hxxp://google[.]com

Analysis

max time kernel
677s
max time network
677s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/02/2024, 23:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://google.com

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
1748	CryptoFileLight.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 58 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	CryptoFileLight.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	CryptoFileLight.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	CryptoFileLight.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff	CryptoFileLight.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	CryptoFileLight.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	CryptoFileLight.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	CryptoFileLight.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	CryptoFileLight.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	CryptoFileLight.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000	CryptoFileLight.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	CryptoFileLight.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	CryptoFileLight.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\NodeSlot = "2"	CryptoFileLight.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	CryptoFileLight.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	CryptoFileLight.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Downloads"	CryptoFileLight.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-983155329-280873152-1838004294-1000\{EC5F8E1E-3169-4292-B665-D25DF2F29ED8}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}"	CryptoFileLight.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	CryptoFileLight.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	CryptoFileLight.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	CryptoFileLight.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	CryptoFileLight.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	CryptoFileLight.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	CryptoFileLight.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	CryptoFileLight.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	CryptoFileLight.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	CryptoFileLight.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	CryptoFileLight.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	CryptoFileLight.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	CryptoFileLight.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0000000001000000ffffffff	CryptoFileLight.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	CryptoFileLight.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	CryptoFileLight.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	CryptoFileLight.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	CryptoFileLight.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	CryptoFileLight.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	CryptoFileLight.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	CryptoFileLight.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	CryptoFileLight.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	CryptoFileLight.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings	CryptoFileLight.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	CryptoFileLight.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	CryptoFileLight.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = ffffffff	CryptoFileLight.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	CryptoFileLight.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	CryptoFileLight.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	CryptoFileLight.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	CryptoFileLight.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	CryptoFileLight.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	CryptoFileLight.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	CryptoFileLight.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	CryptoFileLight.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	CryptoFileLight.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 = 14002e8005398e082303024b98265d99428e115f0000	CryptoFileLight.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	CryptoFileLight.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	CryptoFileLight.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	CryptoFileLight.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	CryptoFileLight.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 755174.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
4484	msedge.exe
4484	msedge.exe
2408	msedge.exe
2408	msedge.exe
3896	identity_helper.exe
3896	identity_helper.exe
760	msedge.exe
760	msedge.exe
1716	msedge.exe
1716	msedge.exe
1716	msedge.exe
1716	msedge.exe
2664	msedge.exe
2664	msedge.exe
4860	msedge.exe
4860	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1748	CryptoFileLight.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 52 IoCs

