hxxps://nexomia[.]win/download

Analysis

user interaction
yes
max time kernel
898s
max time network
887s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/09/2026, 16:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://nexomia.win/download
Sample260922-tgxtpsybnd

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2936	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134345665483461310"	msedge.exe

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2101206053-1414382737-268919432-1000\{4A44305D-1311-4241-A402-B7688DF7D2E3}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2101206053-1414382737-268919432-1000\{6E1B6965-5CC9-4C07-B1F1-72FD205DE1D8}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5288	msedge.exe
5288	msedge.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 33 IoCs

pid	Process
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2760 wrote to memory of 2924	2760	msedge.exe	85
PID 2760 wrote to memory of 2936	2760	msedge.exe	86
PID 2760 wrote to memory of 3768	2760	msedge.exe	87
PID 2760 wrote to memory of 4012	2760	msedge.exe	88
PID 2760 wrote to memory of 3768	2760	msedge.exe	87
PID 2760 wrote to memory of 3768	2760	msedge.exe	87
PID 2760 wrote to memory of 4012	2760	msedge.exe	88
PID 2760 wrote to memory of 360	2760	msedge.exe	90
PID 2760 wrote to memory of 360	2760	msedge.exe	90
PID 2760 wrote to memory of 360	2760	msedge.exe	90
PID 2760 wrote to memory of 1000	2760	msedge.exe	91
PID 2760 wrote to memory of 1000	2760	msedge.exe	91
PID 2760 wrote to memory of 1000	2760	msedge.exe	91
PID 2760 wrote to memory of 4992	2760	msedge.exe	92
PID 2760 wrote to memory of 4992	2760	msedge.exe	92
PID 2760 wrote to memory of 4992	2760	msedge.exe	92
PID 2760 wrote to memory of 1192	2760	msedge.exe	93
PID 2760 wrote to memory of 1192	2760	msedge.exe	93
PID 2760 wrote to memory of 1192	2760	msedge.exe	93
PID 2760 wrote to memory of 4732	2760	msedge.exe	97
PID 2760 wrote to memory of 4732	2760	msedge.exe	97
PID 2760 wrote to memory of 1724	2760	msedge.exe	98
PID 2760 wrote to memory of 1724	2760	msedge.exe	98
PID 2760 wrote to memory of 4644	2760	msedge.exe	100
PID 2760 wrote to memory of 3068	2760	msedge.exe	104
PID 2760 wrote to memory of 3068	2760	msedge.exe	104
PID 2760 wrote to memory of 3068	2760	msedge.exe	104
PID 2760 wrote to memory of 5032	2760	msedge.exe	105
PID 2760 wrote to memory of 5032	2760	msedge.exe	105
PID 2760 wrote to memory of 5032	2760	msedge.exe	105
PID 2760 wrote to memory of 1736	2760	msedge.exe	106
PID 2760 wrote to memory of 1736	2760	msedge.exe	106
PID 2760 wrote to memory of 1736	2760	msedge.exe	106
PID 2760 wrote to memory of 4388	2760	msedge.exe	107
PID 2760 wrote to memory of 4388	2760	msedge.exe	107
PID 2760 wrote to memory of 4388	2760	msedge.exe	107
PID 2760 wrote to memory of 4860	2760	msedge.exe	108
PID 2760 wrote to memory of 4860	2760	msedge.exe	108
PID 2760 wrote to memory of 4860	2760	msedge.exe	108
PID 2760 wrote to memory of 1068	2760	msedge.exe	109
PID 2760 wrote to memory of 1068	2760	msedge.exe	109
PID 2760 wrote to memory of 1068	2760	msedge.exe	109
PID 2760 wrote to memory of 3868	2760	msedge.exe	110
PID 2760 wrote to memory of 3868	2760	msedge.exe	110
PID 2760 wrote to memory of 3868	2760	msedge.exe	110
PID 2760 wrote to memory of 3616	2760	msedge.exe	111
PID 2760 wrote to memory of 3616	2760	msedge.exe	111
PID 2760 wrote to memory of 3616	2760	msedge.exe	111
PID 2760 wrote to memory of 3516	2760	msedge.exe	114
PID 2760 wrote to memory of 3516	2760	msedge.exe	114
PID 2760 wrote to memory of 3516	2760	msedge.exe	114
PID 2760 wrote to memory of 2356	2760	msedge.exe	115
PID 2760 wrote to memory of 2356	2760	msedge.exe	115
PID 2760 wrote to memory of 2356	2760	msedge.exe	115
PID 2760 wrote to memory of 4320	2760	msedge.exe	116
PID 2760 wrote to memory of 4320	2760	msedge.exe	116
PID 2760 wrote to memory of 4320	2760	msedge.exe	116
PID 2760 wrote to memory of 2548	2760	msedge.exe	117
PID 2760 wrote to memory of 2548	2760	msedge.exe	117
PID 2760 wrote to memory of 2548	2760	msedge.exe	117
PID 2760 wrote to memory of 5344	2760	msedge.exe	125
PID 2760 wrote to memory of 5352	2760	msedge.exe	126
PID 2760 wrote to memory of 5360	2760	msedge.exe	127
PID 2760 wrote to memory of 5672	2760	msedge.exe	130

