killmbr | 5e2cd213ff47b7657abd9167c38ffd8b53c13261fe22adddea92b5a2d9e320ad

Analysis

max time kernel
390s
max time network
390s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/08/2026, 15:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Geometry dash auto speedhack.bat
Size 13KB
Sample260816-s71slsec75
SHA256 5e2cd213ff47b7657abd9167c38ffd8b53c13261fe22adddea92b5a2d9e320ad
MD5 4e2a7f369378a76d1df4d8c448f712af
SHA1 1192b4d01254a8704e6d6ae17dc2ec28a7ad5a49
SHA512 90e6eedca424e2ee37c78e0c0380db490c049b0378541812734c134510c40c6e4c48c4e213f395339ed99ff337ef087b6056ac5aafb246c1789ca6082dcabd2e
SSDEEP 192:AOyUySl0UaDz2gWsIzlmj+BxZ3yqueWQx0lZicyC8Sh31xcjBzyxwn7AVhllz3:AVODaDSHMql3yqlxy5L1xcjwrlz3
TLSH
T1BB528D3236754E13193326CB5C3AA256BCF4503F761A6E71A4138DFB90AAFD1319EB05
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

bootkit discovery execution killmbr persistence trojan wiper

Malware Config

Signatures

Family: KillMBR
KillMBR is a trojan that attempts to overwrite the Master Boot Record.
wiper trojan killmbr

Detects KillMBR 1 IoCs

resource	yara_rule
behavioral1/files/0x000800000002439a-182.dat	family_killmbr

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	MEMZ.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	MEMZ.exe

Executes dropped EXE 7 IoCs

pid	Process
2080	MEMZ.exe
3012	MEMZ.exe
620	MEMZ.exe
3992	MEMZ.exe
1968	MEMZ.exe
4712	MEMZ.exe
2756	MEMZ.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	MEMZ.exe

Drops file in Program Files directory 23 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3948_1184300662\classification.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3948_1184300662\extraction.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3948_499460788\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3948_499460788\protocols.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3948_152619834\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3948_31914647\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3948_1184300662\automation.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3948_1184300662\travel-facilitated-booking-bing.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3948_2076337294\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3948_57026254\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3948_57026254\nav_config.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3948_31914647\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3948_2076337294\keys.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3948_2076337294\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3948_463278782\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3948_152619834\office_endpoints_list.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3948_152619834\smart_switch_list.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3948_1184300662\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3948_1184300662\travel-facilitated-booking-kayak.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3948_2076337294\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3948_152619834\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3948_31914647\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3948_31914647\sets.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4412	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4744	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134313688787024078"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{1323401C-5038-46BE-8BCA-B6011A3ACAC2}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3012	MEMZ.exe
3012	MEMZ.exe
3012	MEMZ.exe
3012	MEMZ.exe
3012	MEMZ.exe
3012	MEMZ.exe
620	MEMZ.exe
620	MEMZ.exe
620	MEMZ.exe
620	MEMZ.exe
3012	MEMZ.exe
3012	MEMZ.exe
3992	MEMZ.exe
3992	MEMZ.exe
3992	MEMZ.exe
3992	MEMZ.exe
3012	MEMZ.exe
3012	MEMZ.exe
620	MEMZ.exe
620	MEMZ.exe
620	MEMZ.exe
620	MEMZ.exe
3012	MEMZ.exe
3012	MEMZ.exe
3992	MEMZ.exe
3992	MEMZ.exe
1968	MEMZ.exe
1968	MEMZ.exe
1968	MEMZ.exe
1968	MEMZ.exe
3992	MEMZ.exe
3992	MEMZ.exe
3012	MEMZ.exe
3012	MEMZ.exe
620	MEMZ.exe
620	MEMZ.exe
620	MEMZ.exe
620	MEMZ.exe
3012	MEMZ.exe
3012	MEMZ.exe
3992	MEMZ.exe
3992	MEMZ.exe
1968	MEMZ.exe
1968	MEMZ.exe
3992	MEMZ.exe
3992	MEMZ.exe
4712	MEMZ.exe
4712	MEMZ.exe
3012	MEMZ.exe
3012	MEMZ.exe
620	MEMZ.exe
620	MEMZ.exe
4712	MEMZ.exe
4712	MEMZ.exe
3992	MEMZ.exe
3992	MEMZ.exe
1968	MEMZ.exe
1968	MEMZ.exe
1968	MEMZ.exe
3992	MEMZ.exe
1968	MEMZ.exe
3992	MEMZ.exe
4712	MEMZ.exe
620	MEMZ.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 32 IoCs

pid	Process
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3948	msedge.exe
3948	msedge.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
2756	MEMZ.exe
2756	MEMZ.exe
2756	MEMZ.exe
2756	MEMZ.exe
2756	MEMZ.exe
2756	MEMZ.exe
2756	MEMZ.exe
2756	MEMZ.exe
2756	MEMZ.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4412 wrote to memory of 5068	4412	cmd.exe	85
PID 4412 wrote to memory of 2080	4412	cmd.exe	86
PID 2080 wrote to memory of 3012	2080	MEMZ.exe	90
PID 2080 wrote to memory of 620	2080	MEMZ.exe	91
PID 2080 wrote to memory of 3992	2080	MEMZ.exe	92
PID 2080 wrote to memory of 1968	2080	MEMZ.exe	93
PID 2080 wrote to memory of 4712	2080	MEMZ.exe	94
PID 2080 wrote to memory of 2756	2080	MEMZ.exe	95
PID 2756 wrote to memory of 2924	2756	MEMZ.exe	98
PID 2756 wrote to memory of 2580	2756	MEMZ.exe	104
PID 2580 wrote to memory of 3948	2580	msedge.exe	105
PID 3948 wrote to memory of 4492	3948	msedge.exe	106
PID 3948 wrote to memory of 4744	3948	msedge.exe	107
PID 3948 wrote to memory of 332	3948	msedge.exe	108
PID 3948 wrote to memory of 332	3948	msedge.exe	108
PID 3948 wrote to memory of 332	3948	msedge.exe	108
PID 3948 wrote to memory of 4508	3948	msedge.exe	110
PID 3948 wrote to memory of 4508	3948	msedge.exe	110
PID 3948 wrote to memory of 3796	3948	msedge.exe	111
PID 3948 wrote to memory of 3796	3948	msedge.exe	111
PID 3948 wrote to memory of 4592	3948	msedge.exe	112
PID 3948 wrote to memory of 3796	3948	msedge.exe	111
PID 3948 wrote to memory of 4592	3948	msedge.exe	112
PID 3948 wrote to memory of 4592	3948	msedge.exe	112
PID 3948 wrote to memory of 3980	3948	msedge.exe	113
PID 3948 wrote to memory of 3980	3948	msedge.exe	113
PID 3948 wrote to memory of 3980	3948	msedge.exe	113
PID 3948 wrote to memory of 3344	3948	msedge.exe	114
PID 3948 wrote to memory of 3344	3948	msedge.exe	114
PID 3948 wrote to memory of 3344	3948	msedge.exe	114
PID 3948 wrote to memory of 2620	3948	msedge.exe	117
PID 3948 wrote to memory of 2620	3948	msedge.exe	117
PID 3948 wrote to memory of 2572	3948	msedge.exe	118
PID 3948 wrote to memory of 2572	3948	msedge.exe	118
PID 3948 wrote to memory of 640	3948	msedge.exe	120
PID 3948 wrote to memory of 640	3948	msedge.exe	120
PID 3948 wrote to memory of 640	3948	msedge.exe	120
PID 3948 wrote to memory of 4644	3948	msedge.exe	121
PID 3948 wrote to memory of 1576	3948	msedge.exe	122
PID 3948 wrote to memory of 4644	3948	msedge.exe	121
PID 3948 wrote to memory of 1576	3948	msedge.exe	122
PID 3948 wrote to memory of 1524	3948	msedge.exe	125
PID 3948 wrote to memory of 4396	3948	msedge.exe	126
PID 3948 wrote to memory of 4396	3948	msedge.exe	126
PID 3948 wrote to memory of 3984	3948	msedge.exe	127
PID 3948 wrote to memory of 3984	3948	msedge.exe	127
PID 3948 wrote to memory of 4036	3948	msedge.exe	128
PID 3948 wrote to memory of 4036	3948	msedge.exe	128
PID 3948 wrote to memory of 4204	3948	msedge.exe	129
PID 3948 wrote to memory of 4204	3948	msedge.exe	129
PID 3948 wrote to memory of 1748	3948	msedge.exe	130
PID 3948 wrote to memory of 1748	3948	msedge.exe	130
PID 2756 wrote to memory of 3544	2756	MEMZ.exe	132
PID 3544 wrote to memory of 4472	3544	msedge.exe	133
PID 3948 wrote to memory of 1208	3948	msedge.exe	134
PID 3948 wrote to memory of 1208	3948	msedge.exe	134
PID 3948 wrote to memory of 1208	3948	msedge.exe	134
PID 3948 wrote to memory of 4588	3948	msedge.exe	135
PID 3948 wrote to memory of 812	3948	msedge.exe	136
PID 3948 wrote to memory of 3516	3948	msedge.exe	137
PID 3948 wrote to memory of 3128	3948	msedge.exe	138
PID 3948 wrote to memory of 3128	3948	msedge.exe	138
PID 3948 wrote to memory of 3128	3948	msedge.exe	138
PID 2756 wrote to memory of 4956	2756	MEMZ.exe	140

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Geometry dash auto speedhack.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4412
- C:\Windows\system32\cscript.exe
  cscript x.js
  2⤵
  PID:5068
- C:\Users\Admin\AppData\Roaming\MEMZ.exe
  "C:\Users\Admin\AppData\Roaming\MEMZ.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2080
- - C:\Users\Admin\AppData\Roaming\MEMZ.exe
    "C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:3012
- - C:\Users\Admin\AppData\Roaming\MEMZ.exe
    "C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:620
- - C:\Users\Admin\AppData\Roaming\MEMZ.exe
    "C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:3992
- - C:\Users\Admin\AppData\Roaming\MEMZ.exe
    "C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:1968
- - C:\Users\Admin\AppData\Roaming\MEMZ.exe
    "C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:4712
- - C:\Users\Admin\AppData\Roaming\MEMZ.exe
    "C:\Users\Admin\AppData\Roaming\MEMZ.exe" /main
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Writes to the Master Boot Record (MBR)
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2756
  - - C:\Windows\SysWOW64\notepad.exe
      "C:\Windows\System32\notepad.exe" \note.txt
      4⤵
      System Location Discovery: System Language Discovery
      PID:2924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=montage+parody+making+program+2016
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2580
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://google.co.ck/search?q=montage+parody+making+program+2016
        5⤵
        Drops file in Program Files directory
        Checks processor information in registry
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:3948
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x25c,0x7ff8bbf7c188,0x7ff8bbf7c194,0x7ff8bbf7c1a0
        6⤵
        
        PID:4492
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1860,i,2775546303783992342,17680692252312289342,524288 --field-trial-handle=2252,i,11910425406649625374,754676343442215967,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:3
        6⤵
        System Time Discovery
        
        PID:4744
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1664,i,5682556563116695076,10998148949120288546,262144 --field-trial-handle=2252,i,11910425406649625374,754676343442215967,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:2
        6⤵
        
        PID:332
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2580,i,6652395058003955017,13610776555115426745,524288 --field-trial-handle=2252,i,11910425406649625374,754676343442215967,262144 --variations-seed-version --mojo-platform-channel-handle=2560 /prefetch:8
        6⤵
        
        PID:4508
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3468,i,9832672118979406141,9961488564610270431,2097152 --field-trial-handle=2252,i,11910425406649625374,754676343442215967,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
        6⤵
        
        PID:3796
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3472,i,16895430047661506411,14866395232191915505,2097152 --field-trial-handle=2252,i,11910425406649625374,754676343442215967,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
        6⤵
        
        PID:4592
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4308,i,1524268189585662033,18158140817048901203,2097152 --field-trial-handle=2252,i,11910425406649625374,754676343442215967,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:1
        6⤵
        
        PID:3980
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4340,i,18036136654065846080,1189037976935873257,2097152 --field-trial-handle=2252,i,11910425406649625374,754676343442215967,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:2
        6⤵
        
        PID:3344
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3696,i,7083179639942405355,10430914718853751363,524288 --field-trial-handle=2252,i,11910425406649625374,754676343442215967,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
        6⤵
        
