hxxps://fitgirlrepacks[.]org/

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
user interaction
yes
max time kernel
1799s
max time network
1788s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/09/2026, 18:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://fitgirlrepacks.org/
Sample260922-wweb1scd74

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3228	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134345745803588458"	msedge.exe

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1846164713-4096795028-774071693-1000\{C6D3C9BC-9203-4D65-AEA4-B41B635BF216}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1846164713-4096795028-774071693-1000\{28F341C4-1F69-4439-B4D9-ED3CDC492B8F}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1028	msedge.exe
1028	msedge.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 26 IoCs

pid	Process
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5040 wrote to memory of 2028	5040	msedge.exe	87
PID 5040 wrote to memory of 3228	5040	msedge.exe	88
PID 5040 wrote to memory of 4156	5040	msedge.exe	89
PID 5040 wrote to memory of 4156	5040	msedge.exe	89
PID 5040 wrote to memory of 4156	5040	msedge.exe	89
PID 5040 wrote to memory of 1960	5040	msedge.exe	90
PID 5040 wrote to memory of 1960	5040	msedge.exe	90
PID 5040 wrote to memory of 1072	5040	msedge.exe	91
PID 5040 wrote to memory of 1072	5040	msedge.exe	91
PID 5040 wrote to memory of 1072	5040	msedge.exe	91
PID 5040 wrote to memory of 4780	5040	msedge.exe	92
PID 5040 wrote to memory of 4780	5040	msedge.exe	92
PID 5040 wrote to memory of 4780	5040	msedge.exe	92
PID 5040 wrote to memory of 416	5040	msedge.exe	94
PID 5040 wrote to memory of 3464	5040	msedge.exe	95
PID 5040 wrote to memory of 416	5040	msedge.exe	94
PID 5040 wrote to memory of 416	5040	msedge.exe	94
PID 5040 wrote to memory of 3464	5040	msedge.exe	95
PID 5040 wrote to memory of 3464	5040	msedge.exe	95
PID 5040 wrote to memory of 4644	5040	msedge.exe	100
PID 5040 wrote to memory of 2640	5040	msedge.exe	101
PID 5040 wrote to memory of 4644	5040	msedge.exe	100
PID 5040 wrote to memory of 2640	5040	msedge.exe	101
PID 5040 wrote to memory of 4144	5040	msedge.exe	103
PID 5040 wrote to memory of 4288	5040	msedge.exe	116
PID 5040 wrote to memory of 4288	5040	msedge.exe	116
PID 5040 wrote to memory of 4288	5040	msedge.exe	116
PID 5040 wrote to memory of 4276	5040	msedge.exe	117
PID 5040 wrote to memory of 4276	5040	msedge.exe	117
PID 5040 wrote to memory of 2568	5040	msedge.exe	118
PID 5040 wrote to memory of 4612	5040	msedge.exe	120
PID 5040 wrote to memory of 1948	5040	msedge.exe	121
PID 5040 wrote to memory of 3648	5040	msedge.exe	122
PID 5040 wrote to memory of 3432	5040	msedge.exe	124
PID 5040 wrote to memory of 3432	5040	msedge.exe	124
PID 5040 wrote to memory of 3432	5040	msedge.exe	124
PID 5040 wrote to memory of 788	5040	msedge.exe	125
PID 5040 wrote to memory of 788	5040	msedge.exe	125
PID 5040 wrote to memory of 788	5040	msedge.exe	125
PID 5040 wrote to memory of 4284	5040	msedge.exe	127
PID 5040 wrote to memory of 4284	5040	msedge.exe	127
PID 5040 wrote to memory of 4284	5040	msedge.exe	127
PID 5040 wrote to memory of 5744	5040	msedge.exe	128
PID 5040 wrote to memory of 5744	5040	msedge.exe	128
PID 5040 wrote to memory of 1028	5040	msedge.exe	132
PID 5040 wrote to memory of 2392	5040	msedge.exe	133
PID 5040 wrote to memory of 2392	5040	msedge.exe	133
PID 5040 wrote to memory of 2392	5040	msedge.exe	133
PID 5040 wrote to memory of 1864	5040	msedge.exe	134
PID 5040 wrote to memory of 1864	5040	msedge.exe	134
PID 5040 wrote to memory of 1864	5040	msedge.exe	134
PID 5040 wrote to memory of 6032	5040	msedge.exe	135
PID 5040 wrote to memory of 6032	5040	msedge.exe	135
PID 5040 wrote to memory of 6052	5040	msedge.exe	136
PID 5040 wrote to memory of 6052	5040	msedge.exe	136
PID 5040 wrote to memory of 6052	5040	msedge.exe	136
PID 5040 wrote to memory of 6044	5040	msedge.exe	137
PID 5040 wrote to memory of 6044	5040	msedge.exe	137
PID 5040 wrote to memory of 6044	5040	msedge.exe	137
PID 5040 wrote to memory of 4464	5040	msedge.exe	138
PID 5040 wrote to memory of 5408	5040	msedge.exe	139
PID 5040 wrote to memory of 5408	5040	msedge.exe	139
PID 5040 wrote to memory of 5408	5040	msedge.exe	139
PID 5040 wrote to memory of 4308	5040	msedge.exe	141

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://fitgirlrepacks.org/
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff9c3d9c188,0x7ff9c3d9c194,0x7ff9c3d9c1a0
  2⤵
  PID:2028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1824,i,14799173874209662526,3717565108719991471,524288 --field-trial-handle=2316,i,16859789382548731464,3828863646899320756,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1620,i,5998224318620136180,13389219597508938724,262144 --field-trial-handle=2316,i,16859789382548731464,3828863646899320756,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:2
  2⤵
  PID:4156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2500,i,13558969277802814757,9489260413027847105,524288 --field-trial-handle=2316,i,16859789382548731464,3828863646899320756,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:8
  2⤵
  PID:1960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,2050528596586086054,9608756803699909163,2097152 --field-trial-handle=2316,i,16859789382548731464,3828863646899320756,262144 --variations-seed-version --mojo-platform-channel-handle=3436 /prefetch:1
  2⤵
