Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    1176s
  • max time network
    1190s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/02/2024, 15:40

General

  • Target

    https://www.techspot.com/downloads/5235-minecraft.html#download_scroll

Score
8/10

Malware Config

Signatures

  • Downloads MZ/PE file
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 56 IoCs
  • Suspicious use of FindShellTrayWindow 46 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.techspot.com/downloads/5235-minecraft.html#download_scroll
    1⤵
    • Enumerates system info in registry
    • NTFS ADS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4012
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe9aff46f8,0x7ffe9aff4708,0x7ffe9aff4718
      2⤵
        PID:216
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,13011193423408727692,6485713938440183212,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:972
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,13011193423408727692,6485713938440183212,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
        2⤵
          PID:3188
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13011193423408727692,6485713938440183212,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
          2⤵
            PID:5056
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13011193423408727692,6485713938440183212,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
            2⤵
              PID:3292
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,13011193423408727692,6485713938440183212,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3068 /prefetch:8
              2⤵
                PID:3200
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13011193423408727692,6485713938440183212,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:1
                2⤵
                  PID:3724
                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,13011193423408727692,6485713938440183212,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5588 /prefetch:8
                  2⤵
                    PID:1640
                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,13011193423408727692,6485713938440183212,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5588 /prefetch:8
                    2⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:5080
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13011193423408727692,6485713938440183212,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5820 /prefetch:1
                    2⤵
                      PID:4952
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13011193423408727692,6485713938440183212,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5828 /prefetch:1
                      2⤵
                        PID:3240
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13011193423408727692,6485713938440183212,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7200 /prefetch:1
                        2⤵
                          PID:3004
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13011193423408727692,6485713938440183212,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6960 /prefetch:1
                          2⤵
                            PID:4044
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13011193423408727692,6485713938440183212,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6948 /prefetch:1
                            2⤵
                              PID:1224
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13011193423408727692,6485713938440183212,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6820 /prefetch:1
                              2⤵
                                PID:3716
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13011193423408727692,6485713938440183212,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6688 /prefetch:1
                                2⤵
                                  PID:956
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13011193423408727692,6485713938440183212,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6540 /prefetch:1
                                  2⤵
                                    PID:3844
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13011193423408727692,6485713938440183212,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6424 /prefetch:1
                                    2⤵
                                      PID:64
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13011193423408727692,6485713938440183212,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6164 /prefetch:1
                                      2⤵
                                        PID:2784
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13011193423408727692,6485713938440183212,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6156 /prefetch:1
                                        2⤵
                                          PID:2956
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13011193423408727692,6485713938440183212,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6052 /prefetch:1
                                          2⤵
                                            PID:4284
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13011193423408727692,6485713938440183212,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7848 /prefetch:1
                                            2⤵
                                              PID:5676
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13011193423408727692,6485713938440183212,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7868 /prefetch:1
                                              2⤵
                                                PID:5668
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13011193423408727692,6485713938440183212,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8320 /prefetch:1
                                                2⤵
                                                  PID:5752
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13011193423408727692,6485713938440183212,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6676 /prefetch:1
                                                  2⤵
                                                    PID:6008
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13011193423408727692,6485713938440183212,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8460 /prefetch:1
                                                    2⤵
                                                      PID:5712
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13011193423408727692,6485713938440183212,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8184 /prefetch:1
                                                      2⤵
                                                        PID:5700
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13011193423408727692,6485713938440183212,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8080 /prefetch:1
                                                        2⤵
                                                          PID:5692
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13011193423408727692,6485713938440183212,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7832 /prefetch:1
                                                          2⤵
                                                            PID:5684
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13011193423408727692,6485713938440183212,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7364 /prefetch:1
                                                            2⤵
                                                              PID:6460
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13011193423408727692,6485713938440183212,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7360 /prefetch:1
                                                              2⤵
                                                                PID:6740
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13011193423408727692,6485713938440183212,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7060 /prefetch:1
                                                                2⤵
                                                                  PID:6400
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13011193423408727692,6485713938440183212,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8804 /prefetch:1
                                                                  2⤵
                                                                    PID:6860
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13011193423408727692,6485713938440183212,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7876 /prefetch:1
                                                                    2⤵
                                                                      PID:6876
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13011193423408727692,6485713938440183212,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9476 /prefetch:1
                                                                      2⤵
                                                                        PID:7008
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13011193423408727692,6485713938440183212,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7440 /prefetch:1
                                                                        2⤵
                                                                          PID:7136
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13011193423408727692,6485713938440183212,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8096 /prefetch:1
                                                                          2⤵
                                                                            PID:6416
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13011193423408727692,6485713938440183212,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8340 /prefetch:1
                                                                            2⤵
                                                                              PID:5220
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13011193423408727692,6485713938440183212,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7560 /prefetch:1
                                                                              2⤵
                                                                                PID:5208
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13011193423408727692,6485713938440183212,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9648 /prefetch:1
                                                                                2⤵
                                                                                  PID:5252
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13011193423408727692,6485713938440183212,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7568 /prefetch:1
