hxxps://skinchanger[.]gg/

Analysis

user interaction
yes
max time kernel
52s
max time network
75s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
08/09/2026, 13:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://skinchanger.gg/
Sample260908-q59lmacm71

Score

8^/10

discovery persistence ransomware

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
168	1696	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1696	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134333491259411410"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2684263265-1628758615-802431902-1000\{74B93C12-19B0-481F-85EA-D723DE96B8BA}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 51 IoCs

pid	Process
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe

Suspicious use of SendNotifyMessage 34 IoCs

pid	Process
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5740 wrote to memory of 5648	5740	msedge.exe	85
PID 5740 wrote to memory of 5680	5740	msedge.exe	87
PID 5740 wrote to memory of 1696	5740	msedge.exe	86
PID 5740 wrote to memory of 5680	5740	msedge.exe	87
PID 5740 wrote to memory of 5680	5740	msedge.exe	87
PID 5740 wrote to memory of 1508	5740	msedge.exe	88
PID 5740 wrote to memory of 1508	5740	msedge.exe	88
PID 5740 wrote to memory of 572	5740	msedge.exe	89
PID 5740 wrote to memory of 572	5740	msedge.exe	89
PID 5740 wrote to memory of 5972	5740	msedge.exe	90
PID 5740 wrote to memory of 572	5740	msedge.exe	89
PID 5740 wrote to memory of 5972	5740	msedge.exe	90
PID 5740 wrote to memory of 5972	5740	msedge.exe	90
PID 5740 wrote to memory of 1800	5740	msedge.exe	94
PID 5740 wrote to memory of 1800	5740	msedge.exe	94
PID 5740 wrote to memory of 4480	5740	msedge.exe	95
PID 5740 wrote to memory of 4480	5740	msedge.exe	95
PID 5740 wrote to memory of 5232	5740	msedge.exe	97
PID 5740 wrote to memory of 6124	5740	msedge.exe	101
PID 5740 wrote to memory of 6124	5740	msedge.exe	101
PID 5740 wrote to memory of 5252	5740	msedge.exe	102
PID 5740 wrote to memory of 5252	5740	msedge.exe	102
PID 5740 wrote to memory of 5252	5740	msedge.exe	102
PID 5740 wrote to memory of 2076	5740	msedge.exe	104
PID 5740 wrote to memory of 2076	5740	msedge.exe	104
PID 5740 wrote to memory of 2076	5740	msedge.exe	104
PID 5740 wrote to memory of 5168	5740	msedge.exe	105
PID 5740 wrote to memory of 5168	5740	msedge.exe	105
PID 5740 wrote to memory of 5168	5740	msedge.exe	105
PID 5740 wrote to memory of 5300	5740	msedge.exe	106
PID 5740 wrote to memory of 5300	5740	msedge.exe	106
PID 5740 wrote to memory of 5300	5740	msedge.exe	106
PID 5740 wrote to memory of 568	5740	msedge.exe	107
PID 5740 wrote to memory of 568	5740	msedge.exe	107
PID 5740 wrote to memory of 568	5740	msedge.exe	107
PID 5740 wrote to memory of 4368	5740	msedge.exe	108
PID 5740 wrote to memory of 4368	5740	msedge.exe	108
PID 5740 wrote to memory of 4368	5740	msedge.exe	108
PID 5740 wrote to memory of 6068	5740	msedge.exe	109
PID 5740 wrote to memory of 6068	5740	msedge.exe	109
PID 5740 wrote to memory of 6068	5740	msedge.exe	109
PID 5740 wrote to memory of 5984	5740	msedge.exe	110
PID 5740 wrote to memory of 5984	5740	msedge.exe	110
PID 5740 wrote to memory of 5984	5740	msedge.exe	110
PID 5740 wrote to memory of 3476	5740	msedge.exe	111
PID 5740 wrote to memory of 3476	5740	msedge.exe	111
PID 5740 wrote to memory of 3476	5740	msedge.exe	111
PID 5740 wrote to memory of 4068	5740	msedge.exe	112
PID 5740 wrote to memory of 4068	5740	msedge.exe	112
PID 5740 wrote to memory of 4068	5740	msedge.exe	112
PID 5740 wrote to memory of 4352	5740	msedge.exe	113
PID 5740 wrote to memory of 4352	5740	msedge.exe	113
PID 5740 wrote to memory of 4352	5740	msedge.exe	113
PID 5740 wrote to memory of 5328	5740	msedge.exe	114
PID 5740 wrote to memory of 5328	5740	msedge.exe	114
PID 5740 wrote to memory of 5328	5740	msedge.exe	114
PID 5740 wrote to memory of 2648	5740	msedge.exe	115
PID 5740 wrote to memory of 2648	5740	msedge.exe	115
PID 5740 wrote to memory of 2648	5740	msedge.exe	115
PID 5740 wrote to memory of 4476	5740	msedge.exe	116
PID 5740 wrote to memory of 4476	5740	msedge.exe	116
PID 5740 wrote to memory of 4476	5740	msedge.exe	116
PID 5740 wrote to memory of 2188	5740	msedge.exe	117
PID 5740 wrote to memory of 2188	5740	msedge.exe	117