  PID:1072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,18224085789505725784,7093732357167898293,2097152 --field-trial-handle=2316,i,16859789382548731464,3828863646899320756,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4232,i,15272478846901797886,12381955890430816698,2097152 --field-trial-handle=2316,i,16859789382548731464,3828863646899320756,262144 --variations-seed-version --mojo-platform-channel-handle=4536 /prefetch:1
  2⤵
  PID:416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4244,i,173842040358092118,14471584202851311797,2097152 --field-trial-handle=2316,i,16859789382548731464,3828863646899320756,262144 --variations-seed-version --mojo-platform-channel-handle=4572 /prefetch:2
  2⤵
  PID:3464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4644,i,16577555877495894143,1626174264938976040,524288 --field-trial-handle=2316,i,16859789382548731464,3828863646899320756,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4872,i,6779157016067831854,14559400325079592474,524288 --field-trial-handle=2316,i,16859789382548731464,3828863646899320756,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  PID:2640
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,5939644963984359705,13362178787777206243,524288 --field-trial-handle=2316,i,16859789382548731464,3828863646899320756,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,5939644963984359705,13362178787777206243,524288 --field-trial-handle=2316,i,16859789382548731464,3828863646899320756,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:4144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6380,i,15630872766415895380,17780102570768645536,2097152 --field-trial-handle=2316,i,16859789382548731464,3828863646899320756,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:1
  2⤵
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6504,i,9931460005774223208,13216087980554746033,524288 --field-trial-handle=2316,i,16859789382548731464,3828863646899320756,262144 --variations-seed-version --mojo-platform-channel-handle=4748 /prefetch:8
  2⤵
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6528,i,17999181704023659609,11821866034368817189,524288 --field-trial-handle=2316,i,16859789382548731464,3828863646899320756,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:8
  2⤵
  - Modifies registry class
  PID:2568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4636,i,6619100840442275956,8457396326063686258,524288 --field-trial-handle=2316,i,16859789382548731464,3828863646899320756,262144 --variations-seed-version --mojo-platform-channel-handle=4708 /prefetch:8
  2⤵
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4552,i,12489712820863313819,10308819683304920700,524288 --field-trial-handle=2316,i,16859789382548731464,3828863646899320756,262144 --variations-seed-version --mojo-platform-channel-handle=4536 /prefetch:8
  2⤵
  PID:1948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4720,i,16647872677042723783,13712458941854406246,524288 --field-trial-handle=2316,i,16859789382548731464,3828863646899320756,262144 --variations-seed-version --mojo-platform-channel-handle=4668 /prefetch:8
  2⤵
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=2896,i,10065179911405519570,85458369984540846,2097152 --field-trial-handle=2316,i,16859789382548731464,3828863646899320756,262144 --variations-seed-version --mojo-platform-channel-handle=4720 /prefetch:1
  2⤵
  PID:3432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=4536,i,12847108365744510429,14179790867524211597,2097152 --field-trial-handle=2316,i,16859789382548731464,3828863646899320756,262144 --variations-seed-version --mojo-platform-channel-handle=4696 /prefetch:1
  2⤵
  PID:788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6464,i,6739804719795888444,4074788368272176867,2097152 --field-trial-handle=2316,i,16859789382548731464,3828863646899320756,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:1
  2⤵
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6604,i,15343520805626308892,12885766538185629586,524288 --field-trial-handle=2316,i,16859789382548731464,3828863646899320756,262144 --variations-seed-version --mojo-platform-channel-handle=6980 /prefetch:8
  2⤵
  PID:5744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4228,i,220214432386745897,17811744361886223160,262144 --field-trial-handle=2316,i,16859789382548731464,3828863646899320756,262144 --variations-seed-version --mojo-platform-channel-handle=2124 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=3932,i,11258176660158308982,768157620212725127,2097152 --field-trial-handle=2316,i,16859789382548731464,3828863646899320756,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:1
  2⤵
  PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=5320,i,6386365311351371545,6836684526787002115,2097152 --field-trial-handle=2316,i,16859789382548731464,3828863646899320756,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:1
  2⤵
  PID:1864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6608,i,7298858941590123848,11784179672740892397,524288 --field-trial-handle=2316,i,16859789382548731464,3828863646899320756,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:8
  2⤵
  PID:6032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=5340,i,3592474501174189537,1151021458330923352,2097152 --field-trial-handle=2316,i,16859789382548731464,3828863646899320756,262144 --variations-seed-version --mojo-platform-channel-handle=6912 /prefetch:1