                                                                                  2⤵
                                                                                    PID:5196
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13011193423408727692,6485713938440183212,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7900 /prefetch:1
                                                                                    2⤵
                                                                                      PID:3572
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13011193423408727692,6485713938440183212,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9448 /prefetch:1
                                                                                      2⤵
                                                                                        PID:5212
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13011193423408727692,6485713938440183212,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7492 /prefetch:1
                                                                                        2⤵
                                                                                          PID:5284
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13011193423408727692,6485713938440183212,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5872 /prefetch:1
                                                                                          2⤵
                                                                                            PID:5872
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13011193423408727692,6485713938440183212,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6352 /prefetch:1
                                                                                            2⤵
                                                                                              PID:6016
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13011193423408727692,6485713938440183212,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7308 /prefetch:1
                                                                                              2⤵
                                                                                                PID:5148
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2120,13011193423408727692,6485713938440183212,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6036 /prefetch:8
                                                                                                2⤵
                                                                                                  PID:6508
                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13011193423408727692,6485713938440183212,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8336 /prefetch:1
                                                                                                  2⤵
                                                                                                    PID:6500
                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2120,13011193423408727692,6485713938440183212,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4176 /prefetch:8
                                                                                                    2⤵
                                                                                                      PID:6828
                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13011193423408727692,6485713938440183212,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7256 /prefetch:1
                                                                                                      2⤵
                                                                                                        PID:4416
                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13011193423408727692,6485713938440183212,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7284 /prefetch:1
                                                                                                        2⤵
                                                                                                          PID:4600
                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13011193423408727692,6485713938440183212,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8436 /prefetch:1
                                                                                                          2⤵
                                                                                                            PID:6348
                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13011193423408727692,6485713938440183212,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6988 /prefetch:1
                                                                                                            2⤵
                                                                                                              PID:6232
                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13011193423408727692,6485713938440183212,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9704 /prefetch:1
                                                                                                              2⤵
                                                                                                                PID:4940
                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13011193423408727692,6485713938440183212,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8832 /prefetch:1
                                                                                                                2⤵
                                                                                                                  PID:5580
                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13011193423408727692,6485713938440183212,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7640 /prefetch:1
                                                                                                                  2⤵
                                                                                                                    PID:6320
                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13011193423408727692,6485713938440183212,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6276 /prefetch:1
                                                                                                                    2⤵
                                                                                                                      PID:4708
                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13011193423408727692,6485713938440183212,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8080 /prefetch:1
                                                                                                                      2⤵
                                                                                                                        PID:1104
                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13011193423408727692,6485713938440183212,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6964 /prefetch:1
                                                                                                                        2⤵
                                                                                                                          PID:2752
                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13011193423408727692,6485713938440183212,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9516 /prefetch:1
                                                                                                                          2⤵
                                                                                                                            PID:1664
                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13011193423408727692,6485713938440183212,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7836 /prefetch:1
                                                                                                                            2⤵
                                                                                                                              PID:1080
                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13011193423408727692,6485713938440183212,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2000 /prefetch:1
                                                                                                                              2⤵
                                                                                                                                PID:4672
                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13011193423408727692,6485713938440183212,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6032 /prefetch:1
                                                                                                                                2⤵
                                                                                                                                  PID:6724
                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,13011193423408727692,6485713938440183212,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4944 /prefetch:2
                                                                                                                                  2⤵
                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                  PID:4188
                                                                                                                              • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                                1⤵
                                                                                                                                  PID:5024
                                                                                                                                • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                                  1⤵
                                                                                                                                    PID:1112

                                                                                                                                  Network

                                                                                                                                  MITRE ATT&CK Enterprise v15

                                                                                                                                  Replay Monitor

                                                                                                                                  Loading Replay Monitor...