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://nexomia.win/download
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff81dd2c188,0x7ff81dd2c194,0x7ff81dd2c1a0
  2⤵
  PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1884,i,18377789164814635680,18084995342933906835,524288 --field-trial-handle=2600,i,18209428239386908946,2417379792990625005,262144 --variations-seed-version --mojo-platform-channel-handle=2684 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,3467243974210635229,12043991079962401293,262144 --field-trial-handle=2600,i,18209428239386908946,2417379792990625005,262144 --variations-seed-version --mojo-platform-channel-handle=2592 /prefetch:2
  2⤵
  PID:3768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2268,i,10429770520158785046,8727325313610282180,524288 --field-trial-handle=2600,i,18209428239386908946,2417379792990625005,262144 --variations-seed-version --mojo-platform-channel-handle=2692 /prefetch:8
  2⤵
  PID:4012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,14726567963361614599,14554720504722430043,2097152 --field-trial-handle=2600,i,18209428239386908946,2417379792990625005,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
  2⤵
  PID:360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,875925824993066494,18003368935745727622,2097152 --field-trial-handle=2600,i,18209428239386908946,2417379792990625005,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:1000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4168,i,6461548391183132287,1090352517105990901,2097152 --field-trial-handle=2600,i,18209428239386908946,2417379792990625005,262144 --variations-seed-version --mojo-platform-channel-handle=4148 /prefetch:1
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4164,i,6080836902240747246,16040727466950049352,2097152 --field-trial-handle=2600,i,18209428239386908946,2417379792990625005,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:2
  2⤵
  PID:1192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3948,i,8680546657565082388,10086004593037479160,524288 --field-trial-handle=2600,i,18209428239386908946,2417379792990625005,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:8
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3960,i,5270557054483195869,11067487262810500305,524288 --field-trial-handle=2600,i,18209428239386908946,2417379792990625005,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:1724
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5848,i,5078851617613359932,7967619151370717127,524288 --field-trial-handle=2600,i,18209428239386908946,2417379792990625005,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:8
  2⤵
  PID:4120
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5848,i,5078851617613359932,7967619151370717127,524288 --field-trial-handle=2600,i,18209428239386908946,2417379792990625005,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:8
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6220,i,4010145992434786600,1089771047445976571,2097152 --field-trial-handle=2600,i,18209428239386908946,2417379792990625005,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:1
  2⤵
  PID:3068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6240,i,12038153862744673946,2718898448731210194,2097152 --field-trial-handle=2600,i,18209428239386908946,2417379792990625005,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:1
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4140,i,4662562337679983201,1985101169941179026,2097152 --field-trial-handle=2600,i,18209428239386908946,2417379792990625005,262144 --variations-seed-version --mojo-platform-channel-handle=6596 /prefetch:1
  2⤵
  PID:1736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=4596,i,10152915966819064564,306803721249545521,2097152 --field-trial-handle=2600,i,18209428239386908946,2417379792990625005,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:1
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6580,i,18259224042838848355,6031763122028751502,2097152 --field-trial-handle=2600,i,18209428239386908946,2417379792990625005,262144 --variations-seed-version --mojo-platform-channel-handle=7244 /prefetch:1
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5776,i,6547309977231651314,594299915353150227,2097152 --field-trial-handle=2600,i,18209428239386908946,2417379792990625005,262144 --variations-seed-version --mojo-platform-channel-handle=6792 /prefetch:1
  2⤵
  PID:1068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=4300,i,3875140926342357284,13992166633478572304,2097152 --field-trial-handle=2600,i,18209428239386908946,2417379792990625005,262144 --variations-seed-version --mojo-platform-channel-handle=6832 /prefetch:1
  2⤵
  PID:3868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=7388,i,7800426598307318174,18057061742186078975,2097152 --field-trial-handle=2600,i,18209428239386908946,2417379792990625005,262144 --variations-seed-version --mojo-platform-channel-handle=7380 /prefetch:1
  2⤵
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=4368,i,6936775323133790127,16816609121537043384,2097152 --field-trial-handle=2600,i,18209428239386908946,2417379792990625005,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:1
  2⤵
  PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6644,i,12625896205190702898,2560821859799529159,2097152 --field-trial-handle=2600,i,18209428239386908946,2417379792990625005,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:1
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7292,i,2690144976622057929,9290657391622552847,2097152 --field-trial-handle=2600,i,18209428239386908946,2417379792990625005,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:1
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7136,i,13712186811767413332,2999772830099547600,2097152 --field-trial-handle=2600,i,18209428239386908946,2417379792990625005,262144 --variations-seed-version --mojo-platform-channel-handle=7160 /prefetch:1
  2⤵
  PID:2548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7648,i,13845464970094008902,11979521273440311198,524288 --field-trial-handle=2600,i,18209428239386908946,2417379792990625005,262144 --variations-seed-version --mojo-platform-channel-handle=7056 /prefetch:8
  2⤵
  PID:5344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7652,i,12242250261023160342,1738814185185576057,524288 --field-trial-handle=2600,i,18209428239386908946,2417379792990625005,262144 --variations-seed-version --mojo-platform-channel-handle=7644 /prefetch:8
  2⤵
  PID:5352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7656,i,14517336915569171632,6601592671583420342,524288 --field-trial-handle=2600,i,18209428239386908946,2417379792990625005,262144 --variations-seed-version --mojo-platform-channel-handle=7692 /prefetch:8
  2⤵
  PID:5360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=6384,i,5910548966944231932,7991960609922758881,2097152 --field-trial-handle=2600,i,18209428239386908946,2417379792990625005,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:1
  2⤵
  PID:5672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=4292,i,2071068798191150004,9086110386327570837,2097152 --field-trial-handle=2600,i,18209428239386908946,2417379792990625005,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:1
  2⤵
  PID:5712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7976,i,17197044642863942491,11310975260927014718,524288 --field-trial-handle=2600,i,18209428239386908946,2417379792990625005,262144 --variations-seed-version --mojo-platform-channel-handle=7900 /prefetch:8
  2⤵
  PID:2932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=8076,i,63208290507234320,10701903656990668231,2097152 --field-trial-handle=2600,i,18209428239386908946,2417379792990625005,262144 --variations-seed-version --mojo-platform-channel-handle=8148 /prefetch:1
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=5928,i,1742582196784723248,7727834618928897796,2097152 --field-trial-handle=2600,i,18209428239386908946,2417379792990625005,262144 --variations-seed-version --mojo-platform-channel-handle=7612 /prefetch:1
  2⤵
  PID:5988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=7548,i,2814274967296316872,16485985599124156552,2097152 --field-trial-handle=2600,i,18209428239386908946,2417379792990625005,262144 --variations-seed-version --mojo-platform-channel-handle=6920 /prefetch:1
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=8012,i,10859433839041271767,2592850481822326138,2097152 --field-trial-handle=2600,i,18209428239386908946,2417379792990625005,262144 --variations-seed-version --mojo-platform-channel-handle=8176 /prefetch:1
  2⤵
  PID:2332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6264,i,14971103626364973605,9729202607937475147,524288 --field-trial-handle=2600,i,18209428239386908946,2417379792990625005,262144 --variations-seed-version --mojo-platform-channel-handle=8188 /prefetch:8
  2⤵
  - Modifies registry class
  PID:3320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3516,i,8086730213744014909,649907862524369975,524288 --field-trial-handle=2600,i,18209428239386908946,2417379792990625005,262144 --variations-seed-version --mojo-platform-channel-handle=8064 /prefetch:8
  2⤵
  PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=7176,i,12061330224395580990,9293447867053898592,2097152 --field-trial-handle=2600,i,18209428239386908946,2417379792990625005,262144 --variations-seed-version --mojo-platform-channel-handle=4708 /prefetch:1
  2⤵
  PID:432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=6588,i,5148460259835433733,282536103838548572,2097152 --field-trial-handle=2600,i,18209428239386908946,2417379792990625005,262144 --variations-seed-version --mojo-platform-channel-handle=6844 /prefetch:1
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=6556,i,894477749769164186,17436949296003887899,2097152 --field-trial-handle=2600,i,18209428239386908946,2417379792990625005,262144 --variations-seed-version --mojo-platform-channel-handle=7240 /prefetch:1
  2⤵
  PID:5936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=7520,i,13281397994063781883,9514822386544103625,2097152 --field-trial-handle=2600,i,18209428239386908946,2417379792990625005,262144 --variations-seed-version --mojo-platform-channel-handle=7208 /prefetch:1
  2⤵
  PID:2772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=7216,i,15329382665135168789,2787829822232335620,2097152 --field-trial-handle=2600,i,18209428239386908946,2417379792990625005,262144 --variations-seed-version --mojo-platform-channel-handle=7328 /prefetch:1
  2⤵
  PID:2148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=8288,i,11721143072126929223,449717755095910968,2097152 --field-trial-handle=2600,i,18209428239386908946,2417379792990625005,262144 --variations-seed-version --mojo-platform-channel-handle=8268 /prefetch:1
  2⤵
  PID:6016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=8436,i,11920802327239234505,17770249155345538173,2097152 --field-trial-handle=2600,i,18209428239386908946,2417379792990625005,262144 --variations-seed-version --mojo-platform-channel-handle=8456 /prefetch:1
  2⤵
  PID:1428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=8280,i,3675363952063123255,18109436133133135833,2097152 --field-trial-handle=2600,i,18209428239386908946,2417379792990625005,262144 --variations-seed-version --mojo-platform-channel-handle=8580 /prefetch:1
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8764,i,6531641959094964593,13779199061212692944,524288 --field-trial-handle=2600,i,18209428239386908946,2417379792990625005,262144 --variations-seed-version --mojo-platform-channel-handle=8820 /prefetch:8
  2⤵
  PID:3368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=8808,i,5586024234883185919,13101462204563067352,2097152 --field-trial-handle=2600,i,18209428239386908946,2417379792990625005,262144 --variations-seed-version --mojo-platform-channel-handle=8984 /prefetch:1
  2⤵
  PID:5132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=8816,i,1269390085924261905,3910092653217708379,2097152 --field-trial-handle=2600,i,18209428239386908946,2417379792990625005,262144 --variations-seed-version --mojo-platform-channel-handle=9124 /prefetch:1
  2⤵
  PID:5996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1204,i,9397081627712394671,2006001421378030659,262144 --field-trial-handle=2600,i,18209428239386908946,2417379792990625005,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5584,i,4494636972405039626,1853922468359893355,524288 --field-trial-handle=2600,i,18209428239386908946,2417379792990625005,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:8
  2⤵
  PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5192,i,8413719299292882857,4229250976937477081,524288 --field-trial-handle=2600,i,18209428239386908946,2417379792990625005,262144 --variations-seed-version --mojo-platform-channel-handle=1328 /prefetch:8
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5420,i,14329202771677608086,14474408646866282125,524288 --field-trial-handle=2600,i,18209428239386908946,2417379792990625005,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:8
  2⤵
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2528,i,5710689232993573325,1784743313146358903,524288 --field-trial-handle=2600,i,18209428239386908946,2417379792990625005,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:8
  2⤵
  PID:5948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3496,i,10308279965274170317,6164228662930767527,524288 --field-trial-handle=2600,i,18209428239386908946,2417379792990625005,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:8
  2⤵
  PID:5176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3604,i,7222153743574053724,726457759531277610,524288 --field-trial-handle=2600,i,18209428239386908946,2417379792990625005,262144 --variations-seed-version --mojo-platform-channel-handle=7044 /prefetch:8
  2⤵
  PID:3028

