29CE2A17F156D98E129332C09C2FA7C20725F457253D2E1F12959C87
MD5 SHA1 SHA512 TLSH

Submit Download

2cf955655482eac5_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\2cf955655482eac5_0
Size 3KB
SHA256 ef85579c758e567aba843ef511c8407de7dae0899b6dd49f2e49dd4f8545a37a
MD5 532a17522744e9e6737db5dc2e7857a3
SHA1 7d539ccd79cef72a6402a34972be3333f59c17fd
SHA512 27af908deb838ebdf2f2ca2e628d3cd0329a27b1420b609f188bf49680a5164fd0eb483a2afe0678943c4d086591d679c7f60868ece2d6c7579457a639857b1c
TLSH
T14B6195355B71AC3ACD6A47F951A78C23B73250047F83860716C6A2B05C1D5F35FB894A
MD5 SHA1 SHA512 TLSH

Submit Download

39a5e623cac641bd_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\39a5e623cac641bd_0
Size 262B
SHA256 ef8092e64ad4e5066cb78f9bf801572ee5eb69dfba27bc1b5f48f1b84d023301
MD5 08aef5e05ec15590f007908ee3e1f647
SHA1 124a00631e0ea465aad7958ac3a30a1501746f38
SHA512 d50e738766c94875253114a88e19d3dc018e9e0b4acfec0c336ab2b79d9c40e2481f583ebf83233ae9a27d0d9322b0d753739d34dba317246dc8015b2daa60b5
TLSH
T106D097EB3850BDD2CC08C6F0FEF6EF2BEB12A03C1888C19E080D60B3023002162135B6
MD5 SHA1 SHA512 TLSH

Submit Download

4e72334cc53a408a_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\4e72334cc53a408a_0
Size 7KB
SHA256 e510f85aa6b416e2915b18ead67f3fd9726a8ccd38761a79f6b735b85fb148e9
MD5 fca263bcbfe4f5fec8036a623ec86ecd
SHA1 7f0a714b93f3bab567ff853cc6c499a8f6082028
SHA512 cd87b22f3331a51af9f3d335ee6747c2776cfae201cc18973a1cdf4fa11a34f84e712fac960f2fefd8ded015552b06943c4c2cfc06873dbed2848dd13c2e00ad
SSDEEP 192:NbyXnsO51ekqOGX6k88QwQQ7Nmwwe1BzZZ6G0lN:JyXH5EOE4sswHPZc
TLSH
T129E10910EF97B52AC95B43F56252C917F53380283F9FDA3158A0633418BA7E74DDA44B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5419e86514e02389_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\5419e86514e02389_0
Size 6KB
SHA256 f06d18a31dd477014a7826e75eaf9c2b0c14e5a2cda81179124d597ee846e4f2
MD5 f9efe25ebcac26a9941d1bb299f49d9c
SHA1 417a63408e64a26c85498994164f31c052f25e82
SHA512 a52708168a7f49c70d720a07721c7e413df0383ab19b28c24ed200122e243cdf3529662db239332424b869f72070ad0bbabb139751616e4c13237d3a43ca5caf
SSDEEP 192:EumrD4bnPRnFyK/I7OdeBJQIqaa6ZznYrV:9mynRFWO2JQIZno
TLSH
T1F9D1736657716C35CD3223F206A64E07A333C3C4B9D742CF70B226B62074A979FA568A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6048c53dd280a81c_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6048c53dd280a81c_0
Size 3KB
SHA256 d4ed10ee0415f3ba5621783eb5133ba530f3c725062f596c0d74a0726e4e4fc2
MD5 5ee22c0e656045d9ef2fef709b0ac635
SHA1 5fb7d586fd88c261dda7bbb7cd4dd1bcb2203d42
SHA512 56c9e33abd96988ad30a4fdb94b9dd81f31c0ce7429562e343f18e760aa67b191b0eeb09cd4d0576034206d2f881456ab528009d95477d5fc4d21d19974dfff5
TLSH
T1547184564F51247AC8559BFF42F5C833E23215183B9FE60A8AA053B618363F74D9AC46
MD5 SHA1 SHA512 TLSH

Submit Download

690ccc8eea086670_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\690ccc8eea086670_0
Size 1KB
SHA256 c1c79110861db19cff92c730449ad6cb795ab5f77b39418dd6d2e598fafb6d81
MD5 5fd87f6d712d9b29083db975bc5030e6
SHA1 b583f200885320f1b373cf15d97cb99e7a6207f8
SHA512 cec208ec71b721d2c1a8d2f4d2b36b1675ccfa9617888e4ba20dfe8a6be8e9350c946d62092a69b372baa166aa7eb8d8f4dbe679b5e365c441a42c846bf322ac
TLSH
T177314497DFC66C26D93A13FEDA854627D7134108A983829B10305B752E2E2F38598988
MD5 SHA1 SHA512 TLSH

Submit Download

703a7bc3089c5734_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\703a7bc3089c5734_0
Size 262B
SHA256 0638f32c5f46981afcc64da9051fa3a47a585eeba311fc93d7c52dd9f44751c5
MD5 b1c4a2cdb643a8e3a9a014244372cd7e
SHA1 1876468b501d8f57a0a13072130b48283cc723f8
SHA512 27217a01faaad47ba8aa03ae31a2f9efb5e5535346b05c0f6cdc0d7398019ebead21dbf31ca48746503ecbc8aafab5229d035c6bbe87914aab900bb1fa81b805
TLSH
T187D02B935817A81CC61D95F0DBBD9945C62281740558C5D701089623022A3621B124A1
MD5 SHA1 SHA512 TLSH

Submit Download

7137d53e64bbdcd8_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\7137d53e64bbdcd8_0
Size 1KB
SHA256 2671c65a887124c1b9b3262ac996dbfd4cc35dbc200a45d7853c1d5c3ea05cff
MD5 0cf6e2557806b5acfb06577a31fb5e4c
SHA1 45a9d442f011266ed8f3f25bb171d3a8a3e7b1c8
SHA512 699b3384a50eb56ea4d199a649f491f5eb46ecd56895afdfde57199d6d9a12fdc16ee21df44cf349796386a941b26b48665069fcd969958db3515fd219354b8d
TLSH
T15D3154639F95A412C99B17FD06F1CD13E63AB11C2F63C11F1AA476751C2E2F60A4818A
MD5 SHA1 SHA512 TLSH

Submit Download

76e61c1c89c5ebe1_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\76e61c1c89c5ebe1_0
Size 1KB
SHA256 8980c76e2aa5c070f28fc0c3a7e4f609301817281a4abebc9cb8ac11a4d7a347
MD5 03fe72c0a8ac50acddc3aadccfcf06f7
SHA1 a33016384cd13a9114db1231eeb5b14cd7f542e3
SHA512 ed978d8509ff8b48a6814ac343f09daecd969ab5e768f15aa6b508327c059202a347af1deea67e4df816f839aa4a406c0849674594673c0e2f154df9f1b91f88
TLSH
T17131445397859C59CE3013F0DBEBA929E23140199F678363112452753F6C1E20AD889E
MD5 SHA1 SHA512 TLSH

Submit Download

78b99223269c8493_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\78b99223269c8493_0
Size 2KB
SHA256 32093159f95266a4954786b9ec80ef7aca933c0180a0a01b9ea419f0ad364934
MD5 0ac72542b6a3536fe8e7318708806eea
SHA1 0a95210187100605a18ff74eedc7c76c0a97871d
SHA512 092adf7df3f5bc063fd1768e9780417b83658aecd8897a66536684ff36b1bf8d5182b565ae055c34975bf5c91862f9a9a6a7e7ae088d084e6d68870e0b2eec58
TLSH
T1BE416062ABD1693BCDB913F8C4BB0922D2B701484ED6E317416163368C193F21F62C9E
MD5 SHA1 SHA512 TLSH

Submit Download

7a6268d420b60dbf_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\7a6268d420b60dbf_0
Size 1006B
SHA256 1e0c03c528936cea19bb735bc9442d32c5b6f19a1708540de02ce21b183de720
MD5 36deb4870fb745cc4e8fbd9f2c5f416f
SHA1 08f3ffbdefcbc87d8849888193311c955619f310
SHA512 ee843e9ba5156f0cf17617f5f9fe168d1306a41853cb4546db80a4143a0b1f6b27caf43d9199e89ceb564314a4fd9aa4bbb19f81d3a2ec3980c76ae47bbc87fd
TLSH
T11711006BAF5E2A10CE3D42F4ADE9DA76D623510C8E87835B1054037A7C291F29B6A042
MD5 SHA1 SHA512 TLSH