pid	Process
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe

Suspicious use of SendNotifyMessage 28 IoCs

pid	Process
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
1748	CryptoFileLight.exe
1748	CryptoFileLight.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
1748	CryptoFileLight.exe
1748	CryptoFileLight.exe
1748	CryptoFileLight.exe
1748	CryptoFileLight.exe
1748	CryptoFileLight.exe
1748	CryptoFileLight.exe
1748	CryptoFileLight.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2408 wrote to memory of 2436	2408	msedge.exe	31
PID 2408 wrote to memory of 2436	2408	msedge.exe	31
PID 2408 wrote to memory of 4996	2408	msedge.exe	88
PID 2408 wrote to memory of 4996	2408	msedge.exe	88
PID 2408 wrote to memory of 4996	2408	msedge.exe	88
PID 2408 wrote to memory of 4996	2408	msedge.exe	88
PID 2408 wrote to memory of 4996	2408	msedge.exe	88
PID 2408 wrote to memory of 4996	2408	msedge.exe	88
PID 2408 wrote to memory of 4996	2408	msedge.exe	88
PID 2408 wrote to memory of 4996	2408	msedge.exe	88
PID 2408 wrote to memory of 4996	2408	msedge.exe	88
PID 2408 wrote to memory of 4996	2408	msedge.exe	88
PID 2408 wrote to memory of 4996	2408	msedge.exe	88
PID 2408 wrote to memory of 4996	2408	msedge.exe	88
PID 2408 wrote to memory of 4996	2408	msedge.exe	88
PID 2408 wrote to memory of 4996	2408	msedge.exe	88
PID 2408 wrote to memory of 4996	2408	msedge.exe	88
PID 2408 wrote to memory of 4996	2408	msedge.exe	88
PID 2408 wrote to memory of 4996	2408	msedge.exe	88
PID 2408 wrote to memory of 4996	2408	msedge.exe	88
PID 2408 wrote to memory of 4996	2408	msedge.exe	88
PID 2408 wrote to memory of 4996	2408	msedge.exe	88
PID 2408 wrote to memory of 4996	2408	msedge.exe	88
PID 2408 wrote to memory of 4996	2408	msedge.exe	88
PID 2408 wrote to memory of 4996	2408	msedge.exe	88
PID 2408 wrote to memory of 4996	2408	msedge.exe	88
PID 2408 wrote to memory of 4996	2408	msedge.exe	88
PID 2408 wrote to memory of 4996	2408	msedge.exe	88
PID 2408 wrote to memory of 4996	2408	msedge.exe	88
PID 2408 wrote to memory of 4996	2408	msedge.exe	88
PID 2408 wrote to memory of 4996	2408	msedge.exe	88
PID 2408 wrote to memory of 4996	2408	msedge.exe	88
PID 2408 wrote to memory of 4996	2408	msedge.exe	88
PID 2408 wrote to memory of 4996	2408	msedge.exe	88
PID 2408 wrote to memory of 4996	2408	msedge.exe	88
PID 2408 wrote to memory of 4996	2408	msedge.exe	88
PID 2408 wrote to memory of 4996	2408	msedge.exe	88
PID 2408 wrote to memory of 4996	2408	msedge.exe	88
PID 2408 wrote to memory of 4996	2408	msedge.exe	88
PID 2408 wrote to memory of 4996	2408	msedge.exe	88
PID 2408 wrote to memory of 4996	2408	msedge.exe	88
PID 2408 wrote to memory of 4996	2408	msedge.exe	88
PID 2408 wrote to memory of 4484	2408	msedge.exe	89
PID 2408 wrote to memory of 4484	2408	msedge.exe	89
PID 2408 wrote to memory of 1180	2408	msedge.exe	90
PID 2408 wrote to memory of 1180	2408	msedge.exe	90
PID 2408 wrote to memory of 1180	2408	msedge.exe	90
PID 2408 wrote to memory of 1180	2408	msedge.exe	90
PID 2408 wrote to memory of 1180	2408	msedge.exe	90
PID 2408 wrote to memory of 1180	2408	msedge.exe	90
PID 2408 wrote to memory of 1180	2408	msedge.exe	90
PID 2408 wrote to memory of 1180	2408	msedge.exe	90
PID 2408 wrote to memory of 1180	2408	msedge.exe	90
PID 2408 wrote to memory of 1180	2408	msedge.exe	90
PID 2408 wrote to memory of 1180	2408	msedge.exe	90
PID 2408 wrote to memory of 1180	2408	msedge.exe	90
PID 2408 wrote to memory of 1180	2408	msedge.exe	90
PID 2408 wrote to memory of 1180	2408	msedge.exe	90
PID 2408 wrote to memory of 1180	2408	msedge.exe	90
PID 2408 wrote to memory of 1180	2408	msedge.exe	90
PID 2408 wrote to memory of 1180	2408	msedge.exe	90
PID 2408 wrote to memory of 1180	2408	msedge.exe	90
PID 2408 wrote to memory of 1180	2408	msedge.exe	90
PID 2408 wrote to memory of 1180	2408	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.com
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdf66246f8,0x7ffdf6624708,0x7ffdf6624718
  2⤵
  PID:2436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2236,11189844262963185769,9202048135961723751,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2212 /prefetch:2
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2236,11189844262963185769,9202048135961723751,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2236,11189844262963185769,9202048135961723751,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2892 /prefetch:8
  2⤵
  PID:1180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,11189844262963185769,9202048135961723751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3184 /prefetch:1
  2⤵
  PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,11189844262963185769,9202048135961723751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,11189844262963185769,9202048135961723751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:1
  2⤵
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,11189844262963185769,9202048135961723751,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:1
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,11189844262963185769,9202048135961723751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3976 /prefetch:1
  2⤵
  PID:3320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,11189844262963185769,9202048135961723751,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
  2⤵
  PID:3752
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2236,11189844262963185769,9202048135961723751,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5236 /prefetch:8
  2⤵
  PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2236,11189844262963185769,9202048135961723751,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5236 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,11189844262963185769,9202048135961723751,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,11189844262963185769,9202048135961723751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:1148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,11189844262963185769,9202048135961723751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4748 /prefetch:1
  2⤵
  PID:1516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,11189844262963185769,9202048135961723751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3620 /prefetch:1
  2⤵
  PID:1228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,11189844262963185769,9202048135961723751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:1
  2⤵
  PID:1352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2236,11189844262963185769,9202048135961723751,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=3376 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2236,11189844262963185769,9202048135961723751,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4600 /prefetch:8
  2⤵
  PID:2840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,11189844262963185769,9202048135961723751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:3152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,11189844262963185769,9202048135961723751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,11189844262963185769,9202048135961723751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:1
  2⤵
  PID:2468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,11189844262963185769,9202048135961723751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5936 /prefetch:1
  2⤵
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,11189844262963185769,9202048135961723751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6012 /prefetch:1
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2236,11189844262963185769,9202048135961723751,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3516 /prefetch:8
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,11189844262963185769,9202048135961723751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6932 /prefetch:1
  2⤵
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,11189844262963185769,9202048135961723751,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6728 /prefetch:1
  2⤵
  PID:616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,11189844262963185769,9202048135961723751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4664 /prefetch:1
  2⤵
  PID:1264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,11189844262963185769,9202048135961723751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7052 /prefetch:1
  2⤵
  PID:2848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,11189844262963185769,9202048135961723751,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:1
  2⤵
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,11189844262963185769,9202048135961723751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6836 /prefetch:1
  2⤵
  PID:3212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,11189844262963185769,9202048135961723751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7128 /prefetch:1
  2⤵
  PID:3152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2236,11189844262963185769,9202048135961723751,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=7080 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,11189844262963185769,9202048135961723751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,11189844262963185769,9202048135961723751,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:1
  2⤵
  PID:1476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,11189844262963185769,9202048135961723751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:1
  2⤵
  PID:824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,11189844262963185769,9202048135961723751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,11189844262963185769,9202048135961723751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:1
  2⤵
  PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,11189844262963185769,9202048135961723751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7088 /prefetch:1
  2⤵
  PID:2084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,11189844262963185769,9202048135961723751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7040 /prefetch:1
  2⤵
  PID:3776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,11189844262963185769,9202048135961723751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6504 /prefetch:1
  2⤵
  PID:1300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,11189844262963185769,9202048135961723751,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1
  2⤵
  PID:3300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,11189844262963185769,9202048135961723751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:1
  2⤵
  PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,11189844262963185769,9202048135961723751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6724 /prefetch:1
  2⤵
  PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,11189844262963185769,9202048135961723751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7064 /prefetch:1
  2⤵
  PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,11189844262963185769,9202048135961723751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1688 /prefetch:1
  2⤵
  PID:3320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,11189844262963185769,9202048135961723751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4852 /prefetch:1
  2⤵
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,11189844262963185769,9202048135961723751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7152 /prefetch:1
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,11189844262963185769,9202048135961723751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5724 /prefetch:1
  2⤵
  PID:1120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,11189844262963185769,9202048135961723751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1704 /prefetch:1
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,11189844262963185769,9202048135961723751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4736 /prefetch:1
  2⤵
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,11189844262963185769,9202048135961723751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4120 /prefetch:1
  2⤵
  PID:1184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,11189844262963185769,9202048135961723751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
  2⤵
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,11189844262963185769,9202048135961723751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7636 /prefetch:1
  2⤵
  PID:1692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,11189844262963185769,9202048135961723751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4972 /prefetch:1
  2⤵
  PID:1512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2236,11189844262963185769,9202048135961723751,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6964 /prefetch:8
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2236,11189844262963185769,9202048135961723751,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7344 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2664
- C:\Users\Admin\Downloads\CryptoFileLight.exe
  "C:\Users\Admin\Downloads\CryptoFileLight.exe"
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:1748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,11189844262963185769,9202048135961723751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7300 /prefetch:1
  2⤵
  PID:3876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,11189844262963185769,9202048135961723751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6204 /prefetch:1
  2⤵
  PID:2664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,11189844262963185769,9202048135961723751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5920 /prefetch:1
  2⤵
  PID:2560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,11189844262963185769,9202048135961723751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:2456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,11189844262963185769,9202048135961723751,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7604 /prefetch:1
  2⤵
  PID:1276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,11189844262963185769,9202048135961723751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7872 /prefetch:1
  2⤵
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,11189844262963185769,9202048135961723751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7428 /prefetch:1
  2⤵
  PID:2760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2236,11189844262963185769,9202048135961723751,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7520 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4860