                                                                                                                                  Downloads

                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                                                    Filesize

                                                                                                                                    152B

                                                                                                                                    MD5

                                                                                                                                    d62cefeb0c8fbab806b3b96c7b215c16

                                                                                                                                    SHA1

                                                                                                                                    dc36684019f7ac8a632f5401cc3bedd482526ed7

                                                                                                                                    SHA256

                                                                                                                                    752b0793cf152e9ea51b8a2dc1d7e622c1c1009677d8f29e8b88d3aa9427dd01

                                                                                                                                    SHA512

                                                                                                                                    9fc3968fec094be5ca10a0d927cb829f7f8157425946ebd99a346b7e63c977cb3f37560af1a4bc8f87ab19b43b3ed86fd5b37f89d1a9b2dc86e3c73142c3065b

                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                                                    Filesize

                                                                                                                                    152B

                                                                                                                                    MD5

                                                                                                                                    7ee1c6757da82ca0a9ae699227f619bc

                                                                                                                                    SHA1

                                                                                                                                    72dcf8262c6400dcbb5228afcb36795ae1b8001f

                                                                                                                                    SHA256

                                                                                                                                    62320bde5e037d4ac1aa0f5ff0314b661f13bb56c02432814bffb0bd6e34ed31

                                                                                                                                    SHA512

                                                                                                                                    dca56a99b7463eddf0af3656a4f7d0177a43116f401a6de9f56e5c40a49676cea5c38b6c458f426c6bff11165eec21104cfa9ca3e38af39d43188b36d3f22a0f

                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

                                                                                                                                    Filesize

                                                                                                                                    243KB

                                                                                                                                    MD5

                                                                                                                                    ae14aa867183750808233ad64f53db89

                                                                                                                                    SHA1

                                                                                                                                    3fdaffda2f1f4d71050440ad2569ad846689ad55

                                                                                                                                    SHA256

                                                                                                                                    fcd7b73e67a2efcf9a28b9e602addac393c702e8d7d996b8ec3ae843f8964f83

                                                                                                                                    SHA512

                                                                                                                                    7ab8e63de8ae00fe83fd5313c8b250f24f26938678274d75cc5227058f66866fd9a2ad7f80054d8cfe700761686d44a01bde3dd35c72ec8b389c392d8ded5cfd

                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

                                                                                                                                    Filesize

                                                                                                                                    41KB

                                                                                                                                    MD5

                                                                                                                                    afee65ca1f02417a61cda85676d6baa0

                                                                                                                                    SHA1

                                                                                                                                    9914d7733ac86d2e1d327590d6b03166947b2ff6

                                                                                                                                    SHA256

                                                                                                                                    86c6f49c0fbde6b154ec281e547d67f6606c822a967d93da084d2ff14def036e

                                                                                                                                    SHA512

                                                                                                                                    fc8f860d1795e7df6c46f6faeb171922665ba467882149ed60cf4b9bab740fe78a9ece7a3413134cb57f1b184f3c8ed94baa29fcb9367bc21b05af526d7c7985

                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

                                                                                                                                    Filesize

                                                                                                                                    52KB

                                                                                                                                    MD5

                                                                                                                                    ea732f6c3f8ce2e83f65eb28ee979225

                                                                                                                                    SHA1

                                                                                                                                    6e742360080c6b9e7c7a5e24543e3d800013f560

                                                                                                                                    SHA256

                                                                                                                                    cd9a6739e6087b82a5145d1644916ee05946ed00f3424d3d3a280cf869ec6323

                                                                                                                                    SHA512

                                                                                                                                    8064c30df4f9b4905534e6ca67ed4cf61ecc43f7334938fe2f663e4f5b52ca7318048d73a771d7836db88e0de8583d3ec17174e4a97a7a541cbd71b2de31c9f6