Submit Download

7d6189b66755de2b_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\7d6189b66755de2b_0
Size 2KB
SHA256 1f4c1ab305da67db5bcd9b1ab6642980bc39c5a41a8afd07f5b378e758ea4be0
MD5 40b81b8f7dca2469900a4fa2b2e94a1c
SHA1 f1e408b83981b8fac1d367bfea11e70723bec402
SHA512 e08406c5a1078e750f4c16362303bf509611f48b1dbf78c69a59c7227ab1e18fb8b50d2e3e54db0fac1a191d957acd652dbe7e9f1cef9b4e93376bb0f4f29e0f
TLSH
T1B141545267817D10CE3557FA29A4DD2B8232C4846FC7971B112603F7393C3F61BEA989
MD5 SHA1 SHA512 TLSH

Submit Download

9791d9f6612cb38a_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\9791d9f6612cb38a_0
Size 262B
SHA256 0b922ee9bdac43668ab73b7189c5e8c84d819b74392216fced7d1b3d6dd78c7a
MD5 2de7e734a13163b047476eccac463ab8
SHA1 ee9750d1961126c5f11b7dbe7211d83a8e302680
SHA512 b9b841854679bdcc587e37ff8630cc174695636665435bb34233ceacbe7b345ccfe43dc991ddb8304a0b310e2057a0bc27d11b0a235d222c59b3d0c87f432788
TLSH
T156D097E345163000DE0ECEF2CF693D46CA0361600BCAC0A3EA2110B73B085B2CA7E3C0
MD5 SHA1 SHA512 TLSH

Submit Download

9820ef3cdc166065_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\9820ef3cdc166065_0
Size 11KB
SHA256 bba6fff20ac420c8fe5d5b166ce88b8fb0450d55876497701b815ab750e9477f
MD5 76a680bdc08be109ffa0b8c5ca06a9c3
SHA1 ffbd839486ae3908262ddefb7418a7e53751bcf6
SHA512 b8b8c42c7a356f43c39ce657da33d8eaf51aa198b91d3271633eb5c426ddcf22e51813698e77aa0eef43be5f68219af823a376c3052e4a6aa745519b67e7dc9f
SSDEEP 192:MyeoegA2e8WpfWexvXytJL45eVgrWGeckkDz6eDSZf72yAxCrfN5Qr:6bv3jxQJUMVg+UxDS5hrs
TLSH
T17742739AEB85670DCE6E63FB46B9CE236330910A2DC6C31B70D143382CE61F95D89709
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a2509c30c6083168_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a2509c30c6083168_0
Size 4KB
SHA256 59179f7ccffacdf97d011637cc707cdea80115b0f7ae3628bd1edc74e2df028c
MD5 3a3f8779be5435a283f9f91f923230f0
SHA1 6f9685f5705011841f4c3f4821579020e33cd77b
SHA512 de2fa8c2349d0c08ee12b7b0b04678334a5ffa7bae14c73498cf821328415bbaeedcb97a0bcea4ef1bd740e6e8ec1aa91e557c9acc319af698807a9280e2ad57
SSDEEP 96:JCEsy6Yk8KYGYi0AE8i25dvyX1rNyM7eO0xulvM:B/6qKbYnz2/aX1rNyPO0
TLSH
T172A1E99227925E3BCE2297FBD6D09757B33540082FC7860725E11B780C683F31E9955E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a4d78697d978ffb1_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a4d78697d978ffb1_0
Size 2KB
SHA256 5be3456b8b2efd801177c64756a8cb17ac6816894e5006133b6a2bc1f36d2478
MD5 4bd88f18be6825b6c0b1cec51b1425cf
SHA1 9dde446920f363bd9f33f05acb613e13981f9df0
SHA512 41db7fd691813490deb759fd5dfdab40b7ee46a27a6854e861ff3d13810edb3ed5eb244c0411c30a5ba0e5fd90ae8291bb1cd83731d31a300176d0db9fabe0d0
TLSH
T175416112DFF70035D96B57F80AB1D492A1B288292FA9A257163403BA1C1CBF309A7846
MD5 SHA1 SHA512 TLSH

Submit Download

cbde122905d43173_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\cbde122905d43173_0
Size 7KB
SHA256 9f70365f979952d67c152d721cd0f93925af1a9428e48fe55a83c6ee56d49de5
MD5 16214a9c4e10dad9eee5fa53d2800d64
SHA1 80467590cef20486ba28df42f066ad711203bba1
SHA512 031b9f91e6f5b5f111f4b2a584ae1e6c85f7b95e69fd1f918c4afef86ee7801f121ed2eb52619c50076d4c65a63eff3f72501b4344de2cf3c5b43404f1871b22
SSDEEP 96:9D+5k6nVbYie26woR4e7eMSaE9fn51DI5+RXPmusXoU8NQ8s:9DHXV7y/fbAs/Lmh8O
TLSH
T1ABE1DDA1BAE05E99DA3353F2096294D2313153E65DE1C70B70EA715A2C0E2EF0F76C5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ce4d84248a465171_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\ce4d84248a465171_0
Size 3KB
SHA256 bc761f7606c2fb2ce5e7b05cab601e7451cd0eaf8f2ccf823359a9d9706ec4b0
MD5 e878487403affd1dccf15cbabebf2dc4
SHA1 74fd46073f7ab912b6f55b455f686ddd7138eecc
SHA512 6c8d003b2891ddd59d92392411d6c79a04c22a37fc63bf68fd831e5c83ed5fa79edb2cfedad1f4b9d5339aaf1d55d5a3ada7d6ec37982c0f34e21aa1574706d4
TLSH
T107617953AAA1DE0CCB2623BA01918EE2F721471C1BE1A94B35E5FB270D4A0C75D15D4B
MD5 SHA1 SHA512 TLSH

Submit Download

dc7b47f23bfbb5eb_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\dc7b47f23bfbb5eb_0
Size 2KB
SHA256 66cd10b328c3b6c2ed9dd24bfbde1f91f6f2aab111145d749b2c3f900a18097c
MD5 151da2fd510612112e2aafa0fd59a96e
SHA1 31f8f2a452010f42e1a201d9a8f4b30e74ad41cb
SHA512 3725a3f7d87b5511c2548f33a82ad35a517acd7b8df8a4182c9866ae1a76d65d73a1f11c80c3441cebb2253aa79a32c248bef6c4f3584ae772ceca9aa4db7e48
TLSH
T16851DB75C7413CF9C43A03F845E6C676A13185057EAB8116157863692D1C3FB8DD924E
MD5 SHA1 SHA512 TLSH

Submit Download

e9c7e700cc3e33cf_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e9c7e700cc3e33cf_0
Size 262B
SHA256 5c3fccab7305f9c6725e04712d8827df78c6189ce00805d2b1d2019ee853799b
MD5 c687f1bceb205eebfefc979fbbdeff3a
SHA1 38b12f0631bd301f4f8ccb558380c54fa58848e8
SHA512 34549542e67a5727b579d0cb743671859fa74c7b4c52b00861e98bb087e991f21ca9cb03fe023bfdcc62dafa1d6ec7d0573428b2686bc0d7d63031c50afa78df
TLSH
T1FFD095EF51593850C43C81F1D5F5BA0BCA63B1DC05CDC1E2440420533375C319D17469
MD5 SHA1 SHA512 TLSH

Submit Download

f3fb6df160453c48_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f3fb6df160453c48_0
Size 3KB
SHA256 02cc45ab55d4cee996888504efb5c018dea03b70278433f8d2c5ea8fbcbb8f30
MD5 9cf4b172d3ee1626dc2cf3a268896bf0
SHA1 5c9b1a9a633d696ac7624476e8c76b4fab2cb74c
SHA512 35ddac33cec28d36c9d431d02940abc5947b573c5d634471f61abf5fc3f144c16f671abc91bddc45da0e720f6fb5c392c9f8d2e5b3fb0bda1da030ceca7810cb
TLSH
T1F0517352FFD2AE19C53553F45680D922D33218587EDBA21B12A19336AC2A4F18FDE84D
MD5 SHA1 SHA512 TLSH

