0adf25603532d33bffa96f8c889f576f928e0127fc06122d9367eb39eedd39e2

Resubmissions

23/09/2023, 23:40

230923-3n4p9scf28 8

Analysis

max time kernel
576s
max time network
587s
platform
windows10-2004_x64
resource
win10v2004-20230915-es
resource tags

arch:x64arch:x86image:win10v2004-20230915-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
23/09/2023, 23:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Phoenix.rar
Size

6.5MB
MD5

63cebf3c5c481802464dcc2f29f44eb4
SHA1

fe4716a0f3b40c375b067a6cfb145fcc173cb76c
SHA256

0adf25603532d33bffa96f8c889f576f928e0127fc06122d9367eb39eedd39e2
SHA512

cc314a57341157acdcd8dd015b3b253cd1ef04a725d9e2e012ec2f1bb51fd30f8eb5c628a609811ae4c9bcce0717cc73c05f11b0df968161bb8fc9faef399c3a
SSDEEP

196608:4ouCW0D6evV0rFs3H/RU7vghrtmRqAdOelC+kSCnyeZuKHb:vzL2yJU7YjmRblCwCny+Hb

Score

8^/10

discovery persistence

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 14 IoCs

pid	Process
7348	winrar-x64-623es.exe
5240	winrar-x64-623es.exe
4272	winrar-x64-623es.exe
6780	7z2301-x64.exe
1964	7zG.exe
6720	Phoenix.exe
6672	Phoenix.exe
8016	Phoenix.exe
1564	Phoenix.exe
444	Phoenix.exe
8044	Phoenix.exe
6928	selenium-manager.exe
224	selenium-manager.exe
644	selenium-manager.exe

Loads dropped DLL 5 IoCs

pid	Process
3228	Process not Found
3228	Process not Found
1964	7zG.exe
3228	Process not Found
3228	Process not Found

Registers COM server for autorun 1 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip.dll"	7z2301-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2301-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2301-x64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Lang\eo.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spc.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mn.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng2.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ru.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\es.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hr.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\is.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sk.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\7zCon.sfx	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cy.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fur.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ro.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sl.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-tw.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ba.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fr.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lt.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lij.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\descript.ion	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\da.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kab.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\af.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\el.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nn.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lv.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\yo.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\History.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\it.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sq.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sw.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\az.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kk.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gl.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tg.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\be.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mk.txt	7z2301-x64.exe
File created	C:\Program Files\7-Zip\Lang\sw.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tr.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz-cyrl.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.chm	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fa.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\vi.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ms.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\va.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.dll	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ast.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bn.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ext.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ne.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\readme.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\de.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hi.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\id.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eu.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fy.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tk.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ky.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt-br.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\7-zip32.dll	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\an.txt	7z2301-x64.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 24 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip	7z2301-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings	OpenWith.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2301-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2301-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2301-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2301-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip	7z2301-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip	7z2301-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2301-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2301-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings	taskmgr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip	7z2301-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2344688013-2965468717-2034126-1000\{F8172042-B79A-49DB-8B1C-485399D03BB5}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2301-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2301-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip.dll"	7z2301-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2301-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2301-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2301-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	7z2301-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip32.dll"	7z2301-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	7z2301-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip	7z2301-x64.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Sin confirmar 830942.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Sin confirmar 921960.crdownload:SmartScreen	msedge.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
6012	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 58 IoCs

pid	Process
1332	msedge.exe
1332	msedge.exe
1864	msedge.exe
1864	msedge.exe
4012	identity_helper.exe
4012	identity_helper.exe
4576	msedge.exe
4576	msedge.exe
6464	msedge.exe
6464	msedge.exe
6464	msedge.exe
6464	msedge.exe
6496	msedge.exe
6496	msedge.exe
4952	msedge.exe
4952	msedge.exe
5544	taskmgr.exe
5544	taskmgr.exe
5544	taskmgr.exe
5544	taskmgr.exe
5544	taskmgr.exe
5544	taskmgr.exe
5544	taskmgr.exe
5544	taskmgr.exe
5544	taskmgr.exe
5544	taskmgr.exe
5544	taskmgr.exe
5544	taskmgr.exe
5544	taskmgr.exe
5544	taskmgr.exe
5544	taskmgr.exe
5544	taskmgr.exe
5544	taskmgr.exe
5544	taskmgr.exe
5544	taskmgr.exe
5544	taskmgr.exe
5544	taskmgr.exe
5544	taskmgr.exe
5544	taskmgr.exe
5544	taskmgr.exe
5544	taskmgr.exe
5544	taskmgr.exe
5544	taskmgr.exe
5544	taskmgr.exe
5544	taskmgr.exe
5544	taskmgr.exe
5544	taskmgr.exe
5544	taskmgr.exe
5544	taskmgr.exe
5544	taskmgr.exe
5544	taskmgr.exe
5544	taskmgr.exe
5544	taskmgr.exe
5544	taskmgr.exe
5544	taskmgr.exe
5544	taskmgr.exe
5544	taskmgr.exe
5544	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 64 IoCs

pid	Process
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeRestorePrivilege	1964	7zG.exe
Token: 35	1964	7zG.exe
Token: SeSecurityPrivilege	1964	7zG.exe
Token: SeSecurityPrivilege	1964	7zG.exe
Token: SeDebugPrivilege	5544	taskmgr.exe
Token: SeSystemProfilePrivilege	5544	taskmgr.exe
Token: SeCreateGlobalPrivilege	5544	taskmgr.exe
Token: 33	5544	taskmgr.exe
Token: SeIncBasePriorityPrivilege	5544	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1964	7zG.exe
5544	taskmgr.exe
5544	taskmgr.exe
5544	taskmgr.exe
5544	taskmgr.exe
5544	taskmgr.exe
5544	taskmgr.exe
5544	taskmgr.exe
5544	taskmgr.exe
5544	taskmgr.exe
5544	taskmgr.exe
5544	taskmgr.exe
5544	taskmgr.exe
5544	taskmgr.exe
5544	taskmgr.exe
5544	taskmgr.exe
5544	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
5544	taskmgr.exe
5544	taskmgr.exe
5544	taskmgr.exe
5544	taskmgr.exe
5544	taskmgr.exe
5544	taskmgr.exe
5544	taskmgr.exe
5544	taskmgr.exe
5544	taskmgr.exe
5544	taskmgr.exe
5544	taskmgr.exe
5544	taskmgr.exe
5544	taskmgr.exe
5544	taskmgr.exe
5544	taskmgr.exe
5544	taskmgr.exe
5544	taskmgr.exe
5544	taskmgr.exe
5544	taskmgr.exe
5544	taskmgr.exe
5544	taskmgr.exe
5544	taskmgr.exe
5544	taskmgr.exe
5544	taskmgr.exe
5544	taskmgr.exe
5544	taskmgr.exe
5544	taskmgr.exe
5544	taskmgr.exe
5544	taskmgr.exe
5544	taskmgr.exe
5544	taskmgr.exe
5544	taskmgr.exe
5544	taskmgr.exe
5544	taskmgr.exe
5544	taskmgr.exe
5544	taskmgr.exe
5544	taskmgr.exe
5544	taskmgr.exe
5544	taskmgr.exe
5544	taskmgr.exe