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://skinchanger.gg/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2a8,0x7ffb70d4c188,0x7ffb70d4c194,0x7ffb70d4c1a0
  2⤵
  PID:5648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2000,i,10244938263913912186,17327223547713097215,524288 --field-trial-handle=2296,i,1227035126903285355,10529865987195345966,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:1696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1704,i,7986144424475977491,9713900071403668418,262144 --field-trial-handle=2296,i,1227035126903285355,10529865987195345966,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:2
  2⤵
  PID:5680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2572,i,13877343685205066656,1118983702049961836,524288 --field-trial-handle=2296,i,1227035126903285355,10529865987195345966,262144 --variations-seed-version --mojo-platform-channel-handle=2540 /prefetch:8
  2⤵
  PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3484,i,6067013749113022115,16257692907629163969,2097152 --field-trial-handle=2296,i,1227035126903285355,10529865987195345966,262144 --variations-seed-version --mojo-platform-channel-handle=3436 /prefetch:1
  2⤵
  PID:572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3488,i,2796511865009797062,15470908030751043464,2097152 --field-trial-handle=2296,i,1227035126903285355,10529865987195345966,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:5972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5316,i,16785867818386918875,4311430597414304775,524288 --field-trial-handle=2296,i,1227035126903285355,10529865987195345966,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:8
  2⤵
  PID:1800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5324,i,4479464867974069430,17327318681967162235,524288 --field-trial-handle=2296,i,1227035126903285355,10529865987195345966,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:8
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5924,i,16252706301136824815,16598598457204600558,524288 --field-trial-handle=2296,i,1227035126903285355,10529865987195345966,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:8
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5924,i,16252706301136824815,16598598457204600558,524288 --field-trial-handle=2296,i,1227035126903285355,10529865987195345966,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:8
  2⤵
  PID:5232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5276,i,4293027772945843592,2975976595091477649,524288 --field-trial-handle=2296,i,1227035126903285355,10529865987195345966,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:8
  2⤵
  PID:6124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=6300,i,17418336055288271377,6270380200773196363,2097152 --field-trial-handle=2296,i,1227035126903285355,10529865987195345966,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:1
  2⤵
  PID:5252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6636,i,9537048666858962469,13678994341702999955,2097152 --field-trial-handle=2296,i,1227035126903285355,10529865987195345966,262144 --variations-seed-version --mojo-platform-channel-handle=6644 /prefetch:1
  2⤵
  PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6436,i,7984482116744927049,5748655643566899419,2097152 --field-trial-handle=2296,i,1227035126903285355,10529865987195345966,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:1
  2⤵
  PID:5168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6808,i,17288266599950265477,9482334595452048464,2097152 --field-trial-handle=2296,i,1227035126903285355,10529865987195345966,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:1
  2⤵
  PID:5300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=7036,i,3804492056814033062,4999936924280910249,2097152 --field-trial-handle=2296,i,1227035126903285355,10529865987195345966,262144 --variations-seed-version --mojo-platform-channel-handle=7032 /prefetch:1
  2⤵
  PID:568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=2588,i,17330601904235859044,5874049589241127440,2097152 --field-trial-handle=2296,i,1227035126903285355,10529865987195345966,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6812,i,5964299728475258108,3539475364753250380,2097152 --field-trial-handle=2296,i,1227035126903285355,10529865987195345966,262144 --variations-seed-version --mojo-platform-channel-handle=6924 /prefetch:1
  2⤵
  PID:6068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=7256,i,2248689240188913135,9962825158069982110,2097152 --field-trial-handle=2296,i,1227035126903285355,10529865987195345966,262144 --variations-seed-version --mojo-platform-channel-handle=6796 /prefetch:1
  2⤵
  PID:5984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=7084,i,5654780302461655619,11018464668869649097,2097152 --field-trial-handle=2296,i,1227035126903285355,10529865987195345966,262144 --variations-seed-version --mojo-platform-channel-handle=6992 /prefetch:1
  2⤵
  PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=7016,i,14008198139405425904,7700438630864181568,2097152 --field-trial-handle=2296,i,1227035126903285355,10529865987195345966,262144 --variations-seed-version --mojo-platform-channel-handle=6440 /prefetch:1
  2⤵
  PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7544,i,3537669160683034461,2940954022349341136,2097152 --field-trial-handle=2296,i,1227035126903285355,10529865987195345966,262144 --variations-seed-version --mojo-platform-channel-handle=7556 /prefetch:1
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7708,i,14480173041702950852,3697455972510764051,2097152 --field-trial-handle=2296,i,1227035126903285355,10529865987195345966,262144 --variations-seed-version --mojo-platform-channel-handle=7468 /prefetch:1
  2⤵
  PID:5328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7844,i,12556069011231158977,11544529019043317593,2097152 --field-trial-handle=2296,i,1227035126903285355,10529865987195345966,262144 --variations-seed-version --mojo-platform-channel-handle=7860 /prefetch:1
  2⤵
  PID:2648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7912,i,2942770865389886711,10425237733688461890,2097152 --field-trial-handle=2296,i,1227035126903285355,10529865987195345966,262144 --variations-seed-version --mojo-platform-channel-handle=7884 /prefetch:1
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=8164,i,7317762965816298847,14420601932315698755,2097152 --field-trial-handle=2296,i,1227035126903285355,10529865987195345966,262144 --variations-seed-version --mojo-platform-channel-handle=8032 /prefetch:1
  2⤵
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=8308,i,16004960709240184723,4266577242441044774,2097152 --field-trial-handle=2296,i,1227035126903285355,10529865987195345966,262144 --variations-seed-version --mojo-platform-channel-handle=8316 /prefetch:1
  2⤵
  PID:2600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=8372,i,12429947635801585839,14638337760466425860,2097152 --field-trial-handle=2296,i,1227035126903285355,10529865987195345966,262144 --variations-seed-version --mojo-platform-channel-handle=8472 /prefetch:1
  2⤵
  PID:5468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=8608,i,8272707220181724931,13034100116753982225,2097152 --field-trial-handle=2296,i,1227035126903285355,10529865987195345966,262144 --variations-seed-version --mojo-platform-channel-handle=8624 /prefetch:1
  2⤵
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=8768,i,201442342083157038,16284346754210374942,2097152 --field-trial-handle=2296,i,1227035126903285355,10529865987195345966,262144 --variations-seed-version --mojo-platform-channel-handle=8780 /prefetch:1
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=8924,i,11212952225211836480,10101609301120796579,2097152 --field-trial-handle=2296,i,1227035126903285355,10529865987195345966,262144 --variations-seed-version --mojo-platform-channel-handle=8920 /prefetch:1
  2⤵
  PID:1832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=9072,i,621230177626622479,16329162609847596626,2097152 --field-trial-handle=2296,i,1227035126903285355,10529865987195345966,262144 --variations-seed-version --mojo-platform-channel-handle=9084 /prefetch:1
  2⤵
  PID:2564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=9228,i,10084803904803920223,7553846353475493010,2097152 --field-trial-handle=2296,i,1227035126903285355,10529865987195345966,262144 --variations-seed-version --mojo-platform-channel-handle=9240 /prefetch:1
  2⤵
  PID:2068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=9380,i,11091867786100982402,11280019406097590994,2097152 --field-trial-handle=2296,i,1227035126903285355,10529865987195345966,262144 --variations-seed-version --mojo-platform-channel-handle=9392 /prefetch:1
  2⤵
  PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8184,i,4798996828909735926,11309983770269883660,524288 --field-trial-handle=2296,i,1227035126903285355,10529865987195345966,262144 --variations-seed-version --mojo-platform-channel-handle=9684 /prefetch:8
