hxxps://davinci-resolve[.]br[.]uptodown[.]com/windows/download

Analysis

user interaction
yes
max time kernel
23s
max time network
88s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/09/2026, 22:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://davinci-resolve.br.uptodown.com/windows/download
Sample260925-2fbtvaaa52

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4608	msedge.exe
4456	chrome.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-939655444-3071939294-1401108526-1000\{8BC28BBC-6694-408B-BFAF-D2F0E2E30F1A}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3048	chrome.exe
3048	chrome.exe

Suspicious behavior: LoadsDriver 3 IoCs

pid	Process
656	Process not Found
656	Process not Found
656	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3048	chrome.exe
Token: SeCreatePagefilePrivilege	3048	chrome.exe
Token: SeShutdownPrivilege	3048	chrome.exe
Token: SeCreatePagefilePrivilege	3048	chrome.exe
Token: SeShutdownPrivilege	3048	chrome.exe
Token: SeCreatePagefilePrivilege	3048	chrome.exe
Token: SeShutdownPrivilege	3048	chrome.exe
Token: SeCreatePagefilePrivilege	3048	chrome.exe
Token: SeShutdownPrivilege	3048	chrome.exe
Token: SeCreatePagefilePrivilege	3048	chrome.exe
Token: SeShutdownPrivilege	3048	chrome.exe
Token: SeCreatePagefilePrivilege	3048	chrome.exe
Token: SeShutdownPrivilege	3048	chrome.exe
Token: SeCreatePagefilePrivilege	3048	chrome.exe
Token: SeShutdownPrivilege	3048	chrome.exe
Token: SeCreatePagefilePrivilege	3048	chrome.exe
Token: SeShutdownPrivilege	3048	chrome.exe
Token: SeCreatePagefilePrivilege	3048	chrome.exe
Token: SeShutdownPrivilege	3048	chrome.exe
Token: SeCreatePagefilePrivilege	3048	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe
3048	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2720 wrote to memory of 2140	2720	msedge.exe	86
PID 2720 wrote to memory of 4608	2720	msedge.exe	87
PID 2720 wrote to memory of 4356	2720	msedge.exe	88
PID 2720 wrote to memory of 4356	2720	msedge.exe	88
PID 2720 wrote to memory of 4356	2720	msedge.exe	88
PID 2720 wrote to memory of 4352	2720	msedge.exe	89
PID 2720 wrote to memory of 4352	2720	msedge.exe	89
PID 2720 wrote to memory of 464	2720	msedge.exe	90
PID 2720 wrote to memory of 464	2720	msedge.exe	90
PID 2720 wrote to memory of 464	2720	msedge.exe	90
PID 2720 wrote to memory of 1036	2720	msedge.exe	91
PID 2720 wrote to memory of 1036	2720	msedge.exe	91
PID 2720 wrote to memory of 1036	2720	msedge.exe	91
PID 2720 wrote to memory of 60	2720	msedge.exe	93
PID 2720 wrote to memory of 60	2720	msedge.exe	93
PID 2720 wrote to memory of 60	2720	msedge.exe	93
PID 2720 wrote to memory of 4876	2720	msedge.exe	94
PID 2720 wrote to memory of 4876	2720	msedge.exe	94
PID 2720 wrote to memory of 4876	2720	msedge.exe	94
PID 3048 wrote to memory of 3200	3048	chrome.exe	100
PID 2720 wrote to memory of 2536	2720	msedge.exe	101
PID 2720 wrote to memory of 2536	2720	msedge.exe	101
PID 2720 wrote to memory of 2536	2720	msedge.exe	101
PID 2720 wrote to memory of 1812	2720	msedge.exe	102
PID 2720 wrote to memory of 1812	2720	msedge.exe	102
PID 2720 wrote to memory of 1812	2720	msedge.exe	102
PID 2720 wrote to memory of 3788	2720	msedge.exe	103
PID 2720 wrote to memory of 3788	2720	msedge.exe	103
PID 2720 wrote to memory of 3788	2720	msedge.exe	103
PID 2720 wrote to memory of 4928	2720	msedge.exe	104
PID 2720 wrote to memory of 4928	2720	msedge.exe	104
PID 2720 wrote to memory of 2152	2720	msedge.exe	105
PID 2720 wrote to memory of 2152	2720	msedge.exe	105
PID 2720 wrote to memory of 1808	2720	msedge.exe	106
PID 2720 wrote to memory of 1808	2720	msedge.exe	106
PID 2720 wrote to memory of 1808	2720	msedge.exe	106
PID 2720 wrote to memory of 1108	2720	msedge.exe	107
PID 2720 wrote to memory of 1108	2720	msedge.exe	107
PID 2720 wrote to memory of 1108	2720	msedge.exe	107
PID 2720 wrote to memory of 2096	2720	msedge.exe	108
PID 2720 wrote to memory of 2096	2720	msedge.exe	108
PID 2720 wrote to memory of 2096	2720	msedge.exe	108
PID 3048 wrote to memory of 4472	3048	chrome.exe	109
PID 3048 wrote to memory of 4456	3048	chrome.exe	110
PID 3048 wrote to memory of 4472	3048	chrome.exe	109
PID 3048 wrote to memory of 1464	3048	chrome.exe	111
PID 3048 wrote to memory of 1464	3048	chrome.exe	111
PID 3048 wrote to memory of 4944	3048	chrome.exe	113
PID 3048 wrote to memory of 4944	3048	chrome.exe	113
PID 3048 wrote to memory of 820	3048	chrome.exe	114
PID 3048 wrote to memory of 820	3048	chrome.exe	114
PID 3048 wrote to memory of 5232	3048	chrome.exe	115
PID 3048 wrote to memory of 5232	3048	chrome.exe	115
PID 3048 wrote to memory of 5244	3048	chrome.exe	116
PID 3048 wrote to memory of 5244	3048	chrome.exe	116
PID 2720 wrote to memory of 5560	2720	msedge.exe	120
PID 2720 wrote to memory of 5560	2720	msedge.exe	120
PID 2720 wrote to memory of 5560	2720	msedge.exe	120
PID 2720 wrote to memory of 5568	2720	msedge.exe	121
PID 2720 wrote to memory of 5568	2720	msedge.exe	121
PID 2720 wrote to memory of 5568	2720	msedge.exe	121
PID 2720 wrote to memory of 5848	2720	msedge.exe	176
PID 2720 wrote to memory of 6292	2720	msedge.exe	132
PID 2720 wrote to memory of 6284	2720	msedge.exe	131