  2⤵
  PID:6052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7196,i,5420250358360787801,6897853595296165957,2097152 --field-trial-handle=2316,i,16859789382548731464,3828863646899320756,262144 --variations-seed-version --mojo-platform-channel-handle=7208 /prefetch:1
  2⤵
  PID:6044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7472,i,11672023769197183501,1340716469798374576,524288 --field-trial-handle=2316,i,16859789382548731464,3828863646899320756,262144 --variations-seed-version --mojo-platform-channel-handle=7476 /prefetch:8
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=7500,i,3061732972274754511,4655495971375259434,2097152 --field-trial-handle=2316,i,16859789382548731464,3828863646899320756,262144 --variations-seed-version --mojo-platform-channel-handle=7572 /prefetch:1
  2⤵
  PID:5408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7700,i,516208694056770169,9306251599194378949,524288 --field-trial-handle=2316,i,16859789382548731464,3828863646899320756,262144 --variations-seed-version --mojo-platform-channel-handle=7712 /prefetch:8
  2⤵
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5552,i,1463993152033984701,13041358423304680909,524288 --field-trial-handle=2316,i,16859789382548731464,3828863646899320756,262144 --variations-seed-version --mojo-platform-channel-handle=6920 /prefetch:8
  2⤵
  PID:5260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7944,i,15766976815917337348,15961597533616060777,524288 --field-trial-handle=2316,i,16859789382548731464,3828863646899320756,262144 --variations-seed-version --mojo-platform-channel-handle=7956 /prefetch:8
  2⤵
  PID:1124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8232,i,5887513618946605761,17595718097847142809,524288 --field-trial-handle=2316,i,16859789382548731464,3828863646899320756,262144 --variations-seed-version --mojo-platform-channel-handle=8220 /prefetch:8
  2⤵
  PID:5872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=8412,i,16990949286324153641,1803001564652322678,2097152 --field-trial-handle=2316,i,16859789382548731464,3828863646899320756,262144 --variations-seed-version --mojo-platform-channel-handle=8376 /prefetch:1
  2⤵
  PID:2740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=8200,i,7559423945117119499,11097333440694694653,2097152 --field-trial-handle=2316,i,16859789382548731464,3828863646899320756,262144 --variations-seed-version --mojo-platform-channel-handle=8360 /prefetch:1
  2⤵
  PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=8472,i,15921848955966916953,5726372650557895817,2097152 --field-trial-handle=2316,i,16859789382548731464,3828863646899320756,262144 --variations-seed-version --mojo-platform-channel-handle=7408 /prefetch:1
  2⤵
  PID:5944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=8164,i,13871368145753255864,6474259281863101550,2097152 --field-trial-handle=2316,i,16859789382548731464,3828863646899320756,262144 --variations-seed-version --mojo-platform-channel-handle=8416 /prefetch:1
  2⤵
  PID:1536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=7816,i,11331225738345055655,10293275783231537811,2097152 --field-trial-handle=2316,i,16859789382548731464,3828863646899320756,262144 --variations-seed-version --mojo-platform-channel-handle=7928 /prefetch:1
  2⤵
  PID:5268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=7144,i,8467099185979490269,12546154589267041466,2097152 --field-trial-handle=2316,i,16859789382548731464,3828863646899320756,262144 --variations-seed-version --mojo-platform-channel-handle=8712 /prefetch:1
  2⤵
  PID:5192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=8408,i,2758234104231097513,9481199501492610715,2097152 --field-trial-handle=2316,i,16859789382548731464,3828863646899320756,262144 --variations-seed-version --mojo-platform-channel-handle=8816 /prefetch:1
  2⤵
  PID:760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=8840,i,13421788386393537445,359178365611023885,2097152 --field-trial-handle=2316,i,16859789382548731464,3828863646899320756,262144 --variations-seed-version --mojo-platform-channel-handle=8796 /prefetch:1
  2⤵
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=9072,i,12073964349907507222,3197047456332472083,2097152 --field-trial-handle=2316,i,16859789382548731464,3828863646899320756,262144 --variations-seed-version --mojo-platform-channel-handle=9076 /prefetch:1
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=7884,i,6944887868046624011,1001842336366923787,2097152 --field-trial-handle=2316,i,16859789382548731464,3828863646899320756,262144 --variations-seed-version --mojo-platform-channel-handle=8720 /prefetch:1
  2⤵
  PID:5560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=3484,i,1972792924102253622,18319813349744542995,2097152 --field-trial-handle=2316,i,16859789382548731464,3828863646899320756,262144 --variations-seed-version --mojo-platform-channel-handle=8856 /prefetch:1
  2⤵
  PID:208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=5552,i,7406132498123929383,9759741500497868273,2097152 --field-trial-handle=2316,i,16859789382548731464,3828863646899320756,262144 --variations-seed-version --mojo-platform-channel-handle=7916 /prefetch:1
  2⤵
  PID:2472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9428,i,13475868465785402769,14489261185745576549,524288 --field-trial-handle=2316,i,16859789382548731464,3828863646899320756,262144 --variations-seed-version --mojo-platform-channel-handle=7876 /prefetch:8