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9700,i,13977669815084570482,7976511223143541946,524288 --field-trial-handle=2296,i,1227035126903285355,10529865987195345966,262144 --variations-seed-version --mojo-platform-channel-handle=8172 /prefetch:8
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9656,i,2574545182207472879,14909259476569054158,524288 --field-trial-handle=2296,i,1227035126903285355,10529865987195345966,262144 --variations-seed-version --mojo-platform-channel-handle=9764 /prefetch:8
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=9948,i,14152563776357910225,4044753070767622392,2097152 --field-trial-handle=2296,i,1227035126903285355,10529865987195345966,262144 --variations-seed-version --mojo-platform-channel-handle=9844 /prefetch:1
  2⤵
  PID:1856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=10100,i,4409731887802447448,11417983752679477858,2097152 --field-trial-handle=2296,i,1227035126903285355,10529865987195345966,262144 --variations-seed-version --mojo-platform-channel-handle=10104 /prefetch:1
  2⤵
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=10284,i,829828034983243911,12592269732424075330,2097152 --field-trial-handle=2296,i,1227035126903285355,10529865987195345966,262144 --variations-seed-version --mojo-platform-channel-handle=9832 /prefetch:1
  2⤵
  PID:2232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=8140,i,2145694127730855510,6044685589703792943,2097152 --field-trial-handle=2296,i,1227035126903285355,10529865987195345966,262144 --variations-seed-version --mojo-platform-channel-handle=8060 /prefetch:1
  2⤵
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=8364,i,14040792788432087864,13127343386514694473,2097152 --field-trial-handle=2296,i,1227035126903285355,10529865987195345966,262144 --variations-seed-version --mojo-platform-channel-handle=7892 /prefetch:1
  2⤵
  PID:3596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=10132,i,3173684447876018599,7002247951706153373,2097152 --field-trial-handle=2296,i,1227035126903285355,10529865987195345966,262144 --variations-seed-version --mojo-platform-channel-handle=10124 /prefetch:1
  2⤵
  PID:3184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=9676,i,15504730837209222785,16969427046774788643,2097152 --field-trial-handle=2296,i,1227035126903285355,10529865987195345966,262144 --variations-seed-version --mojo-platform-channel-handle=10252 /prefetch:1
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=10088,i,15657970374666703093,14978231094812230722,2097152 --field-trial-handle=2296,i,1227035126903285355,10529865987195345966,262144 --variations-seed-version --mojo-platform-channel-handle=9780 /prefetch:1
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=10420,i,3300001154339824686,12172609207473337829,2097152 --field-trial-handle=2296,i,1227035126903285355,10529865987195345966,262144 --variations-seed-version --mojo-platform-channel-handle=10416 /prefetch:1
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=10028,i,1780581818395080253,3995861756945676616,2097152 --field-trial-handle=2296,i,1227035126903285355,10529865987195345966,262144 --variations-seed-version --mojo-platform-channel-handle=10516 /prefetch:1
  2⤵
  PID:5188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=10460,i,11608730403855493730,1644081093643842908,2097152 --field-trial-handle=2296,i,1227035126903285355,10529865987195345966,262144 --variations-seed-version --mojo-platform-channel-handle=10312 /prefetch:1
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=7392,i,1178442423422740310,586870398335406928,2097152 --field-trial-handle=2296,i,1227035126903285355,10529865987195345966,262144 --variations-seed-version --mojo-platform-channel-handle=10812 /prefetch:1
  2⤵
  PID:5308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=10924,i,8823328651699433529,10272607973371015721,2097152 --field-trial-handle=2296,i,1227035126903285355,10529865987195345966,262144 --variations-seed-version --mojo-platform-channel-handle=10792 /prefetch:1
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=10576,i,874733724861929374,17872759534890196654,2097152 --field-trial-handle=2296,i,1227035126903285355,10529865987195345966,262144 --variations-seed-version --mojo-platform-channel-handle=11064 /prefetch:1
  2⤵
  PID:2108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=10684,i,3765392329811106532,9457536556626478340,2097152 --field-trial-handle=2296,i,1227035126903285355,10529865987195345966,262144 --variations-seed-version --mojo-platform-channel-handle=11212 /prefetch:1
  2⤵
  PID:6152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=9688,i,10357893634763661915,15502902687728596184,2097152 --field-trial-handle=2296,i,1227035126903285355,10529865987195345966,262144 --variations-seed-version --mojo-platform-channel-handle=11340 /prefetch:1
  2⤵
  PID:6264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --metrics-shmem-handle=11528,i,3543601409411412269,17803581676945341257,2097152 --field-trial-handle=2296,i,1227035126903285355,10529865987195345966,262144 --variations-seed-version --mojo-platform-channel-handle=11548 /prefetch:1
  2⤵
  PID:6516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --always-read-main-dll --metrics-shmem-handle=11192,i,14101865364317869193,4166046541945005828,2097152 --field-trial-handle=2296,i,1227035126903285355,10529865987195345966,262144 --variations-seed-version --mojo-platform-channel-handle=11756 /prefetch:1
  2⤵
  PID:6580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --metrics-shmem-handle=10672,i,2651923852864534974,9755657058536848415,2097152 --field-trial-handle=2296,i,1227035126903285355,10529865987195345966,262144 --variations-seed-version --mojo-platform-channel-handle=11912 /prefetch:1
  2⤵
  PID:6632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --always-read-main-dll --metrics-shmem-handle=11944,i,153368859247389661,7980768291607689666,2097152 --field-trial-handle=2296,i,1227035126903285355,10529865987195345966,262144 --variations-seed-version --mojo-platform-channel-handle=11572 /prefetch:1
  2⤵
  PID:6700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --always-read-main-dll --metrics-shmem-handle=11560,i,1473589357753445259,1032364369288445735,2097152 --field-trial-handle=2296,i,1227035126903285355,10529865987195345966,262144 --variations-seed-version --mojo-platform-channel-handle=12156 /prefetch:1
  2⤵
  PID:6756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --always-read-main-dll --metrics-shmem-handle=12308,i,7091402752109633699,7208082044701137303,2097152 --field-trial-handle=2296,i,1227035126903285355,10529865987195345966,262144 --variations-seed-version --mojo-platform-channel-handle=12140 /prefetch:1
  2⤵
  PID:6812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --always-read-main-dll --metrics-shmem-handle=7568,i,17084902290699528819,17912631133641038194,2097152 --field-trial-handle=2296,i,1227035126903285355,10529865987195345966,262144 --variations-seed-version --mojo-platform-channel-handle=11768 /prefetch:1
  2⤵
  PID:6968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --always-read-main-dll --metrics-shmem-handle=6260,i,16880555784533774680,13291241431919292551,2097152 --field-trial-handle=2296,i,1227035126903285355,10529865987195345966,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:1
  2⤵
  PID:6748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --always-read-main-dll --metrics-shmem-handle=6212,i,7179703034887745590,5455197442981480128,2097152 --field-trial-handle=2296,i,1227035126903285355,10529865987195345966,262144 --variations-seed-version --mojo-platform-channel-handle=12272 /prefetch:1
  2⤵
  PID:6764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --always-read-main-dll --metrics-shmem-handle=6184,i,788417350680261796,7265275809830248487,2097152 --field-trial-handle=2296,i,1227035126903285355,10529865987195345966,262144 --variations-seed-version --mojo-platform-channel-handle=10860 /prefetch:1
  2⤵
  PID:6488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=10848,i,11907521945912497376,8130239256740872303,524288 --field-trial-handle=2296,i,1227035126903285355,10529865987195345966,262144 --variations-seed-version --mojo-platform-channel-handle=10740 /prefetch:8
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=10320,i,10287494095843189561,1377267725082024482,524288 --field-trial-handle=2296,i,1227035126903285355,10529865987195345966,262144 --variations-seed-version --mojo-platform-channel-handle=7652 /prefetch:8
  2⤵
  PID:5744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --always-read-main-dll --metrics-shmem-handle=11984,i,10181136210540927877,7244273106468686419,2097152 --field-trial-handle=2296,i,1227035126903285355,10529865987195345966,262144 --variations-seed-version --mojo-platform-channel-handle=12192 /prefetch:1
  2⤵
  PID:6600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=12480,i,15698724694998624016,9698794434445837585,524288 --field-trial-handle=2296,i,1227035126903285355,10529865987195345966,262144 --variations-seed-version --mojo-platform-channel-handle=12468 /prefetch:8
  2⤵
  PID:6368