        PID:2620
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3632,i,3903334804825254716,13065155312453066771,524288 --field-trial-handle=2252,i,11910425406649625374,754676343442215967,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:8
        6⤵
        
        PID:2572
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5436,i,3298735309276839050,8305053150726449297,2097152 --field-trial-handle=2252,i,11910425406649625374,754676343442215967,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:1
        6⤵
        
        PID:640
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5576,i,9872420586683217636,4362635158579890076,524288 --field-trial-handle=2252,i,11910425406649625374,754676343442215967,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:8
        6⤵
        
        PID:4644
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3548,i,148246665023137184,7138112839161980834,524288 --field-trial-handle=2252,i,11910425406649625374,754676343442215967,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:8
        6⤵
        
        PID:1576
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6040,i,11985376735263872228,2896469433616372258,524288 --field-trial-handle=2252,i,11910425406649625374,754676343442215967,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:8
        6⤵
        
        PID:1344
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6040,i,11985376735263872228,2896469433616372258,524288 --field-trial-handle=2252,i,11910425406649625374,754676343442215967,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:8
        6⤵
        
        PID:1524
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6104,i,2301731263613539969,16779353035359751441,524288 --field-trial-handle=2252,i,11910425406649625374,754676343442215967,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:8
        6⤵
        
        PID:4396
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6272,i,11361988266513188147,17956953554770043612,524288 --field-trial-handle=2252,i,11910425406649625374,754676343442215967,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:8
        6⤵
        
        PID:3984
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6132,i,4055735796784985214,714828956716624192,524288 --field-trial-handle=2252,i,11910425406649625374,754676343442215967,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:8
        6⤵
        
        PID:4036
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6232,i,6449143664764331741,1060411406086437069,524288 --field-trial-handle=2252,i,11910425406649625374,754676343442215967,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:8
        6⤵
        
        PID:4204
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6444,i,3321857808299905382,12049323955956153226,524288 --field-trial-handle=2252,i,11910425406649625374,754676343442215967,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:8
        6⤵
        
        PID:1748
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=4432,i,15162392434085066179,8263114378622156811,2097152 --field-trial-handle=2252,i,11910425406649625374,754676343442215967,262144 --variations-seed-version --mojo-platform-channel-handle=4852 /prefetch:1
        6⤵
        
        PID:1208
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6516,i,2894428891381558174,10238684727130562170,524288 --field-trial-handle=2252,i,11910425406649625374,754676343442215967,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:8
        6⤵
        
        PID:4588
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6584,i,18414840332404628465,7876528189769401889,524288 --field-trial-handle=2252,i,11910425406649625374,754676343442215967,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:8
        6⤵
        
        PID:812
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6432,i,14838200153101678172,10833066756165151394,524288 --field-trial-handle=2252,i,11910425406649625374,754676343442215967,262144 --variations-seed-version --mojo-platform-channel-handle=4880 /prefetch:8
        6⤵
        
        PID:3516
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=4864,i,5213039204661101384,8002246358004025782,2097152 --field-trial-handle=2252,i,11910425406649625374,754676343442215967,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:1
        6⤵
        
        PID:3128
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=5520,i,11224740984152236424,14657331851883044260,2097152 --field-trial-handle=2252,i,11910425406649625374,754676343442215967,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:1
        6⤵
        
        PID:812
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=5572,i,3388694032374721788,12226101065155515841,2097152 --field-trial-handle=2252,i,11910425406649625374,754676343442215967,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:1
        6⤵
        
        PID:1736
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6572,i,7871756608957629224,10636853292686127391,524288 --field-trial-handle=2252,i,11910425406649625374,754676343442215967,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:8
        6⤵
        
        PID:3824
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=5988,i,16082616311787377426,3354913451649167339,2097152 --field-trial-handle=2252,i,11910425406649625374,754676343442215967,262144 --variations-seed-version --mojo-platform-channel-handle=6804 /prefetch:1
        6⤵
        
        PID:1200
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=6480,i,10935215487623914642,7830426730439857456,2097152 --field-trial-handle=2252,i,11910425406649625374,754676343442215967,262144 --variations-seed-version --mojo-platform-channel-handle=6864 /prefetch:1
        6⤵
        
        PID:3752
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6184,i,10230700276206987866,5275304001015668922,524288 --field-trial-handle=2252,i,11910425406649625374,754676343442215967,262144 --variations-seed-version --mojo-platform-channel-handle=6888 /prefetch:8
        6⤵
        
        PID:3200
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=6192,i,16936623473057309473,1668175098751527195,2097152 --field-trial-handle=2252,i,11910425406649625374,754676343442215967,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:1
        6⤵
        
        PID:3732
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=6204,i,5361395109879693504,17936585370111281503,2097152 --field-trial-handle=2252,i,11910425406649625374,754676343442215967,262144 --variations-seed-version --mojo-platform-channel-handle=6844 /prefetch:1
        6⤵
        
        PID:4404
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7176,i,18375812269726497126,15230008081962799401,524288 --field-trial-handle=2252,i,11910425406649625374,754676343442215967,262144 --variations-seed-version --mojo-platform-channel-handle=6900 /prefetch:8
        6⤵
        
        PID:2764
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7204,i,8597404020916893146,15004206957861334154,262144 --field-trial-handle=2252,i,11910425406649625374,754676343442215967,262144 --variations-seed-version --mojo-platform-channel-handle=6948 /prefetch:8
        6⤵
        
        PID:2796
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=6984,i,14287077024408410257,9897085735898723050,2097152 --field-trial-handle=2252,i,11910425406649625374,754676343442215967,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:1
        6⤵
        
        PID:3720
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=4080,i,2266051070632576872,17525081506778551086,2097152 --field-trial-handle=2252,i,11910425406649625374,754676343442215967,262144 --variations-seed-version --mojo-platform-channel-handle=6988 /prefetch:1
        6⤵
        
        PID:3240
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6000,i,14449893315955352196,8697382314458730464,524288 --field-trial-handle=2252,i,11910425406649625374,754676343442215967,262144 --variations-seed-version --mojo-platform-channel-handle=3984 /prefetch:8
        6⤵
        
        PID:3252
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=7040,i,4159159942160571739,9670209124378475795,2097152 --field-trial-handle=2252,i,11910425406649625374,754676343442215967,262144 --variations-seed-version --mojo-platform-channel-handle=6904 /prefetch:1
        6⤵
        
        PID:4896
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=1032,i,2262819326932409510,620673382971041239,2097152 --field-trial-handle=2252,i,11910425406649625374,754676343442215967,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:1
        6⤵
        
        PID:4320
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=7340,i,2522395520629819827,12700185496497540190,2097152 --field-trial-handle=2252,i,11910425406649625374,754676343442215967,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
        6⤵
        
        PID:3276
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=7440,i,8904147702054845701,6363434970221961114,2097152 --field-trial-handle=2252,i,11910425406649625374,754676343442215967,262144 --variations-seed-version --mojo-platform-channel-handle=7460 /prefetch:1
        6⤵
        
        PID:628
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7284,i,11156490309955951516,5898222233115866183,524288 --field-trial-handle=2252,i,11910425406649625374,754676343442215967,262144 --variations-seed-version --mojo-platform-channel-handle=7268 /prefetch:8
        6⤵
        
        PID:3820
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7304,i,17787193808194556732,5952369094455604896,524288 --field-trial-handle=2252,i,11910425406649625374,754676343442215967,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:8
        6⤵
        
        PID:4000
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7672,i,9913574702568360392,9008166290655533474,524288 --field-trial-handle=2252,i,11910425406649625374,754676343442215967,262144 --variations-seed-version --mojo-platform-channel-handle=7664 /prefetch:8
        6⤵
        
        PID:4484
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7852,i,9842361023244213603,7832331708381890486,524288 --field-trial-handle=2252,i,11910425406649625374,754676343442215967,262144 --variations-seed-version --mojo-platform-channel-handle=7860 /prefetch:8
        6⤵
        
        PID:4180
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=5652,i,11805758844054053083,8220642617954175033,2097152 --field-trial-handle=2252,i,11910425406649625374,754676343442215967,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:1
        6⤵
        
        PID:3484
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=7256,i,15314144839725819999,10374611307643145691,2097152 --field-trial-handle=2252,i,11910425406649625374,754676343442215967,262144 --variations-seed-version --mojo-platform-channel-handle=7636 /prefetch:1
        6⤵
        
        PID:2652
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7900,i,11849125057284001561,13443970986285395992,524288 --field-trial-handle=2252,i,11910425406649625374,754676343442215967,262144 --variations-seed-version --mojo-platform-channel-handle=7556 /prefetch:8
        6⤵
        
        PID:940
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=5164,i,12934988441438686109,3664089717860809966,2097152 --field-trial-handle=2252,i,11910425406649625374,754676343442215967,262144 --variations-seed-version --mojo-platform-channel-handle=7536 /prefetch:1
        6⤵
        
        PID:1772
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=7972,i,2357314459823070771,14304018540353359997,2097152 --field-trial-handle=2252,i,11910425406649625374,754676343442215967,262144 --variations-seed-version --mojo-platform-channel-handle=8016 /prefetch:1
        6⤵
        
        PID:4408
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7572,i,5610417676455556602,4702899105511596906,524288 --field-trial-handle=2252,i,11910425406649625374,754676343442215967,262144 --variations-seed-version --mojo-platform-channel-handle=7952 /prefetch:8
        6⤵
        
        PID:4032
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --always-read-main-dll --metrics-shmem-handle=5400,i,5275214451032332793,4178656728012552321,2097152 --field-trial-handle=2252,i,11910425406649625374,754676343442215967,262144 --variations-seed-version --mojo-platform-channel-handle=7364 /prefetch:1
        6⤵
        
        PID:5264
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --metrics-shmem-handle=7464,i,8865133740150156216,14300758055207660281,2097152 --field-trial-handle=2252,i,11910425406649625374,754676343442215967,262144 --variations-seed-version --mojo-platform-channel-handle=7936 /prefetch:1
        6⤵
        
        PID:5324
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8260,i,16464790702943599932,16115074568422244112,524288 --field-trial-handle=2252,i,11910425406649625374,754676343442215967,262144 --variations-seed-version --mojo-platform-channel-handle=8312 /prefetch:8
        6⤵
        
        PID:5500
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8248,i,4308790137428825967,4392548612731970501,524288 --field-trial-handle=2252,i,11910425406649625374,754676343442215967,262144 --variations-seed-version --mojo-platform-channel-handle=8024 /prefetch:8
        6⤵
        
        PID:5804
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --always-read-main-dll --metrics-shmem-handle=8576,i,10183029775449862916,2539657396735587397,2097152 --field-trial-handle=2252,i,11910425406649625374,754676343442215967,262144 --variations-seed-version --mojo-platform-channel-handle=8152 /prefetch:1
        6⤵
        
        PID:5948
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --always-read-main-dll --metrics-shmem-handle=8272,i,16753819978070120983,9694985083106998086,2097152 --field-trial-handle=2252,i,11910425406649625374,754676343442215967,262144 --variations-seed-version --mojo-platform-channel-handle=8188 /prefetch:1
        6⤵
        
        PID:6032
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8956,i,14868887107112308107,4301421456009685259,524288 --field-trial-handle=2252,i,11910425406649625374,754676343442215967,262144 --variations-seed-version --mojo-platform-channel-handle=8944 /prefetch:8
        6⤵
        
        PID:4280
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --always-read-main-dll --metrics-shmem-handle=8864,i,3606561367613924316,12833433370234887734,2097152 --field-trial-handle=2252,i,11910425406649625374,754676343442215967,262144 --variations-seed-version --mojo-platform-channel-handle=9084 /prefetch:1
        6⤵
        
        PID:5340
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --always-read-main-dll --metrics-shmem-handle=8916,i,6197901428609603152,13715868208596966052,2097152 --field-trial-handle=2252,i,11910425406649625374,754676343442215967,262144 --variations-seed-version --mojo-platform-channel-handle=8888 /prefetch:1
        6⤵
        
        PID:5416
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --always-read-main-dll --metrics-shmem-handle=8312,i,5625774454422495502,2354310468893256732,2097152 --field-trial-handle=2252,i,11910425406649625374,754676343442215967,262144 --variations-seed-version --mojo-platform-channel-handle=8292 /prefetch:1
        6⤵
        