  2⤵
  PID:1864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9524,i,9869099930973723199,16308427358300583754,524288 --field-trial-handle=2316,i,16859789382548731464,3828863646899320756,262144 --variations-seed-version --mojo-platform-channel-handle=9408 /prefetch:8
  2⤵
  PID:3320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8232,i,5828014893309266869,11893987893863632921,524288 --field-trial-handle=2316,i,16859789382548731464,3828863646899320756,262144 --variations-seed-version --mojo-platform-channel-handle=8212 /prefetch:8
  2⤵
  PID:2136

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1304

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d11bd63a3c8c3641d5bd4407fbf20115daee67c3050695788e54c8df9585c700
MD5 7aa846396cdcfea376b8811e8e19c8ac
SHA1 ec25e76211c784e758c9892460a28903222a2b23
SHA512 4816b3d9d1883ae78008726282d2a4c42f9b30d81ff004d60af22873868f3ccc332adb8973ee5a1ed3fdec5d56a832c2ead1cfe30616125d07466daec4eaf02f
TLSH
T17DD02203FF038A2CC8C00CB2002EC22C0F8AF8000A00B2C08030328BCC28B00B02EC88
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7481989667805f861819a64a3969aaaf46d409d3cc4fe4b19154b579a00c6e16
MD5 a70a868c80f3eeab924f0b5bd11ac679
SHA1 22ca93079bed2cfcd0fa02ef66751ff5288ac608
SHA512 380ff0ee96c6b0037a0ca6f886ef323cc451588842ad026ea5bd4a5e33587abc8a13aec63444eb9137cad40409498bf6e0730b0a623f020bfebec6de03bf7d19
TLSH
T1C8D01103FB828A2CC8C008B2002C822C0A8AF8000A00A2828030228A8C28A00A02EC88
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 5bf02d1cbc9f7810be156b048770eeb2f23816cc3a8b97f7934a3c9a519f6017
MD5 49725f9fd021d15a2bf4c49ce0fb4367
SHA1 46adad927b5906bfcb3ba665f0bf15d19886a8ed
SHA512 b833778fcfcfd3942c213881e7b5738f5be2f52ee35b400206d44c1778dfa4549c32cda13049b8ffde3233acf3bcd47aa396f3c392ae11558be6dfe904701387
TLSH
T19BE026C904CAC37FA3887487417C770CC281379F96CCBB0A1B00C48D70C1080ABC2692
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 e6c7fbe2d458ba42327df13370911830a2273f54ef91ac32e70b056426f8fd30
MD5 4eb5d39b4535e2c40209ddd74cab7603
SHA1 e6cd18d45d5aed0fee59c7a13572db8f523fc927
SHA512 1c8b5ff541710698e371fb7150d8886eae6d3395a480941ef37f04423371d9a06b65ad8c72c3832448981c7760b484cec471c52a7498804f69a1edde18924615
TLSH
T1AAE020CC14C6C37D612464C781BCFB0D91C0370E93CC6E552701C844704384476D55D1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 1e556960608d4ce2714c63bd178a0e5be569ad307d12a7fa68730f91579f176f
MD5 500cb36aa18561538f048710d1a5e4af
SHA1 c06f05ca3536353cbcf811d760c1d6d22e94b333
SHA512 10a510f33e0b91641a3220cea1bacabd794689f687473bef77e2919d906b6f152e3d0f946ecfd3246671909465b0de3277e964882aabcfc79462033850e289fa
TLSH
T103E026DC09CEC62FB3486487426E774CC2A03B4F92CCBA2A170DC8897002081A3AA791
MD5 SHA1 SHA512 TLSH

Submit Download

f_000083

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000083
Size 1024KB
SHA256 ecf1088769a2619c2e4ce3e36883113798fa12a93b0b622c5e2e392746bdd50b
MD5 705aa88c07ff38f6eb3e00b821c3a714
SHA1 a568818a328fdae67362b85e17af8eec7f4dc1c4
SHA512 69aef8c7c66e4232f34945dec873453f7ce60b3b7f4c220399309c3433472ce0f06b7c9080c9ab9b2ce01edad1b4d74c770518a2ea3df5881e79e9816f1b82ac
SSDEEP 24576:ml3cto8eQTV2Ud7GrRQgLzqvb8AXhOoFnIDwctM44zdVYhN/iP2w52/W:istnx07rXLGvblukDzdCvieTW
TLSH
T1512533AE529603DD688DFE784A4D153D00EF69A3167B83616DEF3649B39B604012C2FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000c3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c3
Size 45KB
SHA256 9f09a01a3e0171e6650a3c8b503adcabcd11a8db200a94b240dfd216f504f722
MD5 fc74e451b871d4155c26682644ae6d0b
SHA1 cd5625b952b7571d55525543600a47c97056ee37
SHA512 c0dd4ab299e1dac261099f8b98dc6de55746107686e391c459a31305905d1d393651e95505899dc07508d761646266340ca7bd39e5dc7d99b0c757f3269c394c
SSDEEP 768:kq0I7CTZwBppn7lnuJx8zQ+NUvYNKdgz8Z1Yhv6qt3BbQrc+5/yjik/jMA:Rzckd7puJx8z5NUvKOgU1YhVoc+ZTkLl
TLSH
T11923018583B844C1264BD8259665E7B241B7A70B53378B360B5E09FC3CC5DC6BB4F6D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000c5

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c5
Size 16KB
SHA256 9a4447bafffa7f28d381ad5718f011c7f0271654f6f4627c73339e11bb441de3
MD5 97e613d78061090d61cbcf90372f1ac5
SHA1 86900236e94f716a7c3adc08e362329b60829221
SHA512 7b8c594c17bcf2d708ce7f94a34c231b4003a1b176d47a991f67cfaf35f304b63089796e1d5e834e3ba9327fd2b336a69887e64929a8baec60ffc1bee8029146
SSDEEP 384:WIdbkdz44nsteqRGtoxSbDunQ+32pFdSLgk:WIdbkdz44sTRkJGnQk2c0k
TLSH
T13772E0FF23517938987BD9913E7E39C2E5B43EA3C0112EB8F225C95B4338BD9615A510
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 0d0e0a8fd90d3529680a98ff038f6a4601d2a9eafaf1a87bb6a3f39d005c6a39
MD5 0264dfd23c872d71a9708dc7772308c4
SHA1 bdb9a6918003973faf80e324534d7cc16a2c9ecd
SHA512 d74a066e4eb6b486ac525d668898fe680b45481d218674e3f77fb30d3771da81cd8b1a25afc75bd2f1fc6ead81d97d29d9b6dbfb90d3bbd2571fb518264ac250
SSDEEP 96:zVEMmO996ylJ/yFswdbgdKRspfX53EF0LMDcx1dGJVQd/Iv3Y/CrRCHktzy:u8DlJqFr1M53EyJdWQV8rRMSm
TLSH
T11AE10C44D8C0A911FF54B4BD43C57C863378689EAC8B9F13625BF978A9B37EB181CA44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 9af58df6e41233b31200c6ff41aec363757f845b843a1054ec56088e71514ef4
MD5 bf54fbbf456b4b4fbe3829b8a94ee687
SHA1 1bfee8064e47ff6874460ccf8b327d37bcb5cc68
SHA512 87b9bcbdedefd7dd1b2a6edec1a8bb772360a1d3a7efcdd647e7920367fc4bb283e62ac6a5f0966e4fe3a2f76e7f79721288c934cc992fbdd4de02a03f1f6d45
TLSH
T16E519541C9802862FF90A17D95C65D8777348CAC3C878E1727A7F8BE9EB3FB20608654