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4760

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7740a919423ddc469647f8fdd981324d

SHA1
c1bc3f834507e4940a0b7594e34c4b83bbea7cda

SHA256
bdd4adaa418d40558ab033ac0005fd6c2312d5f1f7fdf8b0e186fe1d65d78221

SHA512
7ad98d5d089808d9a707d577e76e809a223d3007778a672734d0a607c2c3ac5f93bc72adb6e6c7f878a577d3a1e69a16d0cd871eb6f58b8d88e2ea25f77d87b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9f44d6f922f830d04d7463189045a5a3

SHA1
2e9ae7188ab8f88078e83ba7f42a11a2c421cb1c

SHA256
0ae5cf8b49bc34fafe9f86734c8121b631bad52a1424c1dd2caa05781032334a

SHA512
7c1825eaefcc7b97bae31eeff031899300b175222de14000283e296e9b44680c8b3885a4ed5d78fd8dfee93333cd7289347b95a62bf11f751c4ca47772cf987d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
195KB

MD5
873734b55d4c7d35a177c8318b0caec7

SHA1
469b913b09ea5b55e60098c95120cc9b935ddb28

SHA256
4ee3aa3dc43cb3ef3f6bfb91ed8214659e9c2600a45bee9728ebbcb6f33b088d

SHA512
24f05ed981e994475879ca2221b6948418c4412063b9c07f46b8de581047ddd5d73401562fa9ee54d4ce5f97a6288c54eac5de0ca29b1bb5797bdac5a1b30308

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
64KB

MD5
d6b36c7d4b06f140f860ddc91a4c659c

SHA1
ccf16571637b8d3e4c9423688c5bd06167bfb9e9

SHA256
34013d7f3f0186a612bef84f2984e2767b32c9e1940df54b01d5bd6789f59e92

SHA512
2a9dd9352298ec7d1b439033b57ee9a390c373eeb8502f7f36d6826e6dd3e447b8ffd4be4f275d51481ef9a6ac2c2d97ef98f3f9d36a5a971275bf6cee48e487

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
67KB

MD5
88a552e6be1ac3978c49143983276b3a

SHA1
dbf4f4dc62a3da564b1a87b5191dc9a72a9b9423

SHA256
927121d8118a41fa3460b9ad84daeae59ea60dc9607e462b7e1341bea60da8d5

SHA512
125b13be3d209ff5cc12d8f9f12d01d271cd50c2800059241ebb419167c21adfa9d979ff6b8d88052f5d302e98090b7c8ceff4894b397168d8ba6d8a6204fb9a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
30KB

MD5
a6b4e8315405250e3796d15d51dcc2ba

SHA1
ecc9193572956a0d1b851656c225663697a7e74d

SHA256
72dc64af40f3f9a32933eaea03ad442fad1be9f8b2311138949ffc8aa731c99b

SHA512
2f372bf4ff32f19e3f44a7292d9f93112de888f2d42e951348f974fc169dd5dc2910c5869d5b1803cfc2721461fe299bd667c1907fe954895c853f1473945121

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
19KB

MD5
2e86a72f4e82614cd4842950d2e0a716

SHA1
d7b4ee0c9af735d098bff474632fc2c0113e0b9c

SHA256
c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f

SHA512
7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
65KB

MD5
56d57bc655526551f217536f19195495

SHA1
28b430886d1220855a805d78dc5d6414aeee6995

SHA256
f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4

SHA512
7814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
88KB

MD5
b38fbbd0b5c8e8b4452b33d6f85df7dc

SHA1
386ba241790252df01a6a028b3238de2f995a559

SHA256
b18b9eb934a5b3b81b16c66ec3ec8e8fecdb3d43550ce050eb2523aabc08b9cd

SHA512
546ca9fb302bf28e3a178e798dd6b80c91cba71d0467257b8ed42e4f845aa6ecb858f718aac1e0865b791d4ecf41f1239081847c75c6fb3e9afd242d3704ad16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
1.1MB

MD5
115d1f541c027bf6ff8463066c76bebe

SHA1
c7c8954fa5728e37a5826dd6bfe86b0bd9dc83d5

SHA256
72452b7030dccf63e908a6157f8409eb0f66eab6958d74de3706ee9156e084e8

SHA512
142fbf9c2538f7aecfde7c1ab7a585ce16b423b2b730084453d6f471b70c73175b23ea962dd477b4eebc6d1a623f5632c020054b17560f2af4e0db1f1ac0d275

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

Filesize
33KB

MD5
3cd0f2f60ab620c7be0c2c3dbf2cda97

SHA1
47fad82bfa9a32d578c0c84aed2840c55bd27bfb

SHA256
29a3b99e23b07099e1d2a3c0b4cff458a2eba2519f4654c26cf22d03f149e36b

SHA512
ef6e3bbd7e03be8e514936bcb0b5a59b4cf4e677ad24d6d2dfca8c1ec95f134ae37f2042d8bf9a0e343b68bff98a0fd748503f35d5e9d42cdaa1dc283dec89fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

Filesize
75KB

MD5
cf989be758e8dab43e0a5bc0798c71e0

SHA1
97537516ffd3621ffdd0219ede2a0771a9d1e01d

SHA256
beeca69af7bea038faf8f688bf2f10fda22dee6d9d9429306d379a7a4be0c615

SHA512
f8a88edb6bcd029ad02cba25cae57fdf9bbc7fa17c26e7d03f09040eb0559bc27bd4db11025706190ae548363a1d3b3f95519b9740e562bb9531c4d51e3ca2b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

Filesize
105KB

MD5
24cab279a1b1479cd2848b4cf4db97d8

SHA1
c59c889167dfa25ea85e0ab5b93db29270cd9a3a

SHA256
2feef54f715ea3e6192ec7a9d30e910044968a41d8fe91fc9b1b469ad574df51

SHA512
d1ec7ed765e5ec1b5e095a917437ddcd783ad01a1d6025f1125906617afc24e1d3a9cd702616d18c4231e5ffe60e5326a8dee855db42bc417568283c310e5c10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