Submit Download

fac04c66d8725008_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\fac04c66d8725008_0
Size 1KB
SHA256 f06ee96061310bc6bc0f77d44f662198e92f27de210e3bf2b6d01afc7e6aa52d
MD5 b2572c8acbb0e5708fad5aad35a043ec
SHA1 4087057522ebad14159f20c2b6ea90b1c7c20a8a
SHA512 fb630321a89153409836558d412d2777be5c896d8efb6b95348c7591e086d6ae6e062a8a3b41d912a6cf8d49dbe820cb7b448f38a182102e285a9730c0ca98b8
TLSH
T1E1316152EFD8EE30CF3727F801A19E63E231C14449D2E207197616753E1E0E94D96EC6
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 9KB
SHA256 f1344892cbe5f5ce7da8d4684db3abd3c8e941cbd8b62db916d09c5b1ac9a74d
MD5 b1171183552e8bcb1ffde8f97596c20a
SHA1 011b755f8767569245df1b5b3a70d1504d081e0b
SHA512 d8135eae09f9f38d7b1a747871c77d946c6d3456795482800f865471204971f44b11b2fa3a438131b2f31fbd72bc7dff405f472bd0a3fdfed841e475f3ce91a8
SSDEEP 192:RTt19zIFl9ikcMIj7pFTNdPL8TTkPhPK8:Lzu0kIPtB4viPv
TLSH
T1D112092C00F5B713DF2C553AD0B01D687A7566472A877F961DA07AB4682B398DC3EB8C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 8KB
SHA256 e7498404c95f859e8033b1baed972fae8e14c2dc279c30b94c3b43effa9e54fb
MD5 bcc95194e9b98d78b861e9e59cd05939
SHA1 aeffe35b92f75320b628a8baa3d2d995c1d7b114
SHA512 b92613c92b289d754eeff85cc65a576493c00ca8dd5891eb9e0b08abe60a0d1fdff90af071b239977a806ae323bfd52ce3ac57e2bf4f751e03bc6c2e17967fea
SSDEEP 96:jhOeyxsa918Tjg+V9cSn+GHt9zwgcFfCZSTTi8acnJrWvtjaUTSZCaZ7Alcp/MCJ:jgTgD9zIFJ9vjnZ71FXkIdLMoTHmhPXA
TLSH
T13902E92C00B4B753CF2C557AE0F419687275A6472E477F961CA07AB4682B388DC3EB8C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 9KB
SHA256 e2cfe2763206eaf66a73ce84f918cb7474218b9d76ed51631ce2fa73046d9265
MD5 6da8c4eec43cb677ae86f239bce42b67
SHA1 2b6d6e8212a297561a7c1ec4190ead3b80153fd6
SHA512 5cdd8fd4a3a0231022ec0e80081ae320f0d5ec8716855f9117fa35efa4a904f1a0e8088e88bca905e2cbf9172b03dd38b0046ae10f9abb60561f6f7aee95dbe8
SSDEEP 192:CTg699zIF+q9YcCIFs7CFNAd6LodTfJn98+W:8zmiqF4lw0Jfb8F
TLSH
T1A9120BAC00F1B313CF685579D4F0196872756A472A877F8A1DA07A74681B398DC7EB8C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 64af9610e240826a659ca384ce82a2dff6436d50ce84de2e751c723e981e1386
MD5 29e428c0ac2b8b89bf2171d0c1acce04
SHA1 98ad192e1a7a1ee5e9edf131f3ef122bf594a5f4
SHA512 ea72341769ac6648d222d3957a79949a9073cb1ca5125a202016f4fb0bb5c8f781356cbd6dbbbfebae4b78d5d894e53b68c10c56c0dba51ed8b854fc4eea2b86
SSDEEP 96:Z7wOeyAWarbpJp9BEfIgRRocS6LassJB7cOgc/LYgc6gXveU1nD+8GV8ac8QSzu2:Z7HT23dLwtSjlB/N
TLSH
T1A791731D04B17763EF2C663CA1D4263C317666572A47BFA2217078B8641776CC80EFC8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 9KB
SHA256 fbb1484622aa6cf378f685ccb0d31468151e9e67bf0e48c61933914e29768ec2
MD5 f9d78c43e8946e8a10d169d2d0e482c9
SHA1 ea3a2f4f555e7d419b0b17862651a8d3717d644c
SHA512 6c08a28966a27ed0a403e8d0110bdf373c6781cc0fca218183cf62edfa59f5868a7ff58e4246d72384601fb15047d124a2765a090266928d1c27d6c6cec8a5d4
SSDEEP 192:MTOU9zIFw91u0a1s7dF41dBLAsT8i98Y+:oz/nIiw3MQ98X
TLSH
T12A121C2C80B9B313CF385679D8F495A8727556472A477F871CA07A74682B398CC7EB8C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58ab9d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58ab9d.TMP
Size 3KB
SHA256 4b695a0fdcfc7345e9aaa4f9dc9bcb3fb3e7d61e623e00a1995c063d1c7a56b6
MD5 e030741a8d9cda244b5e1c06260a102f
SHA1 e7c8e4c500734fb9d6b320ce80a73cf1e0eec8a6
SHA512 2f5727fd831998f8e1b15b6c670291640087c2c7f7a60d8f8618c625cf622ee278b409bb7e5bc9e2f262da3f3160cf0d59d169af77d26695a452148247106416
TLSH
T1D9712B1D01917703EF2C563DA0D4293871B2A45B3A973F6321B0B875542BBADC91EFC8
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 1a5124f3a48a0d4785585dd2e0899d5bc5f1ee5299533241e02498f541455f5c
MD5 2345d9b34b1e2ada2329e05fce8f5d33
SHA1 e6839e90206f7d0cd6e7651cbb644311df99de25
SHA512 2b8648a37ce4cd09a14e3eb4d2d4c9a549acaf785d996570a924d29a4477968ae1ef5537d25b15bdf958752e71ff31e5f288a6e7730a76e4302c726e3833b926
SSDEEP 3:MsEllllkEthXllkl2zEWllVt8al:/M/xT02zdC
TLSH
T1424402286BD00525C6001031441287908371D41825925753286105729CD55850E00000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\000003.log
Size 28KB
SHA256 fbb811783d5ef768024977f7d16f0f9084f78ffe1e9d71bb9c2c7a37fa0077c4
MD5 768477b2e51c92897fe9503c7afb8d73
SHA1 c20daadb77debc95bb234db908521ee8e0c31536
SHA512 d693a7eed8a363e6a5e65ced49b819240dfa692490d2e45fb3353b6c64e2211536d47f2e5da6a84043e7f58d3be3344ef9543f1f522b6fa24760b967b1fb68e0
SSDEEP 768:JuCgOAP9yanao4X3vy2GIJpjpMVitN/g3S2/1:9AkyJ8/g3S2/1
TLSH
T176D26766B5F8120AF2BB5EBBA9B217964C7BBE562D04CC1D5860620D4C31F40CD73B3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\LOG
Size 343B
SHA256 33111645d8b1f2d9356a6dd10e3880a157350dc0df5888c530206da3b846524a
MD5 e464501389f6427dc9abc04549c12ede
SHA1 e36a4056508332162179cedb1eb8a98168191faf
SHA512 e463aa694f0cdbfe49c0df1c4afa230bd8c273627a86a84ef88a4819d7cdbcf3b88447881bcd8a14fa2299c0e41446889d087be497379fe6b09c3b135b5fcddc
TLSH
T19EE0D87DC8C9C11FA25450F60525FB09D5A36A0F96886E4D4E5CC950B147044B57D251
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 e501043817c9158dab45efed8d109c7b68a0050763280e06587aca4d55a3f9a5
MD5 f92f521be624c404ebef987919480b30
SHA1 a74d81932eea982b85c4f75c9e3ef4ac86e74ab6
SHA512 717e4eb1034e05d399c06a89a288638c5b5a3846a131b9d2a94704a8b67049e7f01e1234d501c8427c3922cbb17ab9cda3eb07c7993b700cd196e35418b00687
SSDEEP 192:D1ADIUj4Piaaij6/1SPhqx8Ck57XmzidkGchyzgTHx:D1ADIUj4PiaaiG/1SPhqx8Ck57Xmzid6
TLSH
T126D19DF7C3E9826DDD2192F0AA146F1BCE1C0455836C7D6A89D4AF0BA3F2471E141B9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 db6a09f37646c222106bcae7e7dae02382b1cf96c8222f331a42ff5f556043eb