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://davinci-resolve.br.uptodown.com/windows/download
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffa1396c188,0x7ffa1396c194,0x7ffa1396c1a0
  2⤵
  PID:2140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1908,i,12242422977088083496,7233856040470217702,524288 --field-trial-handle=2292,i,1070252267105506577,424960577506194398,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1620,i,12226837195763614908,8224253062819942455,262144 --field-trial-handle=2292,i,1070252267105506577,424960577506194398,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:2
  2⤵
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2344,i,6897565686201238603,7575407231893591488,524288 --field-trial-handle=2292,i,1070252267105506577,424960577506194398,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:8
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3392,i,6193713130114574668,338914453513892463,2097152 --field-trial-handle=2292,i,1070252267105506577,424960577506194398,262144 --variations-seed-version --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3396,i,17325676748296851267,5684424660891697440,2097152 --field-trial-handle=2292,i,1070252267105506577,424960577506194398,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4172,i,129797099263128151,9162636946605975537,2097152 --field-trial-handle=2292,i,1070252267105506577,424960577506194398,262144 --variations-seed-version --mojo-platform-channel-handle=4180 /prefetch:1
  2⤵
  PID:60
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4196,i,9453738633890396737,14465436968513567449,2097152 --field-trial-handle=2292,i,1070252267105506577,424960577506194398,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:2
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5048,i,15399724740296906551,2808749706225195593,2097152 --field-trial-handle=2292,i,1070252267105506577,424960577506194398,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:1
  2⤵
  PID:2536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5200,i,16437643870213814299,16774443548328356166,2097152 --field-trial-handle=2292,i,1070252267105506577,424960577506194398,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:1
  2⤵
  PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5384,i,4835980372570981725,8591323429683951259,2097152 --field-trial-handle=2292,i,1070252267105506577,424960577506194398,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:1
  2⤵
  PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5488,i,14298053730299743492,11471001826719653457,524288 --field-trial-handle=2292,i,1070252267105506577,424960577506194398,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:8
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5492,i,17684656802184451600,18257954818129597489,524288 --field-trial-handle=2292,i,1070252267105506577,424960577506194398,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:8
  2⤵
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5052,i,8532875294548777075,16985018339053162758,2097152 --field-trial-handle=2292,i,1070252267105506577,424960577506194398,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:1
  2⤵
  PID:1808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6152,i,14947346700604877482,14155493140427106035,2097152 --field-trial-handle=2292,i,1070252267105506577,424960577506194398,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:1
  2⤵
  PID:1108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6320,i,89955148969662028,15844677293175578848,2097152 --field-trial-handle=2292,i,1070252267105506577,424960577506194398,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:1
  2⤵
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6828,i,16577148747069217837,12963606514324763117,2097152 --field-trial-handle=2292,i,1070252267105506577,424960577506194398,262144 --variations-seed-version --mojo-platform-channel-handle=6808 /prefetch:1
  2⤵
  PID:5560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6960,i,11907374807078450204,11890045129743775261,2097152 --field-trial-handle=2292,i,1070252267105506577,424960577506194398,262144 --variations-seed-version --mojo-platform-channel-handle=6968 /prefetch:1
  2⤵
  PID:5568
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5064,i,2324986159839468213,14825853056349563717,524288 --field-trial-handle=2292,i,1070252267105506577,424960577506194398,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:8
  2⤵
  PID:5824
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5064,i,2324986159839468213,14825853056349563717,524288 --field-trial-handle=2292,i,1070252267105506577,424960577506194398,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:8
  2⤵
  PID:5848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6996,i,14745169010538711630,14118803792932385084,524288 --field-trial-handle=2292,i,1070252267105506577,424960577506194398,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:8
  2⤵
  PID:6284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6564,i,13422564897994716824,7591036800194684340,2097152 --field-trial-handle=2292,i,1070252267105506577,424960577506194398,262144 --variations-seed-version --mojo-platform-channel-handle=6552 /prefetch:1