Suspicious use of SetWindowsHookEx 26 IoCs

pid	Process
4352	OpenWith.exe
4352	OpenWith.exe
4352	OpenWith.exe
4352	OpenWith.exe
4352	OpenWith.exe
4352	OpenWith.exe
4352	OpenWith.exe
4352	OpenWith.exe
4352	OpenWith.exe
4352	OpenWith.exe
4352	OpenWith.exe
4352	OpenWith.exe
4352	OpenWith.exe
4352	OpenWith.exe
4352	OpenWith.exe
4352	OpenWith.exe
4352	OpenWith.exe
4352	OpenWith.exe
4352	OpenWith.exe
5300	SystemSettingsAdminFlows.exe
7348	winrar-x64-623es.exe
7348	winrar-x64-623es.exe
5240	winrar-x64-623es.exe
5240	winrar-x64-623es.exe
4272	winrar-x64-623es.exe
4272	winrar-x64-623es.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1864 wrote to memory of 1680	1864	msedge.exe	99
PID 1864 wrote to memory of 1680	1864	msedge.exe	99
PID 1864 wrote to memory of 3304	1864	msedge.exe	100
PID 1864 wrote to memory of 3304	1864	msedge.exe	100
PID 1864 wrote to memory of 3304	1864	msedge.exe	100
PID 1864 wrote to memory of 3304	1864	msedge.exe	100
PID 1864 wrote to memory of 3304	1864	msedge.exe	100
PID 1864 wrote to memory of 3304	1864	msedge.exe	100
PID 1864 wrote to memory of 3304	1864	msedge.exe	100
PID 1864 wrote to memory of 3304	1864	msedge.exe	100
PID 1864 wrote to memory of 3304	1864	msedge.exe	100
PID 1864 wrote to memory of 3304	1864	msedge.exe	100
PID 1864 wrote to memory of 3304	1864	msedge.exe	100
PID 1864 wrote to memory of 3304	1864	msedge.exe	100
PID 1864 wrote to memory of 3304	1864	msedge.exe	100
PID 1864 wrote to memory of 3304	1864	msedge.exe	100
PID 1864 wrote to memory of 3304	1864	msedge.exe	100
PID 1864 wrote to memory of 3304	1864	msedge.exe	100
PID 1864 wrote to memory of 3304	1864	msedge.exe	100
PID 1864 wrote to memory of 3304	1864	msedge.exe	100
PID 1864 wrote to memory of 3304	1864	msedge.exe	100
PID 1864 wrote to memory of 3304	1864	msedge.exe	100
PID 1864 wrote to memory of 3304	1864	msedge.exe	100
PID 1864 wrote to memory of 3304	1864	msedge.exe	100
PID 1864 wrote to memory of 3304	1864	msedge.exe	100
PID 1864 wrote to memory of 3304	1864	msedge.exe	100
PID 1864 wrote to memory of 3304	1864	msedge.exe	100
PID 1864 wrote to memory of 3304	1864	msedge.exe	100
PID 1864 wrote to memory of 3304	1864	msedge.exe	100
PID 1864 wrote to memory of 3304	1864	msedge.exe	100
PID 1864 wrote to memory of 3304	1864	msedge.exe	100
PID 1864 wrote to memory of 3304	1864	msedge.exe	100
PID 1864 wrote to memory of 3304	1864	msedge.exe	100
PID 1864 wrote to memory of 3304	1864	msedge.exe	100
PID 1864 wrote to memory of 3304	1864	msedge.exe	100
PID 1864 wrote to memory of 3304	1864	msedge.exe	100
PID 1864 wrote to memory of 3304	1864	msedge.exe	100
PID 1864 wrote to memory of 3304	1864	msedge.exe	100
PID 1864 wrote to memory of 3304	1864	msedge.exe	100
PID 1864 wrote to memory of 3304	1864	msedge.exe	100
PID 1864 wrote to memory of 3304	1864	msedge.exe	100
PID 1864 wrote to memory of 3304	1864	msedge.exe	100
PID 1864 wrote to memory of 1332	1864	msedge.exe	101
PID 1864 wrote to memory of 1332	1864	msedge.exe	101
PID 1864 wrote to memory of 4908	1864	msedge.exe	102
PID 1864 wrote to memory of 4908	1864	msedge.exe	102
PID 1864 wrote to memory of 4908	1864	msedge.exe	102
PID 1864 wrote to memory of 4908	1864	msedge.exe	102
PID 1864 wrote to memory of 4908	1864	msedge.exe	102
PID 1864 wrote to memory of 4908	1864	msedge.exe	102
PID 1864 wrote to memory of 4908	1864	msedge.exe	102
PID 1864 wrote to memory of 4908	1864	msedge.exe	102
PID 1864 wrote to memory of 4908	1864	msedge.exe	102
PID 1864 wrote to memory of 4908	1864	msedge.exe	102
PID 1864 wrote to memory of 4908	1864	msedge.exe	102
PID 1864 wrote to memory of 4908	1864	msedge.exe	102
PID 1864 wrote to memory of 4908	1864	msedge.exe	102
PID 1864 wrote to memory of 4908	1864	msedge.exe	102
PID 1864 wrote to memory of 4908	1864	msedge.exe	102
PID 1864 wrote to memory of 4908	1864	msedge.exe	102
PID 1864 wrote to memory of 4908	1864	msedge.exe	102
PID 1864 wrote to memory of 4908	1864	msedge.exe	102
PID 1864 wrote to memory of 4908	1864	msedge.exe	102
PID 1864 wrote to memory of 4908	1864	msedge.exe	102

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Phoenix.rar
1⤵
- Modifies registry class
PID:4380