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59d3a2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59d3a2.TMP
Size 2KB
SHA256 515464cdb667767fca3566f4c7527ed3a3e8a0f755bdda3f111d864dea503439
MD5 ba5d7d40b49cf4c481fb8c6a29b31521
SHA1 92f64e4dc4e95b575fb8449048b6db4ad2a1dd8e
SHA512 3534fe22c1589678e95d2d031d28f732260fb42130986ce3e11da76f65a9f1cd10c2934c334ea977577cbcb03173c95b5d33928c62c2c18481cec03e59acc948
TLSH
T1A9414342CA5028A6FF9485BDC9D41E9B3B709C91ADC3CE1703ABC4BDEE76F725604258
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\t\Paths\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.arenabreakoutinfinite.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 19KB
SHA256 2608b5ef3e25b3cb06664c8a232fa2b51dad324fccb3d1485ffeae56601b317b
MD5 503ad0f333da739bc96c3f0af9e3f7b5
SHA1 74191905bddf70d41cbe312df3469f853a3380c1
SHA512 0ba4e7d59b44f52c17b5c691773f4330d9cca4d664e224a9f64ba02d16afa8014132ddaf4ff5a8ff960755b600c56f4dbd6eb40e103fae7776a307a64d392a74
SSDEEP 384:DWgxRoCU7bcbUvvkrzh4tnMlVMSpDBeECJ1NbuqlB2/owC01uWEvbjxn0QUdkBbu:5PAAbDTOYVt0i
TLSH
T11692DEF783F5866DDA2195F0DA146F2BCF9C0065436C39A686E4BE4BA3F2071E141B4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 14KB
SHA256 4f4b1833d586b1a9c06623095eb915b2edda334becc3e68610c12e76955f20c3
MD5 2307766f484c4e95d19e66a35ee005ed
SHA1 8c479598f6c3256d4a3464842f0b67f41c70048e
SHA512 71c6ad75345495f922fa88ca9f325a36fe86b777a014fa465e485abc9838486404c390350d0cd13693efd962e3036f0cd6a1381f3336bc067b2c92d830e82aca
SSDEEP 384:DuJr3Z0Qes84EVEPc7L/hS1NbuplBMDowC01uWETbTBn0QUdkBbEWWnd8pEcjq7U:z8jbsp5
TLSH
T19F62DEF7C7F4462DC91196F0AA14AE2BCF9D04A6536C3D16C6D4AF4BA3F24B0D141A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 21KB
SHA256 074c9d8d10e12fe1bd657393a727e804a0cc08669ca4d2efe3535a15a45599e3
MD5 e3cf2bc5f643e43f3f1d2c023c39fead
SHA1 a91a336ef3b15259df4d2755020a048e1d3bde9a
SHA512 4351fd24313dd1dc0de3c63c6de02d14718ac09ca05cd0a5e79c93b50488486f1ed96dffdbcc84392ccbc0184eb74e3119a0699d6510d53580d640d87bebd148
SSDEEP 384:DWgxRoCU74EVEPc7L/h8T5NuurhIEBe+xO1NbuqlB2/owC01uWEvbjxn0QUdkBbf:Q6qAbqOLvtgY0
TLSH
T1C6A210F787F4866DC92295F0AA146F2BCF9C0465436C3966C6E5EF4BA3F2070E141A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 87dea3ed511fde7c7e1578ad15a36982a83ebc499b019364c5f75a3717d682d7
MD5 a0a1edc877a69506de53ba7f27704d07
SHA1 aead3ddb414dc72f141956d8d5574804f6a8d793
SHA512 ed0cdeda402dbef9978c53216175a53cb30ecf977f84714b379ac43fcfe42c7135840f1b73f39ec2b9d347e0620987e87cebf9841a68e0c6996dcdbadb19416b
SSDEEP 192:DuJeeeMNZ0Qes8m1NbuplBMDowe3561ut9iZiaGbmWBn0QUdkBbEWWndB+dx:DuJr3Z0Qes8m1NbuplBMDowC01uWETbR
TLSH
T1C212EEF7D7F4462CCD118AF4AA14AE2BCF9D04A553AC3D16C6D8AF4BA3E25B0D101A0D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 e14e4ab16ab420f2bd6e539c42becfd2c673e6682f6b3002995f938bceed5990
MD5 aacb08d0cf6ec9165d5c32267a865e78
SHA1 a72f13ada09ac592ed9f339748e8184a1c60bfb3
SHA512 e759d514bd57e68c3bb987b420e0a72f79646efed663d5baebd43195e4cd8d1d24eb46e281f3130d515f861158a5100e552514c47969027a2147bf37e254c9cc
SSDEEP 192:DuJeeeMNZ0QesS1Nbc0VplBOd8Dowe3561ut9iZiaicbmWBn0QUdkBmI8+z:DuJr3Z0QesS1Nbc0VplBOmDowC01uWEY
TLSH
T19602BEF7D7F4462CCD118AF4AA14AE3BCF9C05A553AC3D16C6D49E4BA3E25B0D101A4D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 22KB
SHA256 b7f4bc73d5fc2c344921ff9e9720aa99d9a3cad5eb8f69310c87df69c0d25cd5
MD5 e65885df41bd1e8798f0a3e2517cbbab
SHA1 63ac04cd1491855532b28def1bf825f127c41f19
SHA512 3bf1840a6ec010821fe3474b731f906af1cfe91691b886d7b227574366027a4593a97b22bea33f19cdbb3f8225938385f48b3de4e893f995b20c6f26dc585d61
SSDEEP 384:DuJr3Z0Qes84EVEPc7L/h8T5NuurhIEBe81NbuplBMDowC01uWETbTBn0QUdkBb1:z6hjbspLvtgO
TLSH
T149B20FF7C7F4866DC92249F0AA146F2BCF9C0565436C396685E5EF4BA3F20B0E141A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 7916800781c99c9b5391f52118917d8872496c18337f539b0570701d2b50c12b
MD5 417c1aed7074e1f92d64d4a62cc27295
SHA1 ce5c3e827746e89fdf93cb58049633a14138281a
SHA512 cbb563b884efb0c0ff1962d786e0620a0ab99b58f7bd9107e4864e9329aee70d0a7f803f52c26469e4601fa46ef89e4c9e10d787807d84657766a1d9096198f3
TLSH
T131D023F3174870F5E55C5DA14055ACCFD7A700701D03D9D511E5D49D05315AC5557345
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries~RFe5bebc4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe5bebc4.TMP
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 d475b809fca9c239092a6c481617e8fe2db900cc7a0c9f9ec6f91e5192a588f9
MD5 ab158771914a639d0a7e3b41c931c2c8
SHA1 4220476d73e64c3a79430e1a76c290a0ae151632
SHA512 363350fbbbebaf9fa2a2119796ba3d355c232e65147ac29712875066f1bab24b32c7189ad0977ad9794dd2149122e179a3ac7edda7bd8ded506482f0c4174cb5
SSDEEP 192:sxZ8RRWV/fjsu3IdpVuHW6+WN62E/YYBKfpcIgrJ:sxZ8aV/fjsuYsHbc/fK+9
TLSH
T10C22B711AE38A57B8CC7D219BB65BF53D6F95032A1D01E59E6FC861C04EB6DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 53ff48fa06a018154b86486eb6c48052bb0bae3c6a2419a2c1a987848ed5a443
MD5 995aea49b1aedbfbcb56316a86e74e3a
SHA1 1ac74d6b7252dc604364b26e63c23c4649d864bc
SHA512 ef007c17f26623039af9461c5b1316aab102ff22191a7ef6064aba31b0b3512b356898538f27a2184dc6fab950698bfabd4041c67f0e17f2eff7528c2ca2f55a
SSDEEP 192:sxZ8RRyeV/fjsQ3IdpBF2ckwHW6+WNV2ImkAGd9tYYBCNpcIg5jJ:sxZ83V/fjsQYLHbLA2tfdP
TLSH
T12832C756AE38697B8CC7D219BA55BF13E6F9503291D01E45A7FC8A1C04EB7DE220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 28fb2fc47370c69b30f1a9200ac7415620d3ef02fe9d378228ed960a5d6b147b
MD5 e5bbbb2610bc792e1c032afd0a47c30a