Filesize
109KB

MD5
bb3fc9718561b34e8ab4e7b60bf19da6

SHA1
61c958bedf93d543622351633d91ad9dda838723

SHA256
d6ea500b6752094a4c340d4f5ed01afdca1925006077560d9a3f56054cd8d141

SHA512
97da30e9a0d14e6f9151539b77b2216e0f6b6cc4742f075077f9ff92f46f8b97e82f020c562625261eaa01bcf810ce81c0b7b71340ac566aef1bef5a07dac63e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011

Filesize
155KB

MD5
65b00bec774c969842aceb3199fbe254

SHA1
bd464411b9578497f081a5f8b6c04180b6ee0f0a

SHA256
d604e67e9d16b6b3d2f10687a36ec00597c48288fa60bfa957bd3ca78eadceda

SHA512
0c89ad2ca25ecd9058e42ed477bf6cd1512859c7ac63701206a82f2591b2878acc7f9354b6a23245fd186ca9b3c809cf7700c0e3e43f469c37580d8531d3beac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000013

Filesize
40KB

MD5
3051c1e179d84292d3f84a1a0a112c80

SHA1
c11a63236373abfe574f2935a0e7024688b71ccb

SHA256
992cbdc768319cbd64c1ec740134deccbb990d29d7dccd5ecd5c49672fa98ea3

SHA512
df64e0f8c59b50bcffb523b6eab8fabf5f0c5c3d1abbfc6aa4831b4f6ce008320c66121dcedd124533867a9d5de83c424c5e9390bf0a95c8e641af6de74dabff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000014

Filesize
53KB

MD5
68f0a51fa86985999964ee43de12cdd5

SHA1
bbfc7666be00c560b7394fa0b82b864237a99d8c

SHA256
f230c691e1525fac0191e2f4a1db36046306eb7d19808b7bf8227b7ed75e5a0f

SHA512
3049b9bd4160bfa702f2e2b6c1714c960d2c422e3481d3b6dd7006e65aa5075eed1dc9b8a2337e0501e9a7780a38718d298b2415cf30ec9e115a9360df5fa2a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000059

Filesize
134KB

MD5
f73705f1dde46fc0a28d89bfada19560

SHA1
1b11f47a604b40716767c12289aa36a1d22b8e8f

SHA256
bdf50fece9cf39818d0d7512a6a19b4f317f7e7f76c780ac976a442da86e37c3

SHA512
ac1ebc7297d717e5cbd948be58c702efa314ecacf3898ff5249d881d233533089dea49a105a7abb844d93fb1abc6d9ad9b402ece2e63e8573fc5ea9cc1bca247

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00005d

Filesize
62KB

MD5
786aac28d5c0120358007b97190cb0f2

SHA1
459e0aae2b1321f596ac49fa51979120a8c35aef

SHA256
8170cce4c1cc4d9017f8a075af0414db3705bae7832c136df76131672393884c

SHA512
6b93ab6154c6750df8f94aee9c46e46f5c993e6608ed21f5eeb341331b474d5ab249b947e701ef236e32d1d6a7f8f9953c66fcdb14d8eaed2ca867e4f2324676

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000069

Filesize
186KB

MD5
8e0650f8a662647e55dabecc398ebe48

SHA1
1acfa69d68ddbe39ecd5857cb2a2f4eb31251eb2

SHA256
35b1ef55f0dded4409e033fe762908019223206b09e2a51697795151ae972bb5

SHA512
3ed395f8a97eae9d2cda4a6e13140bedbb8bfb075af1c6c578280968d80498a8f351fa3a3391232e20707b4594dc456ee061797394421c776477668ce599761e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\06450eb6a7b09545_0

Filesize
2KB

MD5
41b62a5d03dcde37bbcc40eca4bb425a

SHA1
a92f56bd8def1c8c5644fb3533819b287d884715

SHA256
e16993f1049fc6c86e71ace18061c6b35757a23900ee32aed30d5936d3bc9f56

SHA512
2882e757eec0aea8c53bef42c6364c3f126761ee74ba4497056ec8a347df9267bb275b17c0f40db8e54a73d934a0c25a03bd6fc5ea52b1f349d3710e257e9c4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\1ac673f66e12ce14_0

Filesize
2KB

MD5
3c49db12a0b02d9e6eb20679b6dc1b4b

SHA1
4917785ac0afaf8cf451298224d34aafc1045055

SHA256
ebd9c94cefefbf38437282c67d46c7dee441b09f14481f3860f0f5f6961b44f9

SHA512
397dde06ceb5c9630744e17e94583e23f5178044e4654f5fb4a8cda3780c9c09a3f9036b72cf2e0ecde6293f20549165b57d400c628b92af95a7426640a48677

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\26535df81b2a57bd_0

Filesize
1KB

MD5
f17dc9b3011f0f57f645d6fd889f0eed

SHA1
32d757e02d83c064e4d0686f7729c62ec09fb71a

SHA256
68ccf045eb284bc12925f3f9b6cde2b0cdc6a05437be13af07ddacc771d909a9

SHA512
6e2b3eec60d6c9cf88d3aa4a7c3c76da613f0735fdc7a6e5dd2877bc5ca954dcb67dd9d720c765c96e2a685fa5f9337b0a979e372248faff3da05cd6a8918aa7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\48b1105b4c2874b5_0

Filesize
1KB

MD5
861958e726c68b0ec62fc636ff1a9c2d

SHA1
7b3eb3db699c2c66d569fa6501b0e02f87b254ac

SHA256
0697e5b6a3376de8dc86c758cbece76c12b92c112063b179779eea2dd1aee77a

SHA512
d4a8c2b39921666a44ee412a24ad485de22e72b38719cea469829a8589b2bd965774a147ab15898b396a29c7f0613fc62b9493e56cf11983ded519f00a82b09d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\632e260441be7404_0

Filesize
4KB

MD5
8aecf377f76cb56180c1deffa5ee71b6

SHA1
a96fa652a871addb0e8d7a1410b9edc7fa90ef5a

SHA256
d267c01447ebe5f6bbc5a2636a144aad45fdf8dc8219dad141ee392b0e7f07db

SHA512
a3469d1d605480a12daf698433baf381d9b127ba559622b91276fdf58e17568ec0641a12ae07e421d5aeeaedfe353f19b258b6bf89312675f4d7f23238ff0537