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4352

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffb062a46f8,0x7ffb062a4708,0x7ffb062a4718
  2⤵
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2008,4892325608393971958,314025416494013077,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2024 /prefetch:2
  2⤵
  PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2008,4892325608393971958,314025416494013077,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2008,4892325608393971958,314025416494013077,131072 --lang=es --service-sandbox-type=utility --mojo-platform-channel-handle=2752 /prefetch:8
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,4892325608393971958,314025416494013077,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:1644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,4892325608393971958,314025416494013077,131072 --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,4892325608393971958,314025416494013077,131072 --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:1
  2⤵
  PID:2184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,4892325608393971958,314025416494013077,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4908 /prefetch:1
  2⤵
  PID:3860
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2008,4892325608393971958,314025416494013077,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=3516 /prefetch:8
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2008,4892325608393971958,314025416494013077,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=3516 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,4892325608393971958,314025416494013077,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5136 /prefetch:1
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,4892325608393971958,314025416494013077,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1
  2⤵
  PID:3692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2008,4892325608393971958,314025416494013077,131072 --lang=es --service-sandbox-type=audio --mojo-platform-channel-handle=4624 /prefetch:8
  2⤵
  PID:1192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2008,4892325608393971958,314025416494013077,131072 --lang=es --service-sandbox-type=video_capture --mojo-platform-channel-handle=5360 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,4892325608393971958,314025416494013077,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:1
  2⤵
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,4892325608393971958,314025416494013077,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:1
  2⤵
  PID:3340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,4892325608393971958,314025416494013077,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,4892325608393971958,314025416494013077,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4548 /prefetch:1
  2⤵
  PID:212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,4892325608393971958,314025416494013077,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5936 /prefetch:1
  2⤵
  PID:2200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,4892325608393971958,314025416494013077,131072 --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3700 /prefetch:1
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,4892325608393971958,314025416494013077,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:1
  2⤵
  PID:1480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,4892325608393971958,314025416494013077,131072 --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5824 /prefetch:1
  2⤵
  PID:1596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,4892325608393971958,314025416494013077,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2148 /prefetch:1
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,4892325608393971958,314025416494013077,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5976 /prefetch:1
  2⤵
  PID:64
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,4892325608393971958,314025416494013077,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1
  2⤵
  PID:2984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,4892325608393971958,314025416494013077,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5656 /prefetch:1
  2⤵
  PID:3660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,4892325608393971958,314025416494013077,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6188 /prefetch:1
  2⤵
  PID:3272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2008,4892325608393971958,314025416494013077,131072 --lang=es --service-sandbox-type=service --mojo-platform-channel-handle=5004 /prefetch:8
  2⤵
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,4892325608393971958,314025416494013077,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:1
  2⤵
  PID:468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,4892325608393971958,314025416494013077,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6396 /prefetch:1
  2⤵
  PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,4892325608393971958,314025416494013077,131072 --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5784 /prefetch:1
  2⤵
  PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,4892325608393971958,314025416494013077,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5992 /prefetch:1
  2⤵
  PID:1068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,4892325608393971958,314025416494013077,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4700 /prefetch:1
  2⤵
  PID:3924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,4892325608393971958,314025416494013077,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6724 /prefetch:1
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,4892325608393971958,314025416494013077,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6928 /prefetch:1
  2⤵
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,4892325608393971958,314025416494013077,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7112 /prefetch:1
  2⤵
  PID:504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,4892325608393971958,314025416494013077,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7336 /prefetch:1
  2⤵
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,4892325608393971958,314025416494013077,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7752 /prefetch:1
  2⤵
  PID:1788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,4892325608393971958,314025416494013077,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7660 /prefetch:1
  2⤵
  PID:5180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,4892325608393971958,314025416494013077,131072 --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8152 /prefetch:1
  2⤵
  PID:5416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,4892325608393971958,314025416494013077,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7100 /prefetch:1
  2⤵
  PID:5660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,4892325608393971958,314025416494013077,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7980 /prefetch:1
  2⤵
  PID:5672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,4892325608393971958,314025416494013077,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9076 /prefetch:1
  2⤵
  PID:5784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,4892325608393971958,314025416494013077,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8960 /prefetch:1
  2⤵
  PID:5776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,4892325608393971958,314025416494013077,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8948 /prefetch:1
  2⤵
  PID:5768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,4892325608393971958,314025416494013077,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8796 /prefetch:1
  2⤵
  PID:5760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,4892325608393971958,314025416494013077,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8012 /prefetch:1
  2⤵
  PID:5752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,4892325608393971958,314025416494013077,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8052 /prefetch:1
  2⤵
  PID:5744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,4892325608393971958,314025416494013077,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9712 /prefetch:1
  2⤵
  PID:5532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,4892325608393971958,314025416494013077,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9916 /prefetch:1
  2⤵
  PID:5556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2008,4892325608393971958,314025416494013077,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5660 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,4892325608393971958,314025416494013077,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8644 /prefetch:1
  2⤵
  PID:5408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,4892325608393971958,314025416494013077,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9076 /prefetch:1
  2⤵
  PID:5876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,4892325608393971958,314025416494013077,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6204 /prefetch:1
  2⤵
  PID:6440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,4892325608393971958,314025416494013077,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8968 /prefetch:1
  2⤵
  PID:6460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,4892325608393971958,314025416494013077,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6376 /prefetch:1
  2⤵
  PID:6332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,4892325608393971958,314025416494013077,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9344 /prefetch:1
  2⤵
  PID:6580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,4892325608393971958,314025416494013077,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9720 /prefetch:1
  2⤵
  PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,4892325608393971958,314025416494013077,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9732 /prefetch:1
  2⤵
  PID:5836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,4892325608393971958,314025416494013077,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9808 /prefetch:1
  2⤵
  PID:2216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,4892325608393971958,314025416494013077,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7364 /prefetch:1
  2⤵
  PID:6068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,4892325608393971958,314025416494013077,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6876 /prefetch:1
  2⤵
  PID:5576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,4892325608393971958,314025416494013077,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7200 /prefetch:1
  2⤵
  PID:6120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,4892325608393971958,314025416494013077,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8072 /prefetch:1
  2⤵
  PID:6136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,4892325608393971958,314025416494013077,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7576 /prefetch:1
  2⤵
  PID:5584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,4892325608393971958,314025416494013077,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8620 /prefetch:1
  2⤵
  PID:2948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,4892325608393971958,314025416494013077,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10124 /prefetch:1
  2⤵
  PID:5792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,4892325608393971958,314025416494013077,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10108 /prefetch:1
  2⤵
  PID:5196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,4892325608393971958,314025416494013077,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8636 /prefetch:1
  2⤵
  PID:5600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,4892325608393971958,314025416494013077,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:5580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,4892325608393971958,314025416494013077,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:1
  2⤵
  PID:6228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,4892325608393971958,314025416494013077,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9224 /prefetch:1
  2⤵
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,4892325608393971958,314025416494013077,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9252 /prefetch:1
  2⤵
  PID:3052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,4892325608393971958,314025416494013077,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6492 /prefetch:1
  2⤵
  PID:6744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,4892325608393971958,314025416494013077,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9256 /prefetch:1
  2⤵
  PID:5780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,4892325608393971958,314025416494013077,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9836 /prefetch:1
  2⤵
  PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,4892325608393971958,314025416494013077,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5136 /prefetch:1
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,4892325608393971958,314025416494013077,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:1
  2⤵
  PID:5540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,4892325608393971958,314025416494013077,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:3844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,4892325608393971958,314025416494013077,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9092 /prefetch:1
  2⤵
  PID:6040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,4892325608393971958,314025416494013077,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
  2⤵
  PID:6300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,4892325608393971958,314025416494013077,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8300 /prefetch:1
  2⤵
  PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,4892325608393971958,314025416494013077,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7292 /prefetch:1
  2⤵
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,4892325608393971958,314025416494013077,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7240 /prefetch:1
  2⤵
  PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,4892325608393971958,314025416494013077,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=84 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7844 /prefetch:1
  2⤵
  PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,4892325608393971958,314025416494013077,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=85 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10352 /prefetch:1
  2⤵
  PID:5940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,4892325608393971958,314025416494013077,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=86 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8120 /prefetch:1
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2008,4892325608393971958,314025416494013077,131072 --lang=es --service-sandbox-type=collections --mojo-platform-channel-handle=1760 /prefetch:8
  2⤵
  PID:7920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,4892325608393971958,314025416494013077,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=89 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7816 /prefetch:1
  2⤵
  PID:7928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2008,4892325608393971958,314025416494013077,131072 --lang=es --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5600 /prefetch:8
  2⤵
  PID:8032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,4892325608393971958,314025416494013077,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=92 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6524 /prefetch:1
  2⤵
  PID:6548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2008,4892325608393971958,314025416494013077,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=8100 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6496
- C:\Users\Admin\Downloads\winrar-x64-623es.exe
  "C:\Users\Admin\Downloads\winrar-x64-623es.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:7348
- C:\Users\Admin\Downloads\winrar-x64-623es.exe
  "C:\Users\Admin\Downloads\winrar-x64-623es.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:5240
- C:\Users\Admin\Downloads\winrar-x64-623es.exe
  "C:\Users\Admin\Downloads\winrar-x64-623es.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,4892325608393971958,314025416494013077,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=94 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4676 /prefetch:1
  2⤵
  PID:6828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,4892325608393971958,314025416494013077,131072 --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=96 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4852 /prefetch:1
  2⤵
  PID:6592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,4892325608393971958,314025416494013077,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=95 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4776 /prefetch:1
  2⤵
  PID:6132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,4892325608393971958,314025416494013077,131072 --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=98 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1396 /prefetch:1
  2⤵
  PID:6020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,4892325608393971958,314025416494013077,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=97 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7696 /prefetch:1
  2⤵
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,4892325608393971958,314025416494013077,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=99 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:1
  2⤵
  PID:8152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,4892325608393971958,314025416494013077,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=100 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9416 /prefetch:1
  2⤵
  PID:6384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,4892325608393971958,314025416494013077,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=102 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7372 /prefetch:1
  2⤵
  PID:6456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2008,4892325608393971958,314025416494013077,131072 --lang=es --service-sandbox-type=icon_reader --mojo-platform-channel-handle=8416 /prefetch:8
  2⤵
  PID:7484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2008,4892325608393971958,314025416494013077,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=1824 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4952
- C:\Users\Admin\Downloads\7z2301-x64.exe
  "C:\Users\Admin\Downloads\7z2301-x64.exe"
  2⤵
  - Executes dropped EXE
  - Registers COM server for autorun
  - Drops file in Program Files directory
  - Modifies registry class
  PID:6780

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2020

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1536

C:\Windows\system32\SystemSettingsAdminFlows.exe
"C:\Windows\system32\SystemSettingsAdminFlows.exe" SetInternetTime 1
1⤵
PID:1072

C:\Windows\system32\SystemSettingsAdminFlows.exe
"C:\Windows\system32\SystemSettingsAdminFlows.exe" ForceTimeSync 1
1⤵
PID:4652