  2⤵
  PID:6292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7744,i,16073786122366761958,6172256824578132992,2097152 --field-trial-handle=2292,i,1070252267105506577,424960577506194398,262144 --variations-seed-version --mojo-platform-channel-handle=7840 /prefetch:1
  2⤵
  PID:7128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7972,i,10421681076394933044,4311993894568005021,524288 --field-trial-handle=2292,i,1070252267105506577,424960577506194398,262144 --variations-seed-version --mojo-platform-channel-handle=8040 /prefetch:8
  2⤵
  PID:5804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8024,i,1409891590626310914,15017039268691064871,524288 --field-trial-handle=2292,i,1070252267105506577,424960577506194398,262144 --variations-seed-version --mojo-platform-channel-handle=8060 /prefetch:8
  2⤵
  PID:6080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7984,i,7314476512248243716,692683293457313511,524288 --field-trial-handle=2292,i,1070252267105506577,424960577506194398,262144 --variations-seed-version --mojo-platform-channel-handle=8104 /prefetch:8
  2⤵
  PID:6096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=752,i,10407257712541401177,10627794515024236125,2097152 --field-trial-handle=2292,i,1070252267105506577,424960577506194398,262144 --variations-seed-version --mojo-platform-channel-handle=7096 /prefetch:1
  2⤵
  PID:6572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7044,i,7731231999709241952,12181818298530996824,2097152 --field-trial-handle=2292,i,1070252267105506577,424960577506194398,262144 --variations-seed-version --mojo-platform-channel-handle=7124 /prefetch:1
  2⤵
  PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=8128,i,7903880336364855601,15120645357251449456,2097152 --field-trial-handle=2292,i,1070252267105506577,424960577506194398,262144 --variations-seed-version --mojo-platform-channel-handle=8180 /prefetch:1
  2⤵
  PID:1532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=8220,i,8494236326243083415,218773136806497746,2097152 --field-trial-handle=2292,i,1070252267105506577,424960577506194398,262144 --variations-seed-version --mojo-platform-channel-handle=8232 /prefetch:1
  2⤵
  PID:5868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=6560,i,15561963730120333506,10768088340950716426,2097152 --field-trial-handle=2292,i,1070252267105506577,424960577506194398,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:1
  2⤵
  PID:2932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=7788,i,4529313456710838741,10940097326162348187,2097152 --field-trial-handle=2292,i,1070252267105506577,424960577506194398,262144 --variations-seed-version --mojo-platform-channel-handle=2116 /prefetch:1
  2⤵
  PID:6652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=5820,i,13746872220072215514,11612079821756293066,2097152 --field-trial-handle=2292,i,1070252267105506577,424960577506194398,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:1
  2⤵
  PID:6660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=5840,i,11721292326987006585,3506730649966889213,2097152 --field-trial-handle=2292,i,1070252267105506577,424960577506194398,262144 --variations-seed-version --mojo-platform-channel-handle=8480 /prefetch:1
  2⤵
  PID:6672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6560,i,15661985738699328565,7494135024589100364,524288 --field-trial-handle=2292,i,1070252267105506577,424960577506194398,262144 --variations-seed-version --mojo-platform-channel-handle=8780 /prefetch:8
  2⤵
  PID:6764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=8932,i,14382088864315933264,3777800264038880597,2097152 --field-trial-handle=2292,i,1070252267105506577,424960577506194398,262144 --variations-seed-version --mojo-platform-channel-handle=8628 /prefetch:1
  2⤵
  PID:3436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=8972,i,17783363270968137019,5834880654299903417,2097152 --field-trial-handle=2292,i,1070252267105506577,424960577506194398,262144 --variations-seed-version --mojo-platform-channel-handle=9000 /prefetch:1
  2⤵
  PID:3408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=9028,i,2040720401558096410,627615412116529274,2097152 --field-trial-handle=2292,i,1070252267105506577,424960577506194398,262144 --variations-seed-version --mojo-platform-channel-handle=9140 /prefetch:1
  2⤵
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=8764,i,3977442301601387413,3172299240848529483,2097152 --field-trial-handle=2292,i,1070252267105506577,424960577506194398,262144 --variations-seed-version --mojo-platform-channel-handle=8540 /prefetch:1
  2⤵
  PID:5572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=9468,i,6236168047485212500,10227197214357148596,2097152 --field-trial-handle=2292,i,1070252267105506577,424960577506194398,262144 --variations-seed-version --mojo-platform-channel-handle=9824 /prefetch:1
  2⤵
  PID:6124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=9508,i,9105878302732989716,4261099536964351480,2097152 --field-trial-handle=2292,i,1070252267105506577,424960577506194398,262144 --variations-seed-version --mojo-platform-channel-handle=9840 /prefetch:1
  2⤵