        PID:6092
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --always-read-main-dll --metrics-shmem-handle=8232,i,11759413680056610136,3788466087753188988,2097152 --field-trial-handle=2252,i,11910425406649625374,754676343442215967,262144 --variations-seed-version --mojo-platform-channel-handle=8236 /prefetch:1
        6⤵
        
        PID:1040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://softonic.com/
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3544
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://softonic.com/
        5⤵
        
        PID:4472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=mcafee+vs+norton
      4⤵
      PID:4956
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://google.co.ck/search?q=mcafee+vs+norton
        5⤵
        
        PID:1540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=half+life+3+release+date
      4⤵
      PID:4296
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://google.co.ck/search?q=half+life+3+release+date
        5⤵
        
        PID:3732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=vinesauce+meme+collection
      4⤵
      PID:516
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://google.co.ck/search?q=vinesauce+meme+collection
        5⤵
        
        PID:2452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://answers.microsoft.com/en-us/protect/forum/protect_other-protect_scanning/memz-malwarevirus-trojan-completely-destroying/268bc1c2-39f4-42f8-90c2-597a673b6b45
      4⤵
      PID:2796
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://answers.microsoft.com/en-us/protect/forum/protect_other-protect_scanning/memz-malwarevirus-trojan-completely-destroying/268bc1c2-39f4-42f8-90c2-597a673b6b45
        5⤵
        
        PID:452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=half+life+3+release+date
      4⤵
      PID:4404
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://google.co.ck/search?q=half+life+3+release+date
        5⤵
        
        PID:4288
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=dank+memz
      4⤵
      PID:900
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://google.co.ck/search?q=dank+memz
        5⤵
        
        PID:2764
  - - C:\Windows\SysWOW64\notepad.exe
      "C:\Windows\System32\notepad.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://softonic.com/
      4⤵
      PID:1844
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://softonic.com/
        5⤵
        
        PID:2392
  - - C:\Windows\SysWOW64\notepad.exe
      "C:\Windows\System32\notepad.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=batch+virus+download
      4⤵
      PID:2132
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://google.co.ck/search?q=batch+virus+download
        5⤵
        
        PID:2892
  - - C:\Windows\SysWOW64\notepad.exe
      "C:\Windows\System32\notepad.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3812
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://softonic.com/
      4⤵
      PID:5212
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://softonic.com/
        5⤵
        
        PID:5228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=bonzi+buddy+download+free
      4⤵
      PID:5936
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://google.co.ck/search?q=bonzi+buddy+download+free
        5⤵
        
        PID:5972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+to+get+money
      4⤵
      PID:5276
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://google.co.ck/search?q=how+to+get+money
        5⤵
        
        PID:5272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=is+illuminati+real
      4⤵
      PID:5956
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://google.co.ck/search?q=is+illuminati+real
        5⤵
        
        PID:5960

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:608

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x494 0x2d0
1⤵
PID:1928

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Windows Command Shell

T1059.003

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3948_1184300662\manifest.json
Size 135B
SHA256 cb929ae2d466e597ecc4f588ba22faf68f7cfc204b3986819c85ac608d6f82b5
MD5 4055ba4ebd5546fb6306d6a3151a236a
SHA1 609a989f14f8ee9ed9bffbd6ddba3214fd0d0109
SHA512 58d39f7ae0dafd067c6dba34c686506c1718112ad5af8a255eb9a7d6ec0edca318b557565f5914c5140eb9d1b6e2ffbb08c9d596f43e7a79fdb4ef95457bf29a
TLSH
T1CEC09223CC019CB119743B642AB2AB82F7B41B0B6869705A3AB3148C1F7E1B48082680
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3948_152619834\manifest.json
Size 165B
SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
TLSH
T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3948_2076337294\LICENSE
Size 1KB
SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
MD5 ee002cb9e51bb8dfa89640a406a1090a
SHA1 49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2
SHA512 d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c
TLSH
T17D31535723840B9306DA2B4566AEBDC4B0DDC02D7F27AE05186EF394537B52ED8B3443
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3948_2076337294\manifest.json
Size 78B
SHA256 c7e506687caffcf3906916ad3fc190a19212d67a2535479241096bd0d4418b03
MD5 259f068207f60fb9d4448c02c27b74ba
SHA1 99131d95cce94750a928738a99caa5c710bbc924
SHA512 fa41eac9d1ca244d06083e3d4230dd94700861155359722c1d815d0d9933dcd39c113b6f0f6ea02ff7ee1acd2fbc6ed40267d557afde16f417e80b678e8136bd
TLSH
T173A02230AC02E23320C803B002B083C383A02C02302A388C0B0320A232C823BE2F323C
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3948_31914647\manifest.json
Size 85B
SHA256 2d905d7b28b1afd313753d14f6a916a2e56ec4c1316bfa43046b09214ceb6090
MD5 8ce95626b39ebc2401eee0b34c24fc7c
SHA1 f97a2fefe756f7a03e388e1333573b884730c2b0
SHA512 f04e4f695977918adf6e0603386b6f9c75a4a2202b0fe7215b642f3db491a1db398039cc28633b8e2541749403581622d28c1400f3f8fc66a3daab200e27266d
TLSH
T106A0121018015DE318880320213143D2D3A51C05247437001106108019B8636027A22E
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3948_463278782\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3948_499460788\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3948_57026254\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\protocols.json
Size 3KB
SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
MD5 5e2067a92dcfcb05537479c384a89725
SHA1 eeed29b07d865ac4d46629fddadad629d0ad4e2b
SHA512 c96c5f9cb7a169ad91b070b567cf9fa8f35951ccc5aa930e97dbeccbeac27f7e9dde1379138c9ba6b0d10339f9cb053ef21f19f06d7560f97d5d23a27c8ed4f6
TLSH
T17D7184B7862088194E360AB4AA0DF10DF93702DF2AF598D3B27D455F1F712BB3946249
MD5 SHA1 SHA512 TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 814d47aad78c212b52568b9c7b58d242899d490d3afebce66181cae50c880df5
MD5 8c7cdfea4284ba987d295d82a9c7ddd6
SHA1 7d1a3a66f2d64a383b230196ba89a263ce7ee957
SHA512 59c8229e834c944265aed4131c79f41f9f940a48651b9fb18800cef5bae36d17c7fd5880120c6fee8ce22a157b65bc63846b65765bc4dc86e15926dcce400d0d
SSDEEP 12:sf9iXhV0xoUZxCe+JKlkQuMRxCb8TXuYJ0IJpPK6BsyW1inPiz:U9iRqxoUZxWMk8xVTeYWI31BtXP
TLSH
T105724C85B34498FFC8835E7189BD27903774F6DF1F02866B6A6A760E2E271C84F44224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4bf0783d55eb083b4adaa03ed8b76a2bd35b0819c8ad2530a78e1b8d6856010b
MD5 7a50c2e276f05b686e8cb6c95b86650f
SHA1 bc892af04a9d6b1bee8047f67518d676df864301
SHA512 f1d02fd9f067323214d78de08172e1a78028eba76f4754436f4d77b849e8422865dcea22be13f21c36ac2c5807b393c1dffdb0a3217c3353a517a0467461a474
TLSH
T19BD022203A28A008E282003AA880EB020208CA80282BC322E220C00CAC2B820A3800C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 81240d13af4ca099e1358c75991e3fa5640dbb3aac72c2d98006f6159bf74aa0
MD5 96dd753cd2d8557b97ab2cd76f7fc6cf
SHA1 81697ccb13fb04a07bd47b552b3607597251f36d
SHA512 355c412a688a71b124e85c0527177b3f97efceb2a5553f8428e0913940daffd3bd176f5476b940c64eee52d543f0568112ac073984d9a64015adc15cbef552de
TLSH
T174D09224BA29A149E282007AA881EB565219DA95296B9622E620C44DBD2B925A3851C2
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log
Size 33B
SHA256 68c7ad234755b9edb06832a084d092660970c89a7305e0c47d327b6ac50dd898
MD5 f27314dd366903bbc6141eae524b0fde
SHA1 4714d4a11c53cf4258c3a0246b98e5f5a01fbc12
SHA512 07a0d529d9458de5e46385f2a9d77e0987567ba908b53ddb1f83d40d99a72e6b2e3586b9f79c2264a83422c4e7fc6559cac029a6f969f793f7407212bb3ecd51
MD5 SHA1 SHA512

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 293B
SHA256 ccd788c6f08ed48db0c200a0f0403024a441d0365a033b59627cd7544894f6d2
MD5 fb3d7bcacdbb97463c0909636c4d2b85
SHA1 074f9a2af71acf1ce3f052ecac4135d5c35eb8b1
SHA512 aaaffc217b77616704224641a53a8f2111657eb2039706fdd201580ff2d21a84f322b4612672e6518fc5c63e990ce7a23d429af3ac18a959e74317f2d0c0a533
TLSH
T15BE0C25644C2C62B9A48A5C75565974C8184330EA6C4BA0E1F04CC483047988AB976A9
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

f_00007f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007f
Size 86KB
SHA256 75ebd0ba936007f8355463df2b47bcbacedcc0818fb7ebec5df08d3be383de9e
MD5 6d8cf9d0c1335132793c16840011687c
SHA1 db51f052cfc80f1204cdb761dbbdf94467597777
SHA512 3a5dc86c128a393bd83762409454b798acb6c6986d0ea92afa4898075497b63380db4f86c5fb2725e81ddee46c9a704fe6461d80dc64fb251ef852db34f0adc0
SSDEEP 1536:vAZjaMkLxmshBbzebVFBs1YUIba+etCnSGPXF:q6HbzebeKUga+etqSkXF
TLSH
T1658312E322B8A816815FC04E2D1550A507752FCFF9FB8C50F71AE6AE12C5672EC0B16B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000080

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000080
Size 436KB
SHA256 0b320d2cf00e9215763a5377904e2301b2edb7a5d299bd319259714cf8bcd9a9
MD5 38e965609b7e0769e6754549cfa3c2fd
SHA1 8ef9e62fa3ae6d8b371f5a9e9344a6cdf31515fe
SHA512 18cff962b979abf3e3d06261422f35502463a0e196aa0cf801cadcff8833a83f20c9e9f22fb3133041e406fdf2304088a0a5eaa4bbb8aff07ab15a0c1b46b0e4
SSDEEP 6144:HT+7EhQjYpz+XUGr9+7Km54TxcjJJEWv6p0qOJ7kuKtAiDL6GnkES7+S8HBWzDi2:6vj0iUI9EKFEJdU0p7riDxw7L8oviJ3c
TLSH
T147942367DF08D99BDA158361EA30EBDD1158EB6EE00A3CC844BB462CE54C0F9F6913C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000082

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000082
Size 69KB
SHA256 4fa3f761f6665d706f2c5db63cbaac15655b5a6f730823805d7efa795efbcc41
MD5 9f0f827ab305873357050457542b06ae
SHA1 bae69fe7ca863a5da478e359d74ab1d9df684d7b
SHA512 bc50bd477b6bca0d905c77f0424429cc057ee3ef9f873ddb3f3057693b58bd2f15220405f2520d5a5a95be08ba8167917c6c0ed0c1897cfebef547cec9b4a274
SSDEEP 1536:QdHCzR5TXC6osOv4mguW0HCsDKPhPcTrChc+v+RNkNTpuaDvFGU:QdHKLJoha1sOJPcqhcFRNEtHGU
TLSH
T1CB631233FB903C574DCDB49E7685719EF92101EEC9A288266E0CB0DB017E5B490E29E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000083

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000083
Size 25KB
SHA256 a2ed66f01753747ce359a8be0a9555b91e18d01c6bccf8e52a74078520d3720a
MD5 7077ccb28e70d467500f6994c16ea6b2
SHA1 b47c8f61db3e92fa3fd0ec2e5021b4ca3586a494
SHA512 aa84c24767a1aeaea11b48e2b8b4d10a9f668839030fe47d132a425dc5cc30954c7d6106ed1d6d1522d42266ff03c0b7be0f1b95861fba79b6073fc9b992ab62
SSDEEP 768:3lBWG2FODWjwQU5xhjsNxSyk879qB8RET4qR19ZB:vMFOKUhSxS1L86pPZB
TLSH
T1FCB2E1CAE9CAB097AF1FB05F48E22D256E77B20EF00AC57647A14DD4657E08345E232C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000084