C:\Windows\system32\SystemSettingsAdminFlows.exe
"C:\Windows\system32\SystemSettingsAdminFlows.exe" SetTimeZoneAutoUpdate 1
1⤵
PID:1268

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s tzautoupdate
1⤵
PID:4268

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x518 0x51c
1⤵
PID:5056

C:\Windows\system32\SystemSettingsAdminFlows.exe
"C:\Windows\system32\SystemSettingsAdminFlows.exe" ForceTimeSync 1
1⤵
PID:6680

C:\Windows\system32\SystemSettingsAdminFlows.exe
"C:\Windows\system32\SystemSettingsAdminFlows.exe" SetInternetTime 0
1⤵
PID:6804

C:\Windows\system32\rundll32.exe
C:\Windows\system32\rundll32.exe C:\Windows\system32\PcaSvc.dll,PcaPatchSdbTask
1⤵
PID:6880

C:\Windows\system32\SystemSettingsAdminFlows.exe
"C:\Windows\system32\SystemSettingsAdminFlows.exe" SetDateTime
1⤵
- Suspicious use of SetWindowsHookEx
PID:5300

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\923fe511b4ac45d7936b56010e3b11fb /t 7352 /p 7348
1⤵
PID:1568

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\1b1a1523d8ab47eaaa93bcc8fcfa65ef /t 3216 /p 4272
1⤵
PID:1836

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\bf09d06b8f924e4c8c931c44fbaa9a5b /t 6580 /p 5240
1⤵
PID:112

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1568

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Phoenix\" -spe -an -ai#7zMap26380:76:7zEvent1825
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1964

C:\Users\Admin\Downloads\Phoenix\Phoenix.exe
"C:\Users\Admin\Downloads\Phoenix\Phoenix.exe"
1⤵
- Executes dropped EXE
PID:6720

C:\Users\Admin\Downloads\Phoenix\Phoenix.exe
"C:\Users\Admin\Downloads\Phoenix\Phoenix.exe"
1⤵
- Executes dropped EXE
PID:6672

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5544

C:\Users\Admin\Downloads\Phoenix\Phoenix.exe
"C:\Users\Admin\Downloads\Phoenix\Phoenix.exe"
1⤵
- Executes dropped EXE
PID:8016

C:\Users\Admin\Downloads\Phoenix\Phoenix.exe
"C:\Users\Admin\Downloads\Phoenix\Phoenix.exe"
1⤵
- Executes dropped EXE
PID:1564

C:\Users\Admin\Downloads\Phoenix\Phoenix.exe
"C:\Users\Admin\Downloads\Phoenix\Phoenix.exe"
1⤵
- Executes dropped EXE
PID:444

C:\Users\Admin\Downloads\Phoenix\Phoenix.exe
"C:\Users\Admin\Downloads\Phoenix\Phoenix.exe"
1⤵
- Executes dropped EXE
PID:8044

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Phoenix\token.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:6012

C:\Users\Admin\Downloads\Phoenix\selenium-manager\windows\selenium-manager.exe
"C:\Users\Admin\Downloads\Phoenix\selenium-manager\windows\selenium-manager.exe"
1⤵
- Executes dropped EXE
PID:6928

C:\Users\Admin\Downloads\Phoenix\selenium-manager\windows\selenium-manager.exe
"C:\Users\Admin\Downloads\Phoenix\selenium-manager\windows\selenium-manager.exe"
1⤵
- Executes dropped EXE
PID:224

C:\Users\Admin\Downloads\Phoenix\selenium-manager\windows\selenium-manager.exe
"C:\Users\Admin\Downloads\Phoenix\selenium-manager\windows\selenium-manager.exe"
1⤵
- Executes dropped EXE
PID:644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1222f8c867acd00b1fc43a44dacce158

SHA1
586ba251caf62b5012a03db9ba3a70890fc5af01

SHA256
1e451cb9ffe74fbd34091a1b8d0ab2158497c19047b3416d89e55f498aae264a

SHA512
ef3f2fc1cedfc28fb530c710219b8e9eb833a2f344b91d3ffb2d82d7bbedbc223f4b60a38bea35b72eb706e4880ffcbb9256a9768f39bae95c5544be0f503916

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\78b73dd7-d8ca-486f-ae1d-4a2176aab78e.tmp

Filesize
19KB

MD5
1886e774e596de325bd8cce2152f2d64

SHA1
350976bca9c67fed5d113d0d5dec37cf4d3124ee

SHA256
150e43dc3380cfdbb1e14775375b22bb57b6a230c6a32109a7227ec60b254576

SHA512
42c495287f49264b653ed5f08f8c563a88bc4c34345ba380c7a8676e56694b5eaf3996626b8bb8768a9f444a454d7759b54aa79d10618f6b324954e35ec918d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

Filesize
37KB

MD5
60448aabaf3ce09c5366ef990df77f9e

SHA1
4cc830e73b7cb3acab2af3519a05076599182e1a

SHA256
f95fae863dec0acc29245d95511b39e36142e15303ca83d22dfd967da6c2eb98

SHA512
fd9685e77c7fa4ca0c10c3fc84146e22119e49472118106f8dff392137f927e3c2505143f50971bed3310e4a142d9a6f94e59789cb7a67309b4e5c1fa03a110c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000013

Filesize
136KB

MD5
adbc5f17cd58ec9e37b07e87e7873443

SHA1
1f39ee59beb73c466b18e0a9a1e8b37dcc41442f

SHA256
909ace3889588fdc9118cec9c0af88491533c55de0db2bf6fbed673549adb726

SHA512
59e31a929fef82e9434d7e791ba03b274cc42c4dc8ac5940935e15ee83f31e1b621517b22dc44f8d81cdef21e445f8ec3597710bbf5c455ea905f7d2380d8f2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000014

Filesize
192KB

MD5
aa2e90517374c24be6135ca42ad123e1

SHA1
61d540a5abfe0284c6175aef37c38c8d95e38855

SHA256
d98bfe1cdf73b934955da996baca10414f460ade87f342f1b99b9e1c8ad2e72f

SHA512
26cfb22eda41535f461565e4bb919aa838e8205a0412cd45b080003cc47662c82269c406060c3d7e4bd730265f4be78fac51da10f2c2e321174755717f1ab04a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015

Filesize
28KB

MD5
5e45a5bef158ce07b0766caefa2af6ec

SHA1
7fe831f6953679922ede8463a200ff80f93c20cc

SHA256
95cc38e48a42582321effd772a708f9b6ddb44a261f4bf03ce87e9442358f4a2

SHA512
70f7495024afa1c758962e122cee269dcc18bf8c11c8a6b0f9113577c8e5ab13374822990e9fbd5b29bb7ccac004ec85d8f1451d7c2ac6ec21e47d86fbd3bf2a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000016

Filesize
82KB

MD5
2821243e5a11eeaba127385234a4256f

SHA1
ef10486071d073a470b848c76be11a49f5709b80

SHA256
c3ec7138de897febf1cb9058fa518db0c661b547808423224cd003a6c44f0be4

SHA512
8689890e3513a8cb1eebee1c7a5c9d9d709124893a0e054267cf48a610a3116afada4bf2cf87a53cdef9f7e3879d418d712c1a07054a532d34d6de391ded9ab7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000017

Filesize
128KB

MD5
c6dc8153418c1611b2c9431836ec18c6

SHA1
3fd86116d41b945a4d0914bd1968147aef7a252c

SHA256
77a64b323ffeb2b9f628d54a78e2aae4a1d661c26210b12d36e12dfa9da5218d

SHA512
e6eabe396e82828d3762aaa6aa9a6916cbf51f692e29ae44a6c4d26715a55faa986b9fed3c4cf768b7e2268d2259f6378db6628474a500087de975d4de6ecd79