                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

                                                                                                                                    Filesize

                                                                                                                                    18KB

                                                                                                                                    MD5

                                                                                                                                    268eb4e1bc8b5c7224bc505a94df9fa6

                                                                                                                                    SHA1

                                                                                                                                    4dcb04ca08d2bda8199cff7ddf7193f4e8fc6b1c

                                                                                                                                    SHA256

                                                                                                                                    2d6bf71158b8cf688430bba3c3bb1a1da4cb84524a881a04a2d4dfa3ed505cc9

                                                                                                                                    SHA512

                                                                                                                                    70d3eb4154d079c3d588ea63a188de1f34f5da2a51f3b1749c26338d0378fdbfd17585fc09ad040b0c64b9bf7f73c0c67b5f140a3dfbe0e9f658793e7ca82ce1

                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

                                                                                                                                    Filesize

                                                                                                                                    90KB

                                                                                                                                    MD5

                                                                                                                                    ffe4eeec2b9582ec9908692670dad1d5

                                                                                                                                    SHA1

                                                                                                                                    6a7c20fa2208b676951c90736b6834d344dff86c

                                                                                                                                    SHA256

                                                                                                                                    1407b4d7d57ed37abac6bdb5f6e07b13b2eb7ab5fdf98e8c545bebe7e52cf2d0

                                                                                                                                    SHA512

                                                                                                                                    2eb8d925a13065445650a5f876a6af34e60ad48122509d884c6c0932e682f7b5f7ad3cc8c51ced0c00206d14b6803f6fdcf8b02bb67e05559c29ae3424b74971

                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

                                                                                                                                    Filesize

                                                                                                                                    20KB

                                                                                                                                    MD5

                                                                                                                                    87e8230a9ca3f0c5ccfa56f70276e2f2

                                                                                                                                    SHA1

                                                                                                                                    eb116c8fd20cb2f85b7a942c7dae3b0ed6d27fe7

                                                                                                                                    SHA256

                                                                                                                                    e18d7214e7d3d47d913c0436f5308b9296ca3c6cd34059bf9cbf03126bafafe9

                                                                                                                                    SHA512

                                                                                                                                    37690a81a9e48b157298080746aa94289a4c721c762b826329e70b41ba475bb0261d048f9ab8e7301e43305c5ebf53246c20da8cd001130bf156e8b3bd38b9b8

                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000033

                                                                                                                                    Filesize

                                                                                                                                    62KB

                                                                                                                                    MD5

                                                                                                                                    bd7413700347d61e76c331f09e872ad0

                                                                                                                                    SHA1

                                                                                                                                    edcf8c0e570d8f6dd4251bd68a2800d4dfce4235

                                                                                                                                    SHA256

                                                                                                                                    0ea7fbc16f020a826084718b4a536bc6b5d0a8315687b2833f64294d833f25a7

                                                                                                                                    SHA512

                                                                                                                                    90028946c4504663bddcd07afd11ac964b4d34cd63d090f4d1dc2d4ce34ef540efeb6a9f7412dd4a9e5691718fa0927e0f3c52a2d1a5a9e4512e19071a9532ef

                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000034

                                                                                                                                    Filesize

                                                                                                                                    31KB

                                                                                                                                    MD5

                                                                                                                                    13cfa53cd77baa3cd8f46b2649ce0a06

                                                                                                                                    SHA1

                                                                                                                                    dbdbfe23ab336a3a5ca28bfca16197624b85955f

                                                                                                                                    SHA256

                                                                                                                                    a2306ee57d806468b732988af50f9c991e0b8d005283339b8c24130a455df109

                                                                                                                                    SHA512

                                                                                                                                    80a07ac13f9b730b90bd81565fd611be03eab85c407819f800772f136ed4b35eb2bb1c56841b2b3ba63236c91d98137138e0f149214216d5af84beaef0f42ad1