  PID:6040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=9496,i,859154633409640736,4156122870845163173,2097152 --field-trial-handle=2292,i,1070252267105506577,424960577506194398,262144 --variations-seed-version --mojo-platform-channel-handle=9828 /prefetch:1
  2⤵
  PID:6448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=9544,i,2317156698938948821,10290314178666962672,2097152 --field-trial-handle=2292,i,1070252267105506577,424960577506194398,262144 --variations-seed-version --mojo-platform-channel-handle=9892 /prefetch:1
  2⤵
  PID:1856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=9560,i,6248961438448726717,699621899694956036,2097152 --field-trial-handle=2292,i,1070252267105506577,424960577506194398,262144 --variations-seed-version --mojo-platform-channel-handle=9912 /prefetch:1
  2⤵
  PID:2768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=9520,i,961713328084516589,15537719239698363419,2097152 --field-trial-handle=2292,i,1070252267105506577,424960577506194398,262144 --variations-seed-version --mojo-platform-channel-handle=9852 /prefetch:1
  2⤵
  PID:1904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=9532,i,15632542869337627092,3704739793135947226,2097152 --field-trial-handle=2292,i,1070252267105506577,424960577506194398,262144 --variations-seed-version --mojo-platform-channel-handle=9872 /prefetch:1
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=9584,i,5456714983662189262,13961618265461810778,2097152 --field-trial-handle=2292,i,1070252267105506577,424960577506194398,262144 --variations-seed-version --mojo-platform-channel-handle=9952 /prefetch:1
  2⤵
  PID:5228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=9572,i,588123044042161863,1309589806027977095,2097152 --field-trial-handle=2292,i,1070252267105506577,424960577506194398,262144 --variations-seed-version --mojo-platform-channel-handle=9932 /prefetch:1
  2⤵
  PID:6372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=9624,i,14760572450244077258,5561765219049777692,2097152 --field-trial-handle=2292,i,1070252267105506577,424960577506194398,262144 --variations-seed-version --mojo-platform-channel-handle=10048 /prefetch:1
  2⤵
  PID:5988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --metrics-shmem-handle=9668,i,426521691360807326,1373627678875834781,2097152 --field-trial-handle=2292,i,1070252267105506577,424960577506194398,262144 --variations-seed-version --mojo-platform-channel-handle=10084 /prefetch:1
  2⤵
  PID:6016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=9648,i,4994698462639288351,5376493565635215566,2097152 --field-trial-handle=2292,i,1070252267105506577,424960577506194398,262144 --variations-seed-version --mojo-platform-channel-handle=9844 /prefetch:1
  2⤵
  PID:7100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=9600,i,10565437354957760917,11831539001589558020,2097152 --field-trial-handle=2292,i,1070252267105506577,424960577506194398,262144 --variations-seed-version --mojo-platform-channel-handle=9972 /prefetch:1
  2⤵
  PID:7124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=9636,i,2548605169089466678,8914552144349998032,2097152 --field-trial-handle=2292,i,1070252267105506577,424960577506194398,262144 --variations-seed-version --mojo-platform-channel-handle=9832 /prefetch:1
  2⤵
  PID:7116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=9612,i,10724630048448824259,2559059726970874212,2097152 --field-trial-handle=2292,i,1070252267105506577,424960577506194398,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:1
  2⤵
  PID:5984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=9656,i,3317694920630896011,15478132273189340336,2097152 --field-trial-handle=2292,i,1070252267105506577,424960577506194398,262144 --variations-seed-version --mojo-platform-channel-handle=10064 /prefetch:1
  2⤵
  PID:7108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --always-read-main-dll --metrics-shmem-handle=10188,i,16055568313590247648,10608796066811836322,2097152 --field-trial-handle=2292,i,1070252267105506577,424960577506194398,262144 --variations-seed-version --mojo-platform-channel-handle=8912 /prefetch:1
  2⤵
  PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --metrics-shmem-handle=9688,i,17524164486344226000,3642184554213754366,2097152 --field-trial-handle=2292,i,1070252267105506577,424960577506194398,262144 --variations-seed-version --mojo-platform-channel-handle=12172 /prefetch:1
  2⤵
  PID:6416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --always-read-main-dll --metrics-shmem-handle=9792,i,17630238114212926351,15347042660316565539,2097152 --field-trial-handle=2292,i,1070252267105506577,424960577506194398,262144 --variations-seed-version --mojo-platform-channel-handle=9628 /prefetch:1
  2⤵
  PID:5556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --always-read-main-dll --metrics-shmem-handle=11556,i,2791649982012055808,2728111103597141906,2097152 --field-trial-handle=2292,i,1070252267105506577,424960577506194398,262144 --variations-seed-version --mojo-platform-channel-handle=11720 /prefetch:1
  2⤵