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000084
Size 16KB
SHA256 0364d368abf457d4e70dbc7a7a360f3486eaea2837b194915b23d4398bee91ac
MD5 68c477c4c76baab3a8d1ef6a55aa986f
SHA1 4af50379e13514558dd53d123db8ea101ec5e24c
SHA512 92b34fe3b7f82f10cf6de8027ac08f4a5b8764fb4e0b31c93da6e3d5bd08e0bc83b79fd70b8207a1066b689583e0b6976fa3c885b0c067ea343e6f2031d55d25
SSDEEP 384:Nd1nZ+hLc8g3/2AY8VL6UBP38Y1dDq6w9ZD:bJZpv3h1Z3x+9ZD
TLSH
T10572D092B7F2D6B84D28BDFE122B04099CA91D8729F113F25942362BA5B1C6484FD071
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000085

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000085
Size 45KB
SHA256 4f2cbd16206eef5478577049e51574e6e9668f9b6370a28053f2d358c2451262
MD5 de88c4d8005839ae026437a0886c5661
SHA1 8c057a8d96507209309a58462e949132e557a7f3
SHA512 a578f8e470b5f7bfdee6d813f8fff240307120a5d52524c870816fc86692462da2ce8ae81aa1c93ed0c09e5dbfa02f7759578555c5fc55b9108ce8f315a85c78
SSDEEP 768:ymFssMMQltVHayIZBK8fFWIB8YRmoDAmNq2I3MEMYTbufGQ93TN4ED2qvldxNuvu:yk0lvVIdfsIB8YsoDAmjGMiTCfGQ95Fb
TLSH
T14D23F1D7C5E419259BF1C15F61284F68C5B8093EF3FCA8896EB5BBA40CD0006AD782E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000086

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000086
Size 17KB
SHA256 2ccc637d2e5de261217aa5f07563bafdb0485b5b5725cfdb3abf77d2415c63cf
MD5 5a71b32cb27c3498546d937440afe618
SHA1 adbe90059cb1f53e8da6600d3cee401401356a01
SHA512 ebca45eb6ea094e831cccadd63db35f41be770dccd3bec126a4624ea0f6cc4cdf407d7fd2698ec3f3548345d6f08494a0db55163966d04aaa01c6776c28afbc4
SSDEEP 384:ruocZkR+mXvpCGGLgve8lW9/QlE9mGdmdt3IUhT4kvAjXsHtL6uIXM9anqF:6ocZkvGLgve84/QlEE+mdt3I5UcXsNWo
TLSH
T12582D0BE12C36D743B1D03595C6587A19220F966CEEBB8BCAE3AF232D01B4C5C535934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000087

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000087
Size 24KB
SHA256 def8db3d0393b41c222c29e372c8ce57f9696a7afd5e93ccbcb225e4277e6b96
MD5 1a8d2e6c071e6ebd41e2f8851dd4d912
SHA1 c12e0c8de14b218dac205bedec4500436238a31a
SHA512 4a304a05b7fc18c93ddfc3aa2a4473b7145163c756bcba010ec8549dce90993722841f41c465a1c0d717774a6e394322a949d78706c423a0a9ac87fdff175fe7
SSDEEP 768:C92mZJHiWE0Gw3PBSUA9Kxrtmejy2zsA0SOHQbXHAEO:CNLfp3PvA9KxxmUy2zASOwTHAEO
TLSH
T146B2F119CEE3B922ADB99F25EFA836D108F082547D7D6FDE8E19440C8F1243076BB056
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000088

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000088
Size 59KB
SHA256 7baa3ae7061526c4ff896992f40f02d78cfeb53eb5ad80222d4070d2bbcee8d5
MD5 76a2efebc8a2242fb2ccbb7c5fea690f
SHA1 8fd1c32975bea14aead831aaee9b5c841a436476
SHA512 8533f3c983b844e53fff569495fbda0f7b9dce61aa04d44ffe2eee6299f0ebefa1834ec9214c3b93c8d7efd7c5c9fd14d33302383f8fdd39ac16088bd1684edc
SSDEEP 1536:mtvL4lGw//yBsrAs71ttfRzlNIRJXURJT7J3bQbCwkz71vGjg:Q4lGw/nAS1tlhIRJeCbs1vT
TLSH
T1065302B41AA17C515244A78344CBDAF55B01F3283E434A60CFCB90B1F0AABB47A4DFD5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000089

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000089
Size 180KB
SHA256 0bcdf006d6188f886543b2ce6a45234e4121e21e1c330722ccea3cdd0118a831
MD5 c9ae43024abed139750f9818923e56ab
SHA1 e601ad65c5390e6179153478c0aed46aa1a5f2f7
SHA512 44034cd150595571b645c712dc2e6dc2b977628685543f8acbbbad75350c89c4d2c296977729c90d875341384b4970de6ec0bf5bc9f075bbcbde28360ebb396d
SSDEEP 3072:dLGRVOYY2lm831SiGMsypAncGuTSAc8Kx1uUKKKNEd6OJ9rWKKaDodofSw81qREe:dGRgYY28WIqKcGumAvewr8aTaQq5
TLSH
T184042299E35DF642EB0788D79BE5B10C1A005F2B01C1C2F233B366F09E99BE6353465A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008a
Size 107KB
SHA256 8a635d3cb6a947179d1421661f0b84d3ea2a3599decc80845129839a79dec237
MD5 62a541969d09d23dc86b39fd3318fbde
SHA1 3a4b75a9b351db8a3cd92bcf3ced43652f338065
SHA512 736d239bb133530d342f5446a792701af6053073eb41d9063a64af6b92c4e51ef8efe77885001e5b696197f8336b7badea67fc7c84c132d9c80e9048155c8d2c
SSDEEP 3072:0ZAqHcDiJF4WpXYTsxzX8XcJpa/YiAXis:0yq2E4WOSX8s2MB
TLSH
T123B31262F1D98077D84887664BC600ACC87ADB3DE6D5BC2EDB726EF26239F976140D10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008b
Size 52KB
SHA256 f90a5c882376b0a7d361b0ba46d80bf8fe180e16c9e9d47ba1bdc326b2f7d9d3
MD5 44a7fdaf4f1332946ac7703c2022601f
SHA1 381f5745b2a5660a4c6659f1f755456b03c45482
SHA512 b75b76512cb1f33ac3b62c1015feb381872799b39f79ed754531ef27a0c01ff308006478b874a702e995a5ef3cc5cffa7bf4737ef05659b41cd43dd8b474679a
SSDEEP 1536:hOCoZBK1lsOxM7fv0DKUVj+slo9IfCwkH6zKS8:hbo8lsOxAfUKe74wkH6y
TLSH
T18333021A7CCC6CF71867F5E71B8932259567002C4CF7623A67B906F4796AEACE463300
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008c
Size 24KB
SHA256 c7f1ab381d3c6f0c52968d2d14278c0b107b53a5e154b7381d2a46590e7d33f0
MD5 8b62cb77af08af8a3c92a15d0534ad07
SHA1 a7d15c6d6a8177b229297c54df57bd344b794513
SHA512 3ecf677f8eff0dfd5920b9d2ab8b8de21f7eee62ab429a033b0fae624a6a88718e595a81bfb5dac841f1d67bef8f0d786ba57a5096327cf959689dcecd16a823
SSDEEP 384:ziHP8fq520czx05WRFDagKW0LGE5zX9twpBqNuCxQSBx7eh9nAj751HDdg8Y:zcEfmY02FDagn0n5rbwvCCCo9o51+R
TLSH
T151B2E17C040ADC4CF924AD5E751C3B7B29349AB31FB4A499841A1F09612A0EE1ECB1B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008d
Size 38KB
SHA256 7165713d3e1a610399471a5e93d5677508f62ef072c1151e72273bf4bd54f916
MD5 9436affc97843765a966b3568fa7e5ec
SHA1 7bfda74bb30589c75d718fbc997f18c6d5cc4a0b
SHA512 473ec3a843c33e18d6d194651fe11353fcd03a7959225faeabf8c77484155ea6a7bccb72dbaf2093ed53c408faa3be9f6fc907f7a5ddf8223375f9d09b504456
SSDEEP 768:eUEh2+iKBVQbBhu8vjenqz2Ez6Y/AxHLEaP72sV9qKYbDblXqhP8qwFSE3uk:eUEEoBVQDjeQaLnP2pfZTqgSEB
TLSH
T11703F112148F7FA1C244F224A4EFE416ACC3F565ABA15E6980B8B7C7010E3C657A46FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008f
Size 510KB
SHA256 1470a51ab50b6cab5d0236e3c92c069ad86697b1eb7fcf935886538faa3b0ce7
MD5 4f906e94b3ddae4c90d666aaca69054e
SHA1 797b7fc4bea514aa94c5d5e3808440f3e07edb5b
SHA512 9d08d3f7bd52c8ef2a35b5cbe549cce74dbe62f5f8f8b86c825e762eb4a5470b5c9d54855f23056cc4db8687508e07907a62ec8c93323af8d3b199ca06beb031
SSDEEP 12288:wMyO1V29WuN70Z7WP+qLGlyyOkoP1fF5C4jVMIssMF3uBGEMWyUDEWDY:wDOf2Yu9GQBkQdO2WsM9uBGEMOm
TLSH
T174B42348F7EB44E031EC979EE0484F7795C5D906EE79D3992A368165F0A09074A282FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