MD5 0c5b4dd5e858838d173645194cc20b31
SHA1 d66542f60f7b347006eb86aba9e2fcd1ec157761
SHA512 bd8032fba807ea7e670a97815391bc36a8d0beb7de868d28e04b16bf0097599377d1971a4f90ff195c18d147ac812e3305bc5781b5af012501e1c069230a7421
SSDEEP 192:D1ANIUj4Piaaij6/1SPhqxk57MmzidkGchyzgTv8Cj4Xx:D1ANIUj4PiaaiG/1SPhqxk57MmzidkGh
TLSH
T161D19DF7C3E9416DDD2192F0AA146F1BCE1C0455836C7D6A89D4AE0BA3F2471E141B9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 63fac14a40b86a5d064bf798faf627c52693e970d7e6574c941d27e80360e14c
MD5 6fc3ad09e7cb8d981f31ee32d3508199
SHA1 784e984745e94cc01a8216c534b64cf688ed462c
SHA512 ac6c097561c96c7969ff89914583cedf41956917e52bbb7dd8e809fdc5c54bf9440fff528d000820506a93b9f2254f14b8bd80e5e292d38e2c1729693d95e986
SSDEEP 192:D1Aplnrgt/lgMNOaaij6/1SPhqxk57Tt/Gcjt8Cj44qBJUa0CZ/zMmzmiNzAbyDx:D1Aplnrgt/lgMNOaaiG/1SPhqxk57TtW
TLSH
T1C302AFF783F9866DDE1192F0EA146E1BCE5C0456436C396AC5D4AF0BA3F2871E241B4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 71d9dc01de09738b96cd52a0b02068bedbe36b2b3b276d6f87dc25ec59c0a72e
MD5 7c58f8e03bc0520513cfbccb3dd91946
SHA1 8fcbc53710090bded253dad17293bcf34683fb65
SHA512 848af3dea9bb6676cba331f521e7b2f13c2c4843642eaec9066dff07c3c321110a7ca972c715f2a9145a7e62293af9c703b5b1ebab0ad71514f31f14e3286583
SSDEEP 192:D1lplnrgt/lgMNOj6V1SPhqx57Tt/Gcjt8Cj44qBJUa0CZ/zMmzmiNzAbyNmG6Rl:D1lplnrgt/lgMNOGV1SPhqx57Tt/Gcjj
TLSH
T1A702AFF7C3E9866DDD1192F0EA14AE1BCE5C0456436C3D6A85D4AF0BA3F2871E241B4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 cfbd3b33c08e2b27a42213d6b342d08f9bfd2da4488b7abfce9a33cfc25328a5
MD5 75bd34a1c07d6a1d0464b6343f899eb7
SHA1 a49209ceb1f3c84215bc2940e8f32a15c91cb33d
SHA512 bff50fdcdd1046f517cd2ee0e9c31826b9301b056edf6bc4df61ca23c2ecf160d2247b6281766e3fc373c8100d8da70843461877472d17254597ee530e4eadaa
SSDEEP 192:D1Apln0rN1t/lgIaaij6/1SPhqxk57Tt/Gcjt8Cj44MmzWeivgqBJUa0CZ/zx:D1Apln0rN1t/lgIaaiG/1SPhqxk57Tt0
TLSH
T18EF1AEF783F9866DDE1191F0EA14AE1BCE5C0455436C396A89D4AE0BA3F2871E241B4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 91dbb89afe9d626cda3abb1108a0ada8c984fd6dc5df2935c794f8685f39979e
MD5 f09a948276a421ddfc10fea9dbb5964b
SHA1 122f1555cc2a17c87771d4b0e3bfcb1562edfa9f
SHA512 900461c68624f999cdd4e54880ac80b89a9928df5251bd403cdff30d9cc6115c6ad0f4cd66ec49ae4e839732100c033509fa49396506dc009e54926c6d86cd50
TLSH
T1DB61BCF783F8856D8E2192F4AA14AE1BCE5C0415832C7AB989E49E07A3E3961E10574F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 df7423d8f8f83360e10564adf365bd2fe6d6ce4c505c3c3b557e8cfe17bf10ce
MD5 c5ec392add60f9012096eb45812af76f
SHA1 62550d9adc09da4f1b4baec79b154ab9a7844955
SHA512 8cb3105a97743ffea3cdd56c50c78af8cdb98c7e0b1bdb91ec9856446477b6f3e67cc85111ea3b8da95bce98b9b2a6c84ab1906975bbe3b86566b3bf7d136301
SSDEEP 192:D1AIUj4P6Ncaaij6/1SPhqxk57idkGcjt8Cj44MmDLvqnx:D1AIUj4P6NcaaiG/1SPhqxk57idkGcj4
TLSH
T1EFD1ADF7C3E9426DDD2192F0AE14AE1BCE1C0455836C3D6A89D4AF0BA3F2471E141B9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 1acdd3db636d19137ec9febb815d2a2b2bdcd39cf8eebf7a096a59c28eafc0af
MD5 e61cd2aa33982c4164a73b751ce357ca
SHA1 7a5f594f95b9394569c29ee3e335bebd5dec9f33
SHA512 d89b6856abe11a4d89b439a9e58a3b12dbad0ba2398c4ce8013194da59c98a5d84f4cbaa1784577ba4ed04fc845e91b2db6881b35ba5b93457c61992c0689b86
TLSH
T157D02263630170B6A9AC7F8180AEEC8FC33E00241C03EFE424D0A89E093A86C8907145
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 f9158d602e7bb9be8db3319eaf89ab5d166260d0f97107f32e3ac55e88787f10
MD5 10d42c1ee22fe7f324d524fac3890daf
SHA1 1a324323406e654cf9c3cca1e7da3f38d26d7c71
SHA512 13b4c98172746b1801c2b72d78214e37d200616daf01803334bff0fea6fc9941f372db79ad7fb9a6fb1b037ffc29a984bf17a813879a0f109ebf73ccdcca950d
TLSH
T18ED02263630470B9AAAD3FC140AEECCEE73600200C82EED564D0A99E293686C8A1B449
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 179d02a6ff79583cb483ce7fd7de9503e102a0e8b2051b866dc3fc6424f9e7dc
MD5 1d19290a0a164494454e3b19c5a48780
SHA1 feeac877ab26ff31241544db7dd8bb81f5bd5905
SHA512 3171b2773d0c596e15ff9c8a8ea04e362441a3c81e92ff1c10001e9e7f707dd305a8c09237d5ddcb2831c03b009b345bf8078192007b2f27d52deead92fb4561
TLSH
T124D022636300B1F5B9AD7ED140AEEC9ED33600200D02EED824D068AA093A86D890754A
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 962288edaddf14dc2c33ea43b6e5acd0d596316a00eaf10264f30167e9e1b6a4
MD5 aa828ecacab70570e743af8e907261e0
SHA1 9dfad4d7e0bc046ba797135733807b526d3fcf16
SHA512 3ccd43c0e840e6fbba8f0004c168914e7c8d344f12dafa1aece2cc07e3c3657a232ef3ca7de574e65a127e8829018ac203ce90ba1225688252aea4dd8cb0a93a
TLSH
T126D02353630070B5656C7F95506DEC8ED33500200C43DED418D0559B053745C4907445
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 91fb4588b9e58b1f98e768b00f2456a2f98907d17f60deb10a2c68ee86347449
MD5 b2edd9c6194131c583cc71c1467e1d77
SHA1 40b61ecedc58972d23cec1bada767e9d5bb02707
SHA512 a1b2906e3b8b307b970c827d0f7982e3c457c97b807051155484c3d1bab8b2fcadf1d1b90e19e5d35994476cbb058775c0adcf2804975e132526a44a9a01cca0
TLSH
T138D02353630070F5665C3F85506DECCED33510140D46DED414D0549D553785C4D07441
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 2KB
SHA256 4d3a28cc7e37afcc0521a36daae8a5eb4cfa078daf478cf1b451b28537544a6c
MD5 85e33cabb2718dc7b3f47e9a59daa5e8
SHA1 5466c5deb6bc8098275c1a9f4543933ebb83864b
SHA512 a7cbd0642833407f3fac3e4024fe18aaf104712160d9409e1d92eb76f78223e21d56b846b1479466eef5d5ef9cb356f69a97e3deecf1e0bde54e60396f98a3be
TLSH
T1BC518EA7C1BFB46B102C5C7B1E48BC1628F9A83147926CF5DE6A813CB0D58F74B064A3
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 40KB
SHA256 9068119f3a73558fcc1e84f7179847a6691be24bb158b478f5c2ad3940f386b4