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\64fa70d4ab69732e_0

Filesize
6KB

MD5
27e1bbdc0cf391d70f753240411d864d

SHA1
dde2f342b51a91f5c5cf4f0d21d008d409c8f664

SHA256
563f043097a204a0e064052058ca49b6b539cdacba81c09c4106c08ade8e119f

SHA512
23b102ae00765b3039ae21fc0586fbb1d01aa3c2f3b00661a0c68d58c78259324aead0daa5dc718945c160ba5766bc2cf7ace130bc865120e14aa0c6e8658446

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\695c42f61090a800_0

Filesize
5KB

MD5
ec28c8ebb5351377bebc57c0e890cdef

SHA1
f6779854e94efaf0ea35bbd2f7d2411d230efb50

SHA256
bc607d17739ba2c8b8160e1b2c508d10a372f8b90bbb88690932d203d5d5c165

SHA512
cbb0d1ba466e90efab132a6ab6307a661be2bf9fd91eb839c59fca2854c3921d15afbbe2350e4944f2f98321400ff03276deb0ddc065aae9f88ad7322e6a71c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\794417c96d8ffeee_0

Filesize
5KB

MD5
cc2a560ea7378866e96f4ce2c7702533

SHA1
8f1c87f2111680fc25de5debcf92c79a20db70d3

SHA256
fd239edcdfb9e43827674bbbbb4d461add7a2893f67ed4527e4d5fed4aedeabb

SHA512
924b591dec3ed3382548ab99efb2c3dd2395806dafb2b7ce01d8b69516eb96c0059a3a327528c3f0c2e9d5535655f533ec4e57ace7e9dc4a048aef2f30e475c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\8e5987d08f7b6e11_0

Filesize
1KB

MD5
d96c784653d45dbc319c7d7bb4d725f1

SHA1
c21293d8d62f9df348a7e575d7ee8072629bb270

SHA256
259d3df4b2f58a0e65eec523358eed2b1367d888dfecc8ea4bf2bf2baa919343

SHA512
c010cb01d03ef83d58751b3fbf98855bcaf1719b3f06dd2e7ed2704acc943f63c3c112733977f3fdc28b2bdaabf1c164640b85d55d502246699e69ffd6a834d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a0bf23602ca1ab29_0

Filesize
6KB

MD5
7b3c6806845a5a7fe8654b814144a361

SHA1
617cbc4ed26d2da1b01e83121a8ade5199782e94

SHA256
077e3b3bd52e1bf0b6ffd227e6d32d4bf15f7072e65653c5178fb70bb7cf92db

SHA512
ada8d2f7deb9283157fde6d5ab194f689db7f2c1b5e90f236022664801342635d06b3eb8e6ab9bdb9e8d2ba22323ef5569719cb7aa4ec3a78273d3e1d3cfe238

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\af309f668f980bce_0

Filesize
3KB

MD5
c626b9cf40ad8832a596b217684a9257

SHA1
2628df89395076cbe1ef71452247faf6b0bad6c2

SHA256
7fd28e89549170d1938332cb7db6020dfb9cded0b4360cbea7d468087987802b

SHA512
a250684d299727fdb37019a05e817957c310b2f0accbb241ab7505af41e2a3f7ff3e17bd7e0073198549a2540c41aa6d7a3488f24417521149c550d79f0cb37d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\af48edbd3578ee3b_0

Filesize
2KB

MD5
342dfde1437be5ca4998e6a1139ec230

SHA1
266724191caad0f8eeae869879fa1c1ca92e36b6

SHA256
0aaa84f5a7bc6a0e2218519113bc9df640ac25b0a5c5c0c8c166f0cb3eb6172e

SHA512
197c63e00166b4bc8fbfc249e9f0f9512ce280c6335703a5280d59e3266748dde7070c7822294727b2c95ba84a58d010381b22cbafeba88b74c9fb65d2ad4b51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
ea8609aa9400816f749e65eab2c1a25f

SHA1
4d0913aec50da7ce6f74f5e30a47ab7efef39cee

SHA256
e6c591e9364d5e2ddbd8943760951129c1c26c23892a6e6c35e742fb82a5c54b

SHA512
fec03f8f22b90890936420996df5b75116871a0154870d143c52a4754d089c68878e2aefc5050fb26350997123c3272a51a8e22204b423b6fb97f2ce040de747

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
812b9bae75cef25d2df094f7c0819297

SHA1
9d8d9f60b295aa24a7185053a0a897ff217d6b59

SHA256
7cee70ec0b6f3af44e074b749fdee4f3c216a0d359dc789c5b94a144403f8c3d

SHA512
b6c3f38f786230241c4f3bfb61090b50837c2203b3b4b2d8323c981ff3727bf74761b34af26832af60638a0d081f82defa51f5dd87543e70e72c61a250e862a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
6KB

MD5
f5eb0c668896a318f8b0a54e9f664db6

SHA1
1cbcde866dba93ec53f108d68ca70c7562654d06

SHA256
1bf7f34444f9e195e04ef489ac02507c12080cd5590c8f00adefa4b065aadb86

SHA512
60161c31db910a3d4a5f765cc09a1179b2966b5eec7811ad77bd64a31f09b3bf93129d263900454e9af661fa8a9e907600b7cb2c1f548f947ecbd8ee52586c92

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
10838c88f8e046395fbfec6b88fdb144

SHA1
852e4e9781da4162ad67c17a3a4c8f3ffcd6e69d

SHA256
4d3bdba2b4690110ff62f485751426569e3acf8f7a51809c6ecdec0fa1ea4da1

SHA512
9e8d1ff44eb413d8d03ece8a5ba6f30af282457ac2e3af9590f424218cea1c1cb529b0a1e9aba71ea83c3513af1ed05878c8a73dc77a65a9044216583c6af96b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
c27f5c183b399b0ff171d34a559e2482

SHA1
6407f3fbdacbf343fec66379428228ae01a628df

SHA256
720119492a10bbb99a19a264e040a58d132b2cbd7eea04efa78d3669b928c6ca

SHA512
1cd1fded742dc8f37b1abae77928ee9d3a62e0088f0ca4e1d1ecf7dcd27ac720d6a3829b5c8837bc2ecf366744c16bcd6e68ec4b691ca96c5ae2abf87187be6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
9eb71675db933ad8c03a5995bd252f11