                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000040

                                                                                                                                    Filesize

                                                                                                                                    195KB

                                                                                                                                    MD5

                                                                                                                                    873734b55d4c7d35a177c8318b0caec7

                                                                                                                                    SHA1

                                                                                                                                    469b913b09ea5b55e60098c95120cc9b935ddb28

                                                                                                                                    SHA256

                                                                                                                                    4ee3aa3dc43cb3ef3f6bfb91ed8214659e9c2600a45bee9728ebbcb6f33b088d

                                                                                                                                    SHA512

                                                                                                                                    24f05ed981e994475879ca2221b6948418c4412063b9c07f46b8de581047ddd5d73401562fa9ee54d4ce5f97a6288c54eac5de0ca29b1bb5797bdac5a1b30308

                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                                                                    Filesize

                                                                                                                                    2KB

                                                                                                                                    MD5

                                                                                                                                    9864159c057c39acd5d62f86bbafc7b4

                                                                                                                                    SHA1

                                                                                                                                    4e073f1ff2d02a06ff4c27e74446fb3c7be08865

                                                                                                                                    SHA256

                                                                                                                                    0d11f4538faae4811d2795a848119dbf3e45aed11ed13f6cc0d5f4682b665088

                                                                                                                                    SHA512

                                                                                                                                    efc302b6a451abb71ee212f77e9369219a1f8c69bef6dc8fdba28fa4b8faa02fa4253c2a9ee988f57b6665fa0933cd805fa72b9fd646f9e4bfc6d0d1ba3321c1

                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                                                                    Filesize

                                                                                                                                    2KB

                                                                                                                                    MD5

                                                                                                                                    2c826f7d9f857280bf3c1bc42b22bd36

                                                                                                                                    SHA1

                                                                                                                                    3ae4f00a25578941fd08de3af349645539be9381

                                                                                                                                    SHA256

                                                                                                                                    d34e4b47cfd89436f00ff0f5b6f1356d6ed50aef8a2ff20fd420d8cb749b2e28

                                                                                                                                    SHA512

                                                                                                                                    6a9242f4c66bc062bcc5f33e62fb1ff5d243f5531d4b6871a1f5c898c52f60c4f0ac0065e29807269daf57592e79675ce9c6e74fdf3fa8856a8202aa8957086c

                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                                                                                    Filesize

                                                                                                                                    11KB

                                                                                                                                    MD5

                                                                                                                                    f0e6b3c36dfbdd06676a50a5b9f76811

                                                                                                                                    SHA1

                                                                                                                                    15e06b1412b8d0db6c6ffb19607c0b9f352b1118

                                                                                                                                    SHA256

                                                                                                                                    d8fdb79c9249dc146e67a97afe6aaa916dfcbe9da867103e5e1fa57c33e200bf

                                                                                                                                    SHA512

                                                                                                                                    2daf388eab5d46583196e10168ed8fc10e7679c9b52a14afa9f39a0758f1906383143376857a0102cd77ce36f62ba39b2a5607e453256e948eff5250b4891a70

                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                                                                                    Filesize

                                                                                                                                    11KB

                                                                                                                                    MD5

                                                                                                                                    f065323980eba66f7fd6174c952409b6

                                                                                                                                    SHA1

                                                                                                                                    5962be2361aa1298b7cd1a8002f3a802d1e72b7c

                                                                                                                                    SHA256

                                                                                                                                    715b5689e6a9810df54abce0b1c228f057eaab8a7f0d61c56a33d719624851bb

                                                                                                                                    SHA512

                                                                                                                                    ea8928515398fc1578667ae6e3ac00d1726150afcfe678076bebc97141e8271be7ba3e23ea01f8eca03f20230d9ef3fe3c3998986d9199e18d6bd289e417fb7a

                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                    Filesize