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000018

Filesize
62KB

MD5
92b700adc6060fada92283b01275cf4d

SHA1
d00a6bb54165ea0fa51dea4c961696e3b4e1d581

SHA256
2f69d1aa8156aba4698e9dcdd07da6416fbbb914e899a2269cbd2900e41fbbad

SHA512
58eb8e63c47a54e6b182e06de69745d1df907c2e5fd43d954d2f77a28cc585cb477ad9ae873b29a1ec4de5a8cd140194f859fce5023a77578723396a18433eb1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000019

Filesize
29KB

MD5
b4beb01f23f9f48a35288287b23720ad

SHA1
b05777528b10a2d3bd212305a72d4c3058547458

SHA256
e595b8a56012c8407f4fb7bb9635d815a8712781d002cd6b655f7b878dacdb5c

SHA512
26b4d02e03ae4b99ed157ca4d8a60eba6432565e1f89ac540c67486f33e2c3724a5d3c0371e033c147c13a64f7f7d21e18a7dcd90d03b7b528d4f8079b8bb073

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001a

Filesize
16KB

MD5
89a574ff00e6b0ec61d995d059ce6e65

SHA1
aea09e96808ab77165ffa712eaa58b8f056d0bb6

SHA256
e5c29c139842fd487473d0824f2c01b374680fb35d22fa929686d17896602a44

SHA512
30d0d40bd680e61968273155b740901cdfa66670fc2af6f23e44c6b998b67cc1fcd0b51bd5f9470f209f188e75d071355e592b2a7c97f4bfd15d07d455e0909d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001d

Filesize
115KB

MD5
9e4f5fe6ff105363dad67602473d4ce6

SHA1
7f86d8c06f0c76d45212403f932bfcc59567dca3

SHA256
ccdbb5c733353d2496cdb97784eb57bc93df3c54bc0a01540349af52e45706ec

SHA512
9bd78a08e063e7b23b4ad93657fafa6e4a9e1d772073425f241f6404c998a3f6b2402de0a6293ca3bc61b1c819a65c7b524ba0b6e549914cf2fdf46261475977

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001e

Filesize
260KB

MD5
58cc18c62c272180f6561f8e19f60f3b

SHA1
08510ccfd23eae3f7358d9b4ba8bb75f6a4d010e

SHA256
3e49e59e6884e799f48352a3f64702a739d625d28c0c0814234ce49ba9f78a54

SHA512
303063bfaeafd76a7587f2872f211fa7d0e6d0172f0855941ef221229f333cb8919ab909b93f3a9dad74a3075df2ea82b68c453a231608fb39db2a3ebd28d4f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000020

Filesize
28KB

MD5
ac8c2a58a428b26340f1c1cf6da0c874

SHA1
28d08b7b2bcd13d290dbcc5798692575207ca9ce

SHA256
7d6117b6e22204ec2bff5ce8ce4dee0708db947887d011a8f85224fb9c6245a4

SHA512
64477d097d99641745a3ed436a1c14a18d332e295c7ec0a6f72ce61f49bc607e56ea2bda43cbddae7e4d29efc8430be328ee5bb036fc73677d6d9e287531035d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000028

Filesize
128KB

MD5
f2d2a6aa210ff33196758b69c308184f

SHA1
66c0f2b8291a65dbc40292ab5d46e78d37d46b1c

SHA256
1e94c6b09fe4731e9872c058b7096c2f2addd28c36e4347afc3700195dd712a1

SHA512
8572389265cafb7208cdf3e249e380e0222b6b365f7b56110e8f7fa6eeaafbdd7b93a790918319320d5a3d64d3de406a0b43d82286ff6925c9f907e83925b41b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002c

Filesize
38KB

MD5
2b7ec9fe5044c75348bc52964bf50b78

SHA1
039e784c53ba423877c5c845ffb044abbf4c110e

SHA256
71c9403962b1f930169325d2c812125a0088d2a695609486bb6f31185e84ff97

SHA512
92cb64599e198177093bda32e1c962fdccaa049d9875292b97c6b014d0d0afde750dcef27151751dda3f8639df41bed611bce7816c04d4e581b17b132d169016

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002f

Filesize
30KB

MD5
f4523940171b981534555397f130bc22

SHA1
916170d11d2060e3f2e597b8b230240f35ed8240

SHA256
1e1a7359ae78a07b5abf7172b2429518f848c83fe3ee28d1672999b23f82ae62

SHA512
f846291b6cb4cd1bb88eacf994899653bf133d08a5640550f3b6634e4c413cbe33f203aaaa8e65bb79e0b63df3204d745f9fb9b65509dea350e91d9241056883

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000030

Filesize
56KB

MD5
13d8045f34d295fd032f840796f67cf6

SHA1
888efb7e86bc7f6e515ef8f1f19755552ff43f2a

SHA256
9e5d7183a098369f0c0722861b065b10fc89fcb78731abe16988eb48d0f7332d

SHA512
1876c3adf69bb8d9925d63e678f27cf15e082edff2b2b544888568494dd5c768f39f443b503a08d38d8c8d70f1fd8163defc77a057740cdb5c085c93eb417c59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000031

Filesize
16KB

MD5
9c6b5ce6b3452e98573e6409c34dd73c

SHA1
de607fadef62e36945a409a838eb8fc36d819b42

SHA256
cd729039a1b314b25ea94b5c45c8d575d3387f7df83f98c233614bf09484a1fc

SHA512
4cfd6cc6e7af1e1c300a363a9be2c973d1797d2cd9b9009d9e1389b418dde76f5f976a6b4c2bf7ad075d784b5459f46420677370d72a0aaacd0bd477b251b8d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000033

Filesize
127KB

MD5
9fd25b04c0b1f3cdc4e98fba7757d5d7

SHA1
d3c12169e563d9dd10c0a58b5984a30a1def369b

SHA256
575a9ba4dd8cabebcba0c0e79b5611c1faaa3a880604789a09d4a923089d5a34

SHA512
75238945961ddd8a86c3419889d9477b59abb8e1c0eb972ad893db3fdeaa4f497088a62f34fa0210a4d430e4a20c83f70ec6c8e43dd970858717778c96dbe7ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000037

Filesize
151KB

MD5
9ecaf6631316b20cfa1251d9682dff02

SHA1
dbe4d131084f17a0f92c7ff6f47edde759471add

SHA256
e4fdea18da58f41a77b31df8727d894bb0088259c539df8a2eaae641570eb23d

SHA512
f92f39ffc81b220abd66ec744316df02701790307f4218e5a6ec99d7f3f1a0169d1752ef9412b252fbac28d3ee7b913c30725a377e1efa34a2d2b2b8c7d34554

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000052

Filesize
19KB

MD5
b49848062e1daf78ba945c54da5da273

SHA1
529cc7ad493b0ae7ffcbd859aa9890ec6c8afb6a

SHA256
67150f97072fecff29bc2527ace4b0bcf007e2731a73079ff997873663114f8d

SHA512
87f2b972c37cff75e050695ce50d5083568007ac8dee0352bb0691f4ea735d9abe49985737becbf28316b049805ac65b21b5a7d7120dcca421ce89ffbdde22f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00005e

Filesize
1024KB

MD5
6d8d92a2fb32449fe26c94e885bb3bf0

SHA1
df7a1d4244c4175874255398008a639093fce79b

SHA256
63bbc52cc5b5c81cecee7f8bf55a9cf770e340e6d2c227e3f8461b4b65aa46eb

SHA512
934780206b512ba37149f4f8e57f501fbec829e5abf108ccaf39271bb09e018a18bdd7ff906ef75bfd0bcbbcb842d86c281870e97d127004e5611dd4e6cb6ebf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000060

Filesize
1024KB

MD5
5716464073102582f71aac6868f870b5

SHA1
4abba7005a7c67b18859a051bb51ffcef2d69d31

SHA256
844b4e01b43ffabdb47fc210a758748265e0fb32ddd68ae16fba4425ae747842

SHA512
94f7b31d471993470874c8dec7617a405b6b162487eb3886625076e38d58f8597d664a5141cb34d85bf4b8d55a9dba6dc147022b63bc3067b298d4a76666a6cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000062