SHA1
28fc4afce71f59b9582f6f845dcc435fed29a8da

SHA256
b5842ebfc26db4f521070ef8176442fd7037b587b1de5f1fff658de5feb388f8

SHA512
525c3b55f7b2bf897cb345d29fb4a1067a36ab3214f5c8617acad40b8b02b7d1bb8144804cc53d60af533a845b735a5d489a398e0a3870004c0ce7210e44d61a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
8KB

MD5
0b30553fce1696f71227c76727ec5d10

SHA1
b8077a6689f4508733fe2838c17277670b6929c3

SHA256
43c19d4fcf8ba35ef329acc07c24875f2007e1d795076807b07986637d55317e

SHA512
d256e72a04fd7998786144c571895fe84d5a55a4ef6a2d92ab50c4c18257e840bca693b53e540f3554eac8934b1f86f48cc6b5651852d338842c6c9308f294fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
528f727c5c340cd92b0aa0f230ffd6e5

SHA1
5e85733e126c3059c83c833e5149b828ca0228e4

SHA256
bf7264e15d014a1af96335aef411ca1fdebabfb069f7837a2daeb114e122cdbb

SHA512
ad324223bb29f2fb49c755268abdfc48b301ff679790fd29203d491e968fdef593f2668790e61b08905672ecae3cde793a258526dadeee8c8b381747c8df1ace

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
f2693987f8e4d4a40b6a70a639af2b2e

SHA1
44680bfc702430fe6b5cc5bc76b095ad66d8081b

SHA256
d863b92a4ab65ec461af6344a6aed8bf10f1a280df1adeaa4d3f2b898d053bb6

SHA512
88c1366ec6d4e659a031cc17abd4674d47802b475eb72e26835dbba692320b032d91c79e2f92be94ac3802cec70a653e67805ea7e6673ad3900b6342a46dd886

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
ae533eed2bbcc9b7afa276aaa20b1428

SHA1
be49e4ddc8679171636863f5a9f440d450ec28b5

SHA256
85e0da56e54e2fafd62336b17b56d4acc288989f4a64ee842c6b5addf46a0503

SHA512
4b9916c0493ad62d6a0e3001f7d2c04ee886f3baa9c7a7bbd0023d15a1bb657a9fcd1290cfe69391b355d93c7f012b93282bc71867053982fc957c580e210a35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
cd7628aa253ab8d121763c103dcfa552

SHA1
47dd206cd3d2728cc94c08503c4b9bd8b4a14fb0

SHA256
22f52f6ff47f5f0da79d94b42b677e008b2cba110cc11e696aa768273e8ec39e

SHA512
89e3c3d09cffedf772e4e6eb4bec00e77c3ab47ab2038c7935647d9536be0f2add2eac89b4fd9706c5da28483706a78e0f5e20078d2faca951684e128daf8b15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
5137463a2feea5ca1b2849ec02389e67

SHA1
8865d7e1e0fdb1428d7031a74f2011d4bcc5a162

SHA256
9f488a1a726e1c4f4c9f20c03672165401aaee0fea75bb0a1aa6a69e6b314012

SHA512
52fff1d4c87cc8da4477ba903cab051360feef57d0ba30c478f8b3754e6398d8b587ac97763f65c6e60519605be9b12f499820b1f4dc6f8b15ae4e3235550e17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
5764676335abdb9ba478a5ec35ccb588

SHA1
f1a8a60f03709e974768f9b6813de4cf1535318e

SHA256
847beee2b497ed0e5a6f9632b17ede224a71e054566ac4ca0df35f43b18dc8d3

SHA512
d83cd7329b9d3f8c3e855c0a78430ef54a6decfe3e6236b9a49260cb98a228989546284e6e3d5d2b14385ccd3c376acd2eecdcf4ade2fe058935a223ea1fb2cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
159eebbe6cd89fe5abfce7f02f8f2a8f

SHA1
ece7d7f97cbd0ef60d61c5e19ef109511895caa7

SHA256
584b9422d4154a4fc2d12f331ef2418dfd5c0cbce3f5d0a47027d9c091c02752

SHA512
d5a672574a976f1c129aab12b27b7a9cb69a3128cd717f2f69c92c3ed55031b928ff7536a019f47e643a38673873c43ffccc9055f06f9be042ff7a04e0cac9ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
34aed79e1614dcdd45002404a2491daf

SHA1
0101a3603c82af0043477575ae644f3160d0925c

SHA256
85eef4e7bb768768e4092469e5baefd685e2df4e8d136fc3d07cebcb7cae8189

SHA512
57fda367ef5cd2abeff7410ba624b80a6b3342539b2660d4fd27a13e811802299ae5d4434f525ce08a43b4c4eb6ecb0e7c5fe38b163b6c3cd41e12e4afd27104

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f24ed582aeeb4fc6d728f088073b24ca

SHA1
6511a4934835534fe6b73275d22167a8b8a629d1

SHA256
25f615bde459fd6482338dc6cede4847a096c1c6010f8e2e5678ea6f55c47f35

SHA512
e2c8294a4cb4ccf6a130364967463781e10fd056153f81447b474e0a9dc9358c531a9ee475f2c8b53498407714e2c2f90e6d3a0d30e506ec649457c773a0f1a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
04987c1f43474c4cc68f3b5cb6a8f040

SHA1
c267b78bf37cafab672745e8f3557d6ac970d79e

SHA256
063443984fe73d3f2e5bb507c1d006244da39cfa13d168f460fbf722aa16c0d7

SHA512
58158a2d57ebfa75068ccc60614b0ef9a76bab7c2ed2faf9ac4d209efde428ced784628c59dae41937d16ae72dfd36696afd4a96c25260ed22aa992e8a79b4fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
242ee6002613050e1fcd8c84cad2ca64

SHA1
09c033455e4481b47c8f80c2f5fb8cb013559466

SHA256
30278af1546473013e8f0c057a28427a99d0307c8b81ea38019840e0c27918c5

SHA512
44f77d30e1d752b74e212a7da92ac63e841e4ab68552e52d866dd0d57b53d70e7294d34699af4e70ffb05b23309f8050c23b502945f538c9ad7c96c693d80552

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
11KB

MD5
bca382d976551d0e7ff8067d228dd0ec

SHA1
7e3d046936662ae4a984c0bd78c9328f76283042

SHA256
4096934f4e15cb13838c4c147b892b6a41a36c7e379678a16572229bcd9f2dcc

SHA512
9fc0adcfa29c667816951d2b8659d24086257d90673ab9baad9ca17b6082c3b40526d7abeed8f25890a3aebb5234f992e6288784d257bb59a73d7f43c705b2f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
11KB

MD5
2b330bbceaf8d98577bec33e4dcbc7da

SHA1
f0bb13517d37b680aef92d3260c0e56859a48aa8

SHA256
c6a33a7c351c0ab3d42ddb38297a01a4e466bae8f2e60f8e505bf98172c9f5b8

SHA512
3c4e32d3107158c267fe25cd2203c7b36acd81ff88792332d5d44342afed8d11659f8fb0156526267a87bb0135ee918277e75b49fad836b56b6d33e36623e85a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
12KB

MD5
f062c6d46badf120d96f8eb8ede137d0

SHA1
0c43d69e6bc86177d693dce82046dec5d92cd8b6

SHA256
9b2751a98faecfb2dc99ee27706ba6e1b730c88e407eda3bed4ecf2a51384ffa

SHA512
8eca63b1269cfb2d757bd8ddd9bc85728e330c944ebec3325dae257296ddf91bf065d0f70a40045ae21eab8d43c2c3f4d8fcfa1d380fe18e75f777b468a61e1e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
a1accc6ea6a5040eb879ba1d65be8d97

SHA1
6b7f0d234611e2330399b293e7dbf0f311cb3b74

SHA256
c2fed06a77825ec16ea77d27aae9834c99af676d245974a60f4a23680bd62b45

SHA512
dad983220b487372de761e5524938742d3445c360fa24c051dbea3f7e6809a5a6ebbce06dbdf814c032b9c1df42e222560fb8581d9641233431da37b6cf8cb2f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
9d6f1b63e7e35b60319f6295e024dcac

SHA1
41cf0b5eaf0fa0fc748a56ae76726a4904faea05

SHA256
d15a243879441349233bfe71cca9900be424a0086491c524e1c0c7e5edc34bbf

SHA512
1dd51b5e0a45124b5cf86d981cb1ad0d35dc6cc85533ce8eec443ee34878f4c7f912e786bd2087e3af20d3ccebe8c70dc7b51877201befcc5ca8000bfd7ca7f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
65c79152e471cbf0d8a129c3951e8f47

SHA1
9061deff53b5412e0155a819ebb035a2b5ba1dd4

SHA256
acece75ef006ba78416afbbe96c6c6cd926d111c7988e4aa20d76737df7d57ea

SHA512
02ef26a286cffd715dbd5456a239924db25c1b0be76fe7d14fed5cb0283dc9bca922eb91340ac8c8901a10e9e8f2e19f2d7ee21acf21764c56e9fe11782814fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
aaef5a8c9da4405cec61e328d330388c

SHA1
194360b3a56fb8a70da75c3d3e0cc3c990d4cf1e

SHA256
cc063e9fa9fa1d2ba3b3d7a61d875e0bb9765f96b2b192066ed6045e81f4b559

SHA512
71abd18d67047c3c360897a6e11782c35fe815500b7261500dd2d88af8a9fb451af9fb1b54e0c287b96e11ed138c98c38fa9a9b4b3acba6c43419a66492d79e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
4cde6e0b14b797ce0da8b31ae2dfcc5b

SHA1
bb1eaf9d8008e09dc4408618708ae53aeca4ea62

SHA256
c410978825aa1c3b66d99ba0f7a559dfc858ae33e2a6f3c97ebb40fd4bd1d813

SHA512
38bdd629d7292e9c9a8b77421ae462f4cac8a2afa38d1701817be0a61b46af6baba48fe2e77c4d6b894e95fdd5ead0dab5a423ac2451b97900ef882847c4c0bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
4123f6f0135045a4414118094302b867

SHA1
8ee045c60306004bb34c49ca12f27b29c1e0f25d

SHA256
2836087cd747bc6cdb9afeab84d85fb94337de533f40eb0061ba56dad25d95a4

SHA512
a833a79c60bcb32f33a8f4838de07d407624013c3bf0a82fc373ab0fb5debdaa852f3987d6d66f0f9730c45f65c6e2d4cc01438c4c31c01a994975b7650c6420

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
eb71fe7e4197d847dc6e24415c7f7563

SHA1
8ce6965310ab5cb583d3057928a6a00ac6024c64

SHA256
56ffa90d15057f9df58344bce9de03f7b4516cb70ceacf274d301cddca213d1a

SHA512
f0be4b8c425acb82267b0d3fff80a7abbb4adb3f67c00042549168f43cd0f613fcc5e0419a56b02d09f522e9f365f50feb27eb4f801eb6a4b34a4be31c0e0632

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f6d22f794d027b837d8fb06ea6d8d98c

SHA1
e10d62aa7f71ffc7df53a217903bac466fe3fa9d

SHA256
deda984d433f2320fda07110c32e06a7f34daa8c4327a9aa9f3dbb3cfa9f4043

SHA512
9e77d818b10dbd5eb1199bf77b2a66a24a2f836ef4b59c1f8d5a0d1a4b03fc2ff908f504aa3ff823cea78c8c99733aacee7c6465573bd70af93dbce6de311aac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
2d95655e0020d130fb5963ff7d328a8c

SHA1
ec1bf5e6863a575fe30b5b7cb10f0d75ee830fc6

SHA256
943e59c7bd910582edcf4c4157840a077157575ab0badf01c76f0f276c60cec7

SHA512
716cfade6a3941589bb5795df6e34b85684e3b070e614e0537e50864922fac6c34b9f93daad655531206231be1a70267474030bfa014a8aabfb197cd79f74876

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
72b515fce3762212d982b84556cd91b0

SHA1
20c49579a942c9188335189f6b4fa20b2c9b2f3c

SHA256
1f5be4dbae40f53439f6e2c9726d398b75788b802ce1aec9ebed7d74805d79d3

SHA512
7afac67eff37217f6683fef2ead12cad9413c940cb979839bdcf32b544ec9f4ada90747733a3fb0925df814bad83bdf8af9dcff11a91784dda7f635052998cfe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
65c9c7175e4a523a152797398f67e167

SHA1
6c24f3f5aa83bf9bd0b8f369d43f082e28366888

SHA256
e25e655386d4d972b7029a645862f04b0a06c0c8a72ddbbd7f5d02f07e3154c3

SHA512
9e52ae65a652b09fdc62dd280282aeab4059c11d7900670288636cccbe6d475baff97fd8b174b94255134d57f35b9f522b22c5e1e97a9f1be4b57b0666668e54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58e5b8.TMP

Filesize
538B

MD5
9e69eab96fce8b7966bf906c9b03e06b

SHA1
81cf88aa5155e7d9f4c2212c464685cfa71202e1

SHA256
791d4c9024a170fd32eb5ab2e46e671f4702fc9c3340f9a54388d99a044ca0ed

SHA512
3063fcd40e6346231a7ca2f0b5dc5cb81446e18024f7dbe2e3e874483c2c721a2cfea4fece255fc57600c1004b148b09b27022473647d03acd5a9192fdaddfd1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b169a65e-e720-4f85-ac88-49fbf63c1f6c.tmp

Filesize
7KB

MD5
2ced6645d5e3563b69dc88e7fe5385d6

SHA1
1a0136f846cf97970d1bfdc4f3c8b2461ff59a46

SHA256
ea31143f069a5aee382d713588ff124536b67b49e9d48caf380ee880f1a525e0

SHA512
3296fae77175148812ccf5c707a2597a94c052f8eb495c809f717a3fca1e06d6329070493b85a74e2076bbea42841f9f428a313cb846345cc7658b2c722f79bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
f8a748aa264b2d9d3eb502d68f56ec87

SHA1
8c71bc0aefbb60be335cfebaa81ec9827ca1cabe

SHA256
b8e07a2057e5719dc745282727ad096cd00365f0495df16780b18f0ec7289fc4

SHA512
381e1efc7ed8bed73d0b80884d9f40d8b80374ca84ddbfbe69d37140f9c6832f45ec5cfe85202e9e916e2c12310f81018cf1ed34a65d2f04b5d68b136410e24b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
5f30c6d7d7bb1d47c967201e40d13df5

SHA1
8fd1ae5f774ef8809c487fe3bdf547994e3e68b7

SHA256
155a60d1689b6d8a4dca32fc708331c12cfdebe9bc5ebdf303cc62c128b99e59

SHA512
454e660b52bf0f425f865b0de15c65c180cdb0f4635c79bf4e5ab248ef4cbc46c70b1ee6a0c6f4f500873f0954b72c5ea7a8d7576dcfe83970f91bed976fbb4a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
4b2bcf760f6db0cb7978af96f14ca1be

SHA1
6155fe9046ffad388a1fd56e0f3c0a6917af93e4

SHA256
d863852d66698da3d84d7f5f57ab6fee348f7899d5f8965d9335bd56e491c20f

SHA512
3bba5773461d7fee37017e69d047115f4c6e1941b4da21b204dc36af647a2fe785e8fa685c79fc2a92a157c1ff4138fe75b31f3ff813810cf1eafc99ae1f8d17

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\GLCKMVPMQU8SQDJP8XOI.temp

Filesize
10KB

MD5
ac6ad80133a050e4c97c6ef7c513bb00

SHA1
e8f398d1c3753cf1b72467b5e1d9779267b0aba7

SHA256
cec41ba92d73fdd438686baf24876fea115f46e7eb8c73675262c6f4179b0e3f

SHA512
aa4e88f56bf05761c905b331aee3f3c7e8530f21d9c97630e76bb404e50f361040a945ce160d49d4af815f5eec72f9af536f3b07dfa0ff792cddbfe9e886b08b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
15KB

MD5
cdd231af0e8ca9785cdc08926dcca3ed

SHA1
5f03ea2e3d5bb035394e8fdb9f4ea788f1f22702

SHA256
720e302a88a1a1b274ce8a646032e906c32ba6dfc9a78206172a70d350f21fea

SHA512
05f14a47619b2fdaba76600e7214b64db809e13ac81d8b0c0b6b52575d422d39bb8c812b89ad2dfa53a16cd1ca1a61a097637bf4478dfba07a8da6f7b03b795d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
14KB

MD5
e2ca1bfe23ab22d8faf26e8318a510e9

SHA1
90beb764919446b72d4b278a351c4fae7b729b17

SHA256
b0ba4ee84da012c10189d9cfccd24b98a10a7d544d16b2d1973fb6da8637b1a8

SHA512
3ed2184842afea7ad4e89171c3badbf6dac061eae5166dde9cfa304876e04fa491832a875fd0de5cbd42909397b39a528337de639cfceb7704807b746be1c3dd

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
15KB

MD5
31cb96f3303a562541527f379da89cb5

SHA1
900ecc3e719de3aba208238350ee374a4e21ea3b

SHA256
1291213aa4c8d7cb6980f01489bfe03f36da5fece5a9a0b325a45edd30584412

SHA512
32ebe00245c7ab03303059102604999cb69451eb646d717c72910ab0c95ecfcf1b97b5f5b90b378922f8841684dd471b4fd0c27ead0f1089d6e547820e3c9e2c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
6522a9feaf5c4a511013a6fbb782c0ee

SHA1
cd90b96582700c0e546a16e1b744ae4055fad3a5

SHA256
74341c1f20aa3817be0c47bc56fe78341f464be688d337c6ec2c4a87411615a7

SHA512
ff3e92534dd0bf42e3e5373fb29ddc950f4d882683077d85a5fd29cb4d30447abdb2d798355eaf6c86cd06ca7084d1f2b078aa7c575654542c010746c7b6e8ef

Download Submit
memory/1748-1749-0x0000000001250000-0x0000000001260000-memory.dmp

Filesize
64KB

Download
memory/1748-1812-0x00007FFDE5A80000-0x00007FFDE6541000-memory.dmp

Filesize
10.8MB

Download
memory/1748-1827-0x0000000001250000-0x0000000001260000-memory.dmp

Filesize
64KB

Download
memory/1748-1645-0x0000000001250000-0x0000000001260000-memory.dmp

Filesize
64KB

Download
memory/1748-1644-0x00007FFDE5A80000-0x00007FFDE6541000-memory.dmp

Filesize
10.8MB

Download
memory/1748-1643-0x0000000000B30000-0x0000000000B64000-memory.dmp

Filesize
208KB

Download
memory/1748-1859-0x0000000001250000-0x0000000001260000-memory.dmp

Filesize
64KB

Download