                                                                                                                                    6KB

                                                                                                                                    MD5

                                                                                                                                    926f135ebe7179c5245e95047e863e21

                                                                                                                                    SHA1

                                                                                                                                    0add35af9c0650aa1c66319611d7331d52e3086a

                                                                                                                                    SHA256

                                                                                                                                    587048b769258074c30ae0bd9564a235fd472fa02c893c30f203e3239a89da13

                                                                                                                                    SHA512

                                                                                                                                    928f850451e3c3ba8faa2c0eb7aea243db88df0955806bebf5a363c8a4ca2b3d6db6c8e1e5b7f30f7d25f0883d7bc648934a03fb00b7f5b15b04225225251441

                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                    Filesize

                                                                                                                                    16KB

                                                                                                                                    MD5

                                                                                                                                    4c8353dbeec80925ccea20733c0c561e

                                                                                                                                    SHA1

                                                                                                                                    45d968a15dc569d612c06871d0e5d993b91afd77

                                                                                                                                    SHA256

                                                                                                                                    d676345757d8b2b40f1d3dbff801ebee1420daa53441ca601ea92844bf6277e8

                                                                                                                                    SHA512

                                                                                                                                    9a353d84e4ea38b7fd8633f8fcc068760dc62484562a73ce879db5506eb72917b3a4fde8aaf0a056e0f40e19db6aa23b2ddc8a65feb0f5c47418215043d9f4cc

                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                    Filesize

                                                                                                                                    15KB

                                                                                                                                    MD5

                                                                                                                                    a63ac09270690597ec5e30cbbb30019e

                                                                                                                                    SHA1

                                                                                                                                    daafd72c9c1e1761bd7127cca4861e9b7e0e969c

                                                                                                                                    SHA256

                                                                                                                                    b587522cf70a47d05cb843b7ff47690d751dd287edb43198d0f3d521efd70726

                                                                                                                                    SHA512

                                                                                                                                    45b28e6f66eb156bb77cdcefa8d6c396ceb22a22e33a2cb33a23701203c306aff4533ce37b5ad5a0855c4f031e80e0a3a4556b5a61e33d73d9cf9cba060543d6

                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                    Filesize

                                                                                                                                    16KB

                                                                                                                                    MD5

                                                                                                                                    c1b458c1b6966a115851085da9c6a63c

                                                                                                                                    SHA1

                                                                                                                                    90ca3631edc79c1aa0e8d24c5dc1ad75b8d359fd

                                                                                                                                    SHA256

                                                                                                                                    ae9eed6b8cbd7b00ad86cb260d9a7dd1365b8d7027208cc9e30ac7aafbe622d1

                                                                                                                                    SHA512

                                                                                                                                    0ff38a648d87fbe56e7dc41e7d2485d04a50bce8e896ae071aebb767105c9045405d55d9abd498f592e5eb26fdc08628cfeea37f4a22d3d33d89cea2b02ce561

                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                                                    Filesize

                                                                                                                                    3KB

                                                                                                                                    MD5

                                                                                                                                    44bceb19bb0bb8e2caf4a76202eab229

                                                                                                                                    SHA1

                                                                                                                                    38fe6d73a9ebd5b2ab226faaef240ae63a25da16

                                                                                                                                    SHA256

                                                                                                                                    481890c0922763adb76a63de2d89aa627240e10b8258312b4ba0b95d3409ce01

                                                                                                                                    SHA512

                                                                                                                                    0cd409d6ac24f8192a5c99bf6fd23493d7fc914bb726322b73a4dd871f52d0b08964ae9c74acc8ef815eb0ba1093ed0db3eab9b1bf3b56a460172863c9472337

                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                                                    Filesize

                                                                                                                                    3KB

                                                                                                                                    MD5

                                                                                                                                    256d432976b083d68255fef327a81443

                                                                                                                                    SHA1

                                                                                                                                    1014973ff3b4f530012793aa20d685c29c030da2

                                                                                                                                    SHA256

                                                                                                                                    d150e0b9f0e23f27cb30d8ea90ba50374067947329a85bcd9821a646847d94fa

                                                                                                                                    SHA512

                                                                                                                                    0c6f9e091daed1b13214dccdb39779a0bc1fe20e8612bf907f8450eae493f4f562e0e41843c1ecb850544d07d903834c7c0d6af958e088425ad22044ebe1f7dd

                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                                                    Filesize