Filesize
328KB

MD5
6dc255bde357bdc4c1e6fa6aaccd670e

SHA1
ba41eb853daaa855b9f470f260cc860e16604298

SHA256
42eb323974fe8f33d148dd74ec4ca63237d11619ae08dcf11c5a16e7f88c9672

SHA512
a9c05c493428ce4d57189e56fdab45c1992225e41cdb5b5cc6817ac23c8ae6526233129de2215acdb7db3bff7b6422a0121c4ea0d8a6291ef69764ab6c4aeebd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00007b

Filesize
20KB

MD5
e366ff1043dd9af0d00c2f7104858de1

SHA1
87977ac9a591b2f543bf3a32d4fd28a92bd95cf5

SHA256
ec80eb09fe9e94e688b88803770962a077066e67124db3dff36d261182e10ba0

SHA512
322792c7ba87555c507cc528c833cee5c5fa9c148887d0991f1704ba2af7a945c8c87d1e11540b707cf5b7cede1813ac7e82e4b31c957bc48a3854e5fb7a0b93

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00007c

Filesize
19KB

MD5
2e86a72f4e82614cd4842950d2e0a716

SHA1
d7b4ee0c9af735d098bff474632fc2c0113e0b9c

SHA256
c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f

SHA512
7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00007d

Filesize
67KB

MD5
d94e0e0a05b178d5f668021e14c7a1d9

SHA1
d28e00ff7663ba19bc80a379643ef1cb20b4d2a6

SHA256
ce471ce8016410f68616f0b1f122fc43f2dbaa7fd747877fe19955f492c630e2

SHA512
aa62a9b26850343db5b05ba623b1db75281ffefd7d5b168fd1a4a85c28655b1f3f900edfab3ac57ee7c4ace83769265c9a44d7b19b1b0e9c7fd3e11dc6267831

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00007f

Filesize
63KB

MD5
710d7637cc7e21b62fd3efe6aba1fd27

SHA1
8645d6b137064c7b38e10c736724e17787db6cf3

SHA256
c0997474b99524325dfedb5c020436e7ea9f9c9a1a759ed6daf7bdd4890bdc2b

SHA512
19aa77bed3c441228789cf8f931ca6194cc8d4bc7bb85d892faf5eaeda67d22c8c3b066f8ceda8169177da95a1fe111bd3436ceeaf4c784bd2bf96617f4d0c44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000080

Filesize
85KB

MD5
45a177b92bc3dac4f6955a68b5b21745

SHA1
eac969dc4f81a857fdd380b3e9c0963d8d5b87d1

SHA256
2db3b6356f027b2185f1ca4bc6b53e64e428201e70e94d1977f8aab9b24afaeb

SHA512
f6a599340db91e2a4f48babd5f5939f87b907a66a82609347f53381e8712069c3002596156de79650511c644a287cbd8c607be0f877a918ae1392456d76b90ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000081

Filesize
1.0MB

MD5
666719beca7087c1889e811749bb3063

SHA1
8a0249c0ec987d173bd5443e0d57528109f4cbd1

SHA256
a3611a7726757be70493c9125a49d4eb36df16b15d6ab019fe052e65a3995ab4

SHA512
37ae602af66c2167f2c159725f59f055ac557aeaff22d1666c6b1d8d8fc172dc1bd7970943ba3ec10eea2d47884eef82283cad478af231bcac1b1e31cd059386

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\5913945a95b61950_0

Filesize
39KB

MD5
7b0685d6e5b1234b5fd95bc8814c5ce1

SHA1
7f75520c978dfeb2bd9f6877b60579d35522ec14

SHA256
57f2d3ba236a09ca635e23c74ba29a4c0fc8fa84f320251dc3371955cb33b024

SHA512
cd4d5363db80128a6d1d6dbd39eeb8bae21a54f3dc2336800d3c9461c45fe2c70140cb471dfe640fb37e98c38f8ef5b2cf1a3c9d744da4c05393bfc6458772b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
63e9583522d54b5fa3c7469d12867cfc

SHA1
581b488c9ade14e1b7115e4dbe0adc1980a76e53

SHA256
f26afbc1edddeced566e78dd31b969cd168665c08aad566104b8f098db480a89

SHA512
3aa6e0c3e883ff6f1dc14e785efea23f3cfb24929a8998658a906add882a0259743a9113070d27bb18124b981fcfb47ebd881db7512a4d9b4d363193746da161

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
1a6fd16d10ca0e4130cd88e4cd55932c

SHA1
15d27759b1cbfd13174691b969284a58102a0484

SHA256
73672f9bd5d90197b63ae818aa9afef33dc0180af4f5767148c4ee3fba867e56

SHA512
44078d1b747b67cc8fc627063b89f3619f241971f7c2df5c73ed1e28a59db4957e0be12b58d2836728aaa528cb44eec97188df1876209eea89c775ee21e436c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
386748b64bb07390a04c4fc31e51b441

SHA1
d6604a4d4b07e7e801c2cbb66871f91d36e95449

SHA256
fb0ba8d53ae5f96a358317d8494acee6af696dbaf3d13a4af44e8f608a709415

SHA512
2ace818addeaa9b8671e43a1072e522281e7a458b98ddffc3b7cc9c602a0a830ec9b3a86d6da0830d57899cb5e8fced481fe8c5982fc0aaea004658b172caf24

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
14KB

MD5
02789451c1ef11a324d824814ce1c600

SHA1
60b8189e004f6db21749493a6480a44933c0d601

SHA256
7e1024c3e9326642f21d06eb4f12f70c43182674e716d25ca064933f23b25039

SHA512
39475a699eda90a2491907ee6da8e31c22a89da1c196ec6ec9a7ad54369bd3637773172ceff9f9b841c2dbb34db2f30fcbfafec5732622cbd86736e281782c3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
16KB

MD5
7a729dccb08af52c358562da2c31996f

SHA1
cf5ffdfe452293cdf84fbba169ce27a7a7d6abb3

SHA256
a54e80e731973823e277740f5fd99b05ae99ac328146e9a43aed0f90b1c2a7a6

SHA512
2c5a6389cad911a97391309e35cd9abba667b534b604a3cc0cfdacf041e631d17ddd8db68aef98abd6b09e0206ec38f06fbb4b8039d4cbc1f7ad906b8a7fd62c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
398B

MD5
c5810cba382f0b2b3e93a2b10d822f9c

SHA1
8b5a66a0bacb1e59614d42e52dd92da8f067dbb6

SHA256
58c1527d0f7a38c683cee02f0525d1ca9a73fb285f637bb50ce63f6db2b888c4

SHA512
f0955d43fbf88074e02efe1dd0b1a5de00170a0d4b04fe50f47dd3fbf61def2778fb50165c3759072b6350993257da9b0a1c28ea32317a9adf9540a06410ba66

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
16KB

MD5
c5592ecf0acc482e320e5dbd705361e8

SHA1
fef0674b8ce1ace852897edbf43af6ddb8c6fd28

SHA256
d57b4adafb6b5351db373ac812e690816982fc25aa751429cbee2ab39bc00377

SHA512
c2a5ca14c68d4f99e392a5e794eab3fe6cf33ba14027f11cdb009bf29c69eb66bdbd664fe95bac20eccda0310bbb89358c9f5c5014b7e9c227bbb8df8aa3a25f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e94ccc92dd3d437ba8788d218ab85885

SHA1
67b9f64e087ef0170ded592cf17e8e9796c2ff38

SHA256
989fa3b63d02a1a62ca74a04fa43d685ad8f5b01eb7169976643ff75596deb29

SHA512
0e237e0aa70abd016293357766b14b8d42eadaf341beefb56a4f40b2a769d73a5ca6329af166f0ddffc0a9a740ac232a243737bec4df4dd52036ab8cbd7840c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4bac02ea808855ab50dd40c94444c452