  PID:5848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --always-read-main-dll --metrics-shmem-handle=11508,i,15383654240159211944,372749075127469938,2097152 --field-trial-handle=2292,i,1070252267105506577,424960577506194398,262144 --variations-seed-version --mojo-platform-channel-handle=11592 /prefetch:1
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --always-read-main-dll --metrics-shmem-handle=3548,i,4325859926825377779,17314905759798528469,2097152 --field-trial-handle=2292,i,1070252267105506577,424960577506194398,262144 --variations-seed-version --mojo-platform-channel-handle=11800 /prefetch:1
  2⤵
  PID:2148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --always-read-main-dll --metrics-shmem-handle=10520,i,17969493098441750575,954474635385085526,2097152 --field-trial-handle=2292,i,1070252267105506577,424960577506194398,262144 --variations-seed-version --mojo-platform-channel-handle=9952 /prefetch:1
  2⤵
  PID:5984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --always-read-main-dll --metrics-shmem-handle=5756,i,10246034431847236656,4940297141248989467,2097152 --field-trial-handle=2292,i,1070252267105506577,424960577506194398,262144 --variations-seed-version --mojo-platform-channel-handle=9016 /prefetch:1
  2⤵
  PID:7100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --always-read-main-dll --metrics-shmem-handle=9008,i,8707652307563428463,12423947508122880926,2097152 --field-trial-handle=2292,i,1070252267105506577,424960577506194398,262144 --variations-seed-version --mojo-platform-channel-handle=9316 /prefetch:1
  2⤵
  PID:6588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --always-read-main-dll --metrics-shmem-handle=10592,i,14098044241411652370,7650134982124784083,2097152 --field-trial-handle=2292,i,1070252267105506577,424960577506194398,262144 --variations-seed-version --mojo-platform-channel-handle=9704 /prefetch:1
  2⤵
  PID:6400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --always-read-main-dll --metrics-shmem-handle=10404,i,11015606427173658095,15637526474614753215,2097152 --field-trial-handle=2292,i,1070252267105506577,424960577506194398,262144 --variations-seed-version --mojo-platform-channel-handle=10356 /prefetch:1
  2⤵
  PID:7116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --always-read-main-dll --metrics-shmem-handle=12120,i,14654840856832387988,11956058723826623685,2097152 --field-trial-handle=2292,i,1070252267105506577,424960577506194398,262144 --variations-seed-version --mojo-platform-channel-handle=12088 /prefetch:1
  2⤵
  PID:6280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --always-read-main-dll --metrics-shmem-handle=11976,i,17940586934784022305,15909077254026628346,2097152 --field-trial-handle=2292,i,1070252267105506577,424960577506194398,262144 --variations-seed-version --mojo-platform-channel-handle=11992 /prefetch:1
  2⤵
  PID:2576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --always-read-main-dll --metrics-shmem-handle=9656,i,6265426027596639972,393473218365834168,2097152 --field-trial-handle=2292,i,1070252267105506577,424960577506194398,262144 --variations-seed-version --mojo-platform-channel-handle=12328 /prefetch:1
  2⤵
  PID:4876

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1292

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0x100,0x124,0x7ffa119bc728,0x7ffa119bc734,0x7ffa119bc740
  2⤵
  PID:3200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1692,i,17750996360827847965,1458571418041489905,262144 --field-trial-handle=2020,i,9314757937268713228,3941036622590238298,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2016 /prefetch:2
  2⤵
  PID:4472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2060,i,17220374090776630966,2288421511674966020,524288 --field-trial-handle=2020,i,9314757937268713228,3941036622590238298,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2160 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2392,i,12351045451450115085,4582887269711992679,524288 --field-trial-handle=2020,i,9314757937268713228,3941036622590238298,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2568 /prefetch:8
  2⤵
  PID:1464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3232,i,13419308578516679965,17102967237410497588,2097152 --field-trial-handle=2020,i,9314757937268713228,3941036622590238298,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:4944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3244,i,6237669818972593104,10213297946122803923,2097152 --field-trial-handle=2020,i,9314757937268713228,3941036622590238298,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4408,i,16893825324317952483,8397743743023545078,524288 --field-trial-handle=2020,i,9314757937268713228,3941036622590238298,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4420 /prefetch:8
  2⤵
  PID:5232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4576,i,15019637985693253126,11701037865746653244,2097152 --field-trial-handle=2020,i,9314757937268713228,3941036622590238298,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4356 /prefetch:1
  2⤵
  PID:5244

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2840

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 bb089d536339b75ae43a0ed5b68a8e17c41c4b4f80a91bab1cad621d1898330a
MD5 a49221f46c5ca6fbf0b637ea1c74e7eb