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4668

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 61a97be736e0441d45644d31b38bd9bef6c1bd260fa1ecbb5d099fa493fee6b4
MD5 99bbd8400adc948f85ebd87cb24b3fcb
SHA1 c8fb9564ede7ecb06cef446bdb527025127a796e
SHA512 75b3ee70eca487cbbfb3d5b4b25bae158ff99188ab36d55f391e9f80c51ce9fa433897d79a0ae37ad64698bc3eb5aa9a10a49116fb8f7f35ed0a6e98aa8321b7
TLSH
T109D022C8F2A0300CE00C3233A02BCE022B88CEA8F0032BCA000E8C80E8800C80CF2C8E
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 58cafb516b0325dfe43acd216e9890f0bcc262c718600f107065921213cc859d
MD5 ea427f8b2d510e91da6879bea3afe56e
SHA1 7fc151e36935557cfb0fee70f642c15daa8c5708
SHA512 397b127a558980fc26e11776c73021c94f4a0cefc1a51f07710e4c4514b94057d7a644567b34c0a52555812a9cb5faff1ff782ae1df2104d25249db747844d0f
TLSH
T167E026E819E8C2AEA61E6487437CAB4DC380370AD2CD6A1A670089947102850F6C2691
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 460bec0b746c5dfbc9c99bc7f7ca354b243195a560cb7868e1395cbc507b1fe6
MD5 73494ae4bd425d1c90e1fcca9b16d90a
SHA1 2b82aeb25ea3422d9d5c947120d34a34e9ec06a8
SHA512 68802868f7e1b0ea06c97458285af7703e7438b72cc2aa4176cf9d4d2feaa655d71685e3c61dd060e9d33362c53641afac5a09753a423aa84f8c9ff55b854fdb
TLSH
T159E026C815C8C23FE20C6887426C7B4CD290770B92CCAA2EA718C9C9F102844A6C2696
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 ba3cde10fa217fb7d02cbedce792c90c8c8d908b2f95d9af8305c1cc660cf3c1
MD5 c38624f26d6e72514074d4df8ea27ce1
SHA1 c60af536fd81ea7641faf918c233fb9088b8127b
SHA512 635e2d408c636276a73690eb2e9c32ed22bc82e7cd33cc320b662571884afe1cd613f8494634b088c2e3063a6a6cc79f307be5e09c434d86a7ba0d9d255b8007
TLSH
T10CE020DC14D5C26DB70E6447436C5F4CC280370AD2CDAB16671887C57002880F297765
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000073

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000073
Size 345KB
SHA256 af74444f93c1a87703c134e8e3a1762932e8c9ed17b5781360a51435080b8704
MD5 a3b1bd33206689c75f9acfb640a6ef7f
SHA1 88d1a94a23fc0b9702d6857e71038d5c01a0bc27
SHA512 7d2ab5783a9640015ad2215944cf3bff51babf2ca59fa0ee7e2e587c1ef56901b6ddb399c2a435757aa66bd2d5c7933326c606df7942d354ba6493c51c49acfa
SSDEEP 6144:dt6B0ZtO9WZMN5KSdoaPiC1ghYvx4BmlxTbD5FuTbb1cc:dt6B0ZtCWA5KYP8qvx4klZqTec
TLSH
T1927423E3AC113A4A630789E74DC8A1AB7453C5C32A56FF4237467887A6D8D8E365CF13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a3
Size 23KB
SHA256 4b3d1931e6e35cca3c8990897c9e7eec00d26f9db8d2458fa2fce7c7ce6136fb
MD5 4de8b14556f067d6a378eff66437b4bc
SHA1 1008b64c7881ae7c36aec007519b46016933e2bf
SHA512 5b095bc25a50fe7f34b10ebc3ea9b5dafea9876cb5042e46843563c2e0445f0197e99a056de17e35e2efb09abb330f943635c99c579209e8feffa8625b4a16b5
SSDEEP 384:C0hkiwfig9E4CnqGip3yZtkFv7lFFDCBHF8IuEko9/JdjGq6ng0kbLtMpqIby2qm:C0hAiP4CnqGipotcPF+F8No9B5J6g026
TLSH
T15FB2E1A1FC24F726386230516C6406CBE1795D4BAC350A23812D63BA76FF43FB9563B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000b0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b0
Size 76KB
SHA256 53a424271b8dc5494c30d21d1aaf8bf5f83577d3c139abc6383745791cab9692
MD5 d291bc93920f634958bbafb4b137f123
SHA1 83644e4a3462189d2eccbefe0929bd7b63ecd69d
SHA512 587edbabc1246c5989f88a072228c84f07e0a3a4a35d9d7b017bc7b09b00f32f20d3f5dc4bb4ba525e49edd74a130f7c25550152693de920109b9a0c895ac949
SSDEEP 1536:XOpc91Qa006KfiPS12MbsbtzFfRZIWWsiVHpcsCBatL4ijmiT:Sc9eRSgkHuFfL3WsSJjFG0f
TLSH
T14F731290BC52BC90A7C85CE35EEE49D5344DD6BC0B9C0FCB98F17AC3B822556263295A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