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5764

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4576

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:6180

C:\Users\Admin\Downloads\skinchanger.exe
"C:\Users\Admin\Downloads\skinchanger.exe"
1⤵
PID:6652

C:\Users\Admin\Downloads\skinchanger.exe
"C:\Users\Admin\Downloads\skinchanger.exe"
1⤵
PID:5012

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 524ae55519907b3ab75a388a7d8adb5b3e5bdde0aabefe20ce772a09ea687d5b
MD5 f6eb566f9aba7efdbfb5c795bd65c547
SHA1 0ce2d6e7d9e58cb863af3f628d52cd4dd694f6fa
SHA512 2b08121677adac5c93abf00acc6bfcb28d8a72bca78fdef9052724d4f592d583e28680a2ae9a96d1bb7c0a432f05c206ebc2ec8238e6cabafaf5ae8743b7260b
TLSH
T19CD0C023360D3004E3494231D002C3042311447810078301F330D88C89241C4D2930C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2aafce1c037be05e4c7ebafed37cf7282f3b61da9ab3f68cb43c724193f2a4ab
MD5 1a34bb39930694ea7604881fe671a327
SHA1 984165fe8abd42a03cd121d90e23865b1b24606e
SHA512 c9c7ad13bf7dcca0de7ae942e5c953da986e722b63c12f23dbc118dda97022414b13f1027b23b74906f10699650754782ea88b9d17b1c4e8aad63cf538d45022
TLSH
T147D0C0233A093004E3454231D042C3043321407810078301F330D88C89641C4D2930C3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 7022b101971e9ad69fa628fb7f754c84fca263181f8fee8fc39d9d41215ef44a
MD5 1248c613add030fa4a76cd339738430e
SHA1 f31b75304d4c7a18b4c290f14c783b4253d480af
SHA512 af07c9d58de32caca0f6e8a4a27121c9c023ffdec124b13e574c377bcadefeb5fc1b3a1433d69c30cf2088fce332583ea90e66f94870a73679705e21eb8bb4b3
TLSH
T10CE0E5D5CC61AC3719FC072950A40746E72013562A40894A363C51098F70A374686D6C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000087

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000087
Size 33KB
SHA256 539628bdc4f3b107aeb78713c741ab9b5f4737532233506d8f1b1fdc4c81040c
MD5 a06c8f49a760752dc8b3ee4f217bf4fe
SHA1 2c159af5b7341c03cbce67afffafbbae2cbb7787
SHA512 af3b5c625bf4c83616c3ae1e2380df3bd35119998ca75cb96cd590c18b9227d18a03a50cf22880ddf41edd99ac7b8b9918c93a7be90d4dd3a8e6602c8e2b519c
SSDEEP 768:f+QHjwElyDV21n98SlMi1MEOV1IyItHdLqO:GOwKyD01n9RlfyTVJYRqO
TLSH
T1F7E2F15B2127014BED8CA143576EFB4FA9E374AC5609A24F547BE0AA7B8938754BD0C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000088