SHA1 98f51076f86ac0898e321122e00f9e3beee3ab58
SHA512 6a255c3e20c1ca27f2d62ace0db24e70402fc1c4e4b4317e34970f90ba9b6530f658c526039c895bc07365ffb61343e0e83a94244b085eaa45d2279d2f133c24
SSDEEP 192:sxZ8RRWV/fjsQ3IdpBF2ckwHW6+WNV2ImkAGd9tYYBCNpcIg5jJ:sxZ8aV/fjsQYLHbLA2tfdP
TLSH
T12D32C856AE38697B8CC7D219BA55BF13E6F9503291D01E45A7FC8A1C04EB7DE220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 8ce521d1453f4c96d58600434fbfa2e67911f2782b341afc4de35a34d9ad3b5a
MD5 981f33e7899642c7d0aa9fbfd942cd23
SHA1 6ef0c771ec498f2360c777bd88994f0628dded34
SHA512 f6e33e1a7bf299cc204a7ff88877e0919fc2336ac3b4d8e7840f2f223ec02e546c3f37d2492fcd9e3b20565c7423ad95f1578e4cd2919480a2fb38cc20b9b4f9
SSDEEP 192:sxZ8RRWV/fjsA3IdpVuHW6+WN62E/YYBKfpcIg55J:sxZ8aV/fjsAYsHbc/fK+5
TLSH
T11F22C711AE38A97B8CC7D219BB55BF53E6F9503291D01E59E6FC861C04EB6CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 4aa029eb2f11152ba51756469fce233842653178915ce5a61983963ef64defc1
MD5 a6557d294a17f37f03b7f59671d9512a
SHA1 020b41c105dadd80dd28cc3756ce17a1be86607a
SHA512 3f5ed3978ef644724d50e1d29c7ccfe14a67bd09cf2101e5d241faee05752b425262f815e587b9e2d768efa97efd2f441aba2aacaa78ce62b734ec072d50a36f
SSDEEP 192:sxZ8RRWV/fjsQ3IdpHF2ckwHW6+WNV2ImkZYYBdepcIg5jJ:sxZ8aV/fjsQYdHbLZftP
TLSH
T10A32D756AE38697B8CC7D219BA55BF13E6F9503251D01E45ABFC8A1C04EB7DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 bf1dcb1c5c8ec85ed11711730e30424a01c460a1b2232d3dfd0913550cfed844
MD5 99c8e3c4cd9c258e757b3a10a8a1142c
SHA1 90c171ef7ae7567e48372e67acb5d2e4f68e9445
SHA512 4b54015f902acbe1c44f44a722d8f5fb4a322faedd1d616c0f67f74cbbb81504bcfb265ae5abeb33bf3a75d409e9427c860ae5222f4a0f85fc7d03d58f65a0ec
SSDEEP 192:sxZ8RRyeV/fjsQ6IdpBl62ckwHW6+WNV2I5RFjtd9tYYBK5NpcIg5jJ:sxZ83V/fjsQToHbnHj9tfKeP
TLSH
T1BD32D756AE38697B8CC7D219BA55BF13E6F9503291D01E45A7FC8A1C04EB7DE220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 8582fe2f91fad43c8f0111784fea029e230c01051853773cf1467c362a63dab1
MD5 5c6669f488e1d9fccc30f22df1c0f16f
SHA1 8b1038a93bde85a29b24da550a3fba8fd06d3ea2
SHA512 24ab988c4ee1ee5a77cc2fa7a8fb689473d15ebeee5f595b2b92d3caa11bd0b9d6aa7af313b7bce23b6fdb422f07e7a2434f80a7782312fdb32423f2ccaaabfc
SSDEEP 192:sxZ8RRy/V/fjsQRIdpBl62c9kwHW6+WNV2I5RFjtd9tYYBK5NpcIg5jJ:sxZ8qV/fjsQaeHbnHj9tfKeP
TLSH
T1F832D852AA346A7B8CC7D219BA55BF13E6F9403292D01E55A7FCCA1C04EB7DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 557af456c5192e770d5d09997c23eacd767c9f34342968480c8887a53f0ec210
MD5 4ab7f06e5cafb10e181942de4f967acf
SHA1 b61c04abd02b59c79f3cf0f26362453fd8aa9339
SHA512 5aa7fdccb3632600f5d5062b5cdb20b9c85c08fb517b1d1082d789d20c319e14855c43a4b4f193c40a65bfaf623d6c4109dbf06c88f99e14d2778c8461c222c8
SSDEEP 192:sxZ8RRyEPV/fjsQpTyb+IQdp4Il62c9kwHW6+WNV2I5RFj47wzd9tYYBINpcIg5V:sxZ81PV/fjsQFeAgHbnHjt/tfvP
TLSH
T19F520956AE34597B4CCBD229FA11BF53E6F9403295D44E49A7FCCA1C04EA7DE220380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 a453102a0ea7fb4440159ef52aa6cf77a29183e76d1cc7d5caaa3cfddd7d9818
MD5 0c31cbe04790364909cb41f861268ebc
SHA1 835fd2f9f58d96b9ef6d5daf821c8bd403f994a3
SHA512 f7904d077d0e75a124a12c5ad75c5ed6837f5633365b1a4671aa060d66893be8a61eca70e864a35e2d39c78953a851b0f7022d8709326c80f7347481e0535757
SSDEEP 192:sxZ8RRyGcBWV/fjsQeTyb+IUddp4IiU627F9kwHW6+WNns2I5RFj47wzd9Nku1/i:sxZ8LmWV/fjsQCeOrHbgHjt/p/fwsCFx
TLSH
T14872F952992099BB4CC7D615BD31BF12E7F950328DD15E8DA6FCCA1C04EE6EE220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 adbf07694fb0563d29244be9149b1559b1329f82c3d22e6c158705d424f2d6e6
MD5 0badcce0cd6b52b2f8dfbf331a82fdcc
SHA1 d1c1ae9d9b18380ce3666651c613a49d3a840647
SHA512 2c5b8a4251177f3cda2a9e8a965dcccf611a163b80ab38e82a5963ff7f345c7d11e7a8141ddd1b81f818fd9ff2dd0e4bc34312ad24392a84f0b9b7602938d7cf
SSDEEP 192:sxZ8RRyGcBWV/fjsQvTyb+IUddp4Iii62799kA8HW6+WNns2I5RFj47wzd9Nyp7O:sxZ8LmWV/fjsQLeOoHbgHjt/+XfUsCFx
TLSH
T12572FA52A920997B4CC7C625BD31BF16E7F550328DC14E8DA6FCCA1C04EE6ED220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 f86e8d04d04cc2d6ca6e4e37fd0ad9f0ff1194a2ce64fe5db84a1981ce50f1c3
MD5 96044dc71a6112f27d0fce5d1a5211f4
SHA1 a6d22b3d7b9dff0a10ae98280e32f57759420c6e
SHA512 efe79f5fd16fca4699f6e60c3fcb0f9a1630a02b01a6f23176a497b66db634e1d8a25fe087c743ff887040c95b4ed91a2ffbadc5b3b67b382ca498b02928da9c
SSDEEP 384:sxZ8LmWV/fjsQseO7HbvjHjt/+v/fIAsCFx:sULmWV/fzsfHbv6fIwx
TLSH
T16372EA92A5209ABB4CC7D215B931BF16E7F550329DC15E9DABFCC91C04EA7ED220384B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 30KB
SHA256 930509a091d200c33617b87b76064512e02763bb0f1583fd32efebe93344f52f
MD5 ed9cf99d574bca3ca331cc8c67732a08
SHA1 70845a7e4ae362feff0f33ba7865ccfb979126bb
SHA512 6fa12dcfee75b6492926190691cde640828bf00732dea07da7d7bd2e70d196a5c545f23efe6dc4455bfbc8694ff20a9636e8fcb1111bbaa9b7299f410c3cb97c
SSDEEP 384:sxZ8LmWV/fjsx66s8qMpRiYnazAW8pZS15posJWeT+zseO7Hbv+p/+v/fmsCFx:sULmWV/fY4Mnc7WeT+zsfHbv7fGx
TLSH
T140E2F8459920C87B8AC35D28683DBE32EAEC50625AC5CEDE5AFCCA1C01DD1FD6B07857
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 4aa6e04045663473f9331b1de3f37f2757fa2475f5d86662051f683155007ee2
MD5 caa1c53ae861bf4edbb2cc4730a68959
SHA1 415c53a423768f5b6410bf3845a966d8e19b0b09
SHA512 1add596bc7a92f2f90764170f34aaeaa16580dd0eee27053113e1941b03e4d23c044c061fadca541a4a27d1e4d9e9f1d0a5a262277fecd7ff65ee1a2bb7e041c
SSDEEP 768:BSyYR7jWv3NpB8F1+UoAYDCx9Tuqh0VfUC9xbog/OViCLlGcvXmropjlY:BSyYR7jWv3NpBu1ja/CL8OXdU
TLSH
T1B3C2F92B640DCB7E4FC01A9DDC5A6F9B6E9802C7A6548D4047FA984C02C77EA912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0e7f9391-6ea0-4287-b226-a3703e4d62b6\index-dir\the-real-index