023dca31233d3213_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\023dca31233d3213_0
Size 3KB
SHA256 fac3a51d60f5be63ab1600f923901784d6912d0957e9a405301c68dc0aa67444
MD5 34a1d71bc4b8d7cfd2d685b81543d781
SHA1 f6ffb2b916b8794ec4f9a6f3a9c7c41c872880d3
SHA512 8b3a284c2271468a81d35deee6688c78ed0912f8a759a4cfdbcff56eac5b9c096ff1a31f20441508e1c3254625f1758e5492e76b9a73f9887545a97667a61d77
TLSH
T1AD71B89A9344861DCF3253FA02934626A33580056ED3C72730C5EB721D443FB699DF4D
MD5 SHA1 SHA512 TLSH

Submit Download

248d28c10d34b429_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\248d28c10d34b429_0
Size 31KB
SHA256 bd77be3c4b9b1d5a57f2e9e0f7201017d483b51608c415abf3deca425fa2c3f3
MD5 fab8fdac6acd25d9d427b506e87bb778
SHA1 5a6a82ce2e2f036ce30974f2fd2d389c584b7f8d
SHA512 2740a7339c74edf43212c2dc4d2754e6c5394fcd5d076aff436b9c4fab4a421b6f3c79cc6405275dd4808c9337a030270e15a3ba607d17f3127befb45a786cb2
SSDEEP 768:kj6bd/6Eg+DAcGmGd/lrHn5u3K0Fbp4ZnM42pNMNynZ/kA7r0UjcP:kWd7DBGmGdFMKAmR2pNMNynZ/kA7r0U4
TLSH
T1D7E2D785A391BA9ECF2653FA0152893B7335488D3ED3D32726D4B7252C792F64E49C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

56a145cc834fcd50_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\56a145cc834fcd50_0
Size 310B
SHA256 a3b612708b9f47d7e024e773ace29eab9ed7ce5c58b188f7f0ab30ad286481d0
MD5 6fbb47a70e5729360f47f2246bd205d5
SHA1 da056da099390dba9e530c661406d87b3b0c2d4b
SHA512 10496fb9bc13e7cac8bdb94f3f0d4b78a4d86b9300f8ca2830d6f29698a73292e9452cc326f495f11bf2877ec53bf4d73130eefa91c8e572471508435afa83be
TLSH
T1D3E07DAB40312940E17611B0C1D94516D7A611DF2C5480CC641083213728AF12AEA713
MD5 SHA1 SHA512 TLSH

Submit Download

6fe8279259073eb1_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6fe8279259073eb1_0
Size 256B
SHA256 a1d10ab5e46eef1dfe3506bc4ad940738d2a6ccb3f701a56851555de4c2366c7
MD5 c3a37eafac8e875604700d790b993f7c
SHA1 2aa06a62a739b56056b4d109bf7f4d46c672d9b6
SHA512 b6a3b8b1d28682508b82f162784a24ed1a5e9108dab09a9a9d7f2f05b777d0f479188175d203ddaa03cf6502810797d7ea77fc5b6ddc42b38de3fb03a4e93202
TLSH
T184D0A7EB96A85942C16991F08B9D111ED21703EF1829D59D60719163970D7F8B286623
MD5 SHA1 SHA512 TLSH