MD5 0625e34c010c43301b98a79b0ac269e5
SHA1 5b22e2fd77c21d6f12212f1667887e0c39f2d87e
SHA512 26bb217afcf264739fdacda2caf1db864ef5845c12da1c78b0d87b29a93d4398e53b9c2f7ac014cd5670d439c9ecf0e0dcb6b86895b24636756c721d4f2cac82
SSDEEP 768:ss75m4C/f8YE8o4Mnc7WeT+p0mQ1/b35Adt+:F75m4pYE8ZMmW0mQx35Adt+
TLSH
T1310309569424C4A7CAC79D1CBD3C7E329AAC14639A95DE8E19ECCE0C00DE1BD6F07867
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 8798297b63cc5d790a848fa80866609e4eb6a0ca2864efbe5051fc7e634a0223
MD5 0012aa2475d4468e3347c1c6d5968496
SHA1 125c08e7db238864e0f63cd811200fe612f4cca6
SHA512 a2b38d6195b759631cd2e86770d8567af16a58e07890ed05b728634e9b31367bad1e0a61ebb02f276307a0af61bf1fc11232aa0e36a47ff1a541a8732e11b752
SSDEEP 192:sxZ0RTyMqZjK1Ml8UQmoC/fEs+8jE0CXU1zodpolP/W6+WNeAv/Y0dN3TShIg5CC:sxZ0MqtC/fEs+8o0Leq/bx/5XE4C
TLSH
T1F162F716AA38597B8CDBD219FA457F93D7F91533D2404E44A9FC8A1C00E7AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 203cce1c4bb7086bf045d43912169a83adc65717c7b46dd51e88ab586e835b9e
MD5 c9821a650e1491ab2fab27fefc745a82
SHA1 3ea8a2b8ff01a01991c000fb740f506901f57279
SHA512 ec28c1925e34ca9914b2b22b4d8ebdbc04e95fecb3a0206730cad06b2a23429bff4d7e4a301a29b943a6e02bb5e5710113a1d59e8c719f29fe83597336591358
SSDEEP 768:ciWKy8Eq2+dWRm5rQW78F1+UoAYDCx9Tuqh0VfUC9xbog/OV3TQLl/Ck0sg3ro1A:ciWKy8Eq2+dWRm5rQW7u1jaKTQLpCFsy
TLSH
T117E21A2B280CCB7E4F841E5CEC266F966EE8018B66A84D5447FA494C03C77EB511A4DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\6dbe8032-66f6-48e1-a29a-302ff742d487\index-dir\the-real-index
Size 72B
SHA256 fe270adecf1d23b0f77d3f0af089e5027adc11e1203c6b27961d6dc0e7eaf991
MD5 419b82f9892220532867ef664328c66a
SHA1 a5142517ba5067eefd064a220fd4d015df54a581
SHA512 301ea4ae7e51e74a9feb05c7b91dc5840ed016bd0c14ac7739100928fdb362a7ce487dc99d6d454bb9246d482c85d22a18a1c33710634c06c5672b0c87ebb094
TLSH
T112A0026489680517C0120774904BA6BC7B7C5C1101150E038390F176DC90940C10941C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\6dbe8032-66f6-48e1-a29a-302ff742d487\index-dir\the-real-index
Size 72B
SHA256 b30f7636c4c6f764bfe1ac04c2ebdee86730fd8b4a9807d498545a3e62a00e53
MD5 4e60c6d5b78e7753db7953bbc5e2d3bb
SHA1 b80938bf4b6a35fc56ed65eb4bf4bf41a40dc7aa
SHA512 bbc247857a4a157e13d606cbf65f6121bb8d403e06c0e5102b86e68acfbf2b45b1bb5ea85becdf359fa0501d678093c79973afac47c116fede0fc9c85dfb0cab
TLSH
T1A6A002B046940402CC1107B751A3055CF7585C5141554203C3D0F178D868EC84521C10
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5b0f00.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\6dbe8032-66f6-48e1-a29a-302ff742d487\index-dir\the-real-index~RFe5b0f00.TMP
Size 48B
SHA256 a591178bdf3c6183c7abdf2111e3ebed6989e90ccdaa4c65d06487a51ddff4e8
MD5 91f87e6ce8db23b1c204f82a6de586db
SHA1 cb56182b1d1d39f5fb6e0f5330eab76427760eed
SHA512 0494d88b6d794b41a41690b420125a7da8a1b4c69f301bc66c37d849f020f1a8f93d3dcf1369134afaa22f79cdb55d5fc18acffa38b132c17d5d9c87bbacf853
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\86489cb9-7e6a-411f-8a09-c63417bb59eb\index-dir\the-real-index
Size 2KB
SHA256 621674ea41ae90d30bcc1d8d408cf07ba2b13ac396d16f36e7718329d23a38c1
MD5 c8d249f69fdbe57c9cf280bb1492f5e2
SHA1 4b4fae2153a9b71b0b40be6ebfdf6c939fb2d508
SHA512 068f73eae7edf21d08ef639013b1726ba5548ebdb77b01e094c604e54d1fc8c9a25ab4db310bf5f7de16a7c4fb203161a4ed9325b98a20856b32c0ce1ecf64da
TLSH
T1E951C70F8D875F56DDAC11B354FA00803736A8DE6AC8CB1B31ECA134ACC37691E9A565
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\86489cb9-7e6a-411f-8a09-c63417bb59eb\index-dir\the-real-index
Size 2KB
SHA256 f3b192958b50bed7d4183909bfe8c05fb27b371b8a33be2e8430cd9011c222db
MD5 c0c7021dd309d6c18dd2f0929dbb15cb
SHA1 42f5cb8d77f453eeb5f011972dda304487d3fc32
SHA512 4c9478f7ba9f40014eaee54dab9a1a274901c40b4c4dad4258a69724583a8664ca16822c62707d5bafd1bbb8bd43c3e82b1355e396d31b2b5d6949d6bd884ed6
TLSH
T17351D74E4E428F2AE8AC02F314F7549033354CCE5B50961368FC22326D9376E1E4B6DD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5b0f00.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\86489cb9-7e6a-411f-8a09-c63417bb59eb\index-dir\the-real-index~RFe5b0f00.TMP
Size 2KB
SHA256 f5a34cff6de8ca6ec69a67a0f66c5dfc4f2fe255bfdb3f6c7df3fb4994a2e448
MD5 5f044be6bc45335d4c78756ebfe11916
SHA1 46f3d49473d0b39d6ce5714c785cf71dcffaff83
SHA512 95984ce839c9f52cd59aa4869b99b066e43ea1475a216779101c16cdd2f6d625199c8c442824d27fff2d0f827b46dee37cb98b62c5b8fbcc2952503be323ef82
TLSH
T10451849E4D824639E89841B70AE3A8A437391900C619BB5374FC9636ACD379E3D4E2D9
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d54a3707-cb0e-4bb5-ad36-fae9c8c805ea\index-dir\the-real-index
Size 72B
SHA256 c98ae09402ba1f749d77387bbf3057050b8e94ac942a976c71e60eb5e55243a0
MD5 74536b4c3bcf80af764a4aa75cb3ac91
SHA1 e52650abb256a07782f2c56c27dac18e11f7eba9
SHA512 255c2bfdfe7fe3a98e35ad5f2359bd399d15cf1bcee75c98b24ebcafb09a7d702afe0f38dc049f519f571e89318237718d0cf1028e4b5d3c06837ed212c30768
TLSH
T189A0026C42953111C16722F335D25661666189904205922941E1105CCCD0740856200D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5b8818.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d54a3707-cb0e-4bb5-ad36-fae9c8c805ea\index-dir\the-real-index~RFe5b8818.TMP
Size 72B
SHA256 8c77d197761a222cd584c3c0edecf258f597373a04a1c01f3b09803a7e125318
MD5 c835937eb8e8f1551d59cdfdc26d1f18
SHA1 e268306794add07784ba56be469526e6f4602723
SHA512 3f492c6763dd7b712e407cf2e7422966f00ed0d868551319477d333cb57c0be7d6eaf27c631283ad3adebb768b22fd84e94fd4ee43eede20443dc8e91daeaeb4
TLSH
T178A00250BF84410AD05325F1556343413300CD911210131752952944DC514404D4242C
MD5 SHA1 SHA512 TLSH