SHA1 b606caeda5536e648e7d6de209cc761531f104de
SHA512 6566a3cb53ca9780d41848cbb31f73799144bbc038d7a21e1ef11174eac9ef011cd84691e2a5a8a226735121c11ce8e00ce9890fde3013134ad064d5f92e11ed
TLSH
T174519AF7C7D8D66DC81166F49A256E1ECD3D0A28121D3C16C8D8AE5F53E68B2D24138E
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 67f8af8d999cc04f941f679d091d33332d696293f408d21523625a392c7e516f
MD5 2d20a62fc3bd421d5d70d771b07b6bfd
SHA1 d981933b02ebe796af109496813b0faab9f037b2
SHA512 dc868da382e6f24d069b9f37d89e3ed9443e5a2aa48193bc7670df5695e96d5d3d9a1885a9eaec8526c94213e26df75c03aa0c67527cd4e0f474eba8e40294f3
TLSH
T128F050D7D27E7877907A45671D44B8461AB5A83415425CE8DEDB413DF0C54E70B92043
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 3356ae0f0c30da6b5f101b5a0f3d5e8a29548916cf5ad861667d26284d335240
MD5 b88597cce4d929823d5d1613e4ce739e
SHA1 bf0971b76fd0e240865c015265df6acdf5ba01be
SHA512 09be98c13437c689c1545cd7f8708b187d36ef3a4c02defc8ac392eb1ab71c66c99866a30af46c1e220afea681225e6725e02529f428ec05c36c6cc9a697ce5f
SSDEEP 192:nRb1D6zv71vAPRp2Z9IHsb+WNnY0dhm2SIkwuIvVyIsnAUgR:nRb1OL56X62wndc2rO4R
TLSH
T11932852DAD10793B5CDBD32AF926BB57D7F9002235952E88E6F8893C15DB5CC2227407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 77005e3a227af37a831b17e07b41342e2abb4db99a3a149ce5f2abd15ef61012
MD5 fdbf0cd8f46b4b3aa3a65d5eeb324bc1
SHA1 290e1fc645420cb94f1618bd74a45fed3d5f8b06
SHA512 219ed3650d4c4e8ef2377aee68d4a6ba9b3e28bcf5a27f441c28c8b86bedf4475306ec36f423540a50dcb809ea21897cf54c41a0f767dd0748c30199fb1cb126
SSDEEP 192:el64K67/7KxkXqK4I40pUZNCgVLHrKHfFKslEz9LXzKD/Qj+ErUkKN9gVS27SS0s:c6jY/7KxkXqKf/pUZNCgVLH2HfgslcLd
TLSH
T16F32C927948DAA3F0FD8D51DCC12AF4BADF502527368092497FF9D14039A7CA214E6BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 131KB
SHA256 b060f942675e4285556f5c84b7484fa70a96b077619863391f399c69e7fc98a2
MD5 fead9e294d32b7db37b7f5462c0319ba
SHA1 c54283a00361d2b4380f35879c3f94f72d7347ec
SHA512 83c4f0ded8a763dad195a36bba86d1bd36eb549bb3814ebd9efbbaabc1e01c9f351bc7d856c84081dac40e65b2213ae0ac96275bbdc7641775ffc3a75fcfa74f
SSDEEP 3072:cT7+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gG:cT7+hFD+7t56OD9ZfSApprG
TLSH
T140D31232AA95D87BC9FD6541B157A300CE6668EE51DE3A09444A5F8ED09FC4C07B3E33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 b9f36f7cd91199ce43f19849ac40587d652abb093a4e4ed3fcc94d03fee3ebab
MD5 d4158f694a9e38c6f68fe8d5ba5206b8
SHA1 fcf607ccab5d981fc4224ab18e9da8f7f126a4de
SHA512 c0fcfe05a0320d24eb660040f04e379150bb40c6a03dd6bfa7dfd1ce7138bb14548dbfbbc89e591460ef82f4b08fdda177202bdc1019be2762d15333b300777e
SSDEEP 3072:dt/+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gr:dt/+hFD+7t56OD9ZfSApprr
TLSH
T10ED31232AA91D8BBC9FC6541B157A304DE666CED41DE7A09444A5F8EE09FC4C07B3A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 131KB
SHA256 4434b15e0a4ba6e8cf7fe45892827b5175942dd26b9578d58a2237012cea40cf
MD5 9c33e961f3c3791be6871db006682de4
SHA1 d22783b5f407885efc6d3ac188a4a1c38fea3486
SHA512 b3d234f4f092d459cceb02aec7b37d4e39ffc41255108fdbe8436fa46009dc1f6afca323480bfe9e33e920e1e0562b8b7084056380a84546cd22f899262e359c
SSDEEP 3072:cXP+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gG:cXP+hFD+7t56OD9ZfSApprG
TLSH
T1CAD31232AA95D87BC9FD6541B157A300CE66A8EE51DE3A09444A5F8ED09FC4C07B3E33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 33216cc8094343b1e673d6d0ce51864cf882b00961e3411c47b6a0cf1488a291
MD5 67f6e997d9180458e1a8c1eb8facdbb8
SHA1 ba71d9acfdbf5ad19e98c71c4ff3936488e5302e
SHA512 cc39dc134ebb79f6ba88453b88057a692c89209ccaada0ea03ca92512d41d4b9cea1179950cf85647315f4dd3a45c3553a403d01ea2891cbdb3b8df87cb294a1
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7z:fwUQC5VwBIiElEd2K57P7z
TLSH
T16AB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9e411e40b2b1e7f1576e6c2cf3027d590d4c5916b7a5e41c1a711f9117d0f1e1
MD5 f86a69ac894860b8a7e2ac52b3c2987b
SHA1 835d87e07bf2af2a2410d66f27145dd25efdaad6
SHA512 6de1915f0367b482a80195c1b703b1007a524ab2a6815670db955de8dd4235e1faa888dde7fcefe1ccbf4dae73b9d41563a6a2f7e5d8d75bf2ff9783b485b777
TLSH
T1ABD02BF8DBD88120F033383400398283308C660420061120A873114C0C441C34225868
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 18eb5a70b8dc14ee5a30ef2a54b3e14abbda2b2d751a8e8abad286d8e92d8872
MD5 a2b3071ef6468d20d3499dac11b0df41
SHA1 e96a1ba764d6003a0c508557df66dec18df2a1e7
SHA512 144677b38dc2433c6ce2cd569ea8dac3d5f5013e173fcf4e0e6d6d88ad42c12001c58ec8fdf8229ee7476fa921cb946792037c4914570deac4969d9365895b19
TLSH
T113D02BF89BD88520F433383400388283308C660420065221A873114C0C451C34225868
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e73b391410b47c494ee7953905a0c60fd04c6bc35617583539b46b92968689a8
MD5 c67fbef7f62bf0056c3e3f786716b78a
SHA1 45f832458a5b84f29df5280a7973ebf46d014c4b
SHA512 623599849df6e275e849b53aa15de4c0c6df018ceb72805f4afbfea2a8577410fc6f21085b8473298805a9eec11bfc75b61276472cfcad39c54461995984dd1a
TLSH
T180D0C0F0CEF896F0F031343C01344142308C274122021211B432001C0C900C34265DE8
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 3cd4fe1a0bc2c3c0b3c75135b6dd4b6956121ad38e8d2ca6dd10937fb54a5fde
MD5 514840a304d28c3a885969117246715e
SHA1 7cfd2729d9491cc6bff8dbffff915da766961f73