Submit Download

739f5a5dc8e4dec8_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\739f5a5dc8e4dec8_0
Size 267B
SHA256 4aacf8a835180c0cf1b151bf123d346650ca1ff93d0931ac382b9ef576b35116
MD5 e3795b322db6db1b2d99f4ce87ca4eb9
SHA1 716bc0fe6eb941eb381932fc86f435fcc7169c96
SHA512 1d464891b305d414a76a5e1a590d5488bc538152009a41baa66595bd99c2c9eeaf7124206880f5275e604fea2960aa015e9d7b1c6e37fe18dcdd6533602fef86
TLSH
T14FD0A7DBE0A42551C72D51B04FEE026F951381EB1CFDD09AB01050712714FF5B787523
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 8KB
SHA256 154ee5c57c1bb812e7b3ec369a6d29ce9f4bf176e7643a39ad995cd762f7fa8f
MD5 64a516df4bbd12104efd3903ac60151f
SHA1 52bb3c3a4bfc3e82b51111175a261747c4a46133
SHA512 b6aeca2098e5d2b390a432713da8036195d190166cbd7ab66a516da19edefdeee83f5f4f8ed434e7e2970a3bd0c69176956f4e2c6411429974cb783220f28422
SSDEEP 96:8vUhfSk8+oBQDh085yL7cVKHS4Zc7lLKMoQ/6xPbS3GyTxKUNy48C8tKHK2DA9Kh:meU+DhNlKuuW2yTxn+9bpM
TLSH
T14702E9C298D47654FF96703196DAAF67FA721CCF4C07DE1E2147F43E680B380A189A99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 26KB
SHA256 24af740f6bae7c0c2357f63519283cfb02e62ff74ed5ece8e117bd72fbfbc8fb
MD5 1f36a671be03cb89f93102f553ad2895
SHA1 fdc1c5414d9f847b4da62c18a89a4511199d3949
SHA512 0dfb0ea7ac8365d865ab1b20d04c04823a518594b1334da502a5eeffa37383d38dd5068a4cdf9b20c7cf276b2de8c9fa358353fb046ec2e38edae4fc9153e9b2
SSDEEP 384:DyWuiX+r1xQGJTueUTeNQIJtBeUt+7MJIqKtatltTtYtwtXJtTtQtwet6tFJtzBu:WTPprzueSueR9l/GxmyrM+lBO
TLSH
T142C27EF743F4866EDD11A3F0DA187E2B8E691515032C3C6A85D4AE4B93F2472E281E5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 34KB
SHA256 88bfbffa8d41cc170d7d77549793a7fbae0a06c94bbf62107f640e66cd1c0586
MD5 3f833ba1db49413b8ef2c2e1404bec6f
SHA1 01c0c35846932cb931f81126f4bb33b0ef8faa32
SHA512 0d6c63d212fe6d556ecd7c9a19fc7c3195012c5fcdb91dfbef9db9936f47dbef831e5848206459b97d22cdd765144b3466d03ce8034c6344a932391e158f8eb0
SSDEEP 384:Di++yj5u6Jx6zdBeQfeWckJYBePTwjxJ9Tk8tptKt1thtUtHJt6tFtJt4etftvJz:WWp36C2xU+YXxz8ShT3BrGGeKO
TLSH
T155F27CF7C3E8862EDC1196F4AA243E17CE6D1915432C3C1B85D9AF4B93E1471E282E5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 b566b7fc5b988e6f073411272cc119df7cdb6d4af95d8d3e27b3321b2c9de18b
MD5 a3a64c530af519e20af82c7682c7e598
SHA1 68db529beacc9278d2553f13f9ca7e9bd5e6c30d
SHA512 5a43a8dc19d421395bd2189c4842d515e03fab7f1128d6af9f1f103286081f664e44c82e277cd09fa71ae2e5f558957831134607a33302934f1adf4ae4492ffd
TLSH
T1E5D02233130930B5A97C2E89506AEC8FC37720301882EAD820D2DCAC063647D098B145
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries~RFe59e526.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe59e526.TMP
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 31KB
SHA256 9d545d48bc6622907c761951d1d6447042f4e01dc716b06ba4a36379abd7413d
MD5 ba15ced66f2a78ff8db03540e908de66
SHA1 6a57664448c7e80e56e2db712826831acf81bba0
SHA512 29612cb32aa2c4a366c75061a05972e0e5aa9716aa0bfdb0f46d1dafd3349996ed41bcc615d8f827ed9c063f2fb848d079f6602f6075c6da3d6dd9fe305d3a92
SSDEEP 384:sxZi4Gmz//fssW66s8qMpRiYnazAW8pZS15posJWeT+DITfGHbSOSZ/L7RR:sq4Gmz//f24Mnc7WeT+DIjGHbM5R
TLSH
T1B5E218469820C8678BC35D28A93DBE36D6AC405299C5CFDE5AFCCA1C01DE1FDAB07853
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 7ac32564b5d09e47c14ec4b3dba4f613811224e6e9d251a6c6bfb774360176c5
MD5 58df16d7bf8b653d564339adf0d5b4c6
SHA1 482cc9928fac6f0a399e6441d8da68ed0f87382a
SHA512 3f384a501556208e6f459a40f3298a6f99cd03e6b8163ee9304d2819ba37836a61f887cf9045ee4b64d35f1b1a10b89fa3bd24f5c5a3f6f673fe1f669b4a3d51
SSDEEP 192:sxZi6RdWR9/fxCsG+nOIdpqSKZHW6+WNCHDf/YaRGWIgrJ:sxZi6e//fssG+faHbO/b9
TLSH
T1B222D955AE38697B4CC7D20DBA15BF53E2F9513291D41E58EAFC861C04EBACD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 be9c11ce2d6001cbd4549276136985e8e3b2355ddd846f1681659e653cbd1982
MD5 332777fca4df791edc3e35faafe32a01
SHA1 7780981833583f17a49954bd965f8ae303e911f8
SHA512 c6176e279587a3dfa0f96ea37b569a9397b2b3e3f0737e553dee50a2d21d5ecca238c9dded4fb63067b15f4c3a90f41eb3c9c5f66adb3a6ac7e1e1ec3090aca4
SSDEEP 192:sxZigRducBzR9/fxCsZ1nndpQ9Zzscgxi5rHW6+WNC5KDfWx5H4W/YaeGWIg5xTe:sxZigGmz//fssZ1T3cHbJSZ/OeRR
TLSH
T11462C9529934D9B78CC7D619BE35BF16E2F54122DC851F9CAAFCCA1C04EA6ED2207807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 6cef34652b320cdfce02fa0fa67aff802259383ea7eb214e47a9fd186e6dbcfc
MD5 c0dd2d58e6ed7c625ebe97b311fb518d
SHA1 69d35c4599ecf5038a5c5df130a1695fce3f916e
SHA512 47a7873da4f8e3529bde47d5d1ec0a85e834548e3f27bb617eb2ef0d1f29b2ceae562d830b1de42a1cf240a534039abfba6f006aae7638d73bd4e03034f55f9b
SSDEEP 192:sxZi4RducBzR9/fxCsZ1nndpWtuuzs22gN1i510HW6+WNCzenkDfWx5H4W/YafGW:sxZi4Gmz//fssZ1TfGHbqSZ/d7RR
TLSH
T12572C892993499B78DC7D529BA31BF16D2F54122DCC55F9CAAFCCA2C00DA6FD2207807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 d2209c0cfcf661dd42858b4307032a29a528c81225782285ac1b92b94aacd0ea
MD5 938d8c25713063257fea1ba47ce38c28
SHA1 ef8e2db2b9e074bac2e5829aaefe273794aa8840
SHA512 e489958b5692348319fb3ad3d61a2bfae378e71dc9fd79b07062832e39ff572013654f39dee097fc68484fbb44d2e41492f4bf2da2c6b998f66ec6e598cced6d
SSDEEP 192:sxZi6RdWR9/fxCsZVnOIdpqSKrHW6+WNCHDfWx5/YazGWIg5GJ:sxZi6e//fssZVfcHbOS/JA
TLSH
T1D632D955AD38697B9CC7D20DBA16BF53E2F5513291D41F48AAFC8A1C14EB7CD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 df5f0fb09da28ad114fed531665c00bd7fd94e957a1f95a5179d83a3f402b31d
MD5 9be28af296513a5e2c585698885e4304
SHA1 d50047be38038e291d224e6613cacc9329e7cd4e
SHA512 7312b4942caaa3ed5c38d5c6ea259f4fe26e5a1498361cdae257979cbb013e7ee468a0c8932511aa5c8a0ddd579372548201cff06bf2206df3e8f346f8556db0
SSDEEP 192:sxZi6RdWR9/fxCsz+nOIdpqSKrHW6+WNCHDf/YaRGWIg5kJ:sxZi6e//fssz+fcHbO/bC
TLSH
T16022C955AE38697B8CC7D21DBB16BF53E2F9513291D41E58AAFC861C04EB7CD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 5bd59e5e501d234893a26788918039c75ec419980aac05a92c5ec71d66b396a0
MD5 1a302b4e5e3b07dda591e0bc4231faa0
SHA1 f9796af6b8723a89c5a927d296f993cb6a2974fa
SHA512 b3701823531366e3ac78ef9f54047246e175b75dc6dc468a8a4dad2016ecefe1461ab30657bb9547ec08c1873162ecdd5605aa12108cfb10a660865e8faf36bb
SSDEEP 192:sxZi4RducBzR9/fxCsZInndpWtuuzs22gN1i510HW6+WNCze+juEFuDfWx5H4W/5:sxZi4Gmz//fssZITfGHbSOSZ/J7RR
TLSH
T11072C892993499B78DC7D529BA31BF16D2F55122CCC54F9CAEFCCA2C10DA6ED2207807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 0b37557910233b7d7b4041fe031704d5bea3ad26c57a89d6bf88e34025cea9fc
MD5 459d0f064f7a3d12d49b84cc325f0eb8
SHA1 3969153c9645d165849fa800f1ef4ba0fe9ec87a
SHA512 6892d0b542a956b4d810722e45c4e5fac1242a0f8da411775125aec2593113f72885e5edeb6cca0ffdbd7f82e9f5e6af33ff429eefec50aabe0e9901ec6f9e6a