Submit Download

4f2277ea2139c475_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\efa5fb9a-837b-409b-b4ae-b9ffdff33476\4f2277ea2139c475_0
Size 61KB
SHA256 1e811d09f48222ce034beda0c7109a9921e411b353a7d06bdb35529122c5fb21
MD5 a2e9bb94f22eadc143b11d9adccc0d93
SHA1 e2222a39957d8e2e64707bbc3de0c5c34db0f816
SHA512 67daae91572b0c20758a5bb556eae0feac9cd9943be23be23b7037f4a96a62a8d58bc4e6e16b59f77feb9307932da0ba59498ad2bcaefbe4f0dd689815d25e8f
SSDEEP 1536:cagg7m6WuBHKut3JWWOQ7DtO/YdsllqtybR3ewQVMeiRHPwqpzGd/D:caSPukgMgDtyYdIYwl1y/D
TLSH
T172531AA7A26260358BAD21D5649B7F00F12B17561844C9ECF0BD76913B18E8B53B3BFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\efa5fb9a-837b-409b-b4ae-b9ffdff33476\index-dir\the-real-index
Size 72B
SHA256 77342551a012a69a35d38d32bc1fe13d957668b27c3c408b54acb0954d9e6102
MD5 db4ce89ea5c1a3366c6e546f02f5dd36
SHA1 186b5a28ea093465e13028af80a2def45cba7f00
SHA512 90cfdd8ce984ecff804335943d135ad27195e9f996557d2ea17a9dea46d4e0cdf05e260cc7380c41f26710bc061002879e01fc1912bd77a1b644b99ed3d1cca5
TLSH
T1FEA0022019683445D18147B275E3127423145C951101D3294191066DC8E23588A21086
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 476B
SHA256 f9b9c81bbdef32279fe721f3563e005f002a7c069033d8e8aae83fddabe0bc55
MD5 e710a4d3b8bafc0adcef47f4697cf9fc
SHA1 c88dece3d961b85511c5a3064e89fe7a25fa894e
SHA512 0f56515fcb0101be4e5db6aaacf104441ea79cf03d29ec202330ec45468b0445bb90674999d23abb6863ab520184e494a0f531dcc5bd8bc6fed10dbfa8070090
TLSH
T196F05C733FF71468F86FE3DA547160A40411B899D566ED4F243672A7E0B135E240EC72
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 476B
SHA256 35c3bdd68e3cab7e46f8f5583c89632934bf899a6b5640bfa6807ba872484f82
MD5 56ce034a0ae74a498557afc948e71b48
SHA1 78e7d1fc986415ef79b6973dd5a69ebcd53beb07
SHA512 33890a1ad7ba087f28eb66c07711cc9d9cf329394b2510ae47c5aea0e5d2ba02d34aa2d2163e44e2748d8b13e3e8b18d0b13cb24b4320e856615e0522a3d0d03
TLSH
T195F0DC733FE71468F96FD3DA103210A40021B849D0A1ED0F242671ABE0B135D140DC72
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 481B
SHA256 408279565a943d1465e840d84178d8b9095e5a93ee377c1f334fb374624a696c
MD5 f37cdaa9e4ffdf478aee23a84ca82cfe
SHA1 6049cc15bca67f6f333f6aa146f8f93a7ba6086e
SHA512 3a969ac3a01087ea0cf49bf56843159a519cd3998dd6eade3744b067b4d613dd81bc08bf134fb6d4664ca4f82ed8172727e5ff9e398c2869d638510b8c78cf26
TLSH
T106F0DC733FE71868F96F93CA603210940420FC49C492ED0F202671A7F0B135E140DC72
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 639275a20441d2ab5f5f2c7d74bdbb0bc22139a386a09ebfe42ea41da12f9dd4
MD5 be34e86e8f6e42562975e1b8e978d3ec
SHA1 a4877483991e2bc3de873811ed98c75c0142ddd7
SHA512 ed9b52724f6c5abe7bdee3cddfe72e560b7d9b08b3f63127d28fa951a62eca5aacc3d9d7b7a5e52ad418a60233ab3d59495d42a5b2ebf739b82108fdb35ab565
TLSH
T104A00261D97D90C6C81207F8D4B24185A613B8DC46157A1144EC40F89C5517345E3844
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 027afc6901ebb31d540fd1cdfc36bcf1cd9c895cc8103a28d11e17eff25fe3e9
MD5 64e1ba757403c8de6f2a23206c04cedd
SHA1 37842b2c297691a72ef37a1c9bd490fd38947dd0
SHA512 82774d64c1c87202b7f66c2f086dd02ae7e7ae69f608d258c5c0960615bd1d4cfedb778069450c5544770f854c84ab17d0212c16967c31df717a4121985d6f44
TLSH
T1C8A002238199110EC80007B09157ABA033605C1F0B061211C490D7EAACA65C49562109
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5b0f3f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5b0f3f.TMP
Size 72B
SHA256 10a16c39ea8d2860bd94d87e0b157852f015673f71fa292f614d3b64fd608f5e
MD5 bd6f80a9b7e7f3743a04350e1c946d0c
SHA1 53d579bf7ca1f41f75af4a153e010109e466e87b
SHA512 0933ce831d12caf4adb0439b9f0987497b010ab8715b5cbb24bfff17b27b7bb738c922008c4df92e63494cd4a40ccfad4853cb5e05065b189b85868e03ecc182
TLSH
T1C6A00223828A5509C40005B1101777E01340CC5F57205256D4A0A19CEC919C1D9A1109
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 ddeead3d38be27e74a393195cb0dcc6871dd7fb664aaf34878c9ebe92f03577f
MD5 6dd9b3014ee72062ba14db46acb76415
SHA1 ebeecda9e720b7fde393761efd85ead9858b7d1d
SHA512 2ce2492d6407a52701aa8dd3d72e10c272cb323b01930a8f15b9d59d1de18d80497ae8d9686352aef2a4967ea32f5b086fe5cbdd10559231451f896e1b5ddc08
SSDEEP 384:AFBHhTofhno2mB21q3Llbfe3sLDdeEpYt1UHv7Gx5:AFBHhTofhno2mB21q3Llbfe3sLDdeEpY
TLSH
T16CB28F56717B12023C3D290CA7929B370E8272A33558A56F7BB900BA4E67E215DFCCCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

cd01575c-dc43-4833-9a2d-6441b7af2d1c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\cd01575c-dc43-4833-9a2d-6441b7af2d1c.tmp
Size 15KB
SHA256 19e2905298bf6baf84840c3d1164d78f1811e62cee41d5e9228a8d9987b5eb15
MD5 58ea150977a919430ca8f9dac3bf37dc
SHA1 73125f613704c2796167fae3dd2916193ddc04f0
SHA512 ce040eae086cd062924bed57bb8e4c909c367168d2d7b0a3504d4f6bffb43e85d7f929add6e0113e8823ad4acc224dc7544f7dde99dd31fc2425fb35c9386fa5
SSDEEP 192:sxZ0RTyMqZjK1Ml8MoC/fEs8w8ixE0CXU1zodpolP/W6+WNeAv/Y0dp3FShIgj2J:sxZ0MQC/fEs8w8i60Leq/bx/5VEjC
TLSH
T18162E816AA38597B8CDBD209FA457F53D7F91533D2904E44A9FC8A1C00E7AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