65407850592810bd_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\65407850592810bd_0
Size 333KB
SHA256 dbb2ac6e7023709383019ebc19093ca217bae7e1dc29a894c67459d6f79e4710
MD5 ff73b7362d0f92cb641410ddd27a09f3
SHA1 c068b23a028d28309a5d5a3d81f269dceacb248b
SHA512 8fc5fb77725c3faa2f81ca20efe3c70f1285f27171d95c07f169c9f1a57345612a1295a130d7306212244a4d7dc4c7a1441b30ca54d17dd1688f3cbe9611ab49
SSDEEP 6144:MFV4I9yO8NjAmNwz3OdhECAhl/wt5dQnd8SNor2FfHDkjg8vi2VyxTNwFYed041m:YclNKzJhk4KPGVirLeg8BFJMPWHCQxpz
TLSH
T1A174C791A7C96AAECE2793F942A3DE677332405D2FD3E30722E0D7352C192E14E55C4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9ed51e8d7b636e1c_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\9ed51e8d7b636e1c_0
Size 354B
SHA256 7a617df80edff04eb364323c704232fb48da296a3b400a52110f320fc1745c8c
MD5 11359e74186cb9a9f12bf288d58d64fc
SHA1 6f11c78bed9c65fbf8cb3795609396b7b0c9bcc9
SHA512 bf8e898c09665526d59abb9b0b8c3afa0811c61fc2d50ff9c0251ead3f319d9dc4e5fe60ce2b0ebe57b5db8c5c4c0bb8e7582248f4c6f9c8f0f30e4ac30f68ba
TLSH
T1BBE0C0A34A048D12CF3D5238DF1251BE7252D0000C7F818A440CBE6F05849C58A69456
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 2376f9df7d3456b21bbfe3bf4f3dfe97578991f5720bfc46fc6ed342e42d456a
MD5 6e1d2d7751bb5ac47343e9d12976f497
SHA1 7ffbbd76f75476e37259faf90c835195adffde97
SHA512 3b05249ebc969ba6526b07ec4e4774470301ba22b9901c245c4933186ad27ccf7c476a204d4a8707268223fae33ed00793885ff58c2b4637fa4af031e6b78eb2
TLSH
T14E719077CA11C067FF9601B298C302D974BF88ECF0034E5E8113187E3318B29C1AA798
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 3a186961d2318b691b1b0df59685dd09a5b04d1c96866d03b137c5db24f68e96
MD5 13b5c51011e18fca588187f317e83630
SHA1 aa5f008e4a64aa310f8871ec256845ad23a90211
SHA512 1aa079d0f29b8a05303904d6694de85f2eacc9c20046605b43ae1bdbc8e24668b57b7b3f5739c4aa7b710d024c226d5513104f4ecf768add2c0f2e6b8a9fab97
TLSH
T13C719177CA52C067FF9601B298C302D9757F88DDF0134EAE9153193D3318B69C1AA798
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 773c28d35dbe43209b045e796d44d094b5d0e0d1b1a3ab8d6689413f856dfc93
MD5 5674cc2bf7bb5f1666abcd85cd0dc663
SHA1 cb1efce3481399701b6787bc60c4752ac5fa5fc9
SHA512 e1d94138731b8da7ca411963de3b69fa564310050a2d45ef9b6ded9826315ee0572fa677994195c55976b5bc777096aea7ff2f8d3388032dcf78a09d3eaaa4cd
TLSH
T1AC719177CA52C067FF9601B298C302D9757F89DDF0134EAE9153193D3318B69C1A6398
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 363fb4531a977cb2c38ae078fac4d61ae5fe42416261bd727d7fd88987a380ac
MD5 68180a7958fb307cc969eb2cf8479e78
SHA1 4bd05f2d01cbbe603205dcf60754870fe9bcaac5
SHA512 bc11cfb2a8fcd43fda36b6235d1e9625f9ef1cacf04bf58d8a06c08aa36a87f0615877b7407ddf968b5015ff3d499446a65d1de5b303da2eca25fc25b443e4ac
TLSH
T1FC615C3BDA12C463FB6642B298C301DA78BF89ECF4179E8D1113597D7718B2AC268784
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 a8a646b557e764793986e3279c8684b6b4de16ff286bc32f4a806331876835c6
MD5 2b6c59c138272c91c4a782375ad2698c
SHA1 6707fc09f3a8383c940eb9c156ac4c1fb1a9f040
SHA512 4b6c5284d1c72767f303f0eb4f3a824e95e6b05413a4dd6956a435d4380e22f3160ee0d0ae92c479a3def8c465b5c6ea7cd961463a396db502e06cdd8b99281c
TLSH
T1A281B2378A41C823FF5A42B29CC302DA7ABF89D9F0034E5E9153097E335DB69C1A9384
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 99d3a32a5fda8eab65dad6813063856573bd5a01378ba5375687b4098fbcd235
MD5 3904a7959a736f27438c609387232871
SHA1 a845fb0503b332c4b0fde39fe4f1fc598edc8242
SHA512 58d43885a3e8e872302be07069538a5899b33bf465824e94883485850f18c6f67c9adc0c380f01d8bb453148cb60895c97742fbd1cc6fb39ac704230a66f2286
TLSH
T1FC718077CA51C467FF9601B298C306D974BF89ECF0134E5E9113197D3718B29C1AA798
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 8567b46ddcbbb5edf9a900d76c757586008257d7b9fa145ea130fc2c55647ab6
MD5 3e34421b862962fcf42cce0cf3176d8d
SHA1 e4ba4e004ff60591139638324418d4a267434d5c
SHA512 b4e5ec4ed22391bcd227cb0fd40f43cc36bf8a4ad37395e78b5d3587d3234cdafea3594db925a533ac362066fa1e3039fdc28ff7123fe45c6ac457ecaac68d9d
TLSH
T1D7718077CA52C067FF9601B298C302D978BF89ECF0135E5E9113197E3718B29C1AA798
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 b87a2ad1ec500f89993f25e5e03e4971e5f39cca3c6efd54024f43681a11998d
MD5 41da5356fa139c4260f4d6aad0dded1b
SHA1 46e2e24ffb7ad916bc07b1500ea8e40e9a0c7dd1
SHA512 9cbde08f49f4c27af282c123edb8c53d79bffc8de0c193b09cacf505b463683ff173be1b543d29123409ecf3696b3c381987e75508d7face1415156644c14e61
TLSH
T1EA81B2378A52C823FF5A41B29CC302DA7ABF89D9F0034E5E9253097E335CB69C1A5384
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe592f05.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe592f05.TMP
Size 3KB
SHA256 b8290cdd08b074dc0569c4fac12ffa9ce8eb44e2dfa4573306b485b8753dcf11
MD5 4181cb8eaa8ceea960bc73e94d0e3686
SHA1 270ca2ec1e35a926dff72ce262fae69dc79bf624
SHA512 0d9e30a5f3704a15b5b9b7359696139f124d4922ba1d3bd2fad14c4e60afb8e6fccdc2a52b47062594bfdb8ea68b664aa770965c480c98ab3c72c15a40845e8b
TLSH
T187615E378A11C463FB6601B298D301DA74BF89ECF4175E8D1117157D771CB29C228384
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 99f908d2a1dfbeb99584962858e861306b5ef322bfc72124873bcf1a27d81d8b
MD5 c8d7445cdd63e0fd5b12823d75510823
SHA1 5449b43197f3420b52f5c65009be10a1e37bf28d
SHA512 40a67e542c5577335949d335dcdffc30f4a9822614d013a71ec118521ae20621a49e323e000040d70953cd1e229214234f6e139a175aeda8bde5418869a029dd
SSDEEP 192:DVjlHEZ8EAQ38OTdG0InBn6P4NVgJ9KjeoA19VDkI5bbVfoVSJIXK12dx:DVjlHEZ8EAQ38OTdG0InBn6P4DgJ9KjT
TLSH
T141227AF7C7E8952DCC1256F49B253F1FCE1D092892183D6BC9D9AE5BA3E2471E20064E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 6da2c585d31315aa5f807181bb6d4a9987caa577f5ef3a5a09e9f43c1c286be4
MD5 381de4eafa4eb94eb03763f933051316
SHA1 9fa14fa0d81e14bcc65f7501330dad23f00bfeb1
SHA512 ecc3f5b0308c13c603c0521ed62f37aa9b052348dccd368f8aa51f4c92eddcc6416b5281d2b889db38ee4f6e7a666a2400781aa0bed06f052f33870a2917e840
SSDEEP 192:DVjlHEZ8EAQ38OTdG07dknBn6P4NVgJ9KjeoA19gWoVSHiFUNvq:DVjlHEZ8EAQ38OTdG07dknBn6P4DgJ9q
TLSH
T1AA127DF3C7E8952DCC5256F4AB263F1FCD1D092852183D5BC8D9AE5BA3E2471E200A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 b233d018f02e430413a248d27175923e0b975cf9b1556e58ff8255e04065186f
MD5 e3d88a4804e544e6ecbb52286cab383e
SHA1 d6f05d6bc864d6f537001a934606d232a48f9fdf
SHA512 85f2bf40c4560ef39f328cbee451a7ad2e2e19ed34054866fdf7ec7950a48be75c3f9dc0be2e52c4f07bcc7969cec6efe44d04d2b1e801d6856aa59c3fd12247
SSDEEP 192:DVjlHEZ8EAQ38OTNvEG0IncPO1DkI5bbhNVcgFuj4XsK5dYoVSnLWOBg8fnunWnV:DVjlHEZ8EAQ38OTNvEG0IncPO1DkI5bw
TLSH
T1BA329DF3C7E8952DCD1256F49B263F1FCE1D092842183D6BC8D9AE5BA3E2471E20164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 111e23978283c8d2986772a3c275d18a65f5ec13eb24e6578aa628324da99298
MD5 2ee41888c71351bbce780300e4f9f0e0
SHA1 f630cf3b5d3d7c70b61ff327636e441766239280
SHA512 9f9a6a5d484bad1a229d0684cb75bd4144a2978752643913527b9b560709a5ee9d3db5e470dd751ed63465805f03895a567a05fc7db68a5f9b1586d3adc6581c
SSDEEP 192:sxZIRBig/fNsx9SOO6eBQIdpVqzHW6+WN80K/YCwwriNaIg4J:sxZICg/fNsjSOOFx6HbS/tikc
TLSH
T16432DA526E38A9379CC7E21DBB19BF53D7F91072A1851E48EAFC861C04E6ADD220741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 3118957db7478bc92d72bc84002f796a96cd135128fd722622057a24ea43a2ec
MD5 70954d9ff84b7d4bf805c2ef4aade780
SHA1 c83fdffede29ac22bdfb4e16f4f74d48bc74da5b
SHA512 d3557589b425ed5de5605d6dcd543ec37ea28d3d607518e1f1df7e976dcadaeec51a6cd4cc7fe1a3cf63c1d574c3f6b343bf7034bfc764bf34e9fc900b7be0fa
SSDEEP 192:sxZIRBig/fNsJ9SO76eBMIdpPeu7HW6+WN9igh0aZ3YAoEZM7G+ZriNaIg5lJ:sxZICg/fNs7SO7FVzHbX3ZG1ik9
TLSH
T13142C852AD3869776CC7E21DBA55BF13E7F9147294940E48EBFC8A1C00E6ADD210780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 9a93ef013959702c33585022565ed2958fb6493727dfb58a7353be0b9f2f953d
MD5 13e0d892e66ab622b66782478d1164fb
SHA1 0487acc61ae0e55ad3a5a284e894ad0d94af8b85
SHA512 2671059f649565c7fe9576a53144d5da4e9cf11f00ced8ed63faca4fc5b87c5330f4eeabf688fdbe7dd23a9b77a631a58bfa429576f081e572f622c77d32b732
SSDEEP 192:sxZIRBjg/fNsJ9SO76eB+IdpPDwK7HW6+WN9igkI3ZqBrb3dTAoEZM7GMZriNaIY:sxZIDg/fNs7SO7FvJHbXv6rbdHik9
TLSH
T10F42D852A938597B6CC7E219B655BB27E7F9147290D41E88EFFCCA1C04E7ADD210380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 7f427165e6ab12e1e829878607e6b8cebe9daad0498154f1a540c201b68aad12
MD5 cea9d15ab539891d54668a96e3c61c2a
SHA1 3bd9fdac72a8325381f6f4cf936ee3f2010a9fec
SHA512 0666d9dc388a52dc008e4db47a0dde203e8a99789d458e66b311ccaf9251c20fdde2bf915ba4f50f8e23a477aac820739a0794dfa69132a8df3bfc68d02c99ca
SSDEEP 192:sxZIRBjg/fNsJ9SO76eBxIdpPs0K7HW6+WN9igkI3Zc8p3dTAoEZM7GOZriNaIg9:sxZIDg/fNs7SO7F6eHbXvtpdxik9
TLSH
T16542C852A938597B6CC7E119B655FB27E7F9147294941E88EFFCCA1C00E7ADD2103807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 bf23bfac66d55ee7a70a40f28603103eef151414a6202ee40875def4d4ee8fab
MD5 1e9251aacad368eeac6a02d07e09e74d
SHA1 e27ccfe3a11451a904a3091cd987924749a685e0
SHA512 2142e2e1ea55d11c1c473ba8b837072972c72819887c6626663c882aa2ffb4d2910edd2cae525674745c885126562903ec989b168f38c75c08c1d59db9b92027
SSDEEP 192:sxZIRBig/fNsJ9SO76eBiIdpPRn7HW6+WN9ighW9f3YAoEZM7GgZriNaIg5lJ:sxZICg/fNs7SO7FL5HbXSfGzik9
TLSH
T11A42D852A93869776CC7E219BA55BF13E7F9107294940E48EBFC8A1C00E7ADD320780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 6fd8e906d175fc74eabbaf86c74c80ae835079ed09b9aa0584c4955f8a68f335
MD5 18d20284cbc933fd71dd91d5f414dc6c
SHA1 4787b44135d59daf2b37853edba405ec011e0f9d
SHA512 ac1ca4ed85b3bab7eb83d5de08d24b40403f1c4b426e7450828b846a90cf0fe015b861a2a605db8299ba44035f0f816b13902e98d64b366634d4abe04260283d
SSDEEP 192:sxZIRBig/fNsJ9SO76eBFIdpPL07HW6+WN9ighsqZ3YAoEZM7GKZriNaIg5lJ:sxZICg/fNs7SO7F2KHbXfZGdik9
TLSH
T18D42D952B93869776CC7E219BA55BF13E7F9107294D41E48EBFC8A1C00E7ADD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 3c443ea30b18dea2ea85e5ca00d31dce2428b07d4fa0d49afd619b81cc5c6423
MD5 12cbd6547c48cefa85791303aa33312c
SHA1 3013be97a624ba71239a365303a722030bde9aaf
SHA512 d7a538296761885746015dfb6727e59551ea5207f52fae17c64ea7da0d5f8d290621a14492cf6155d1b8962054ad05a10bb82f3323ba114814fd62452ed4eddc
SSDEEP 192:sxZIRBig/fNsJ9SO76eBbIdpVqF7HW6+WN96xZ0K/3YAoEZCK2riNaIg5lJ:sxZICg/fNs7SO7FEcHbWz/aik9
TLSH
T19142E952A938697B6CC7F219B655BB13E7F9147290D41E48EBFC8A1C00E7ADD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 27KB
SHA256 225f740f840ac4d0ea466e1ee1710d9a0fbe37be4f50ea9ff5f9c744b4b7749f
MD5 07739b1204a005a2ff8d705ae067ebec
SHA1 ebb9e61f725c15fe62134222c5d4e2de93ba95d7
SHA512 bad28525a971336d9c65856fc7faee7aabf16f57b7c6c35c380c2b89503e093a427cbd004acd5c766ec0e73925a64fac03ff19c01bc5830d1d3c5d6d75ba8ddb
SSDEEP 384:sxZIDg/fNs7SOa66s8qMpRiYnazAW8pZS15posJWeT+/FhWHbixWBKEiJ9:sADg/fWY4Mnc7WeT+/FQHbF3i7
TLSH
T154C2F946A824C87BAEC36D18747CBE37DAEC106251C5CEDA5AECCA1C019D5FDAB07853
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 d6d6e8b387dc60e443230607d70e46a9b2a86e2c901e4af4e30880212417cfcd
MD5 8897d7c09b489189097529f7932e9fd3
SHA1 adf163a80105f2eec58c546fb194079755221fcb
SHA512 66d50dac6da84095d485e9ae9a2b782201cd0cdf9add1fe89e0a54a41f1f25532c0af674c8814c2ac1f80878ebe1cc81c431f32e61039f1cf4f627ace619754a
SSDEEP 192:sxZIRBjg/fNsJ9SO76eByIdpP3tKvHW6+WN9HtmI3ZAAJ3XP9TA2HmM7GKNriNa9:sxZIDg/fNs7SO7F7iHbLR9Jn/pik9
TLSH
T13852B852B938597B6CC7F219B655BB27E7F9247290D41E48AFFC8A1C00E6ADD310380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 bcb3059b71b4c333a0eee8407b8db1981501be8465bd4c93249ceb524f3947ef
MD5 5d8b5d6981b429e63a455ee5f0d72e3f
SHA1 9ad74e909c71b119036977d5f0a5d0c2c7ab02ce
SHA512 3b80053e5e52ed5feaf030059bb11943551c749af6a99022e0bf2343b2df5603da87216ac48307d259e24999b77f099bfbb18387ba12b9e85115d7f3af8fa562
SSDEEP 192:sxZIRBjg/fNsJ9SO76eBrIdpP3tKQHW6+WN9uFGI3ZAAJ3e9TAOnrCM7GQrriNa9:sxZIDg/fNs7SO7F0pHbix9JK5ik9
TLSH
T18752B752B934597B6CC7E219B654BB27E3F9147290D50E88EFFCCA1C00E6ADD620384B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 84eeb75d491bebf00973bb13e6ea447523db896c1da60198d30f5da6bc0b8a38
MD5 55529ce62ed5d2c2284939bf28d0d770
SHA1 29d09663f2ada74f06ea016345b03c157e6ffed0
SHA512 894262199526b49e182f863c8546802ac07ed63b3467400453d072f8b5edfe6bf5ca89aa18dd3bb3b2edea603ddb396d34d4095a8871ec6ef7741aed7f890307
SSDEEP 192:sxZIRBjg/fNsJ9SO76eBWIdpPs0KvHW6+WN9HtmI3Zc8p3XP9TA2HmM7GBYriNa9:sxZIDg/fNs7SO7FXaHbLRtpn/Jik9
TLSH
T16152C852B938597B5CDBF219B654FB27E3F9147294D41E48ABFCCA1C00E6ADD210384B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 337454cc0955484aaed14c840b39008efce69e9aae0c663275dc50d1eb62465e
MD5 a2b0121341249bfd9bd56935f2e70b4c
SHA1 9e0b56a4295843a223bfc33135fbd031f9dcf80a
SHA512 444c07316287759e22b9a877a4a23c2dddb70e8dfebb19361ddeba3dbb457b88d3c0eb715aa7719650dbb1bdfcc782695d856ec887d615125aad05a23f8cf71f
SSDEEP 192:sxZIRBig/fNsJ9SOO6eBQIdpVqzHW6+WN80K/YCwwriNaIg57J:sxZICg/fNs7SOOFx6HbS/tikX
TLSH
T1DF32EA52AE38A9375CC7E21DBB59BF53D7F91072A0851E4CEAFC861C04E6ADD220741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 eed104f47225209bea8b3b78865375551ede9b39721fb9a52f54f2717254b8a0
MD5 0c022901b22d0851d8b29c5ffcfe9898
SHA1 3dc9c5260f3ed6dcbba1124bf0d67a74a0276a48
SHA512 419b449a50cf7bd5a15263943abecf394b6d007cc21b9dd86ed3d3c5c0905d543467fde1c22fda804b1678a8a65f0dd22cf18bef81fd6bfda5c06cec163fbd68
SSDEEP 192:sxZIRBig/fNsJ9SO76eBnIdpPeRK7HW6+WN9igkI3Z0aZ3dTAoEZM7G2ZriNaIg9:sxZICg/fNs7SO7FofHbXvPZdhik9
TLSH
T1BC42C952A938597B6CC7F119B654BB27E7F9147294D41E48EFFCCA1C00E6ADD210780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 45899189ac4efc3adb35ff1b89bf01bb4f8cc28ea5609b5975ec1bb5a6b7969e
MD5 3b4362bb63a7fab07aa6e69625560a0a
SHA1 a8944edab79b1fe3f472c74fc144ea169798c44f
SHA512 2936e0dc6f1bab4674251f9a6a6650c7202c54524bd129665be71fe8f3771e391eb7ca003713b8e6342d1b80b45d347ceb4bc9939c2af4c9de4e04d38ca22c10
SSDEEP 768:dbqbUkO7pLuLze+WvSCs68F1+UoAYDCx9Tuqh0VfUC9xbog/OVGqaZLlRTKryro+:dbqbUkOEze+WvSCs6u1ja3qaZLbWrp+
TLSH
T18DE20A3B380CCA7E4F804E9DED1A7F9B6EA802CB9698C94447F9945C02C76EA51170DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\dfa4cd3b-6396-44b1-9341-22ecfa35924f\index-dir\the-real-index
Size 360B
SHA256 e9487c5dc240bda8209ffb31c7a12fdf582f7699821a5e388126f2dd4bb2b587
MD5 7df40eaf930a8db355e49f86cd42977b
SHA1 ae6468f7d389f5171136562b84b52c8d5a15cf08
SHA512 84ea7df9060cd4e57bd224c350fbd2177529f429d235719a22f93d3b2d9e4ba034edadf4a5722e8b7c773193121a2f6df0d78aece4f50afd788eff5c2797456b
TLSH
T105E02B114ED1082ADA205EB5147251ADB3F14CFCA611984E243DA6BF2C1A35C54162CC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5d53d0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\dfa4cd3b-6396-44b1-9341-22ecfa35924f\index-dir\the-real-index~RFe5d53d0.TMP
Size 360B
SHA256 a2050ec7ca7d59b12c731ea16ef90a30ff384c3d431afe006cdef2d3324abc96
MD5 36018a821bfd0d6f95b3acf4eff6d1e4
SHA1 37906fad8f79091e79662639a38516c6c783f8a7
SHA512 e30dcc2ff192302419066816dd3e59158698f0357b1cc5f1c1bbd8cd934f266165b30e1e5cf973786c86f968a85560e4565a8b931457961cf79a861ce628ca9d
TLSH
T1AFE0959487420621DD200677251155FEF3B4CE607531F98B347C696E2C2974CD5521CD
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 aeb95789587f6ee9ecda4116fc6b080a0336feaebc0c2aa4a7291e2542e6707a
MD5 7a554dc0b26a21895ac20b06a8bd455a
SHA1 68d4911d170156040179a9f6f3647684f78f3098
SHA512 ecf0e8f62e219ac5d1e4a1cbd4297de88db05bbf6ca52cf274af380ae636a457d1ae9450da6406940f10f70da834c06077d652a7200b6cd244abf43a46c05d55
TLSH
T117E0D8BA29E72860BC7BA3F5247148E002597998CD86BC9E1069A2D750B3361285AC61
MD5 SHA1 SHA512 TLSH