SSDEEP 768:G3yQRbrWvvlRZ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVaKLlRXH3ZroszZ8Z:G3yQRbrWvvlRZu1jaXKLf33ScZ8Z
TLSH
T121C2EA2B640CCB7E4FC01E9DDC6A6F976EA802C7A6588D4447FA984C02C77EE51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\b53fd729-5e68-4c79-ae2b-a02eed782329\index-dir\the-real-index
Size 2KB
SHA256 7683bd95b671b5a0b816b5bd848ebf419d3a0acd995738f8f93e1d68615d3430
MD5 4bbfdeb34f372c1ecca02dc6fc249d11
SHA1 d2ddce0736f1b94b342198911b720190d39dd818
SHA512 5f319aa4fa5b0b911dee9f3eeb5acb71f1e3f572996f5240964ece222edf156a18fc1a37f4d93c53d1ec8a52d7450e4056d6aa9a9b547f2a7e3184d54c9d589c
TLSH
T1FD41764CCC94ABAEEC7551BD1DD415F287751C38FC58C2E18154B2B53403AA81B5B9FC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59fe5b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\b53fd729-5e68-4c79-ae2b-a02eed782329\index-dir\the-real-index~RFe59fe5b.TMP
Size 48B
SHA256 e6a3ab7374c1c041fcc65a037fb8ddf5ebbbfaa3b73953c212694708f619a320
MD5 461f3ccc90511ab74ab40587c7732511
SHA1 66dfcd149efc901e99caec087e2ae538ab5c009f
SHA512 c8dacc60ad9b043dd76005ae98710d4de9afbf01775a93ececbb167a8e6e1254c1b2823c0c87ee31182d207f1ba35aa41e7085cb33942f5f469cc01fb0947d66
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 214B
SHA256 dde80c1ba2d4f859c21ef58816fd1ec0e90a6906d80c1c9a8203c39dab6c185a
MD5 165820dacb72153ba3ff693955e3c085
SHA1 c1c96ae036a175dbcdd6c81f374311279077bf4b
SHA512 20ffb9fdc333f6f645a0ece69a9ee00c034ad20faa35d223e4727674ee2c9b664bdffc8db0e684f4e5d672543973ddd786308e1f771003e833227ddd930c06c1
TLSH
T10DD022DA8170C4DBA734EE85A439A19E420E5CACCC8AD8E5EC04B00770F8703C149A38
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 130B
SHA256 56beb35c30234e6cbf9c2010f71f026f7fe5ce0b98d4d07832a4afb0973d70d3
MD5 1b8396e704647f5eee90a77c0b32dadf
SHA1 0b01d5d87c7ae90908364df80a6af9c13fc03bce
SHA512 8b14988b6f7693cef28a417e08689fc300fa23e90b014be2af4e9e5828cb674ecd548500a7fea1a4ed0dd28e3f014fffe340e67f6afae48994adb52a0f73bcf5
TLSH
T1A7C092E62810C59F9B70EFC82478A2AD950F859C89C7CCF9EC58A40B70B8A138406939
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 132B
SHA256 70eeefa346f9fe926340d797b08f93c9d33f805b307907c1141128222687b5db
MD5 ae696d7be5f90ba4ec7600aae7d62446
SHA1 83c7c3e6fbc46d5b440b6805921b93e197889c3d
SHA512 207591b95f9482c6d29093756234442e7945cb7d978e454b7120492f7a089846a4d20d6791aa691bd16e210abae40fb12d45afb01f64bc07271dbf2fd0b1f160
TLSH
T101C09BE6181045DF5A30BFCC6478766DD50F549C89C7DCF5DC54940772A4B138405935
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe59d17f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe59d17f.TMP
Size 137B
SHA256 7a692428535ccb6faf14f5ce235f5ea60f2bee727358b6589539652147a54b2e
MD5 ecd63b6ac82b6689621d97dafd8ff1e8
SHA1 6b3a3d72a4d10a1aa97f7cd3e65c154ac835d11e
SHA512 79347860ac751574615d66ef6d2c45c21dc079157773913b60013cfe097db4c5dc5863fb127b7ae4781ed9cfb4f142c89b82e5c005b0a8a462cd6c0aa2ca99d3
TLSH
T103C09BE21410459F5B316EC45478629D951F4C9C8DC7CCF5D855B5477074613C505935
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\1adacc9b-26d6-441f-8c91-36a9b595a034\index-dir\the-real-index
Size 528B
SHA256 1671c0e7bb9cf3a22a029256d7d5a659046483ba6e479cd276ea685621bcae17
MD5 95007db980af275dd1cb403bf4e33975
SHA1 74527e3a9dd1c0f69526b5be09ca2ecfdbb57c2f
SHA512 40397ac747d4909dd9e38f2d7ddc3a7b59896d64ea2cfe7902bbb44097ad211a113be1973b3026e43cd9b5bfd3e63a0695519cfcb9e12e8d240656d31a757a13
TLSH
T186F0F1D83D1341DAFC200136B03D655557F402CC53506A4B30FCA0164C477847B816F4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5d99e1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\1adacc9b-26d6-441f-8c91-36a9b595a034\index-dir\the-real-index~RFe5d99e1.TMP
Size 528B
SHA256 dd164611fa15bbc949d84537d69207d9090622715ca92c72cd7aa0210313384c
MD5 38610b4f49a1e394656cdf47a8ca9be8
SHA1 79ba376404009012c05ba3963509bb03bb006cc8
SHA512 787d9bf95f3a440ae0863ea67d522aa5c8adc5c2a8e14e0c6040ba960740f39fb050160beb7a697d6f19fcb773eda373325e4d1df8f52a0278bb98e1b2a3adab
TLSH
T1FAF0C0D856138796FC044272A52E656A62A51448A3652F4FB1FA5059CC43BC05E82BB5
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 53b7f0638612f17668c20caeb0959ccda84369637b774f62599bd63ff008761c
MD5 5d618f91d786161a4bc7b6ae2a345ccc
SHA1 2c746561a2f1cf8ed5fdff8724a7828300bc7395
SHA512 b64ce2a18a2951f10586da6a4b4dd453b71a957e57ef378f3cecfa7d6445ef10889f4aa458f5532de115673e3fb3883da1facd98e7a94d7a2fb263b8c63fe010
TLSH
T1C6E06FBB3EE72800AEFF83E2083140A90001B8008999EC4EA02AC3C740B13822832CB2
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a566779293633a3ea3f8a3ec5ffff2d59df0622b\3f9a44ea-61f9-4d8c-9c57-c18bb0f9a304\index-dir\the-real-index
Size 96B
SHA256 6a157086fa50992b201fdf9b4e0dd1d5e499b0f413ea62b0b88f659d8d52e250
MD5 bd9cf64114e82e076dd43aa7b275a091
SHA1 57f5b03ddc646d97d5b3cc5cfca1628f31d0e9e1
SHA512 429aaafda87f9c5590360a271dafe316d3d52ec67574e28354e0a7f1201be95cfb9ff5b7bc06947b45011ace6d8c7e5620787b9a06fb7914ae683f6e9d16a79f
TLSH
T1C6B0240D40141043CC00133054D1317133F04C4C770D431740DC0D704C433773CD4410
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a006f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a566779293633a3ea3f8a3ec5ffff2d59df0622b\3f9a44ea-61f9-4d8c-9c57-c18bb0f9a304\index-dir\the-real-index~RFe5a006f.TMP
Size 48B
SHA256 89dbdca7c4561275362b57dc1ab13ae6f9bcbb00344aa8c420f8aae4715a243e
MD5 8621f2d58912d496925ae2ced6f26d95
SHA1 c3e8eef7c3b532835dc36cc0cbd8eec6a2ba4849
SHA512 d4282824af7a86a6e0c17b4af62a055df43ab67919fd5fe9fd9162a1996e663b389e6a0491d4fde526604cabc4b9be4600c1930554b8598baa44e526a3bcb77b
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a566779293633a3ea3f8a3ec5ffff2d59df0622b\index.txt
Size 112B
SHA256 c4cbdfd1e6cb0289284280cc60ddde6a9886e530d3bf4025f4b730b0b3a175d9
MD5 85c12cf9b083ac67b775bcdc11f0574e
SHA1 6057fbfb91ece0c7a1147f1b30744c9ee5f2e9b4
SHA512 18dbe1724380cb0961e82853e7eedb883e9de6185a95b4fbb73b7f2ff3e6a55111e39e26f94209cd9c04e5d730b33f41821156acbdcafdb84b6f5d989dcb84a5
TLSH
T11FB092BB09292C4A5980528A00102A8D8B1B236884EA4888C9156416AA008F7A88AA9F
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5a00ad.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a566779293633a3ea3f8a3ec5ffff2d59df0622b\index.txt~RFe5a00ad.TMP
Size 117B
SHA256 0974b3887ccb4377ce425bb9df6b416654aae9976752337c22778fbe0558ea04
MD5 41b73ef473da49dd9b15eaeae1a2d496
SHA1 06cb0e7bbef01a047920fe492ea1a91e9b657955
SHA512 98656be0115aa7794b130b44c7c3c1ec23125376a0c68c6cb6562053c400800df57ddc44b7389bee71558bc1139f39938629fefcfd86dc88f9d94d423419372a
TLSH
T17BB092BB0A39284A5A80028640241A8C8BAB6F6848964940C9167806B9748F3A98EA9B
MD5 SHA1 SHA512 TLSH