office_endpoints_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2026.6.5.1\office_endpoints_list.json
Size 9KB
SHA256 f0c77aaacfc571e0bc3f51387febe134d991bf3c7f1941af303ed901f288dcd6
MD5 30719122f9edf4e23019a3b74e4f4325
SHA1 6707d64052797b9c5f1a5ccf016e5859c8ef898b
SHA512 ec2e1a33fcd1301f282512ffafb611ea705dc5df09d9aee014276909c1b62b0c73600121d94e9b6d9e160296672b41f2cb8c3ba23f121244ad2ea6521680723c
SSDEEP 96:DdQ/JJvwjyUsrdfsysVsnQfbJNZidYusysXYs2sFsdv12XvlRT07s/DkhcrHPglW:D7d7mfgiIWRcV4sobxezQd1Y
TLSH
T11512BB3BC4B49F229AB060659705E244F13C43BF5600C6FF76B9829C1F366ECA58E1E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 dc6dd1db4e60b4beaf31034bc75fff7fafaf82b5cb7870fbee1c37eb4656c3d9
MD5 4156831bb5bc583a3056d7e90adfe622
SHA1 644d31d63e4f5de6173f5ff8d9ba582444d92fe6
SHA512 168b867a8581b1cc5cbfb4b1de7c15738e90cd34ffa84c69865355ccca4404a741467ded092a00987f2d2e18d7e19e59b891b86ccf8ef5271578a39e82810efc
SSDEEP 384:nLiFiZcIA38NL8TUNTUlIR5ytwxjkpfb7oV9Ph7OSmdlJ2dOObjI9G6w7UUHy/7L:mFQA3kwgD2JoPMD2d29MUr
TLSH
T1F5D25B32ECA4C9B7EDE74E95B74A7A03DEE05163C69C9AC4E5DC5E0D009B1AD030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 1d77ea910544227dc4e6ccb0459cd3f6851aba2453acf2a4f2465ea11d9ec308
MD5 73b04da0cab2c0ebde7a82c9c40551d3
SHA1 87b03e7413231d62d83e512564b0cb10e066698c
SHA512 d3fe7a643127278775400d26643a6cdb8407415e333f0fcc0b429c01ce07ec6399bec030b24bd6ba631beb96885076e0841b4e8b95deeecff2a56da5b7de08b9
SSDEEP 384:nLiFPZcIY38NLY8TUNTUlIRdTC7Vljkpfb7oV9Ph7OSmdlJfdOObjI9G6w7UUHyH:mFHY3QYwgCCJoPMDfd29MUr
TLSH
T1DFF2B3F298E78977D89E4B97A37D2D029AFCC153B6885684B7C85D0CCC961BFC306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 21aae42b40bdcbaacc6b7d6a44b4a3469b0dd635171411ea30a9ff6f597bdf4e
MD5 2d10a7131dab1bed6f860915a9bd3904
SHA1 0e515a6a3677be4b3d65eb2354c2fdd46e966f9b
SHA512 17375beae32e3c71db5c1fa008c991c1df2ce2ea073954e712526257e3fbe57b271352a5f75cd3a724123198589f1d93508823ef8d828f8b5e9cac83af5941ea
SSDEEP 384:n5TiFiZcIy38NL8TUNTUlIR5yTwxjkpfb7oV9Ph7OSmdl0dOObjI9G6w7UUHy/7L:UFQy3kwgx2JoPMyd29MUr
TLSH
T121D25B32EC64CAB7EDE74E95B74A7A13DEE04163C69C9AC4E5DC6E0D009B5AD030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 5e92b052f575bf83f65198343bb128e156a9e3ed3b1a23506265f13f79c06679
MD5 ce2f86ab67a3f4f46e5cdad692ed3947
SHA1 5d34496e107aa059f4592687bc6c36c804c9dc53
SHA512 8e52fedc0acfd4f81ae2218f2bc3df12a9df45931c53d2c4afa34a0e14b973e096c06d126759bfb73648f91e387210e0f3519444e452c51bf0392207238f7f20
SSDEEP 384:nLiFEZcIY38NLY8TUNTUlIRdTC7Vljkpfb7oV9Ph7OSmdlJfdOObjI9G6w7UUHyH:mFiY3QYwgCCJoPMDfd29MUr
TLSH
T12FF2B3F298E78977D89E4B97A37D2D029AFCC153B6885684B7C85D0CCC961BFC306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 d305774de079f3f338c528f56b99ffc30fab9e1f08598f6c343beff3c9bb4888
MD5 28d3d0e47667fa594a598595402b3a40
SHA1 80f1e732cac1e633781f9094fd891bb5fdd0cf03
SHA512 f276f3bc1a9b76e0ab21b6466277f0f487d9777eab3bc3a4b26cd00d6989c8009478a35b11ebfbb2b836a788e542b5b471090cf32b5c55689bd46d0a6c5ab94a
SSDEEP 384:n0iFiZcI/38NL8TUNTUlIR5ytwxjkpfb7oV9Ph7OSmdl0dOObjI9G6w7UUHy/7IQ:PFQ/3kwgD2JoPMyd29MUr
TLSH
T1FBD25B32EC64C9B7EDE74E95B74A7A13DEE05163C69C9AC4E5DC6E0D009B1AD030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 62d9b0d592cb6dc962968180b91ddeeb76ffbe632b7854cb1a113bd7b67e5e4f
MD5 c5dd178f2cab8d4cfe89e83a11002d82
SHA1 b09af21b60c97687c6f3688207af076ac024d068
SHA512 81b17b4db5acf4e44dbb52dd4e0411e8dafa9b9b42622b14ce2f00837e60206d5b75aad000edc9cce5e19af35afcc95d657caabea7ba18142a02a1342ceaae46
SSDEEP 384:n58iF9CcmyWCs38NzA8TUNTUlIxBydv/oaajkpfb7oV9Ph7OSmdn8hkP+lFYS/Tn:xFccps3CAwgmF7JoPMn8hkoFYS/r
TLSH
T131C24A32ECA8C9B7ECE74FD9E74A7A06DEE011A381889AD4DAD81D4D00DB29D1307C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 1d6484318d690ea30f7da229046bb8f7c1ffd2eaa44e1c29e81f502e1ffa8fa4
MD5 535a227abe48251fb6d89edc0f4e8135
SHA1 51a4187fa00cfaf980a398f290ba08adf7ba7396
SHA512 80f09746b7bb670150bd515649a05acc044ea4c6873dadb3ea412657b4b6e1b65abf5c46ad4b6ab253edd767288bf47d09dc6614e81bb88fe6694779ca54323d
SSDEEP 384:n55iF9CcmyWCs38N38TUNTUlIxBydxryjkpfb7oV9Ph7OSmdl3dhkP+lFYS/TsH8:CFccps30wgGjJoPMRdhkoFYS/r
TLSH
T174C25B32ECA8C9B7ECD64ED9F64A7903DEE041A3C68C9AD4DAC81D5D00DB1AD530BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 83c11c20d128b93487bfca9f350a4dd53fa95f10489749fda2f8cf8715651b1e
MD5 2f97254bd8a26dc2734ff005b5ab7ab7
SHA1 5cd211889f285e98d0c3ee2a9742704f2cf897cc
SHA512 ac65f7b0105c29ac16ca2ef37eb964d3e44530f0b8a98951f86a66c4e839efb985e7089bb56b7beadc9db5709cd63ee01998f8594a679d652027530ac8ed54ab
SSDEEP 768:mFwRQYwgZCJoPMDav9ZG1K7k3q48grcy29MUr:tRQdD+nG1K7k3DTrcy2+Ur
TLSH
T1D0137EE99CD3897AD49E6B4BA76D2D2299BCD133F1A88584F7840F0CCC6247FE706815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 617d4a08b0d24fe6253a4471e7e2c3dcab4e40f19023f032276eccfdbf50d2c2
MD5 dda154b562f779de8aa0b1bb143cc6eb
SHA1 4414a2dc0078340e9f48bc2116937938bc79440d
SHA512 22fd4cc225a5d2f37d1083f4da54ddb15a5862d5c7c0434a86a891b1dab8b2513494a8ed521c5fb88ca801496e1d547b87afc8ed504eabfe201ee0a62276b032
SSDEEP 384:nLiFpZcIQ38NLY8TUNTUlIRdTCU3ljkpfb7oV9Ph7OSmdlJYdOObjI9G6w7UUHyH:mFhQ3QYwgtCJoPMDYd29MUr
TLSH
T1CCF2B3F298E78977D89E4B97A37D2D029AFCC153B6885684B7C85D0CCC961BFC306806
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 b8a647801903aaa25792b665fda07ef338f9d78f99e67374ddea82b2f6008826
MD5 efbdf8f87c3222b2c1930693faa22d48
SHA1 680886d4eea06f0efc689ba05e8c9b1e6b522e64
SHA512 eb1c5d0f91b4de61688a6e09251bb85819846d71eb843d04f197df8eb2841938e3810ab33d6151d05d90bea94de9f1e942649e4cdbef67fc49c2e466c547dcee
SSDEEP 384:nUiFCZcIR8NLm58TUNTUlIRdTCcIljkpfb7oV9Ph7OSmd5VSuMVFd8g0cQkObjI8:vFwRQm5wgqCJoPM5QuMVFd8g0cQ49MU8
TLSH
T19AF2B2F698D7897AD89E6B47637D2D1299FCC123B2585A84F7C81E0CCC664BFC306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 aa9a748cbde18a5cb8c884c07d4620cb47bc8e97c2b3021249327ee7d92d80ae
MD5 7e90d43a9b61b58f8146643fc93a8584
SHA1 d9ae48ab26d29de9d4cf60ba45149271080b03a2
SHA512 1ca62659a06af044606ce65f4ac99e9aa7eb455e47b513c622c1aaf0212ee9c75b382ba545808f3433970e811f878b65a5d835b925cc55cf39e3c2c97ebe5cfc
TLSH
T1BDE00211D284406EC174037040831B345EF19010027602494620426C2C2B3012B247C0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 d5d68e3a9ce99c7ea801d23136d3efdc799bce405228bee323dbcc9d820fc1bd
MD5 1e98d33004fc3fd6d931c2d4c1d922a4
SHA1 20dc3ecfaca71f0cb28485c7db7749ce8dc172a0
SHA512 59561ee9710a52cfe874d0e5134c02714c9a081a83b14846fefdb5574e781ed786097da3b2662592f3cf336aa4d425429c2e1f11e7dee4100eac3b801d184cbc
TLSH
T178E00213D38440EEC174037040C31A346DF390300277024D4E20427C2C2B3012F247C0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 f0f8d15f88610f9fbb62cbd6b43f3513d36e119b1507c9585ff6d49c74fc0302
MD5 c663e4a18371440c704c35e8e0de0132
SHA1 1be6ec0ddcde5bb3445327c1f7c6fa2183eb69e0
SHA512 acb18db0a5a6ba803ece3dd5608e0c0300a756548f45270ad83c5012b6bdf2ac944df13ebea62bd47b8a43978fb135c1412d57809c8777ee36fb0c76bea02c1a
TLSH
T159E00953E78540BEC57A077040C71B357AF2A06402B742AA8E6682682C2B7016F38FD0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 529300c910a9fcda89db587dd38bb04241c6a285703bd525308d7d61fe05e2f4
MD5 570b99e86a1c2060824e37055483db49
SHA1 30460e5a5ea1c3df38754752c8933c09e4cce91d
SHA512 f27aa8846ebfa84fb849da6f07ea08ca41bd86301653c54124a531d6d8f77468e84505425b7f2a9f2e505d43a63f73360bc92fab0cb3934cb2c8034982d2bfe2
TLSH
T185E00913E78441BEC578077040C71A347AF2906002B7025A4D208268282B3012B34BC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 98bb639e2179e9f4487209abbe8a3586049abf71f6bca69484b0e09e5b630d38
MD5 46b7b482c0a452222054caa2d6e748ee
SHA1 347783a96b40de345118457255ae448cdb9c0f2d
SHA512 9ba9c668c867af58cf2beb9a2371c96ad7ea745d0c74db236ead563eb254461a7fa6e0c81606604cc12bdd94ff846078bae12f44c6432489e00f4f97d1be28c8
TLSH
T14BE00953E78540FEC578077040C71B357AF2906402B7426A8E248268282B7012F38BC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5b71d1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5b71d1.TMP
Size 392B
SHA256 17f4e9f49be04ca9616a8ce0da386985dab8bd93534bfa00e8e5932444c08cd4
MD5 de3be8972ef1690a19a0e9a15b32bbaf
SHA1 e27a354e162c1f8be799526146bf5d0a7ef4f82e
SHA512 c5f4989040b53e9f5541ec4700bd97bad0bb8b647fab111d4acf3151a6c7d03f9b4959a8fe330bdfa3a644d53834647f273a4b871d235e0abc981ce60a97654a
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 356a4ede1e6106d7d213fa14907970aa4a9324f65ce348058c1c4cedbf729e49
MD5 b8f26b5de2a0c83281c43b6c1f78742a
SHA1 a28e1fb043a2056823fd14b1b9eb1b3f7831ea3b
SHA512 a7298cfe379da59fde9b90477c5c5df023c858631cb0983ef6550634014d34b312eadaf8310198df4b084aa109685ddd2358e1b2fe5799924e45ed15e47656b2
TLSH
T1AC513FE05C7D1AC1D1BE0E6FA48738FC81E8D725F4A0747D6848EA980ABA61D708187F
MD5 SHA1 SHA512 TLSH