Submit Download

88eaaf5ae55d808f_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\88eaaf5ae55d808f_0
Size 255KB
SHA256 008c3c706ad90ebd530c0a4dc8e684c34634783530cc0a6ff41b62e3e8e374a4
MD5 1b3b723639450eb81a76ded5dd0d42e9
SHA1 40fba64ae6efd6184d363898b5252db5b3342e9b
SHA512 ac27d6b254586746ad40ca0e5f1ea13c308613cfe0f1071cf743b5332a63bb88da2f172fba33d1a2295b921b8904f0bda7130ddff4816a3ce72ea9e807cecda5
SSDEEP 6144:eJ+FUp9fMuss8L/6rC/LhgP8+Md98biEaE2uIGmV5n5u595BnQkwPPv:eJ+FCSrs8hb8eEaErIGmX5ofBnQkEv
TLSH
T169447E723300B53FA8278EA5E67E7F4D3829F217DD2706B8D6E4E9358BD2DB61012548
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b4ddfc033e365b6f_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\b4ddfc033e365b6f_0
Size 1023KB
SHA256 91af15992df9f4e969cc9b78384e9bdd0dca21180fcdd6fc31abd001b441b8a2
MD5 6cce633827667bc59a9e2a09fa103172
SHA1 624ccb3a90a0df2cd9527aeb9cdfe850934bbcff
SHA512 fc05f240cbdcda07e903e409c79553e4f9d8b26e72173364ef989fe3391c71dc3903d0e5093a51bcba4f9ddd30e1eaedfcc133a402000bb31480098d2f0c45f6
SSDEEP 24576:iZf5bDY1+2dPObPSa4wlDRcCxekVGMKIz:iZFDY1+/PSa4wlDRcCxekVGMKIz
TLSH
T17B253CD873A2B463A375F1A4426F42C7F2AEE892B449886CB598DCD12E74C5540F7F38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 19ad3e028d5704b3d748dd3c0c9c5e7983402513bce76cb952ee4dfa4fd9c2e1
MD5 47d2f1ba7debe89d1e42a1ef67dc9766
SHA1 aea68e41e230a90066d9824d94b5f4577bcce4dd
SHA512 eb45b419c9f88a7aab9e2349f0389f9d395bb94168e92ce68dd314a473d16f69e699d019bdc850ebe0d6c9957f024e1c5805f6a793604fe9b1b5df32552bc338
TLSH
T1D6A00258055010A1D948127C51D305A062704C53D3914E55489285C98CA06545261D08
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 2c27907881ffd971cba264fd90b7f54727daf92b6ad48124d2187e6b4e09d692
MD5 3dbcc7f4dd6bd94fade71562f6748fa2
SHA1 5fb9fe7e60cac50f05bd272c806ab76675dfc654
SHA512 e8787359cebc4c3a9d1369043b6e339aeb584121e16bd8b5d08079712b1077fc7a90b0e5a8cf6197083c191db9745658eaf7b02ecaf5377f253e18efe4c5b700
TLSH
T11BB0025C43302A57E245737DA1D247917FA80DE7D393890FD992D5D4B4602507A67918
MD5 SHA1 SHA512 TLSH