SHA1
5470270965f7f492975893853e4e6c2ccbae8b0b

SHA256
667d8a103aac8ae7e7675713bdfebc5159a2b225ff82d8c6a3011acbbeae225d

SHA512
ec607ff4f9cb47bf30cdde4b84b1fa441dcb00d1e4cb7f9f303b6a3956c6ebfb03d148211058a98c5126c1bfcf5c2f01d776b5d8337d0ba636267e669f331220

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
15KB

MD5
ca4bd07e3ce9499d89374f67be6974ea

SHA1
94be0620d43335dc02af15c4ec98c4b8cefcb590

SHA256
828b58776f317576962d0e19aabb6e2c4adb629add72207f279452f6373c3999

SHA512
1ead5e1830d60427df4cb973d7073bde479a0e7472cb785be848871b6d095514a106b3a27f670eef2937f0413701c6bec1de55da2e746c49c952d5f9c6f4e3ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
19KB

MD5
9032c526b6bb33b8e39ea717e8b2dc64

SHA1
db49b397a02b9b3af429079783abe2ae788d8732

SHA256
cfb803009cf1a6bc84172c0c1c33133889eb4cc12ddb51f9f4a326c1ff82892b

SHA512
13bdec63a9a3cbef96f2bdcf5455884e3bb88dc79d178b4e7966c862ed2564c700915cac893a38450b7784d03fc82cd57120ef1ca5ecc16be3adae84e67a4ad6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7c467487b0938846d9546bff36bcd29b

SHA1
dfc8747bf2d2e9d2ad71139458531c6e8e0555f7

SHA256
15a3ccf3859c0521c87e408b492e7e4eb9b37f8d9b85078a8f87f334de8e7130

SHA512
15a915de7ef5490ad179aa8020a66a369705754dbfd3d9dfa506b76ac2879cfa20a93c64a87b037a5a6ff8843f2d24002454f701121df98635bf81e8eff83355

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
18KB

MD5
90f33aa33c08a0bcd157e449f88d9a36

SHA1
4cff8fd54f4481b02f0f5e2b01d6ddfac4f62ea1

SHA256
fd4967c3e6dffc8b08a8fa97e4e81b50448a465046e5489c5c0727e4e4f78427

SHA512
bd034f345b3132be86e07f506e9a2463ce86c859ffc5688a24662635f10fe1a914e8226bbabf7bfeef10a6fe092480b22bd95ea1e9a29e16e3dd2619a56ef766

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4d4fd4f444ebd71f21c5e873fcc3380c

SHA1
a42f87d86235b4bc8f89ad3e9a28508f2b8e0dc0

SHA256
9d822e49cd19e6907356d17ee6372843b96750b60a910f10d8c18492e3975e46

SHA512
6bd73c206c8234a5b3d943c2a5d1af9de40cb5bf19c55e8004d4e6a0c8dcc0aa4b39404514f1086e6311bfefb029d963f0196bb40936b8537b03b23addfb34fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
20KB

MD5
0163e3a2e924001f7f24272aef9d6fed

SHA1
7bef2ee964a6643e835c6b30202c00347d24add0

SHA256
eefea35c35a256f4dc27f2cb7cd5d36b6d8c8cef2d57f260157b580bb08548e3

SHA512
c6feaf4d2e5e2f1ca089d38cc4867b81bfa8618e066c3473605b8d8bd3b2c7de2a37a0ffb600ff71751ce296e9ace8da39a5047a4fc7c5044b615d274b4b5c66

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
19KB

MD5
82bf97c373884269d82c92abdb08cd64

SHA1
d9c353aa46bee5576c715c3b20f049ad8c049708

SHA256
f62110b5555994976a98b5ad55548f0cc77e4f4d2cd4685a0dbf08dd77bf97d8

SHA512
2a33e455efb7e50dcdf0c73aad86f081405ee92e1068ba7c7b9fc2ea9bab2ebab1da49fae2141c1cc2fe38caa206fc116d0250964c60aaa12b93de8f16caf225

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
20KB

MD5
bf013a7a6d3dd6b1fe3d5bfc9c20b81e

SHA1
8a47b8179b19470564900d9f7887c453be8314a4

SHA256
4a3a7b04b195466f86fedf10d8dc60a7ce0af1c6d9011434a22d32559a98b67c

SHA512
4736f3774b3c9453a33a8b6a5cec552db61d2515d73de3eb0b7205a35405efc3d74cc228069fcfcc73d4d9fb88b540a4f86b418e4c3774661908a932fb6f6614

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
20KB

MD5
aab35c67a870d65eff37754503eba129

SHA1
24455785a2ed5783ec733a1baef7d8f0b792b893

SHA256
37d226ecb3034f6bf613ec3b0e9ebd92e5ee30b17970c376177afec878877add

SHA512
9e6d1884a07593c6f4f56fb8a530f6209b371419eabe871a192947f541b697f17de23de7a03aadb650c0a80f5987177f420d845aa1bf56142cb4e86a55e63667

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
15ad31a14e9a92d2937174141e80c28d

SHA1
b09e8d44c07123754008ba2f9ff4b8d4e332d4e5

SHA256
bf983e704839ef295b4c957f1adeee146aaf58f2dbf5b1e2d4b709cec65eccde

SHA512
ec744a79ccbfca52357d4f0212e7afd26bc93efd566dd5d861bf0671069ba5cb7e84069e0ea091c73dee57e9de9bb412fb68852281ae9bd84c11a871f5362296

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
959e02402d1ecd811f5aa0028cdb13d5

SHA1
2ac0053a0fae9c4deb831ebdfc10098a51ed152d

SHA256
d0cb79102467334c25813122999f1ae778665d24b6422f7d235446498a72e1dc

SHA512
f02c3dc160b20dc61c8356fbfb8ed724c9d9d73da78f5ab41883d6c3001d3b7981df9acc927c5d6f593add801cccb66afb678a14cf3f223787687354d59b97ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
fc63656f31cf0433310bdb234d1393c2

SHA1
a18b147f30d87aab7bf17057ab36ef23d7b18dc9

SHA256
2117169ec37a338146798ffa28b4950165f1740a5751113ec73ff7e86f81329e

SHA512
1ef1f2843d1884746030d67b025a58bd1902d9a1b7174b9468b229c0fe729e97d02e1612f5b55a21b1028c651522a68eca7671ae650e88b864ac3075211cdd00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
9ba9a32871338669df1fd12ec1fff7ef

SHA1
944d949dd45082add54c0ece38800490f5dc78dd

SHA256
f7b7ba68ee85f60eef1b9a61068d26124b2f58a489a55e68fa7aa23f37f5eb7b

SHA512
152ee79bbdcd8b873bfeea84bb0c7153d54337844c3ef3d259b1304d52de2b6c4774ce142090e023a38ee5f85f9f32f9f1355389c224f8c01b6f08a0a8f14bff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
ff2227bb03e3330cacdd9222f911dd43

SHA1
a43773fe90471d9109e87d32a5c9d95de7e899f6

SHA256
da3dfa71c032803a70960dd9eb19ce80984c64452f98f114fd4b8fca3d1cfb22

SHA512
0dbf1c2d2c13301687406e724200c083713d0fdc464130fa9964a5cc1c48cfad1e17a317d2039fb0a4a0528fea2cac8f1f157e1bbcdb123d4f6264638af67149

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
282cdc6c3585d05383faa2dad17551c2

SHA1
527466da710bc8e52ed4bbcf98f977426c71a90b

SHA256
92589fc1b1fef51e644ce960dd8c1889cdacf2a2b2fd628b44a7d0fadb6a7f5d

SHA512
5f1dd87051c03b01a1a936f17352dcceec6ff046bcb39aba27ef848e5025049f6937db5669412efa3ee28f522943a624bdee436470369cf558da19958219efcf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
7d6118a191be34dabafedab281e3c9f3