Submit Download

4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\qur8qcyx.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
Size 15KB
SHA256 65e2c14b942b37fb94c9a1ad9b142c3de0af48941c87b2ca2b7783330eb03fbf
MD5 7315b385c707a1af3653631087a65528
SHA1 3271d19f2064bbb7b43f2fb2aed708d1dea01efc
SHA512 63ea4995bc2cf6917b3e0930a4c106ef97fc41915cf90a07a6001df3ba39eeb3e26e493fb4a2b43ffb4e12a54c60ccada0ff0888031f46e93b0c3c909d1d2f74
SSDEEP 384:HwCe7iO024Yzdcs3hk2nhfdDE2Ba/rIVy8ebbb+Pbb+u:QqZYzdv3hk2nhfS2sDIVy8aX+PX+u
TLSH
T13D728DBBCF512C5D191BD585C8AD9769DD05F9ABCFF680B608243449CB8432AB0FA48F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0c8e1875-0133-42e0-a580-e3061b8bf400.zip.tmp

Path C:\Users\Admin\AppData\Local\Temp\0c8e1875-0133-42e0-a580-e3061b8bf400.zip.tmp
Size 3.7MB
SHA256 dd544d48a457b6c12041612325df3c7f9b4c3cd0369ca24cc4f71128e625be98
MD5 3850f642d336e5b283975359ae18e3d7
SHA1 3978cd7a6dd7a3e7cd38e17b153e16ec119d7cee
SHA512 31254b8b9d53e4ea690eda16e079bcd983d40379e410e8078803078ec9a9ab4e168f3b9f7b591dadfda36bbe9c5cae7b8a9570f712af61ef14ccfc47de52a54f
SSDEEP 49152:7Vv1Dboz1hnoFzgmLWGBR/VvhF62rIydNOW2ytsj6F6Qyla0NPjuO4J/ceo0nw8E:Zv1vgHohhFLGmtsjO6QINNohnw8ZG
TLSH
T15906F175D75C1609C9FF83BA850C2FC2984C4FAE8054A96BEA6AD9715CE33EE1F4484C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1f45db28-2efa-4999-bee6-ff9d0f4c9344.tmp

Path C:\Users\Admin\AppData\Local\Temp\1f45db28-2efa-4999-bee6-ff9d0f4c9344.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

9e903e14-5147-44c2-af9f-0b4243bb7d41.tmp

Path C:\Users\Admin\AppData\Local\Temp\9e903e14-5147-44c2-af9f-0b4243bb7d41.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f6ac90d1-ae28-4ae6-9640-5c23ecf34518.tmp

Path C:\Users\Admin\AppData\Local\Temp\f6ac90d1-ae28-4ae6-9640-5c23ecf34518.tmp
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir868_1247379739\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 21.6MB
SHA256 7b81444b063f81e77c527c5589e86836cc2f7328deb2772300ccc7dc9e2510c3
MD5 40bf410fa9ef0d5499907e34885af6f4
SHA1 4d7722337a0e26bf4a1c6478129356acb2f7b720
SHA512 b763712aa4bd9819b7972a40216c08fd32338b14fab7ce4b166e39ce441ad62678bf0e1f25da436ffdb56ff1b1a21e3dbbaf47c0f5918c252e70656f5d0307ac
SSDEEP 393216:KYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHY:3mghF5QDwWCm/2YU8Ivq9u5P
TLSH
T14F37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download