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000088
Size 72KB
SHA256 d7badf0bdda03df48eaaa50db3618e4e5b9acb6dcafaadef31eddcaa200fcf69
MD5 0407dea5217f688b95f298d73e75e6d8
SHA1 d11e6d4015965f7fa3a81da9df4d9db41f80dd26
SHA512 d5de8d6e6e9ab4a7a4b0b63f2394822781f9143fabb2f0e4df5764fc0b0eaa89d5f57762854f710335078a9af817b9748bcd19259291aa304df5345e79037832
SSDEEP 1536:5hV2BMScgqnf7CB4xit8dCsCEfVDf4JNwZbIhULqQWABPJXviXzIIk9+22me:5+3fqnqaWYN/VJbRq2BPJXviXz7k8p
TLSH
T14E73123981659A058F0BCD1803DC3C91A0FF636A6D5ADA78EECF467DF7893A1011E41A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000089

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000089
Size 96KB
SHA256 00b42308115826481315f6a815745f8d445a89d855fa587f627b7b4388810023
MD5 89341da90f4120b2461a9bafeef01775
SHA1 90e281f4ff94fc0eaee2e876234884e16f69894d
SHA512 bb3e8fd234ec764c6450622ff2d5f2e6e777cac6006fa23b9c3e986d79b89911b9a57ebca3bb3f3e15b8437d0b305634eea968e7d8808188efca4840bf4d5112
SSDEEP 3072:OFM4gnEp7667akyq8ez5pqVo0cvK4Dhq/8fQVT:8cIwdq87ouczQR
TLSH
T1F8A312DE415A5AD9711B87D540A18F2E140288FDAE3AC206E3C7493E1D7E1BED2392DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008a
Size 409KB
SHA256 7481b444adbaae4f7a79174b175946fa4336f6baf026ccd4df590112712f6b60
MD5 66037a123614fcddbadbff1c63f466b8
SHA1 3566e363b0cd701ae364e4a6727ba57d619ad4db
SHA512 f9906e983519b12ef3da4d544c3ceab9695215cb7ea0a1c7486cc16c9e075526bf63558a31ffaf1d8e5176cee9902535975ea8f1ac897b56e19abdb847b228ff
SSDEEP 6144:G2T5/P8VpjUC5Hor5v1Y6jxnMcYdVCUUBWOLDIE2anufvM+txgpf3ra7fpoEhO7s:G2T5Mm1Y6GwdBWi25fvM+7wf3rGfWKs+
TLSH
T1D394233DBB1A3C5430523C72A9816A9F483563B3579D3E66A918CCE428F5F37582533E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008e
Size 27KB
SHA256 64e79147a82c808d8a3daae687c53b872bd0f3990445a7d146f16d0a5bcf5148
MD5 f1d6ac69d6247fd7d5a820b1d6b5112a
SHA1 26f6a525b97b7f2a9c008e8e4fa6a193091e071a
SHA512 3a2cb9a7defda2b8d3479cee40457053e50b41974ec090737e3c8a77b3d6b697a3b49f446d02422f6ae9a98c50ebbecb2a739670fbb0bd70825344a5a874458c
SSDEEP 768:itNT5p0OyEHO9J1EMdzwfKgbcNHC1lgET:QNTf0FEYNdY9bcNiIC
TLSH
T107D2E106CA539FE6238354A5473364DE5FBE12211123EC108421672EFADB59B7BCD0F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008f
Size 77KB
SHA256 4a5474b8eb5183875feb79c3f2ca10f145311acb585d1df9d28cc692fbeb8c22
MD5 952d54373c7fdba41d9e99c9619adafa
SHA1 996fe4d75f2da8b9c64e6b5000abbfc4ba66e900
SHA512 cb40c731d0e19118527d19d33f0611c7d5d59027a57d6a45b82ec65b42f459e8b084010608873eb84e1acc1cc6ed371475c4c5ac50a30fb0e779926ebbc50c6e
SSDEEP 1536:gKON7OxmpmanKc106awC8RwzopLPNJZcxoG4fgR5nx2+fZX5I7AbRaRf07:TU7/mGKc15x1wzGLPNJZg4fw/rZIxB07
TLSH
T18F730202AE24F136F89B835B9B8F351313B53BA2064C22D2E130B07F6E6445C79679AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000091

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000091
Size 62KB
SHA256 e7cee158f4d8c62f6b069c8e110537bccad609d0f2e9839777a745bd92391e5e
MD5 f2ef094996a1d68512fdfd64a48e13aa
SHA1 c221273871cb46b2e22e1ad54545e3da59a6be76
SHA512 f199d2ddfd505882ace4588beebbb90d594e148c5104bfd9eb01e38eba4c0239ecc59d2cc7d835fe05c74e5a0dbe50675db057c998a7adfcb4dafe7341ae7098
SSDEEP 1536:RRuSFQTMx1VdJzCIZMy09vjKUtF49cyVQi2ic:RwvTsJzCCM/vZwVQi2P
TLSH
T1B253F176A0D1A3025A3BD0026899BEF1E7501AD160F5CBA7D0BA6691F60FC60ECF517F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000093

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000093
Size 72KB
SHA256 ee5144f1d44952edbc9a0eec9f3d0bdd5fd9ce7b6d13421cad8aa8361f7145d5
MD5 1fd6570fdf1ef993333a3ae9f417d9f4
SHA1 8728c27a27bf76c17572445949026fa3493e233f
SHA512 da2a971d5018efe5d0fe8a89f4a94840fc13f877031eda234c0d059c64bf9f2915d191ab201de9ff45cadc64a71ed7745545b7dc4105522e8af85ae63587f602
SSDEEP 1536:Yu4NzBsS+SFCsSftljaAH67DRqwKdNqJHHmPPfTAOoF86cNVdD:YuI16SNSfT1H677KdUOPfkO+86cbdD
TLSH
T14973021A93BAB973B26063014ED1514A0A03F147FDE8DA89C948755A30F9B30DEB57F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