Size 72B
SHA256 cfd9c40653ae731e60d3d0877dd5818d545ce7b47872cd787f9f5521c24562f0
MD5 7f79fb6496bfab3353f4ddea93ee3896
SHA1 b1b24ad0f8a72fca84202b59db81a627d1c742c8
SHA512 c7b305d73f7b5d301ec71e0fa254c40c3451525e1a3574e8f1ab2e9cecdcbe349f3e607bb1b0fad7c48a37e10685d9e3be70885ec03e29593c40270b75cc8a2a
TLSH
T106A002511AC16D41EC6103751812117592528C75243486AB44F9D044D9E22C04581508
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0e7f9391-6ea0-4287-b226-a3703e4d62b6\index-dir\the-real-index
Size 3KB
SHA256 a73824b55bc0196aacaced396941f0868f34fa61cbd31705d301e33b1185195e
MD5 5c0d29b9140010b591a00193f3c87750
SHA1 e030d824a20cd3cbee4903b8e2b7c79d74f169ae
SHA512 06f212e6ef8af8213f3aff3aedd7cd592d5b71edcafb7264bcd9389d876145416223d2f79dff0ccbf6143cf8be8a82449f94d3fd86424fc50f316c744ef88cf1
TLSH
T15E51C78FCD465B96DDAC52B624761483237916CD03440A1F5EFDE138BDC33AD2C4E518
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5b7423.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0e7f9391-6ea0-4287-b226-a3703e4d62b6\index-dir\the-real-index~RFe5b7423.TMP
Size 72B
SHA256 a63417447b0ec0f9b6bb4f62e6986e16c53b2d67d0b9c27065e3703beb86b90e
MD5 f7af04f6d9c89e8d693f8e3fa1243e45
SHA1 bd3170f573c8b2d50ccbe541bdda435e4a7303b3
SHA512 7f3b125db0fa2556a8a93dc3a3c6f5629363f64759ea233535a3af79043c9b53cbad9aa0267fb9cd81a7854db95f75ae339e9b9becdae6dd60ee24472773bfe0
TLSH
T122A0025027C06FA2DC610B76150352651602CC106420833B50F34145CCE31C04A95560
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\17c9f7c9-75b6-4651-a32c-d59ed1a12c9e\index-dir\the-real-index
Size 72B
SHA256 345c68f9c4a89491356cc4a3c0da128ab0270a8a143902123eda79ea554f18cb
MD5 42b217e2f77eea31c2c7df67a7faa362
SHA1 02cd2913d111a9224e6ceda42b7ba6a3990c1904
SHA512 2bd317d041ddb031a6a9eb16cb5fe31c70f8619912dc1ac66fa367371c3ce97dbe356fc516c42a97eb32576ce482b29b36750d09fd1478e6b913dda0626e9916
TLSH
T1D3A002D506956012D00312FCEE9A19463314CA15061653878690126DCD6596B9FC702C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\17c9f7c9-75b6-4651-a32c-d59ed1a12c9e\index-dir\the-real-index
Size 72B
SHA256 5821a67ad1ed14100090ca1c5af1d6f0fe1df31f4f7ac38ef32a0366d04c22b4
MD5 37eddc0d32524567ef801edcfe8e757d
SHA1 7fdb0b7f5efd4e48046991f6fad95222f086bb65
SHA512 c9313602792e3e222bee2aa18e847190a74f38819b49e0b20a45d16ae07b70dbe5f418a2ccc7e0c345ba0ecd5d39b0447b3bead61b4b964f63673c7638ab6c6f
TLSH
T175A0027647810D0EF412E2F1157202711302E8121A03131740D15465DC609605F7150D
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 88b553cc77c60cefc09b952e778614effb736547418c386fbbbd0e4e620cf0db
MD5 e49c48ccd2a9305a893446ba649adba2
SHA1 8c0aacdebe81d7117685c65eda8006dc98395403
SHA512 af796f86ae061d848fe60161a9cf51d2fb0980f5d59bfe0a643f8b9addf26efac8158e4f4f3504292dc907e5faf307489d28c25de3f59f6b8b148f03c59aed35
TLSH
T19FE020772EE72810BCEFE3D51471C4F906443858D54DED4F9015E39750B1325245EC66
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5bcea7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5bcea7.TMP
Size 48B
SHA256 a0e9e613d91ec79202679bc91ddabbd40783ce3e53ad363262f53023ae89c0a6
MD5 b4b1b8be4f373df88f899f3c155ddf80
SHA1 8a6b157ea813e12011370bb6c234c110f301ab85
SHA512 7eae472591d51602314b5f414a43857ca30ab2869af72eed53cff7a65a57669dd76e70ac5d3b54f35e2027e72ad0e098dbfc819c0b6c2254f21302bf419eabdc
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 afd49433701a98821b1b0b022e488725b5925920ed7e082dec42d91df802907f
MD5 b91d9688318ea5129cd721213e191fa1
SHA1 0de318fc6d0555c44877fcea426630ab77d92d69
SHA512 6fab2c825a00bfae95aab304ac377f37b9b1975141856a5df411ef6b3ab8065dfa226884339fc69825b0089e6b854565a0979ea1eca27ce868b98e9f5da87620
SSDEEP 96:KoUYKxayaSwKrPER26cqGbZ2DqPibKniPobjEM7emo+/WKJ:u3PPER26cqGV2Dai0iPo3EM7emo8
TLSH
T1E591020036BF120039BE259881B48B6F524536F6325CE72A7FAD15D24D2BE0A5DFE9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59a8f8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59a8f8.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 1f84468b1e1baa803163c3b29fdf6aad7d14dabe8425f5ebbf316b6b364c9baf
MD5 0eb52ea134f61336e586adea344daa7c
SHA1 763d8fc14f499b3a01ae58546a03d3d649157acf
SHA512 4c970acf58e1147d2d7c07c1277392f3d08c6f039164bc221b6354be126c5d475b52954563694bc83d1f25ecf01bad9376215dac8a1b816ef6f2851d53f6c52d
SSDEEP 384:9ZcIhsNthiWibqIQX5+Dtv8XLFXPJrdX/+2AkdY7vm/ej:lh/WH7kDuRPhdXG2Ak2r1
TLSH
T10A827D729DB4AC7B5DF7A552748A36139EF8902396C47B80D1FC6B1E01DEA78130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 dd9b6f65dc61c9c05b4622d621579c2f9745a6b06ebf343714675bc6761f8e34
MD5 f5864d0f13efec3361491cd5b426ba4e
SHA1 82c184e01552314a7aa86a99414d4f7ef9867ff4
SHA512 e85e75a57c1c8a56d41039dc6783a0174c21f17652ef03007446f3df0cd2f9e62f8f47c81cac1bffade62f548b385a0f7b54fd05716c56c9586a01c28953f39c
SSDEEP 384:5iFiZcIvzsN38TUNTUlIlGiWibTZ2QX5+Dtv8XLFXPJrxX/+2AkdY7vm/ej:QFQLqwg9WSZ9kDuRPhxXG2Ak2r1
TLSH
T10AC22BF288D7983AD9EE5743777D2D128EBCC063B5846680B3A85A1DCC9A57FD30AC11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a978d54370a97f0659a9d329e7ac0afc16d8cf75b8fa5e85d48d012cc7664aba
MD5 bd9bada28741f4265b1ae63ddf7b31d6
SHA1 2144291d1f55b9ac465b7777e11ffccde1f5d5e6
SHA512 e2bd52a7a58cda4f48b616f51e7b27fac88b280e56dbad705aba0b8c0ca760cbf61aaa549bf708d2ad5586cefc6bfc762eacf02edded091946c7c8da565e8895
SSDEEP 192:EONw6nnHGQmiUyfvQYcX5hQDP1HjzorMoLCMcJzU6:EONw6nC8QNX5+Dtv8XL6hU6
TLSH
T1D002CA35BCB87C7B8EF3AD46B48626139F95216BE5952B80DAF81F1C00D765C2306937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 b1d22a5df0d0dbbaafc400937654511f9ed150628f69bed1bae7d1a64b971dde
MD5 f4dbf8a3c838854723544b5972c11b49
SHA1 faf754c72bcf2fefb570e23cf9a7daa9d8b05fbd
SHA512 055d868e663e05d505fd15e9e6697f03841615c2ef3213c4088acbb9354d6a58334356fb65e779f6caedff4cd4defc48be4bafe1d32804fcfc5ddc08655d078e
SSDEEP 384:WZcIhsNtGiWibbZ2QX5+Dtv8XLFXPJrdX/+2AkdY7vm/ej:EheW2Z9kDuRPhdXG2Ak2r1
TLSH
T168827D729DB4AC7B4DF7A552748A3613DEF8902396C46B80D1FC6B1E01DEA78130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a37e7915c7c1f89f0fa751cc5ec2029bda0d9e8be6e6e833f131908e6e82a1b6
MD5 e22c49a64a2ef76a199318d5dcf6bcfc
SHA1 c1085cb8e01f924212460db6e646c49b1d686f45
SHA512 2c4331c0e5f458b7e4c6f2292c6db0017c634998a87b2a2789cd7f2262cb2b2037c8a644dd18a4ce81bfe0494b79fa6ffc3f4ecc07e7a1fddb2ef9db5e152724
SSDEEP 192:EONI6nnHEQmiUyBnv4YcX5hQDP1HjzorMoLFX4SJrLBg3tr/5/+U6:EONI6n0c4NX5+Dtv8XLFXPJrqX/+U6
TLSH
T18B121C31A9A4AC7B5EE3A595B08731239EA45117E6897BC0D6FC1F1C01DEA6C5309C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 1db7fd4dc4e9fefd4e5f83c9f44bb2457a5a6f406e163c1fcc15c0cb34f4cb33
MD5 3503cf7cb1be02fb53d46ff8430c3ca9
SHA1 660996c0d502196bac80b9b968c9ae993de90f7d
SHA512 7c41f7694212b37419aa64ccd78f23a46a88e077231860baf65d19963fccd82b7dd9c81a255d6d50657ff9cd8d1b07849d8af751f7d744e4886f642b68dfa128
TLSH
T1B0E00102D30010BBC52C033989C31F207EB6802407E746965B7115BC7C323213E30E80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 a44ac0f684cbf908e9474d62c176fb33cb287dd23db6e18e6a18156fc4fbdee2
MD5 8f0a1f916af3799d2f14d217e0ef740a
SHA1 0275f2be88e85231d1969ecc6ffb929fc4ee1461
SHA512 51d7c2b388a73575f779f9e0d54b9ef7e74e0d645e02eeef7542320fa6b10c13e9d7fd39dde1c2afd46cba9b44fc2c46402f13b00fd87fc4b0b69067fce6f039
TLSH
T14FE00902D30010BBC528033989C31F20BAF6802507B746965B7115B87C233212E30F80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 f81554b4a19df6a80487ec4cfe8b74c76de665fe5755fb3a95dd01d095055458
MD5 c92c406a8fd7bae48283da0d258e0ed4
SHA1 caeeec88d710dcb0af4c0374400208dcf3cd0f1c
SHA512 aa919ffae1d0d0c8ad4f6cffc61ff9b2b4724cd14ec91bcb3be5a329af51776b63c064234a13f94a544405d5f6812d1fdffa593fb277db8f192934ebd3b8e99e
TLSH
T1E7E00402E30410BBC528033989C31F21BEE6802506A646965A7255BCBC333213E31F90
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 baf220aa35446f48093254e0087c83d473ee772e382ba8e2fb97678d4cb0cb2e
MD5 13dcee45a6c85fe60713d8ff728edb10
SHA1 7dd90952fc7bead8966a9569221d1d2f709fe8aa
SHA512 3ae8cdd2f40dbdb3f177dfa768137bff7f2cba79c2a6fd94c8bb83a8ed63bbdf6f7ef3a322ffb71e3ccab2692245e2bf266c2c014b20fb20f51d1e32534bdc8d
TLSH
T15CE00402E30414BBC928037989871F22BEEAC42516E68A965A7255BDBC333217E31F90
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 fa1e29e71cf73b10d9bdd6a58daedd39fbfc72a6ddbecb48d7a575da303f6aed
MD5 d70f5184d938968f63bf2ea7dc60e215
SHA1 c1e7ff144197bdec472478d66b6a6c4cb09ed06e
SHA512 14b62eeb59a8e9dc41f53c423ac60eaa2efdbcdb04bc61408074a5ee9e8ee0ac55a23bf42102d8b0116eda244ae6f7891797abb2c83d6d50af7f4e0d12a8c53b
TLSH
T179E00112E30000BBC528033484830F1279E6842006B205820AB2006C6C333103E70F80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 d90de6f4f9f34fb42a43393af0f308423a650a43eaaeb5774ef7d13017079b02
MD5 5c961c4a86abf7f9417d3ff9b863bd23
SHA1 9e5677d942a82c5873689781cad3e61016cebc69
SHA512 1ebc705554ed802a0e7f93e9755788b963d26c68bca57f33fe2182c799a1e6a2a624012225ee12bfea1a5ee13df69f5f981bb4cdf232f213ae9507dbeea1600c
TLSH
T1CCE00203D30010FBC42C033949C35A203673843407C742955E2115747C117511E30C80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 31e931b44bd3a0313ed3b356923dfdf3d21ebb7ec139692f37e080554c46f705
MD5 862321165c88aa4a996974b5f46af7c8
SHA1 14e68c0ab144eec256a352a17f9b1e4b5b6f6fc7
SHA512 12423358f0165db5bf74735454286ba5a95a6e50ba744fc5ef9096d48f7d6dc7af2aef7cbf33868422af302b62740f9f925df19d3ed9af64a9c08859ef493b66
TLSH
T13AE00212920010B7C41C033945C359103572402007C341945A22057868117511930C40
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 28335dec0844018cf6c1c1f7575bf20b4f3b34af96f7074f29232dfde240577f
MD5 ba01db83667f796b758b76bbe89d6e89
SHA1 9a07b2e4e4110ad70010a6ead17d31ad3e868b3a
SHA512 249d89ac3eee097ce3fd2b79bd8d2833cb9bbb741b6debe797744ced26c81be31b015afa16c9cdb5d5199402057253ba7b407e997cf594ecb33a767c09e609d9
TLSH
T1CBE00102D30010BBC52C033989C31B203A76802407C742965A6115787C213212E30C80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe595903.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe595903.TMP
Size 392B
SHA256 48fd70d8c4b5428c0f9cc4aa0e08fa853840a34479acd8a6f1386c1edee20b5a
MD5 5c944e04e8f8f2d1f41b6ce0d0170e3b
SHA1 65c6bc4a7c13af2049dce000ed764643b8617141
SHA512 35ede9bc67dc5f3f4c70dc0d15e566e4b49ac2c1a40e750ef15d93b5cd97807e1707cde707f590e9709ff42af55caa64f18cee80e4f46f1faf99e08bbac76539
MD5 SHA1 SHA512

Submit Download

fd175083-3e6c-4739-b016-36408ea4a271.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\fd175083-3e6c-4739-b016-36408ea4a271.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 c93455562d2e0ea8bd4bbc9a73c358b4ae914012e33d22694f96f36fa2e6cecb
MD5 84bec26fb1bdcc60bed38c18f73fcee7
SHA1 4de639a97697b665e4ae925988146760fdddded1
SHA512 1041efca4ab70701ae887eb067c72d4bf7e8989a522950ad6436c21cca2073b1cb2eecaa00efdcf83f0be9fc52bf8e2af846037c272ffa55a60a0b1b4acdcd00
TLSH
T1DC41E458B6E91158B3B77F5A9BF7A86E487B78732E06D05E10110D4F0A66B40C9A1B33
MD5 SHA1 SHA512 TLSH

Submit Download