Submit Download

f1cdccba37924bda_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\f1cdccba37924bda_0
Size 4KB
SHA256 b7ecc6d528c31113746f588951b096383a23d1b350b8aeb95adebe5da89dc9f6
MD5 45f6c00c0cd0e3af2b26f8ac55029f88
SHA1 dde802ccf57126cdaf807e212b7b60c852ffc5ce
SHA512 e4f40e46783045a2a983d76a3ab828085cfce29a08692ea0533c25893c2b6c504208c460ad82a2619f49c08b06069025a07a566e68704e6f91fc01aa3899b05f
SSDEEP 96:GZk9eqDp9T39tR2eo9KO83FWGF+ROE+SXiYV+l+OqS6zRb:GS9RDrTx2eyU3FWGF+o+Xi8+FqtJ
TLSH
T15A91E9C20B7C35A3C7A39AB0EEC5D4AE7E7910C1278A5486744ACD7A05D2BD049A598A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f1cdccba37924bda_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\f1cdccba37924bda_1
Size 2KB
SHA256 4ee7c85d35fbc92bc4bcc72afa7aecb694c737031b6acab0bc82d26e385f2e3e
MD5 fb7283eb00f7b243df3e4d75f10a0605
SHA1 d1fff26e4acf2d89cbb3b4b80f199d4e5f78d508
SHA512 fc5cad5df3d9b7dbc3d37465a6145b4fcb32c265a33dda27d4705853e477cd5a766bda0f2b6139614ceb0944f89442d666efcd7a75b95e50ca5f4cd795fa9c61
TLSH
T10051248283D63C2BDE3B57F9A5938127BF759A847B47E35A449213718C227B38CED406
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 f4f850951e7419991131a4c4876e5797d39672c4a9e3cb53801ab52c33beb127
MD5 3bc4f5ec31840fdc24911dd69a0c1eeb
SHA1 889945a7332f69feb6c4a29b5c3d4fba9a0e9888
SHA512 47a0657f08d7b1880eee9bb9ca18fa700b4c04062a82f06e159e0dccc274fe6cd62c1722858884b802c51932e45aaabc811228a94e7bdaaa8d454f226f3651c0
TLSH
T13EA00214015B5427C53866F42055174063D14D550547965DA4E8A5DDCCD216351C15B1
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a4c2d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5a4c2d.TMP
Size 48B
SHA256 2bba2657bc9fda51aeacccfeee39561bd9c4fd8c4f0ad74cb6916383758559c1
MD5 2d41520901e34d246af6bfbcceac0cff
SHA1 8eee43cc1605869b97266acd427bf36d28c23e62
SHA512 edfea502e206943bbd008098b437b4858bff7ccaf40aae1daaeb324a7154fafa1db8ec34c7392872f204f3e247bd828a82f732ccf1941d74fb0e895c76814650
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 2271cc3742ea6bcf54743e28759d6bcd908ea7b6f150881c1afa767ced945c53
MD5 4c07d4de4274e48c69c03a1af1e05522
SHA1 c685103529e20f42b0ee91b01027b31c1aece0c5
SHA512 89f585ddfb57ba61d0fae8b124332b119f297878b42217a996c604cc8e074fd47a037f4f46c3b961e169e5e91584410d0495dca4bb1c51f9fa9fdb305cf3330c
SSDEEP 48:K08x8g8N8B8L8P8T8sb8f8q83IS8Z8sK98518T8sx8R88Y8q878x8bnyLdTNdTsn:K4ZGKSIAasAKtuShaKa4qu
TLSH
T16991B45573BB0201397E2D8C82A4D66B024275727068ED2FBFFD0066DDAAD054EFE9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

00000000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\6\FileSystem\t\00\00000000
Size 1B
SHA256 6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d
MD5 93b885adfe0da089cdf634904fd59f71
SHA1 5ba93c9db0cff93f52b521d7420e43f6eda2784f
SHA512 b8244d028981d693af7b456af8efa4cad63d282e19ff14942c246e50d9351d22704a802a71c3580b6370de4ceb293c324a8423342557d4e5c38438f0e36910ee
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\6\FileSystem\t\Paths\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