5940cd8b-9b37-4681-a7dd-9a096bd68e2f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\5940cd8b-9b37-4681-a7dd-9a096bd68e2f.tmp
Size 1KB
SHA256 44c4952000005028f10da1de640238bf456f7b4e2cf4d6e005bf9651364792cd
MD5 d77aafe139035484e4ae8bd80c6f95d9
SHA1 472d0d366f65c774c605f6249951acc1671978d4
SHA512 6552db5e80c641256501d82d545a1ec4a60393ff363d2fa1d8004704282e2d0f57d246c1a94f809d8cb32e244ea337b2f88b3876023aac26a42bc71acceb59b6
TLSH
T152318EF783E4856E8A0195F0BA18BE2FCE2D0515436C3D9AC5E4AF1B93E2471E141A5B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 36KB
SHA256 613c6706b6acc6820b0370f578d419be3703384fbf8ec66324b1d2d45ad71bb4
MD5 f9805ec36162369d22a5a3af35e39d8f
SHA1 ab9210b062c96fdace0f1d82a50d137393acdf5e
SHA512 158034ca603bb7d0f603c588aba662acc9f9a80137f814631c8bedb7147d3c3560e716fbf295090e77d5b76d487fa98b205b8762e26db876a95839a18f908550
SSDEEP 384:D1BqfEMIAMDexSKpvkUdAoBeGFgdit1DelABJvRaaiGT1quHazcIKvcBicP8cQGm:in5d1iDXXAiBAiFN0fnl7uZYv
TLSH
T1AAF2A0F393F089BEC91266F09E142E17CF5D445A031C7C7B8AE4AE5753E6832E25164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 207B
SHA256 d363e76ff863ec50cfece3f660bc0b15a6aff225e96c81b1ba62b053114d04a4
MD5 a74fafbbc561e8f49536216a148e602b
SHA1 0ec421ff58109bc57b3599b2350f0d5b149e9d39
SHA512 6d09765cd0143afb0ab1567211b035dd9e644033ec7b3f0c030157a19aab41b8ae3d82222b75ffb6bb38721c90c06a96143502f7343d95396703620151cf46d8
TLSH
T1FDD022232B48B0B5A77D7EC1A46AEC8FC32720A00C02EDD420D0D8A9153156C0D0F244
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 50b384af1f400df532fa655382dd1237483cb1c554c45517066cb1e776839b67
MD5 931bbe9feb7a7e35880512e94aa55b37
SHA1 69719392da2288d575255dca0b132ea63edb21fa
SHA512 aa0b507222a214a8aef88f55ea915ffe352187f4053caf3c5d2604d3f2c38f8c4b34a1caba2c6808d72e707186405f9ad4837e2600113f9933e49914ff7885d3
SSDEEP 384:sxZDIsmW0/fOs25C5rBN4HbJtyo/oRcfos33F:s75mW0/f85qwHbJhoRcp33F
TLSH
T19092F7026A2489778CDBD609B9757F52D7F81563D9918E4C6AFCCA0C04EB6FC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 62c47e76a04fad5da474b92f9ecbf055a6129d31aa1d57497c7f6df1e4f5b0e9
MD5 2a7fa19a4cd091b337b96c4890d2ad83
SHA1 8e4b408db9061b45d8b00faf29fd101c72d4a578
SHA512 633e7d578d2751d2d4b4a5d921b505965e9eef4015802955b50f61ef60bf23d0d8de3902dc0023b638ae69fba24d0664d24a520b9f8e35508877b97bf73aa59b
SSDEEP 192:sxZDR3yMqZjK1Ml8Mk0/fOse58Z5z/wzodpOGHW6+WNLMgfYQ9qCcLrIgjCJ:sxZDIM0/fOse5C5rz9HbvfLcfje
TLSH
T11962E8166A74997B8CDBD209FA45BF53D6F9156392514E44AAFC8A0C00E7BEC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 20KB
SHA256 4516402c3cf82650e90fe6310c9ab9ee2d7c737c70f4df28f3a75fbb2161033f
MD5 e4adaaae1dd51d2064f7b5b638c12b26
SHA1 967bc50a942becfb6746478f0ddb15cde98a764b
SHA512 e2c9e5581f7ff6e5f8039c3b011ba641e6bb0ff994bcfe21f742d40b275d10b33694a9b542880b926806a74213e6857bbf1ca7a570594be2012a8b1746e080ed
SSDEEP 384:sxZIbsmW0/fOs2BC5rQJRmHbJJda/Scfos33F:sAImW0/f8BqQqHbJ0Scp33F
TLSH
T18F92F7026A248977CCDBD618F925BF52D7F91463D9918E4C6AFCC91C04EB6ED221382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 ddd93c640e662c502f8eb86638cc1df77a2298622f6e99b3321005e81ad97b67
MD5 05935d2041921213c2915352f66cfcb9
SHA1 da1777fe0ccc73476b61fb62b7ddeaded5a5d048
SHA512 12857425d3c7e0616dd87b28b12e481e52fac401d62cf2d444b3a35b85e2bfac067ef4244c51b9b84be70447d5a8135ce2be134629431716442650f79874268c
SSDEEP 768:cFADqXGWviq5i8F1+UoAYDCx9Tuqh0VfUC9xbog/OVfRLl5bKp7roK/X:cFADqXGWviq5iu1jaSRLDmpIK/X
TLSH
T16DD20B2F684CCB7E4F841E5CEC266F8B6DD802CB6A984D5447EA844C02C77EE512B5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\68b528cb-fe7f-46e0-b568-05fcf4e883af\index-dir\the-real-index
Size 2KB
SHA256 a230c1c687ea3492fc6057bf43a45e870fb17c19168f81754b868f9ea5c4704f
MD5 aca8389e9cb47033675c8d7aa1271c6e
SHA1 a5bdc7351b08ada3983418797752e30993b9aa26
SHA512 ba7e8a7237b92f42a557b9520038d7d448f6735410f1386ba9e84d4a00f35acb1b1b33ccf70189176ecc69fb987a9313dcc12be3194c10b9a1b848e458a05105
TLSH
T1AD41E84D0D508A5FD86841B318B2A49433F0A8CD5A199A13ACAC2130BE4376D291B6FC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\68b528cb-fe7f-46e0-b568-05fcf4e883af\index-dir\the-real-index
Size 3KB