                                                                                                                                    3KB

                                                                                                                                    MD5

                                                                                                                                    8cf0a0e2ed2dba7ddfea6b1b37cbb7b5

                                                                                                                                    SHA1

                                                                                                                                    21fd7f92333e6cbaab895f614ebff1a8c7ce112c

                                                                                                                                    SHA256

                                                                                                                                    eec20674041a062da89487adf233d16c168a63eafcf131f4bed324ed706e601e

                                                                                                                                    SHA512

                                                                                                                                    bb503c10c9c7743380c785c83c77d251335ca212355bfd9fb4d4b96b52c15a989374ab06ff35a4256dc9bbecfd8c3a014a469ae576e29136ffdf1050ef0f2ccb

                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                                                    Filesize

                                                                                                                                    3KB

                                                                                                                                    MD5

                                                                                                                                    0f96ef7e91edfe415d8cff0aa1139c3d

                                                                                                                                    SHA1

                                                                                                                                    e1eaf3c43e3d363828e8f88e8e320906926be082

                                                                                                                                    SHA256

                                                                                                                                    3d9c24b747214ba937120d3c2600886fdbdd0ed8fee003eeb08650f3b944f803

                                                                                                                                    SHA512

                                                                                                                                    206c4dc324741f474d69a1218dc3edffbe8b9897feb495e2103bb5d8669d87a25247b13e47ff554505ac2942d319649d62b9bb394915dea981d9873227c145b8

                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe578e46.TMP

                                                                                                                                    Filesize

                                                                                                                                    2KB

                                                                                                                                    MD5

                                                                                                                                    aefd0b90d3c795d84d69c245e2964c1f

                                                                                                                                    SHA1

                                                                                                                                    a6909a99f8477757fa5db4b8b00f34c9902c6c7b

                                                                                                                                    SHA256

                                                                                                                                    f338db8d0930a7e981d60968cffbd3a0a8bf66e1af582ab166f719af4f962fc4

                                                                                                                                    SHA512

                                                                                                                                    ceb0dc46366ea92d0826994c78163297cbf795676b788799dc525938bd7b8f4cb321c28bc2fd4d6d0aae9587e15c2175fd7c0e8cf236c28182f602ea6c952527

                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ab518acd-4822-4a1d-acc3-de6e3a5a1cf3.tmp

                                                                                                                                    Filesize

                                                                                                                                    3KB

                                                                                                                                    MD5

                                                                                                                                    4802b2603ae08e2ffa03556c68f79c70

                                                                                                                                    SHA1

                                                                                                                                    f8c8a4337005b03261e83c9cedc9e0770c0de31a

                                                                                                                                    SHA256

                                                                                                                                    53a287c8049d929f175d993eab96bf53d5391dcecb8160ebcf4fc33e6e4630b8

                                                                                                                                    SHA512

                                                                                                                                    2dca09f755a1e3c340fae210a4bb28efd3f257a5812a8fafd4c6e437274e6f34dd877b09811fcc23bb266e76b6bdfcb67a9984e55b191cfb18f78cd6cd47e7f0

                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                                                                                    Filesize

                                                                                                                                    16B

                                                                                                                                    MD5

                                                                                                                                    6752a1d65b201c13b62ea44016eb221f

                                                                                                                                    SHA1

                                                                                                                                    58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                                                                                                    SHA256

                                                                                                                                    0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                                                                                                    SHA512

                                                                                                                                    9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                                                    Filesize

                                                                                                                                    12KB

                                                                                                                                    MD5

                                                                                                                                    009cb79134a0b98627436fcaa2f8e8fc

                                                                                                                                    SHA1

                                                                                                                                    9e9c4d384ab8f8d0bc664c4211a2a4aca4ad5748

                                                                                                                                    SHA256

                                                                                                                                    905aef37e1ff66cccc7556ad28161c154b0d7a16a534f68128e95e9454928252

                                                                                                                                    SHA512

                                                                                                                                    32872a895561f14fb21a59fe7eacb6f441f697e8f7b2767e07dcd4ed623860a3db44bd0106a5d4ab48a8493c75f88c73024dab34465a8ea14f5fd2f0f27e6859