Submit Download

e5cae590-9982-4250-8a8d-e1552e340bef.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\e5cae590-9982-4250-8a8d-e1552e340bef.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

office_endpoints_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2026.6.5.1\office_endpoints_list.json
Size 9KB
SHA256 f0c77aaacfc571e0bc3f51387febe134d991bf3c7f1941af303ed901f288dcd6
MD5 30719122f9edf4e23019a3b74e4f4325
SHA1 6707d64052797b9c5f1a5ccf016e5859c8ef898b
SHA512 ec2e1a33fcd1301f282512ffafb611ea705dc5df09d9aee014276909c1b62b0c73600121d94e9b6d9e160296672b41f2cb8c3ba23f121244ad2ea6521680723c
SSDEEP 96:DdQ/JJvwjyUsrdfsysVsnQfbJNZidYusysXYs2sFsdv12XvlRT07s/DkhcrHPglW:D7d7mfgiIWRcV4sobxezQd1Y
TLSH
T11512BB3BC4B49F229AB060659705E244F13C43BF5600C6FF76B9829C1F366ECA58E1E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 085542b976cc7cf2d34c5257b37966e50e5d9491bfc2392b8be4c6fb5385b228
MD5 2188e22386d79a707791b69e37fc0258
SHA1 1bf1fac6dff6a1b614630338223c9232bf8e3685
SHA512 d5411b7b83937a44f769bc15d8cef9b75482f9000d653995b437f32e4fe16af56e994d5900eb0f31e1c3aa7292b02bd25dfc7a39db4ef76e98b30435d639e773
SSDEEP 384:ngZcIhsNbM0etUjYmEa+edyj45YOOPrXLpe8C/h:eh8s1a30cuOi9Pi
TLSH
T16F927D316C786D6BB9F7BA95F98636139FF89063E6C92B44A5DCDB0C00DA5680307C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 31KB
SHA256 a48b3c251396ad0de3f8b776eb8ec4cd79fa443f921c8b148cf420b16549223a
MD5 f0cd58192c254360fe9852357b585084
SHA1 dda8a88f44db3da925cbcb2b6267b2394c438ec3
SHA512 20678d88f6d3090efce2775fe94020632c01cd1162271dcdfe77b8219fe50ba9f5ddb83b4208b3e2152a544d2b53593d4ada7beb169c897138963828d7a9563a
SSDEEP 384:nsiFPZcIcsNOx8TUNTUlIRhBtUPXmaffRxa+edyjc5YOOPrXLpe8C/h:XFHcjxwg2fxa30YuOi9Pi
TLSH
T1E2E2B4F198D79937E8AE5B87A77D2D428EBCC153B5885984B7C84D0CCC961BFC306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 717a6c3c448bb5daf2b622934e8c32f196d3523bf78a8b46313c352f58b987db
MD5 22436a85fb409cea79bee43b8747dd2f
SHA1 c83fbf58673cd1b1f36d0eb8da90309867599702
SHA512 385651ea849c15a0fd4483e53737ee8db9a4c393dedae6d900d4a2f61036adb1780fa01b6f61f2a69a3a13601e2759eb2f988ba22f6fc71aef15a8984c2d3d7d
SSDEEP 96:EqONkiQsjpf1bxX5ih/cIPURHl8h4otop5cnDhBfPgvE5BzatIRdy+0Uf+FdCaCM:vONu6Db6QmiUyYXHBa+jN+FdCtRgppU6
TLSH
T15202E73568786CBB9AF26E49F48B37275FE4203BD99A2B54DAD85F0C00D764C2307827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 b820095e7b2c413e1cd310e9e5d6c91f23eece0eb54307a2a488fa84f6f6c003
MD5 ce46542fe832798e5c5cfd8e6e390d78
SHA1 331a66e8b72379c068159ea30363b5064d116f14
SHA512 9ae8dcf8681f50ef82ba410c68570cdbb7f7eb460a2f814c73af68cb944076eecc08133a83251e93219adb4c73fdda7db46ace8ce21be942c5e078df5c41fa09
SSDEEP 384:ntZcIhsNbMdetUj1n2Ea+edyj45YOOPrXLpe8C/h:1h8Enla30cuOi9Pi
TLSH
T112927C3168782D6BB9F7BA95F98636039FF89063E6C92B44A5DCDB0D00DA5680307827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 31KB
SHA256 e8a6e51850d01e91b82207a8f63255a1b5d594d39f65d2e70e14b40de363adc8
MD5 ddfb6dbaa9191621601fdea1d9c09ab7
SHA1 08342b5b576a1063dbcfb33317fdef31df8efbe4
SHA512 4ff8105f4a7c718eaa7dbffbac7364d00aae0459515396d3ccb071e59d66f09b3779a51fa78c4d9a43208cd0319400c108f3ebe8e9b787f04034826f9d168088
SSDEEP 384:nsiFgZcIcsNOx8TUNTUlIRhBtUl0iaff+xa+edyjT5YOOPrXLpe8C/h:XFecjxwgb0xa30HuOi9Pi
TLSH
T177E2B4F198D79937E8AE5787A77E2D029EBCC153B5885984B7C88D0CCC861BFC306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 31KB
SHA256 78645cc27ee532a3fd268e4065a14d857b33a9dab8644fe29388fb3fb0dbd030
MD5 1ecf8d20903b113d91d311c5148ce42c
SHA1 291aa0665d05a91e1f1ca907d7b9612aa35b1440
SHA512 b3545e65cb8d549973b57b97949b06df90832ad12dd54eabf51ea2f3f9aae43b0237df0fa6aa1eb3d16c3a50c362a129b5faa1a2da629dd060b7d1081c776d42
SSDEEP 384:nsiFBZcIpsNOx8TUNTUlIRhBtU1giafftxa+edyjI5YOOPrXLpe8C/h:XFJpjxwgrvxa30MuOi9Pi
TLSH
T1B5E2A4F198D79937E8AE5B87A77D2D029ABCC153B5885984B7C84D0CCC961BFC306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 31KB
SHA256 a45751dab4a69ad66fd594ce45c74a7af69f693c6aa061971f4e09bad6291b11
MD5 cd48078a43611716f692c9e8a7e87971
SHA1 a6e3e8e6a81b202f75c153fbb768f82390ea97cb
SHA512 a1da6377de7578120032c6856baab35cb639e8d1d73816d9ad1662af2194fcf8e02423897f9bb826f47291b68c27927a64878e051f75e2a06eb21c9eacf27805
SSDEEP 384:nsiFAZcIpsNOx8TUNTUlIRhBtUKy6afftxa+edyjT5YOOPrXLpe8C/h:XF+pjxwgynxa30XuOi9Pi
TLSH
T1B4E2B4F198D79937E8AE5B87A77D2D028ABCC153B5885984B7C88D0CCC961BFC306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 31KB
SHA256 2082e9fa0ff09f8e3da7c2bbf87278932d9f8fd493633a7cee1ae66b8c37d258
MD5 187675326f03de8a5023abcb563c8786
SHA1 7ef21f94ffe71c39c774409be5f11972d4bd8c0b
SHA512 96cbfdcbd0f5e1011efdfecc8e912baf2ee01b8d0fcb3623ec1aaffe0689dfc9f87afa307df77b0309e3405e8d0525c635afe909db9b049fa5130bfb96cd0472
SSDEEP 384:nsiF4ZcIQsNOx8TUNTUlIRhBtUcFYafftxa+edyjj5YOOPrXLpe8C/h:XFGQjxwgzxxa30HuOi9Pi
TLSH
T1D7E2A3F198D79937E8AE5B87A77D2D029ABCC153B5885984B7C88D0CCC961BFC306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 fe3a310f54fd857f936962f6576c1b8cb4eb9f31d78f1aa52a46eb53ebc949a9
MD5 35992a4279a7298df965c626aa75b723
SHA1 2d5630d40727f93ac085f6954c33c2f45c860acb
SHA512 5a6c877733fddcb4c33d8a5758b3026875870045c29ef650ccd06ce71efd987eb72f9b07b2118d338a1d0a72f802c3f015686992c488e0d51b0c1480e98a12e6
SSDEEP 192:uONPp6DbNQmiUymXyBa+jN+FdChHtFSNz5Crq4U6:uONPp6jlyBa+edyjm5YU6
TLSH
T12812183668686C7BADE27954F88736139FE45167DE8E3B40D6DC5F0C00EB66C2307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 31KB
SHA256 cb1396a6e1f3626a7674cdcdefcf3e8f0fc5ee4d4828f9d9a104c58e5e511054
MD5 7136d33da7020e88d62ef14da248f268
SHA1 a98d067aa87e1903058485a5cb2ec8e690ddb41e
SHA512 193b281bea60a84fe34b93f0ce70e38b117459f91773c9bc5ad2942f7999a49d4d9f838d0758d97a3b633fd5e8f6e001a5940ae9291c697c283217227d20dbe4
SSDEEP 384:nsiFKZcItsNOx8TUNTUlIRhBtUPXmaffRxa+edyjc5YOOPrXLpe8C/h:XFotjxwg2fxa30YuOi9Pi
TLSH
T15FE2B4F198D79937E8AE5787A77D2D428EBCC153B5885984B7C88D0CCC961BFC306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 31KB
SHA256 69d0f2e51fb21079c8d7ffff6492c5d78197fe6f6255966554ff8bd79d0e87f2
MD5 6fe1c5cae717374abfec810dbaf263cf
SHA1 ce228869f58e5bd06a52c53762cb2194554797c4
SHA512 4f3f31ad045bc985333b8ba1365a1eac9ae1be37e3498a419e95342c4f9c020d62f9d28d37c07bb3e57ae1e68a1b9d409064ea1bb3ceae866c7cbbfb849770da
SSDEEP 384:nsiFBZcIrsNOx8TUNTUlIRhBtUBTsaeftxa+edyj35YOOPrXLpe8C/h:XFJrjxwgsWxa30ruOi9Pi
TLSH
T122E2B3F198D79937E8AE5B87A77D2D029AFCC153B5885984B7C88D0CCC961BFC306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 dbf28a354a81233c30c01d8e9eecbbad61ff38ae7bafe8e251dea598b90ec466
MD5 dcbac91b1d6dbe9a90202ceac493e0aa
SHA1 deed4581c0ac0ff9f33684c1a6a89ac330531252
SHA512 3d71f14cca204837f3ca060f81c2515fdcadbf4ee6c28930240bb90b25f486c0f7ad327000b208ce6db41612a8b05ec1e0b361653d9b8710d7071b5e9e8f96b1
SSDEEP 384:nsiFiZcIYsNbE8TUNTUlIldetUjuaaDfwxa+edyjL5YOOPrXLpe8C/h:XFQY8Ewg+yxa30HuOi9Pi
TLSH
T119E2C5F198D79937E8AE5787A77E2D429EBCC153B5885984B7C88D0CCC861BFC306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 7c199b6f579ef872ddbbd8a3fb0114ec3dee576e4cfcfe71afdf077a2356b72b
MD5 d3a0238a9285c9fa3804ca3c19ac8d1b
SHA1 12091a698be1b1e356834e250579e6d4ecea4375
SHA512 3cce0417f8608aefba4ca3472612a19e673d200475ac257ff2073313f98c52bf0558da6034027b0a7c77567ffad61793e8466da83f8810bea8f2251a9f8d103a
TLSH
T1B3E00902930120AFE8280B3010C32F203FF2842507B34666AB34017C2C3A3053E21B80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 13af208d4552971293de45f3577b4774409ddbb66beaf1c9997cca844bf6ff2c
MD5 14f9be0c5d65e3f224e01ef751dbacd6
SHA1 4c484980ad365ba8ed5a1a5882f555ec8eb8217d
SHA512 ba5e11b7dc24bbfbf358325df9abb3730c316d39827496e38253d6010b98ab283d4587be1bf5b101dacd8d73d8c2c432de4e3da7e88b2058ddef3bf1c41ad317
TLSH
T186E00202534010A7C4180B3010C317103BB1801007634255961401781C263012E11540
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 0be17b42eacb05f825bde27c6488c7d16debc6796a84cd9c64f5ef7d3391594b
MD5 c65669e704bd7f36775fe0886d1bef1d
SHA1 5b7a115a94b97e4037057a0216d81f110da3e80e
SHA512 2577a2bac5ebdaebdc4bd13079ed378d1fb2e3ffa3cdb244e059e1f856b0ffa19c192e038c369d661fe433b1b49b9327b9b6263f39192a6e0f9de438d810aba4
TLSH
T178E00402E30561AFE9380B3061C76E303AF294621BB7476A9A24057C7C2A365AF62BC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 8c21bf9d1f377509ebd8f2d224b0a109ed749d311d35b8ce671ea95d0ef638af
MD5 dbef8b6a6ce956acc7e1a82d16764476
SHA1 d457ed134a2316f96f404bae3ba14e9a943397ad
SHA512 85ac8b49d0356a47fc85236d612c1c63500778c461724178e5d3d165869db4ae9187e7d19a6772dc6601f0e6f19ae889868423fa18eb4d843ac46d032dd31616
TLSH
T1D3E00203930130EBD4280B3010C31A2037F28420077343659914017C2C173051F11780
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 9872818f627cfe865b18b0476d26563b56b8d7e89548da26e4540c87e7e1fff0
MD5 85adcc8136769b882ed156a4e9aa9d6f
SHA1 a255287669e25febf4846c4a9b95e8eb3653d9aa
SHA512 44b053605f2232a42c81b3269175190212fcf86e9a41e5f635fe397ae867b2e3d78166b1f43bf164b86304c56e04af627efc13da100fa761711f4b83fc0ec4cf
TLSH
T13EE00402A30160AFE9380B3060C36F303AF284220BB74666AA24057C2C2A305BF61BC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 678b52f4b295bc23a416df93e8f606c5a709272ee148c3abde1235d81890b62e
MD5 630b53b1a1ba0684b93ca3fbffddcede
SHA1 6912edee9b45fed5f9e5b0029a1210dc2436d8e3
SHA512 cbe4485ad7303c4474ced3673a5f281c89b546ac5499e5aef3841fdf197fabcc5cfae9aaafac726eee154ff9a9047c02e7e4782817443673f7dec4fc037c2c33
TLSH
T108E04802D30020AFD838073010C31F303AF2802207B3035A4A20003C38273107F31BC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 97355cc7075f026b258f81ff7fa8bf13fb11d85186a6129b4b0d4679d8bf1360
MD5 69541ff318e0511fe4e3a0ab46884a04
SHA1 e6bf77a613786f819dd7057420bfb36cc02e497a
SHA512 3fad3ba5bf9f354937b3e2321235d561604bd4e8757082d067f144473b251e7ec09683eb6681d095f2000a6d7c9fa3d5e63f88eb2c7c431fe98fc8deecf926f8
TLSH
T15FE00103930020AFD828073000C31F313BA2C02207B7435A4A3014383C163646F20AC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 bfe2532075e8b8f4e0f27a194af4ec21a722072b77a2f5ef430b037c83d44aba
MD5 f5bdab3d68d9b146b7127c2f8e04bed0
SHA1 a86217f3b1dc80238c498081d109157e1d21d8f8
SHA512 33caf3fae9834d0b29092a71f3adf8beab55e13653581923fadeb87a65006dbc24570327dc67b4a3427ccb78f80aa12a6f81d289784276336cffc9e04fe07714
TLSH
T103E00103930120AFE4380B3010C31F203BF2842007B347669A24017C2C263052F21AC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 c39d5321245a28644cbcba3fb5c867a523622a55cd42006e3cc27f886faadc45
MD5 74ac0f7a7212e509863aa3fc1d2b1de6
SHA1 e7b6bd3b068c49a1b62f39f5ce1b978f49d7f2f1
SHA512 acacec244b228cef3cca32566d98d5743506486683a92693e66c67986a59bd0ad45e50a0c769d9dd64a87c95746514845067a6ad87a8fdcb3fb08377c36c6fa0
TLSH
T1D0E00902A30160AFE9280B3060C32F303FF284220BB74766AB24057C2C2A305BF61B80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe59a6f4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe59a6f4.TMP
Size 392B
SHA256 5c8e7433f751d737e50b1850978cb557e74865709114dce8497b2bba56b17dd7
MD5 3902676172e469104c0701b194d21625
SHA1 359c25b9bc916ba19cabfa72ca688b4bc950a52e
SHA512 a5c9a48fc06b122e38537def6c6b7e263cd37a04e980f7980dae6c250f87a36dc8b0c3212df9b4ebcd5727b0877e89a94d016e26c760be958a20bf32228a2b5f
MD5 SHA1 SHA512