01db7b71-1079-47ad-abff-ad22e093798b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\01db7b71-1079-47ad-abff-ad22e093798b.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 c1a693f1f50f3c7f7c08d3d16ed2c44d98b8f769e32455824c8e86938cb8f781
MD5 b94c756cfaf1b107f7ed0b1f6a0e8719
SHA1 6db55c772a77d38310a228a62ca3560b96d4560c
SHA512 2dc8a028a3b84365b816cc05c8525b0a6aeaa5d9f7689971cbf44fc6dfc1a4f329a5ecb15d5d8718a9587bc20841e2a18e241637e3764ac738d2e65ac5004bc5
SSDEEP 384:oZcIhsNCTPxdN3ibtMp5u8iGa128iBkwc0aKor:WhR82kGh8iBkuaKg
TLSH
T178828C366C746C7BA8E6E551F44B3A039EBC816BD7C86F80E4EDA71D01DA5E41307A23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 908ca010daadd9629b5d1702e795198aa736a989432dc191a8dbf4bab39d99cc
MD5 2ed7e2382d6343d220891cb4ee787a26
SHA1 e170959e2b0f0af37f26a1249c91a4d7a8707534
SHA512 6a1084c5c7eb295799dcd339bb1923c9473d4a575fd2ab7d8a21b3610afcb0d85aa6d987c80f7543f7d1657365ec4d40a3cf38b2eb76fe85448e70bd8500cc60
SSDEEP 384:NZcIhsNCyPxdN3iboMp5u8iGa128iBkwc0aKor:VhcR2kGh8iBkuaKg
TLSH
T1CD828C366C746C7BA8E6E551B44B3A039EBC816BD7C86F80E4EDA71D01DE5E41307A23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 425b0338f8fd249915711c0e800779f5369ceac8444480ad0487eb164a144326
MD5 0d5b3328ee5397df06291954d2414988
SHA1 daa0fccafe40ce63e344f52a878e2f954d99f700
SHA512 27aae4922f68080c3c8dd9a2dd999d6cdbb10f7ad29c882633b4d4c36f8483c395902f140304c89f0a5f60d2ab1d5ce1418cec925f58b64143aa1a7795abfd76
SSDEEP 192:SONt6iDCQmiUyt3Hq5u88PGPCuSqUzIU6:SONt6/oHq5u8iGa2hU6
TLSH
T198020939AC787C7B9DE3AD15B54B7B179FE8016FE6941F84C9E8161C01D769C1303922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 08434bf491c35faf9a0dd01cae63f4270ba191b0bafdaca59dbd1e198c4afa3f
MD5 bf083b75a2e042c61213ca072b39901f
SHA1 6cbec9c1d0f7e57e80af003c5e19883450bacdc6
SHA512 0751b9f57249b94a2715a0ce1e2ab1d30401057560ae75516d27473c628bfc7e0114542e7313cba832d96772751369b2675c5e4d71557e830b29ef8d5e28d7db
SSDEEP 384:BiFiZcIFzsNa8TUNTUlIlyPxdN3i0QIp5u8iGa12xiBkwc0aKor:oFQ9nwgEUikGhxiBkuaKg
TLSH
T180C208F248E7987AE8EE9753A73E3D028DBCC157B6845A40B7D8561DCC960BFC306912
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 05530d428e223404e0beeb31afaeb2516d73db352cf4f811d16797c0528fec7b
MD5 72e03efa6e08eb897d2f3f7246725a41
SHA1 7740ae08af8522fd61369a7301fa56e4921a9d05
SHA512 33ca7f9d8b597502886fae92597451f08be05bfc593b68424d2c1480644de7e19156df8de8f113860d43857c590089a0ed74895e4dabbe8bf574a7cf52dde07b
SSDEEP 192:SON76iD4QmiUyf3cq5u88PGPC1/KHVuZI/2sU6:SON765Icq5u8iGa12siU6
TLSH
T1C4122B356878BC3B6DD2A861F44736139EB8426BEB886F84D5EC272C01EF5D85307923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 e0e09d6d57ab493db5a171e396000e1463a511105740cd18310133690bd4519c
MD5 e15eba0d3ac4e556a6b39815c9401437
SHA1 9cdf9710b0eedcffab50d18adba8f2d7e75ae081
SHA512 fa353042ef4ae98a1243ca1462e9fc89d68f3e30044067111673fef61fc9a9becb19c6485087cc46d85a865bc23ed055c66f0d3e55e6616d168f2fbe74ece71a
TLSH
T1D5E00203D70008DEC0344174008727301753C434175143669D1002586E113005F604C0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 34ce80b70ca4055602af226732d5c5c691f4579c98b83939e1ab6c20fb156e8a
MD5 7dac5ed44ddbd74f5ac95a2e18f2f761
SHA1 1bbbd3b01cfb138c4d7908cdda8364e21fe15f3e
SHA512 febf8a33512c9ed0387fde9a2b5bfad63bbef8ff5475a3118586dd3435ba3761fa1cf085400f712b4d8e0179ca84e69f42fa6c8a32d2165f5902669b2fcbbdd7
TLSH
T11AE00102D70018EAC038427400872B302A92842416A142669A20025C6E223006F709C0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 04458a89a6f063dc89a98763cb0712c602da07980db9828a2dc09ab538a10aeb
MD5 a2d32bc6d5d222b70e4d5baab4100bdf
SHA1 296cfbae6f676a8af0e184630ced344ef941a4af
SHA512 eefdf4b64a86ebbeb34264ab0fdaafdaa5d2f50907f756a52fc8093cdec6ec79340241b30c0e2e59bc6ec8f0f1687c3bf1acff2990f7a2ede756c3f539a6b86d
TLSH
T1DDE00103DB0018EAC028477400872B306FE3843416B146669F30025C7E333406F70A80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 b0e9ba5fa44613cd52c83e97096082d94d7bd3b206e690276ad298e83b75af40
MD5 2da61952aef93b8d416c976294dd8faa
SHA1 9c77f1f48123f23fde709f1a7eb08db3a5089840
SHA512 a1d24be022c83767263207e8ff603ddf633c66e562c2d4b0d3ac900ce50c6e9ffffc892e31d67c29326e638de086fc02889d73fd79d04f557c167a15fd265bcc
TLSH
T194E00902DB0028EBD428437401C76B216EA285641BA24666AB30026CBE763406E60B80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe594646.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe594646.TMP
Size 392B
SHA256 b53cd2e00c718354e46b950227d73dc525d1685be60deed5ab8718aaa84dd2d1
MD5 9705e153d0e1a93e3ac88a393ae4f67a
SHA1 e55dd4a133705b0f2b5bd0de5515c6a1efa60a7b
SHA512 c6d8de000772d5395b6d7d845ec2530dde2c8ca63779d5a160f531eabcc4a8814f912de73f81b77f1fc8371448a3ae78046d07c9d535258960c896a0ed9711a0
MD5 SHA1 SHA512

Submit Download

ace2657c-0eb5-471b-a58a-ca430ef9e659.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ace2657c-0eb5-471b-a58a-ca430ef9e659.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 4559b46f10870aaf74b0c69c7cc5ed8e26825031f8f3a490c77dc65af08b4444
MD5 2368f8e0bb81538edbdf4e7c4fc54699
SHA1 f4f962399ea803e56546bf230ce2cc36ae51b7bc
SHA512 38bf4306439605f49da57efd4178216e980bb4b5d0d150f4f89439f9b8c77edd03f6321f11efb1190e2a5253306159207b3ac7e13e709fe4484d6ad82a00db9c
TLSH
T160411858B6EA1148B3B77F1AABF6B42D483BB9772E06959E00110D4F0622A40D9A1B37
MD5 SHA1 SHA512 TLSH

Submit Download