SHA1
767041747ec3ed78a0754484a6568718d5a5e833

SHA256
251fb3fa58beb68843d8a650cc7c4bd05b98958b716cb9138161fda1c64675e1

SHA512
af67ee50ef74f9caefeb10bcfb9b0296852ee1e08d6947d7a06905d96310b73adc4680529557ed5437032bc602fa7dce6c1553a5cc4f8aa805f71791c5cd0092

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
2394029da3803c95334ed6b96a0499e0

SHA1
ae8ab46de965e975089d0e01735d1a33c2fb8c0d

SHA256
b843278e6a2471d0dd6e199332f92168173dbc3fe404f569e189d7ecb477b1e9

SHA512
db9ae4c309d9fbee6006915f84d474706cf69cee9d20fcca2c7a62c1e52c7f70618df054f08d4c972abedfdc967cd849242efe1ce66cd10a70ce76fb4024aa3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe59fd71.TMP

Filesize
536B

MD5
cc86b3a3cde34f75fc1e3fc6114e6475

SHA1
7f857186e41ba55960f18e476b089e8c07610d55

SHA256
f42b035c065e414ec193f6661689413a21e0fdeba1207158baeba82c25adf5f3

SHA512
c0a1adc9916b81724853e00166305bbeb67a220fc3edc164113d17b0e1be4d8d49269b163bd4c03be25e8220a161bbb2d87621b7b1c9bf1d6910ff1235c24b67

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
a4e3efa067182e27f74b6ad6895cd861

SHA1
6e3df28344ab0b32bea2a147f88f4c8bb1ce3802

SHA256
a2ed4884818a4806b9da3ed7bc38bfd60da66459500d0a8d762a723b4d943229

SHA512
c251935e51147879819d0b3b701c5b66372db29abe0f1f9ef952d399e32e03641c12b780ea6093906cd931779a7a71b9bc33cb691c46d0e19827fa935452c179

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
1a23e4d936ea0ab0fbeeb1d4a5162c56

SHA1
d20b89bb4e28916f42ae2c67a7dda1d6c44dd531

SHA256
2dd6795b4efc8f53dc6771864a3eee76774e8addaf28eabb08f6d3162e9dbc89

SHA512
dd6770ad9015202663a2d196e66b751bdfbcc833b89a37941538257fae5ed58c8d993e63317235794289f85bca7722e75a444a5898cbf4cefbf01516f579c614

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a5c91c4ed0f618b643ce8efad7d74f39

SHA1
61244ab4f115de4d7bc1eb1991f4fefa012e3b2c

SHA256
65ac27f9df3cf6f09555740640756b2dd2c9a62ca90b0e4f176cba1a3572e026

SHA512
d72b0a43b2dd3f4c6f9e1d7d94b6bd8fe6c77a8804bd1c2d694ed2eae112746a10a9fae696d32ee8b9f7a4c974c83f45e412c71dcb6badda16a38dcf2bcd14fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
08aeadcddc4d4bf1a29044ee959eb629

SHA1
be7c520af1881231f0ce1b57ee9a16f14200ede6

SHA256
9fd30ae0e9d94c1f0e0e603f89c186a4401036dfe7a48673d8adc78ffa3b494a

SHA512
dc587caa2771e737b54c6880214fd56bca40fe935b870fba030321850888b36ceb2d61cf7fe3da2a79a22a6b27781c1121655afef560296c594f5bbb7419311a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
2f0ef17c7acdfcb98f2533911c479960

SHA1
a4de13f3fa28d1a9fe8de482e0f1e40d5bcafbb5

SHA256
7dc4ce4926d23a69e0936859d7af1d31ea537d257f93df5548d9bfaf55c3fb10

SHA512
a1809788b9ff13a8c87f8b4afe3c92d8980b948281ee5c52155446ebc09954031c7314a8d7ba938bd767a1bdbe659ca54c6c863147b104adae93544249e13d5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
28021753aed78aa9d150c8bae9f28882

SHA1
4376e279ee2e4ea7765ed60cf47c961cf86812ce

SHA256
bebbba31ac84c81dd6e85143ebc7fc7e0836294133d42ce8c8d22e1311dc1d8c

SHA512
2b746972ae2de26347eedf1a2edd2008ec775be3b5228cccce4f007bbc48d7c8efb6057b30d5f974d2652a4bff4f5ee6ba102ef8f2d9f91831eed829d57099f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
b46849d73d6a948947931dcfac57e43d

SHA1
f873d10b752740d4505aafe305896cbe448fccc9

SHA256
4a050e71ff54d90a64005c6bab6e826488c999ff4fa7be0d54816e80bbe4904f

SHA512
e0feaf5f99b73dec7deb835d9a9349d8d2a46b9d6eaa8beb45f646dd4c54e3bd01073c95d47bab76a87523921901985a4c36ed26773b43ef55061fa344642dfc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
3c55be19141158d255ee82e550c96bdc

SHA1
90dc6a408e2c16b65119d9b93896b0d7147417f5

SHA256
178a02d8ebc5229431f7fee8ba1a9c28e592624bd72c9aae4cd2f0c2830682f8

SHA512
312a8399237ef0b572abf3d4eb5c04a225826653c0b72708393e91ae246168a0d1eab25322183932ed9d8534a64040aa68706097afc3a75b5f51694a6b243d5b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
37592657726675af4d0194552c153777

SHA1
d3ffacf009151c152b300b4db620a613d4615795

SHA256
ab3542d6eaa7ab1eb91ac02dd67d86ee6986f40a89923f42b5612901168ab85e

SHA512
baee3b8134267cbbcd44fde011641edb610705ca020b4a60129ec46e28ee91436000736abc58ed9124666ab92ab17d8eeda140b5e974575a8a342c4795834084

Download Submit
C:\Users\Admin\Downloads\Sin confirmar 830942.crdownload

Filesize
1.5MB

MD5
e5788b13546156281bf0a4b38bdd0901

SHA1
7df28d340d7084647921cc25a8c2068bb192bdbb

SHA256
26cb6e9f56333682122fafe79dbcdfd51e9f47cc7217dccd29ac6fc33b5598cd

SHA512
1f4da167ff2f1d34eeaf76c3003ba5fcabfc7a7da40e73e317aa99c6e1321cdf97e00f4feb9e79e1a72240e0376af0c3becb3d309e5bb0385e5192da17ea77ff

Download Submit
C:\Users\Admin\Downloads\Sin confirmar 921960.crdownload

Filesize
3.5MB

MD5
2987543ab1a99b4b16cb9daaea31b64e

SHA1
2fa2a3f7bcca13f1c201549d3af4365b343ffdc0

SHA256
235507ff4e0fc91573e4baa2df7502318fcad337b6722d0b81aeb4b23b53ed84

SHA512
3369924cd51e8802ee9fea28a9eb4ac820b781b9a32a71ebe2b9c6ee6a4806af58c5f741b60373277affa786c6ee5cee5a969bd21fca841d91ea64169af5779c

Download Submit
memory/5544-2006-0x0000020985D70000-0x0000020985D71000-memory.dmp

Filesize
4KB

Download
memory/5544-2005-0x0000020985D70000-0x0000020985D71000-memory.dmp

Filesize
4KB

Download
memory/5544-2007-0x0000020985D70000-0x0000020985D71000-memory.dmp

Filesize
4KB

Download
memory/5544-2012-0x0000020985D70000-0x0000020985D71000-memory.dmp

Filesize
4KB

Download
memory/5544-2011-0x0000020985D70000-0x0000020985D71000-memory.dmp

Filesize
4KB

Download
memory/5544-2013-0x0000020985D70000-0x0000020985D71000-memory.dmp

Filesize
4KB

Download
memory/5544-2015-0x0000020985D70000-0x0000020985D71000-memory.dmp

Filesize
4KB

Download
memory/5544-2014-0x0000020985D70000-0x0000020985D71000-memory.dmp

Filesize
4KB

Download
memory/5544-2016-0x0000020985D70000-0x0000020985D71000-memory.dmp

Filesize
4KB

Download
memory/5544-2017-0x0000020985D70000-0x0000020985D71000-memory.dmp

Filesize
4KB

Download