Submit Download

keys.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2026.8.3.1\keys.json
Size 8KB
SHA256 3d6c659801f1686ff3ac64bc3b24b1d0ae76ffdd5f0e9c399ba37d1354a15ab4
MD5 ee666d1b2290efa6cdbc89ea3d317333
SHA1 a8bdd2c1d7e76fef48a735a80524243cd453e0bc
SHA512 7b2b577c9a168f626a687ee158cc20fa0ad0f816fb0583abfe45f89222d1762eb4fc619e029856618479fb6096a02eb2f9934cb46334fa781cea5cbcec992ee9
SSDEEP 192:uNtGbR0m0GflPAyR9Pm4lOvMwkoR9PuGMXcy:O7mZpKjA
TLSH
T17F02B6BF14A41182CE7FC16D9F0774B78FB03C066BCA3A83925BEA49484196D173B5B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nav_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json
Size 2KB
SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
MD5 499d9e568b96e759959dc69635470211
SHA1 2462a315342e0c09fd6c5fbd7f1e7ff6914c17e6
SHA512 3a5922697b5356fd29ccf8dcc2e5e0e8c1fd955046a5bacf11b8ac5b7c147625d31ade6ff17be86e79c2c613104b2d2aebb11557399084d422e304f287d8b905
TLSH
T16B51DB73D5988C4B9BF4A29CE919A309F11107CF75D48C0B76BE010C1F7757AB5C6588
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 612B
SHA256 918167fab0fb4435546513252415c1a2e44b6e8e60caf6f31d07587ba0a71ab0
MD5 5ca920f0e1c81dfb329b916e242a4065
SHA1 1d068ad79883fd23c27647c98e761858e46f48cd
SHA512 2b99239123f922883dea3137835bb8b74713799981e5aa1434ea70db85e7666f2372db684f94bb599ecff70c8c31d02286b0587ffe620333eb1d4bbc7feb84b8
TLSH
T11DF002D04C3E19C3D5B90E6EA40717EC50D45517B0D8383804CDE894D07A05E315183E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 852B
SHA256 cc631188ae4a22c0621e596be3d4335218373ee3aafe98bb7b213069a0dc3b70
MD5 1a8162cc03c34509f59ea81728419884
SHA1 459f726ff17ed37a212bf5291cc592b4745c3c06
SHA512 129393fb77432dda8e2c4181dc778f609f56572e69213f9f8cffc544b845119929242d41078170b2dc72a678116df340544edb181c2aff069f8cd4ac2a541083
TLSH
T1E8011ED14C7E1AC7CABE0EAEA0872BEC44D86522B098347818CCF864917940E3451C3E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 732B
SHA256 cf5e5467ab3de71fcb419acbbb754c3effd5e787864ffa7c767f24ff9bbe5ae3
MD5 87299a8105078d6252386ba9d333ff05
SHA1 c43e027b4174d2ae2c7f138de07b18ac0407148a
SHA512 f6678cce079ae97838bf5aebf3c195a2c82d27dd6546fd7e5428396130ca4bd2c809f2d2edca4f130da479624c3418beffe998ae1a032451706b9a47bad62885
TLSH
T1670110D14C3E1AC3C6B90EAFE04717EC40C89512B0D8387818CDF8A4917A41E345182E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

e248907f-be97-4978-a2ef-bf23c13f4bbe.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e248907f-be97-4978-a2ef-bf23c13f4bbe.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 542e7cec7f609ffd76a24396e1429b44e1341cf9633b75766f1841f29366c0cc
MD5 ed0c0cff1c4d936d83bbfd2bf58f0851
SHA1 4a36f3c56ddc3d183c4808a1f2162d8e697a8fab
SHA512 f3c40d3935bd09bf6f86df5e3151fee13d88bca4c3b03cfbdfa58480e1da8e30e0dffa8c5e3a25dbb838034be7a59742c92e3e3478348251efc10b2950dc1794
TLSH
T17F410B5CA6FA1144B377AF5AAFF6A46D487BB9372E46D49E10010E4E0673A40CC72B37
MD5 SHA1 SHA512 TLSH

Submit Download

0c8c9bc5-f482-4f27-9ffc-bc1ea427afba.tmp

Path C:\Users\Admin\AppData\Local\Temp\0c8c9bc5-f482-4f27-9ffc-bc1ea427afba.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

6f6fd62f-b920-4087-8d39-4e538d7c5084.tmp

Path C:\Users\Admin\AppData\Local\Temp\6f6fd62f-b920-4087-8d39-4e538d7c5084.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

671ca32c-e939-4c13-89b7-06e2308afa6b.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3948_1347240775\671ca32c-e939-4c13-89b7-06e2308afa6b.tmp
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3948_660816478\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\x
Size 11KB
SHA256 3c8cea1a86f07b018e637a1ea2649d907573f78c7e4025ef7e514362d09ff6c0
MD5 1882f3dd051e401349f1af58d55b0a37
SHA1 6b0875f9e3164f3a9f21c1ec36748a7243515b47
SHA512 fec96d873997b5c6c82a94f8796c88fc2dd38739277c517b8129277dcbda02576851f1e27bdb2fbb7255281077d5b9ba867f6dfe66bedfc859c59fdd3bbffacf
SSDEEP 192:Ljafl1gt6iUq/l0ZQjGNxYoanyJfjvB0BXmqqTZhXBnaRL9znQ32z8h0:L29mtJUui1any9Bn/RaRL06
TLSH
T12632BF3332B50E131E1037EA9D1BA21B8CF551377B2B1E35D1118EEAA1EED66D283B54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\x
Size 4KB
SHA256 45f18ccd8df88c127304a7855a608661b52b0ca813e87e06d87da15259c45037
MD5 214f98cb6a54654a4ca5c456f16aed0a
SHA1 2229090d2f6a1814ba648e5b5a5ae26389cba5a0
SHA512 5f058b05f166e2688df7b3960e135ada25bbcdfbb62a11da3cf9e70c08c51e5589a1e6ca2250318a694d27197f2c5ba1028c443831c43fba2171ca8e072e9873
SSDEEP 96:2OfjuOV4dI3CMQYGtWJQsRmWZu2Ik6iUqLplsQuK0sIF2jGM:Ljafl1gt6iUq/l0ZQjGM
TLSH
T1DB918EB6A5B89D076B4133F59D2B349F6CD4653B794592498810CCB904FFC0A81CAF38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

x.js

Path C:\Users\Admin\AppData\Local\Temp\x.js
Size 448B
SHA256 aa01b8864b43e92077a106ed3d4656a511f3ba1910fba40c78a32ee6a621d596
MD5 8eec8704d2a7bc80b95b7460c06f4854
SHA1 1b34585c1fa7ec0bd0505478ac9dbb8b8d19f326
SHA512 e274b92810e9a30627a65f87448d784967a2fcfbf49858cbe6ccb841f09e0f53fde253ecc1ea0c7de491d8cc56a6cf8c79d1b7c657e72928cfb0479d11035210
TLSH
T148F0DC1CD210E3DD40B3138E2888E6D892872B5D790BF5771554C0CDD027626126EB8B
MD5 SHA1 SHA512 TLSH

Submit Download

z.zip

Path C:\Users\Admin\AppData\Local\Temp\z.zip
Size 8KB
SHA256 44c1857b1c4894b3dfbaccbe04905652e634283dcf6b06c25a74b17021e2a268
MD5 63ee4412b95d7ad64c54b4ba673470a7
SHA1 1cf423c6c2c6299e68e1927305a3057af9b3ce06
SHA512 7ff153826bd5fed0a410f6d15a54787b79eba927d5b573c8a7f23f4ecef7bb223d79fd29fe8c2754fbf5b4c77ab7c41598f2989b6f4c7b2aa2f579ef4af06ee7
SSDEEP 192:egFudZs7gU52m4qi2hvimtucysYSM3lRNm5wy2k89QPaNmCpCfAKgW:SdZs7n52mbFimtuckPXEKyuGSXCfAKx
TLSH
T11402AED2B15ED3C986DAA1BB449D46D221105A2B2F3DA914CF3D83C73C6D3A6744CA1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MEMZ.exe

Path C:\Users\Admin\AppData\Roaming\MEMZ.exe
Size 14KB
SHA256 a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d
MD5 19dbec50735b5f2a72d4199c4e184960
SHA1 6fed7732f7cb6f59743795b2ab154a3676f4c822
SHA512 aa8a6bbb1ec516d5d5acf8be6863a4c6c5d754cee12b3d374c3a6acb393376806edc422f0ffb661c210e5b9485da88521e4a0956a4b7b08a5467cfaacd90591d
SSDEEP 192:sIvxdXSQeWSg9JJS/lcIEiwqZKBkDFR43xWTM3LHn8f26gyr6yfFCj3r:sMVSaSEglcIqq3agmLc+6gyWqFCj
TLSH
T180624BCFBE204417D8F0C57530659234DFBACABA1B968EDF9CF91E529AC4C072823265
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

note.txt

Path C:\note.txt
Size 218B
SHA256 8e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270
MD5 afa6955439b8d516721231029fb9ca1b
SHA1 087a043cc123c0c0df2ffadcf8e71e3ac86bbae9
SHA512 5da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf
TLSH
T1C3D0A719040784251C7052D17145A5A09B70562D77F626EB74DC690C212700F0B37C9A
MD5 SHA1 SHA512 TLSH

Submit Download