SHA256 ee7dc20ae25bb3ca312ecf60c70c77e396d47a173d70cf64a76de9aeaf4062ef
MD5 8208b3b781fee39821672ce683691aae
SHA1 bcb2711c8dc31478382f6299b05a5b8bf75a2ce9
SHA512 0828325f230a373bb4cccea4b9407783201a68e6c43a97d033ea8d86b0b0835e4acf32db3cff9cd594f4d5d0acc7d5ee77594fb9805db30d77d29eba52740feb
TLSH
T14351D80E0D570F6ACDAC537214F90445337866CC23AC690BA5FE9234F8C376CAD9D969
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58dbf4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\68b528cb-fe7f-46e0-b568-05fcf4e883af\index-dir\the-real-index~RFe58dbf4.TMP
Size 2KB
SHA256 62addd91f2d1601a8a4abbe9d61535e6eeb0db3454357dde46aa3d922f7476e0
MD5 0f29a0fcc62529e3f80e23c83e504068
SHA1 32c9dfde8140ca6991d0cc349fae59c5b9335b3e
SHA512 4ceaef10782be0342a87fbd5e28782b9af6f2ab88c4de36e7cbb8898ddb82d8ac5ab5baf5512245dec5d564e427da52410eb3f9e9f4e599caf25666bd2d071eb
TLSH
T19A41EC594E818A2EF85440730DE3B4F47336584087157B4778FC5135AD927AD2D4E0D9
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 91b8e007a2c441a2071956d56996a0f1f951a690d4ddd55c010f13f1f55d1692
MD5 f3ae83b28b501115fc823ca087e6ad85
SHA1 51189ecbfb504e4278c6f164c50a0fb481332a81
SHA512 470d0abb5c7e3da4042660d1bafec7f2bff70a928d26f7c26888a817b25f394177bd7e55cc1503a7f281df1ea8d7813056eb6e8fc7ec06eee11b3c5964360296
TLSH
T153E068BA2DE32820ED5F83DA2471586900103845C998ED4F103F5393906125228AAC62
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 b94523ed897c49bc957a35073d2b6200008d56dde0c4687d74c593695ea05ede
MD5 97e11e8cab927aff780c8bb3437e0966
SHA1 07b1aa8c97ac0ca7256bca4ec081665eafc45857
SHA512 c42eb77f3f7ba1d36356ea1ad379add49e8e39c45a6926e14abb46012373f74ae9e2b4f2c7b65775a3485a952bbb10b391126d8fd3c261647f7af7d95e7d6dac
TLSH
T181A00212CA4D9A42C40246F9A4E5524237914A9E0105135BB8D8E0988CA555155C1742
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe595460.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe595460.TMP
Size 48B
SHA256 fc4ba26c32b6869374a740d8a49ddee09493d8c132dc315e82d8b9181756cbbf
MD5 3221dc6d38d660431727adfd36cdbe48
SHA1 ed6a8448e9bb175a19d954246e0bbfe98e3b967f
SHA512 da6ab919578a9fa01a1333a4d940c7df8c6ec4dc149274266cf855c8ec840c886f3ec48d1181c766127eb54030aecf699761b7074cab3824adfa4a53daf34e32
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 f463989007694bc38ba6871daaacb4ef8e9a9702cdf1001dc68b96d3773a9002
MD5 0978b41d880742e4e9203c229f5ddc83
SHA1 7fcbf0b148304c7e064ad478e3dcaefc6e398387
SHA512 24aecae2580a3e45b9d734c60b12973ac0284fb0090b08de1c734111f17005aac6e4eccfb40fea1893c53feb5eff952f8120ce7d197106ff9baf5689d258170f
TLSH
T1B3A00256DB557449D77056B02E81158133104C310B21060740F04184885C55382022C4
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 22KB
SHA256 8e2672d3b156acfd351a69c0815cac80efe094ca003e7769c854283d69f839c6
MD5 2e1c3099a50eceac93932f3153d07ab4
SHA1 f9f3450b8db2ff8a8de6e0aafdc358c6ad27115f
SHA512 abbf01241e09452a32ec286aee4ff217156438d3a161d62a6eed98f5527a2e0f1e1011bf5bf41e12b98a4add8e294eef547c3676c29afe319f228ccf5bd910c9
SSDEEP 192:cVSnNDxZ9l3iZ3QxVl/1hVPUfPlruPLdll01K:c8NDb9ViJQXlthlUnw
TLSH
T190A25A16713A425238BD6D4CB3A6863B4F4271633418E5AF7FB810B60E2AE125DFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 7875f41c3e571e06b0c9d3b61913078c63cc72852d0a39f41eddea28391aab91
MD5 57df3d6661ce4f5fcf37724583586aac
SHA1 40a0b2fa7239fc58e52c150a8d5c34b97eb93100
SHA512 fba0014b124c7471b17e869416f1388c4c604d1a0fd3c8a5d95244a4bf99df60b43eb15d52d2185fbf8c99e2ab810e0ecd8d5a24b52a0ee8c473a5dcb04a9bb7
SSDEEP 384:nmyiFlZcIAsNH8TUNTUlI4AnTnyc58CifbZocx8e/Lqw52MYxuvzxV+MhdpZGkFy:gFdAiwgW4WocSeuw52MY4184pZaB
TLSH
T101E2B5F198D78977E8AE5B83A73D6D029EBCC153B5889984B7D85D0CCC8617FC30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 34f346d7578ffc4a496011f3fdf2975b87f81a76d075474a9b69baa89114b1f4
MD5 c5b23e5d9ae15c2f573ed68ef48ebcfb
SHA1 7ac74dace71681c7d49c84a42fda4ce5548fbf93
SHA512 d96b9ddd2d384d71441f80d709a2f2b8b9d60a298dbd4304570f5bfdbc3cd9af730b8744f391e3c7c25cd2b78072bdbe294f728b0d8c62cbc6dcef1509829cfc
SSDEEP 384:nmqiFlZcIJsNH8TUNTUlI4AnTnycQ8CifbZocx8e/Lqw5qAMYxuvzxV+MhdpZGkk:cFdJiwgWPWocSeuw5qAMY4184pZaB
TLSH