SHA512 802436849eb3757e1157e7c73f169b3071062cd5c8f372d905971b5d4f164973785325bcad58df1cf6e8658bd35cdc880d64c42c3b03f5d4c3fc368e032bc8de
TLSH
T1AA71E881B86041C4FBC4E0F0C1FD918F36FB4D8809431E52F95BCAB596777A19AC608C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 b17a25f9e066d6145fb0ad74b579e65a24003d6d6d1963cfd7e648057bc608b7
MD5 f6404b03175e5fe0e1ec83e92a05b26f
SHA1 a6cc091f5247e5fe03ddbff13ff29b08d8b19970
SHA512 cffcace9f174dcd4ca3e1dc86d745f55229c9cfcae575ffe06efc0f0dce06003754fdd1c6e653f9ce10003aa456d3f3e5e8675da2727063ff431c10e18c29d76
TLSH
T16B81D682A8A04184FBC5E5F0C0FD914F36FB4D8D09431E52F85BCAB496777A5AAC609C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe592532.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe592532.TMP
Size 3KB
SHA256 1e91237d53ed268745e86c52181af9668f39aff97474c5d5e5bc15ea806fd652
MD5 cd9e2faa52f13e189e26d659a1db0094
SHA1 4416822d104a533698f4340271e053f1fa65bd25
SHA512 44bdd6b08a41be85b4323e4a359f63da502d7989696b79c7f9075e296a400d530bdd95aeee5c84f480bd8601376bcc0318f8aa65b4130022a1745b70c85b1dba
TLSH
T1CE510882DDB040D8FBCA40F081FDD18F36F74C8149832E92FC6BCAB85636764924A05C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 25KB
SHA256 39d3828e079aad5861059073c237f032c0038608854c712e885c12050eb0722c
MD5 a96b8e5e013d70132a12ae2501fd7588
SHA1 f8f5991496294761d1893001bb8fa74ea5b9d850
SHA512 2b65ab39c6493836e770d660f964c98602ff22c4ffe73171d4dea179cf37867bc4110aadf8f1556557091d64f2e828d8ef892fbfa20253da12b06e9119fca27b
SSDEEP 384:DBg2yN3zIYeyPe782RYehb0SJLJUOq7S/jLBe31LNbcna7RNhoNvMF7RgNVYNgmS:lV97kW4sQcYSUmUTu
TLSH
T1C1C280F787F49D2D8D2169F06A162D2BCD590E24531C3D6AC5E8BF1663E1430E602ACF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 e8227bb10bd518e0e7832e84a01a44768db288440b12c2be1e8ae31668612f99
MD5 cfe31dbae5adb9deb0ffcdb798d2092b
SHA1 90a32a4f17ee0789c4ca6b2b08ed060b80df14bc
SHA512 7bac3fa22dc57f80906df0f8bfcdeb105d278568c4f9d806b0875e7ffe4cc7936be59b248c93530df69746522b3ca1b06327c6ab264f43a9be6f07d7779eb306
SSDEEP 192:sxZnRsWA/fcs5vi9oIdpUFHW6+WN2e34/YapqD1IgUa8J:sxZnBA/fcs5vivAHbv4/IUag
TLSH
T1F822B7566E38A97B8CCBE21DBA15BF53D6F9103251D11E48AAFC861C04E7BCD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 d1868fd48f1bdaffaa0c6a17aa710809042a9e93bd824ddd8404986164f72d89
MD5 b95f932cf8a0b2118ed159a8457eb54a
SHA1 3ff4f47840066c95cd21981bf22049ce8a9721d5
SHA512 f138647c330a248a37b7579e8b5b3fc3275f20ecc3a5d1b98668428caf986c20021374f1e6329bd3cb64f3f728e6cbcd646f0950eeee7a4a8ceb1c0823b14f36
SSDEEP 192:sxZnRCnA/fcsLWpVi5O9oIdpaFHW6+WNmta5XYepKFrnIgbsa8J:sxZnuA/fcsLWvi5OvyHbXXeTIag
TLSH
T17742C7566E78697B8CDBE21DFA157F23D6F9103251911E48A6FC8A1C04F77CD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 c777e003fa78ff4344c5e0e881e8c77e2dffa0c5552086a11730f9391c32b3cd
MD5 b23d56537dbc6eef28fdc0c3e76483e1
SHA1 fe343fc728b995b48ab377fc8cb83a8c7b08b35d
SHA512 1c03e67cc6964e2b8d67430b98c08fcabcc92064d18700e9805af5d91d0f980812473093dc6b787f0c3d6a73a424ae5481a44f83ceb7c1e97ba6503c5990021d
SSDEEP 192:sxZnRsnA/fcs95i9oIdpUFHW6+WN2a5XYapQD1Ig5sa8J:sxZn0A/fcs95ivAHb9XGKag
TLSH
T16132C756AE78697B8CDBE21DBA15BF13E6F9103361911E48A6FC861C04E77CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 c099956fe171385a0d3366702d7e29bc4edcb86bb0432f88e3d8ac2edd3e4a55
MD5 2db52af6607f1bdf66e86cb5f314b365
SHA1 bf3478a715c20230d0189bbb662b0ac54769264b
SHA512 e08bf508ae1de3d17d1343fee1ce69fb09a1affb72962bc8a83efcafbc8806b19517e1339cc4b026c1fd27639f5a7531bee89e539711ed084862e86cccc5c7bc
SSDEEP 192:sxZnRsnA/fcs9vi9oIdpUFHW6+WN2a5XYapuD1Ig5ia8J:sxZn0A/fcs9vivAHb9XQcag
TLSH
T1F422D856AE78697B8CCBE21DBA55BF13D6F9103261D11E48A6FC861C04E77CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 56edd466a245a4d14aaa9692fb30ad3df90c704ab83c279afce0e955059b332d
MD5 fbad2f59769fe8e195217c190dc02234
SHA1 52615efd1f8d3f4a6d49b38ff68c09faf465cd0c
SHA512 2335c458e80c36021ccf4b2e34b2c563663a0b23d39fee67ac3a5a1f5b55e82a9a3e9b5f663827e83e4de04a4fd17195e02a1b48661abce96ea23850c51f318c
SSDEEP 192:sxZnRsnA/fcs95i9oIdpaFHW6+WN2a5XYapvD1Ig5sa8J:sxZn0A/fcs95ivyHb9XvKag
TLSH
T1FD32C856AE78697B8CDBE21DBA15BF13E6F9103251911E48A6FC861C04E7BCD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 692a38a25fedb8e426166ff840f0f69a3ee972a9d81b574965818d109b5adfbc
MD5 dac238ce15bf2d557df17c1d494df7b2
SHA1 d519b3eeaed309fc0b2bfecea80d0a1c7cce315c
SHA512 cffbe5de91f1feab7a2e6fb877fbe5bb1bc6ec518be7650f0d4fc61f0c8a13cca6ec53ebe1a56f0c04e1158de3740af2ab0695b81663deb0de03578ea6a22dd4
SSDEEP 768:DtWPcLKWvKece8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjlLlACy7gro4USImRH:DtWPcLKWvKeceu1jaClLiF7r4USImRH
TLSH
T122C2FA3F644CCB7E4FC01A9DDC5A6FA76E9802C79A548D4047FE984C02C77EA912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c791fa4da53571d8_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\c791fa4da53571d8_0
Size 64KB
SHA256 7b67264f98f5ca6076aad400973f7f617ec5c9893fc8c15a8938da3105e1e6a9
MD5 faa188bd8b372bcf853d5f9cb78c7085
SHA1 6a224d0ed769cef399281c1fe1f48e4e13e05f97
SHA512 5191a173d0e1e1305c00bccb295072453c4eb97937d3bebee3faecb61483ddfb99b14281e29f45feec74fd1e7d5d61c5c46ad765e204511f71ed40708bc3ad54
SSDEEP 1536:cvS8fe5uWXSUiJCQpygYh9kN2oPipx0TrpmVniUPQ:HuHESppJYHkPi0pzU
TLSH
T1CC536BD93731B4B383BB61F1506F120B713EE567B404C4A4B198ECE55A54B6A02BBFAC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 f7a15db2febc731b7759c50d6738850bde00b8a127b71e72e673e1a7d8918696
MD5 a8f72ee692b97f5004655e5ead62a1b0
SHA1 05ea3d4f5ef6b5dba47d2dedfd5f2320fac82a9d
SHA512 ac6b6e561c3beee16208be71dc6bcc3efc211235a57f63e71558bd168958b28598bda730ec53ad753f70dfc7324be9e6e53a03a1a9621d175b45e2813423c329
TLSH
T165A002A01F91004DD5105B74949507517710D8296631535744D50445DDE15E55D42014
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 27bcb3a2eea80a3dcdb514bd96670bc493744416a6215be531d7daabf20a7c20
MD5 2a73fe4eab5acf8948632383f9ad1273
SHA1 331f8122a81334bcc8d7933ffea685b0678570b0
SHA512 e87306056f42d673f24345238dc073a11db71063316464f0c08da6f636aab6739edf6e7f00bccb1681799f2e16ee6eaa45285b0a52ae051783e8a49aaef920ba
SSDEEP 48:K0HqTnpJZybRcBIS3yK931dyx3iYUFn7yL5IVpz3Lkb10JF3jXYbLuLISdYK991q:KU0wKBeiiZCoKP626qoKHqr
TLSH
T1D0A1D30530B702413CBE294A85B58B2A514335F33018E62BBFBD54D65E6FE051EFE9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59864d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59864d.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 179d846e3d72daaff88c9f9531debe1f8bc84fabc2392f16a35cc3e67b5bdac2
MD5 1e02dc153014d5d1e22156c310bdb1e4
SHA1 5478bd1bf8a84b54f6412b9c15ec782f7d7712a6
SHA512 e39a44bf32dc87bddfcee0ae675b8302b1e58fa1358a669762be9e381e4c99133c9bc95be65984b3da2e8fa8f1040138569af7ac9ff6be61725d352fb1caaf9f
SSDEEP 384:5ZcIDsNiTlW+1Z+i3zIGmQ2msMtiDgtgOIwZOyo8og:RD/veiDT2xEiDgXsaX
TLSH
T1C7827D368CB85C776EF7E545F5473A239EB88127E2C4AB90D4ED6B1D00EB2A81307D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 e0e5da7a568aee9cb7846f81d58f5ce09b4674221cbb88bc64722b4b33c1de20
MD5 3ae7bdf258518ef9e2d5effd534842c5
SHA1 3c9cb24df26152602c234fc857feb3bba0462a34
SHA512 50a71aef239bd1da747cac557f8c73231a4b9c097a681ff5389125869da127e3109984d459536c0d94e3655a40b812e38a79db457b5bfb0a3260ce01eecfcf89
SSDEEP 384:IZcIEsNiflW+1a+i3zIGmQ2msMUiDgtgOIwZOyo8og:2EvvViDT2x5iDgXsaX
TLSH
T19A827D368CB85C776DF7E545F5463A239EB88127E2C4AF90D4EC6B1D00DB2981307D1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 85a69ce4a0f2491518110b9600827516ec2c3cf2801f0c518287ffd2712e54fb
MD5 704dfa1f1a2c21afb837bf9afccf829b
SHA1 420c0f16abf8ba6964a7687e6b9e81d7f8ca2c59
SHA512 a4661f0d6939ff581b48a4aee974c18da44e7e30b31ec8312b1658fb46ece490d137ed58ae03edbdff22b0d4c0e9284f717dcf76e3b2821151f7dc9d0844b453
SSDEEP 192:aONe6IE7QmiUyXoTPuIGmQ2mdC7sDX1U6:aONe6Dt7PuIGmQ2m+sDlU6
TLSH
T10802FA39ACB87CA79FB3AD48F4872F235EA5112BA5952F84D9D81B1D00D725C1303922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 16fd58431b01de2105047ebdaacd0b9db9da022476c304e3b90d57f501d226ee
MD5 34c9b9bc22764bfcbb4ffc671165f458
SHA1 a72badf867ddb95086973461fb87206e59fdc890
SHA512 3063b8756670f2d90202e806c35df5571f4e6f00420e46ffda78820a9f6ba50a5d788f968a3e4938acd0f80db535634a3809e1c28c8d4d8282c8cf4447c8951a
SSDEEP 384:uiFPZcIcgsN68TUNTUlIl4lW+1R+i3zIGmQ2msMnNiDgtgOIwZOyo8og:FFH3bwgCvmiDT2xONiDgXsaX
TLSH
T1E1A27D378CF8987BAEFBAA44F54A36138EB48067D6C5EB90E6DC5B1D00DB1980307D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7ee2ff1cab183a23b913d990558db6d0448aa90bee559a6b808780da4973cff1
MD5 92ccfd98db0419d42e2e8ac1ccbb694c
SHA1 39b4b4caf95d53fd08bda76ca7e59b4dea2ae42b
SHA512 36c9349d32188333eb82b99ad477d5cfe4655da98e3ae190cdb5fba0bcd6a5faaf375c344ac277b7f103b1497d4ba33bb3b1323ac96736d0e0a773a25d64724a
SSDEEP 192:aONj6IEHQmiUygYoTFuIGmQ2msMH27HDm/HU6:aONj6DpZFFuIGmQ2msMkHDgU6
TLSH
T1F3120A369CB8AC6B5FA3A954F4433E239DA58227E6C5BF90D5DC2B1D00EF25C130B912
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 6519394f0b55b62849e6f2b03290f36df3985811314fa7317dd1e52138dad080
MD5 2696b0cc8696591ae77aa46ad90a08dd
SHA1 de71a9190108c099c1c4763f80ffdf4611c7c9ff
SHA512 2523449e0e8e22b14c955975adba0abccb654b4a0343d272f03a1df20d6ee8ec5883e1e804112edfbbd5da4e47747c320bd09bb192ef6f2763992faf8fce08ed
SSDEEP 768:FFu/SwgCv6VDT2xDiM9SavKwIr+M+XsaX:K/Vv6VTgDzvKwIa7XsaX
TLSH
T108E26FE684D74CB6D8AE97C3973DAD12597CC133B1885648B3E8652DEC9B1BFC306841
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 16d61aaad7170e4e23eb58b54995f62c99468ebc426d96f3b4a45d92e4352311
MD5 bf740013029f828b41113cc740778af7
SHA1 82e5760ac966422fbed17740b4f442b1e0a458ff
SHA512 89161af6970ce152b5fc4734fea09bdf7bec3b739617b6fa081c87ae552bb35c485d8e18308d6c207561dfe5606fa8fb6d36f6459fb64c738da75eb7cd511d97
SSDEEP 384:rZcIysNi4lW+1R+i3zIGmQ2msMUiDgtgOIwZOyo8og:zy+vmiDT2x5iDgXsaX
TLSH
T1AE827C768CB89C776DF7E545F5463A239EB88127E2C8AF90D4EC5B1E00DB2981307D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

043762d9-14f8-454e-8cbe-0a5c6dbb142f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\043762d9-14f8-454e-8cbe-0a5c6dbb142f.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 d746891511dbde0d237d3442d66f42e254e9992d41daa4d85c828639c9ec59ac
MD5 1bd88fccf698f3e324e4d298f5c83eb5
SHA1 8b6beecbc94d37170642941accc94db41f4f115e
SHA512 33e9f879d7510f93c8a15e8165af78b6260b8b4b1ac18b5080659c5c8cacb75cdda7f49efeb4837253eefde3b930fea46a5124663265ea2eb9c653a5b86bfb17
TLSH
T1E2411658A6F91148B3B76F4A9FF3A86E887FB9772E06D45E10110E4F4A62B44C871733
MD5 SHA1 SHA512 TLSH

Submit Download