T124C24B72EC94C9BBECEA5BC1B64A7603DEF45163958C9ED4E9D85E1C009B1AD030BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 2e81b8728a5da34e6aa04596b4d9f2ec0325e66625763ecc8ecc9fdd4135f796
MD5 4a2da7e2f9a56fcd4507e2e0dee44f9b
SHA1 9e5ea56010328113c5b90ebb437a427569535288
SHA512 61cd5886bccc272554e77f25267ce2c0454d63c71e23777d5d3e84dc819863682daed4d744ca611b7cf30ef6e3d52e31996939dd80ee752d864718e7bfe5f966
SSDEEP 384:n4iFiZcIl3sNH8TUNTUlI4kYuJUaQCifbZocx8e/Lqw5qAMYxuvzxV+MhdpZGkFy:DFQl3iwg/KocSeuw5qAMY4184pZaB
TLSH
T183C25C72EC94C9BBECEB5BC1B64A7603DEF45163958C9AD4E9D85E1C00DB1AD030BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 0a716190e518c78b0bdd5346041ff921578763ee4a3db186e3b04aebc9bc5303
MD5 3c462a976c137a0fa008ee395002035c
SHA1 43baf3d4b71cda0c590b0635304760f3391c56cb
SHA512 b8f9d9e0caad1c5efb83ac9951a1e41bd248248e8407fb651740600aa4954f5a9293910ca3ab92ea575acfa5c7dbe366223658ad46741148ccacc1078cc107e9
SSDEEP 768:sFccps30ZwgalocSeuw5g7MzhkoFYS/Pg:ss308SvIzhkoagg
TLSH
T1A7B25C36EC98CABBEDEB4F95A74A7A43DEE41163949899D4EAD81D1C00CB1DD0307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 ba755e2ae32d6d22de8d6e32de30b5be0e5ca3f93e2c57271ea5f3209b864628
MD5 3e7789f97ddcb8b911c5106b10ad138c
SHA1 533be147e412394b6eedd3fd1ca5b77206b45b41
SHA512 2b004b57122378155c972088e6f75af7f9386792b7c340b60b7753539d10bb5b0c00fa3963c19d83e05f4ac2b08f6addcd9b4d8172e801f6694790ba82c7104b
SSDEEP 384:nmqiFiZcIfsNH8TUNTUlI4knTnycQ8CifbZocx8e/Lqw5qAMYxuvzxV+MhdpZGkk:cFQfiwgKPWocSeuw5qAMY4184pZaB
TLSH
T157C25C72EC94C9BBECEA5BC1F64A7603DEF45163958C9AD4E9D85E1C00DB1AD030BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 d0bb5123467d93bc57b159b3eb1a199fa26ecf21c523a9a6493afc7bcc889620
MD5 75ea1bd43483a12cd992fd079ecf3e57
SHA1 a04704c155a4f6b6e06a0629e71dfdd0414711e0
SHA512 35ada86fa1511a25936fc693987ec7855e4e425e8c5167542893422329575e4d99d3c149439215e1d6730dea3c143c54a55231e922ac65e4fa47943f72d29e14
SSDEEP 384:nhiF9CcmyWCs3sNB8TUNTUlImkrJkc9CifbZocx8e/Lqw5qkMYhkP+lFYS/PLF7O:IFccps3MwgDJocSeuw5qkMYhkoFYS/Pg
TLSH
T1FDC25C32EC98CABBEDE64FD5E64A7643DEE44163C58C9AD0EAD81D1D00DB1AD130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 5fed2fd6a22e9556b797a9c876ad70806a3689026ddab67d4cbcb9807eb522c9
MD5 00b33b889a107421ed42b847418747ea
SHA1 01e58329c7cf127bf8305b9bf7b7404c6766571b
SHA512 ad1622acb60c8cf9cbc3ce95aa0a7db3708af42bd911b1b0ae1d2ae0a2fd0a96630aa3eee4d5889d37bc0fbf94d23da81791e3d82a8a3f7c7747dcd951e95b65
TLSH
T119E00143D30050AAC12D077800872B203EF3C0320AB207469F2001A83C233402E31E90
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe592532.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe592532.TMP
Size 392B
SHA256 ff742084b22b21655571dfb54937cbc7f4d80263f41c3f8e1816db4918c40015
MD5 0cccefb52bdda9ec2508bb40136804bd
SHA1 0d8a927dc0bf11a5ea960ecb27fcdae4820026bf
SHA512 991be2824e9b3aa4827c41a7cfd3c7d5dd184b53eb8fa4bdd9f2857e9e9eebf5e5e7e6010648e527d43e1c88a5942d6c716d77614b16253cc122b41897742501
TLSH
T115E00243D30050F9C13D0774004727302BE3C03105B10346DE1001903C233401F30FC0
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 b337a39f623c77c22bde19fcab2cea156d95f8007c0c22aeb8ce0398ab021d94
MD5 f3d29b9ee8fbd18299ed93a297dc4d08
SHA1 8d932ed656ae11b4c101f23e81343639de00b387
SHA512 aa0ef2ed7840f410ad0bcff760ea142150a82ec62cae176ebc4fc76691f547dd391f357defc9b11eb48e44bc302899ff5171d04fcb84cf6c856453eb224c6c90
TLSH
T134410C5DA6FA1148B3B7AF1A9BF6A46D847BB9772E07D45D00110E4F0A27B40C872737
MD5 SHA1 SHA512 TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

skinchanger.exe

Path C:\Users\Admin\Downloads\skinchanger.exe
Size 23.5MB
SHA256 fb81fb36718e0039ab5bf51eea5b9aeef7dd305b09b1616d548df8cd3c5e62a2
MD5 fcc308513e2ef1930714318d3f0499aa
SHA1 c1bd3a7797bba095a509705e56efa4bb99f2c2f8
SHA512 eed4a7989dfb6e8a34a8bf941b536b6685cb70fa85eb3815d452ec4ab9b07dd44a93e8b6ee05c152a2924db519285e2c80d39aeb7ba139caea652dd014658dec
SSDEEP 393216:oDAXg3D1Ffx1GW8f3Ehq3iaiWpQVMScPPxEr6m41kBw2v7rHWh:oDOgPJ05Xia4SdXaHob2jjWh
TLSH
T10547F0B42D9431D8C7C38574D2CD59F9E088786DE9FB5826EB860D017A3C897C8A7F26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5232-430-0x000002233C9B0000-0x000002233D9B0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads