9b136612a0fce26212377db945319ec533c7671ace325ccc2616df9c9a5b0e2e

Resubmissions

01/05/2024, 14:05

240501-rd1ebagd9t 6

01/05/2024, 13:01

240501-p9erdafd4t 6

01/05/2024, 13:01

240501-p87e1afd3y 6

Analysis

max time kernel
148s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20240419-en
resource tags

arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system
submitted
01/05/2024, 13:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Netflix-CE V3.7.zip
Size

7.0MB
MD5

e0114161262d6962d7f0070ceaec7b56
SHA1

eaf3a04dcc79f0a1c49ffb8c9664330081520bd8
SHA256

9b136612a0fce26212377db945319ec533c7671ace325ccc2616df9c9a5b0e2e
SHA512

89362ab507a7363f170b0fec1f758caadd6c7ee6a34cc369a6cf32fd8adc7df8f3740c289fee8a121d96c9aeafb0a394016515d4ed35555aef520b7ed91fe8da
SSDEEP

196608:VfRG/lS1WObi8t9FDbBH4ma6bgP6MITd9WrxiXKE4QsK6:VfRGdMk8tHDlysrMwbQiXKE4/

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
2	pastebin.com
3	pastebin.com
136	pastebin.com
178	pastebin.com

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SYSTEM32\version.dll	RobloxStudio.exe
File opened for modification	C:\Windows\System32\sechost.dll	RobloxStudio.exe
File opened for modification	C:\Windows\SYSTEM32\GLU32.dll	RobloxStudio.exe
File opened for modification	C:\Windows\SYSTEM32\uxtheme.dll	RobloxStudio.exe
File opened for modification	C:\Windows\SYSTEM32\opengl32.dll	RobloxStudio.exe
File opened for modification	C:\Windows\System32\win32u.dll	RobloxStudio.exe
File opened for modification	C:\Windows\System32\win32u.dll	RobloxStudio.exe
File opened for modification	C:\Windows\SYSTEM32\Dbghelp.dll	RobloxStudio.exe
File opened for modification	C:\Windows\System32\MSCTF.dll	RobloxStudio.exe
File opened for modification	C:\Windows\System32\ws2_32.dll	RobloxStudio.exe
File opened for modification	C:\Windows\System32\ole32.dll	RobloxStudio.exe
File opened for modification	C:\Windows\SYSTEM32\dxcore.dll	RobloxStudio.exe
File opened for modification	C:\Windows\System32\GDI32.dll	RobloxStudio.exe
File opened for modification	C:\Windows\System32\advapi32.dll	RobloxStudio.exe
File opened for modification	C:\Windows\System32\user32.dll	RobloxStudio.exe
File opened for modification	C:\Windows\SYSTEM32\wsock32.dll	RobloxStudio.exe
File opened for modification	C:\Windows\SYSTEM32\winmm.dll	RobloxStudio.exe
File opened for modification	C:\Windows\SYSTEM32\PROPSYS.dll	RobloxStudio.exe
File opened for modification	C:\Windows\System32\ole32.dll	RobloxStudio.exe
File opened for modification	C:\Windows\System32\KERNELBASE.dll	RobloxStudio.exe
File opened for modification	C:\Windows\SYSTEM32\PROPSYS.dll	RobloxStudio.exe
File opened for modification	C:\Windows\SYSTEM32\apphelp.dll	RobloxStudio.exe
File opened for modification	C:\Windows\SYSTEM32\windows.storage.dll	RobloxStudio.exe
File opened for modification	C:\Windows\SYSTEM32\GLU32.dll	RobloxStudio.exe
File opened for modification	C:\Windows\System32\bcryptPrimitives.dll	RobloxStudio.exe
File opened for modification	C:\Windows\System32\MSCTF.dll	RobloxStudio.exe
File opened for modification	C:\Windows\SYSTEM32\msimg32.dll	RobloxStudio.exe
File opened for modification	C:\Windows\system32\explorerframe.dll	RobloxStudio.exe
File opened for modification	C:\Windows\System32\bcryptPrimitives.dll	RobloxStudio.exe
File opened for modification	C:\Windows\SYSTEM32\wininet.dll	RobloxStudio.exe
File opened for modification	C:\Windows\System32\shell32.dll	RobloxStudio.exe
File opened for modification	C:\Windows\System32\imm32.dll	RobloxStudio.exe
File opened for modification	C:\Windows\System32\combase.dll	RobloxStudio.exe
File opened for modification	C:\Windows\SYSTEM32\GLU32.dll	RobloxStudio.exe
File opened for modification	C:\Windows\System32\MSCTF.dll	RobloxStudio.exe
File opened for modification	C:\Windows\System32\shell32.dll	RobloxStudio.exe
File opened for modification	C:\Windows\SYSTEM32\ntdll.dll	RobloxStudio.exe
File opened for modification	C:\Windows\System32\msvcp_win.dll	RobloxStudio.exe
File opened for modification	C:\Windows\System32\comdlg32.dll	RobloxStudio.exe
File opened for modification	C:\Windows\System32\gdi32full.dll	RobloxStudio.exe
File opened for modification	C:\Windows\System32\combase.dll	RobloxStudio.exe
File opened for modification	C:\Windows\System32\user32.dll	RobloxStudio.exe
File opened for modification	C:\Windows\SYSTEM32\uxtheme.dll	RobloxStudio.exe
File opened for modification	C:\Windows\SYSTEM32\uxtheme.dll	RobloxStudio.exe
File opened for modification	C:\Windows\System32\comdlg32.dll	RobloxStudio.exe
File opened for modification	C:\Windows\SYSTEM32\wsock32.dll	RobloxStudio.exe
File opened for modification	C:\Windows\system32\explorerframe.dll	RobloxStudio.exe
File opened for modification	C:\Windows\System32\RPCRT4.dll	RobloxStudio.exe
File opened for modification	C:\Windows\SYSTEM32\ntdll.dll	RobloxStudio.exe
File opened for modification	C:\Windows\System32\oleaut32.dll	RobloxStudio.exe
File opened for modification	C:\Windows\System32\msvcrt.dll	RobloxStudio.exe
File opened for modification	C:\Windows\System32\clbcatq.dll	RobloxStudio.exe
File opened for modification	C:\Windows\System32\psapi.dll	RobloxStudio.exe
File opened for modification	C:\Windows\System32\shcore.dll	RobloxStudio.exe
File opened for modification	C:\Windows\System32\ws2_32.dll	RobloxStudio.exe
File opened for modification	C:\Windows\SYSTEM32\kernel.appcore.dll	RobloxStudio.exe
File opened for modification	C:\Windows\System32\clbcatq.dll	RobloxStudio.exe
File opened for modification	C:\Windows\SYSTEM32\msimg32.dll	RobloxStudio.exe
File opened for modification	C:\Windows\System32\clbcatq.dll	RobloxStudio.exe
File opened for modification	C:\Windows\SYSTEM32\Dbghelp.dll	RobloxStudio.exe
File opened for modification	C:\Windows\System32\user32.dll	RobloxStudio.exe
File opened for modification	C:\Windows\System32\shcore.dll	RobloxStudio.exe
File opened for modification	C:\Windows\SYSTEM32\windows.storage.dll	RobloxStudio.exe
File opened for modification	C:\Windows\SYSTEM32\kernel.appcore.dll	RobloxStudio.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.22000.1_none_271a8fad6a2d1b1e\comctl32.dll	RobloxStudio.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.22000.1_none_271a8fad6a2d1b1e\comctl32.dll	RobloxStudio.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.22000.1_none_271a8fad6a2d1b1e\comctl32.dll	RobloxStudio.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1856190483-1022094809-400023910-1000\{95B4E058-A2D9-447E-BD6D-C6A292482848}	msedge.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
812	msedge.exe
812	msedge.exe
3876	msedge.exe
3876	msedge.exe
1176	msedge.exe
1176	msedge.exe
1436	identity_helper.exe
1436	identity_helper.exe
1244	msedge.exe
1244	msedge.exe
1676	msedge.exe
1676	msedge.exe
956	msedge.exe
956	msedge.exe
2356	identity_helper.exe
2356	identity_helper.exe
3584	msedge.exe
3584	msedge.exe
2880	msedge.exe
2880	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 39 IoCs

pid	Process
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
2880	msedge.exe
2880	msedge.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

description	pid	Process
Token: SeDebugPrivilege	2828	RobloxStudio.exe
Token: SeTcbPrivilege	2828	RobloxStudio.exe
Token: SeTcbPrivilege	2828	RobloxStudio.exe
Token: SeLoadDriverPrivilege	2828	RobloxStudio.exe
Token: SeCreateGlobalPrivilege	2828	RobloxStudio.exe
Token: SeLockMemoryPrivilege	2828	RobloxStudio.exe
Token: 33	2828	RobloxStudio.exe
Token: SeSecurityPrivilege	2828	RobloxStudio.exe
Token: SeTakeOwnershipPrivilege	2828	RobloxStudio.exe
Token: SeManageVolumePrivilege	2828	RobloxStudio.exe
Token: SeBackupPrivilege	2828	RobloxStudio.exe
Token: SeCreatePagefilePrivilege	2828	RobloxStudio.exe
Token: SeShutdownPrivilege	2828	RobloxStudio.exe
Token: SeRestorePrivilege	2828	RobloxStudio.exe
Token: 33	2828	RobloxStudio.exe
Token: SeIncBasePriorityPrivilege	2828	RobloxStudio.exe
Token: SeDebugPrivilege	1548	RobloxStudio.exe
Token: SeTcbPrivilege	1548	RobloxStudio.exe
Token: SeTcbPrivilege	1548	RobloxStudio.exe
Token: SeLoadDriverPrivilege	1548	RobloxStudio.exe
Token: SeCreateGlobalPrivilege	1548	RobloxStudio.exe
Token: SeLockMemoryPrivilege	1548	RobloxStudio.exe
Token: 33	1548	RobloxStudio.exe
Token: SeSecurityPrivilege	1548	RobloxStudio.exe
Token: SeTakeOwnershipPrivilege	1548	RobloxStudio.exe
Token: SeManageVolumePrivilege	1548	RobloxStudio.exe
Token: SeBackupPrivilege	1548	RobloxStudio.exe
Token: SeCreatePagefilePrivilege	1548	RobloxStudio.exe
Token: SeShutdownPrivilege	1548	RobloxStudio.exe
Token: SeRestorePrivilege	1548	RobloxStudio.exe
Token: 33	1548	RobloxStudio.exe
Token: SeIncBasePriorityPrivilege	1548	RobloxStudio.exe
Token: SeDebugPrivilege	1812	RobloxStudio.exe
Token: SeTcbPrivilege	1812	RobloxStudio.exe
Token: SeTcbPrivilege	1812	RobloxStudio.exe
Token: SeLoadDriverPrivilege	1812	RobloxStudio.exe
Token: SeCreateGlobalPrivilege	1812	RobloxStudio.exe
Token: SeLockMemoryPrivilege	1812	RobloxStudio.exe
Token: 33	1812	RobloxStudio.exe
Token: SeSecurityPrivilege	1812	RobloxStudio.exe
Token: SeTakeOwnershipPrivilege	1812	RobloxStudio.exe
Token: SeManageVolumePrivilege	1812	RobloxStudio.exe
Token: SeBackupPrivilege	1812	RobloxStudio.exe
Token: SeCreatePagefilePrivilege	1812	RobloxStudio.exe
Token: SeShutdownPrivilege	1812	RobloxStudio.exe
Token: SeRestorePrivilege	1812	RobloxStudio.exe
Token: 33	1812	RobloxStudio.exe
Token: SeIncBasePriorityPrivilege	1812	RobloxStudio.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2828	RobloxStudio.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
1548	RobloxStudio.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
1812	RobloxStudio.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe

Suspicious use of SendNotifyMessage 36 IoCs

pid	Process
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2828 wrote to memory of 8	2828	RobloxStudio.exe	87
PID 2828 wrote to memory of 8	2828	RobloxStudio.exe	87
PID 8 wrote to memory of 3876	8	cmd.exe	89
PID 8 wrote to memory of 3876	8	cmd.exe	89
PID 3876 wrote to memory of 2716	3876	msedge.exe	90
PID 3876 wrote to memory of 2716	3876	msedge.exe	90
PID 3876 wrote to memory of 3380	3876	msedge.exe	91
PID 3876 wrote to memory of 3380	3876	msedge.exe	91
PID 3876 wrote to memory of 3380	3876	msedge.exe	91
PID 3876 wrote to memory of 3380	3876	msedge.exe	91
PID 3876 wrote to memory of 3380	3876	msedge.exe	91
PID 3876 wrote to memory of 3380	3876	msedge.exe	91
PID 3876 wrote to memory of 3380	3876	msedge.exe	91
PID 3876 wrote to memory of 3380	3876	msedge.exe	91
PID 3876 wrote to memory of 3380	3876	msedge.exe	91
PID 3876 wrote to memory of 3380	3876	msedge.exe	91
PID 3876 wrote to memory of 3380	3876	msedge.exe	91
PID 3876 wrote to memory of 3380	3876	msedge.exe	91
PID 3876 wrote to memory of 3380	3876	msedge.exe	91
PID 3876 wrote to memory of 3380	3876	msedge.exe	91
PID 3876 wrote to memory of 3380	3876	msedge.exe	91
PID 3876 wrote to memory of 3380	3876	msedge.exe	91
PID 3876 wrote to memory of 3380	3876	msedge.exe	91
PID 3876 wrote to memory of 3380	3876	msedge.exe	91
PID 3876 wrote to memory of 3380	3876	msedge.exe	91
PID 3876 wrote to memory of 3380	3876	msedge.exe	91
PID 3876 wrote to memory of 3380	3876	msedge.exe	91
PID 3876 wrote to memory of 3380	3876	msedge.exe	91
PID 3876 wrote to memory of 3380	3876	msedge.exe	91
PID 3876 wrote to memory of 3380	3876	msedge.exe	91
PID 3876 wrote to memory of 3380	3876	msedge.exe	91
PID 3876 wrote to memory of 3380	3876	msedge.exe	91
PID 3876 wrote to memory of 3380	3876	msedge.exe	91
PID 3876 wrote to memory of 3380	3876	msedge.exe	91
PID 3876 wrote to memory of 3380	3876	msedge.exe	91
PID 3876 wrote to memory of 3380	3876	msedge.exe	91
PID 3876 wrote to memory of 3380	3876	msedge.exe	91
PID 3876 wrote to memory of 3380	3876	msedge.exe	91
PID 3876 wrote to memory of 3380	3876	msedge.exe	91
PID 3876 wrote to memory of 3380	3876	msedge.exe	91
PID 3876 wrote to memory of 3380	3876	msedge.exe	91
PID 3876 wrote to memory of 3380	3876	msedge.exe	91
PID 3876 wrote to memory of 3380	3876	msedge.exe	91
PID 3876 wrote to memory of 3380	3876	msedge.exe	91
PID 3876 wrote to memory of 3380	3876	msedge.exe	91
PID 3876 wrote to memory of 3380	3876	msedge.exe	91
PID 3876 wrote to memory of 812	3876	msedge.exe	92
PID 3876 wrote to memory of 812	3876	msedge.exe	92
PID 3876 wrote to memory of 2236	3876	msedge.exe	93
PID 3876 wrote to memory of 2236	3876	msedge.exe	93
PID 3876 wrote to memory of 2236	3876	msedge.exe	93
PID 3876 wrote to memory of 2236	3876	msedge.exe	93
PID 3876 wrote to memory of 2236	3876	msedge.exe	93
PID 3876 wrote to memory of 2236	3876	msedge.exe	93
PID 3876 wrote to memory of 2236	3876	msedge.exe	93
PID 3876 wrote to memory of 2236	3876	msedge.exe	93
PID 3876 wrote to memory of 2236	3876	msedge.exe	93
PID 3876 wrote to memory of 2236	3876	msedge.exe	93
PID 3876 wrote to memory of 2236	3876	msedge.exe	93
PID 3876 wrote to memory of 2236	3876	msedge.exe	93
PID 3876 wrote to memory of 2236	3876	msedge.exe	93
PID 3876 wrote to memory of 2236	3876	msedge.exe	93
PID 3876 wrote to memory of 2236	3876	msedge.exe	93
PID 3876 wrote to memory of 2236	3876	msedge.exe	93

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,"C:\Users\Admin\AppData\Local\Temp\Netflix-CE V3.7.zip"
1⤵
PID:880

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4392

C:\Users\Admin\Downloads\Netflix-CE\RobloxStudio.exe
"C:\Users\Admin\Downloads\Netflix-CE\RobloxStudio.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2828
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start https://omgexploits.com/byfronbypass
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:8
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://omgexploits.com/byfronbypass
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:3876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffc347f3cb8,0x7ffc347f3cc8,0x7ffc347f3cd8
      4⤵
      PID:2716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1924,12791172783444896390,7393384944688762453,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1940 /prefetch:2
      4⤵
      PID:3380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1924,12791172783444896390,7393384944688762453,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2392 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:812
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1924,12791172783444896390,7393384944688762453,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2564 /prefetch:8
      4⤵
      PID:2236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,12791172783444896390,7393384944688762453,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
      4⤵
      PID:4656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,12791172783444896390,7393384944688762453,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
      4⤵
      PID:4904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,12791172783444896390,7393384944688762453,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:1
      4⤵
      PID:4840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1924,12791172783444896390,7393384944688762453,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1920 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1924,12791172783444896390,7393384944688762453,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5868 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,12791172783444896390,7393384944688762453,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:1
      4⤵
      PID:3704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,12791172783444896390,7393384944688762453,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5948 /prefetch:1
      4⤵
      PID:3464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,12791172783444896390,7393384944688762453,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6096 /prefetch:1
      4⤵
      PID:3508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,12791172783444896390,7393384944688762453,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5940 /prefetch:1
      4⤵
      PID:8
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,12791172783444896390,7393384944688762453,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5984 /prefetch:1
      4⤵
      PID:2404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,12791172783444896390,7393384944688762453,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1
      4⤵
      PID:2524
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,12791172783444896390,7393384944688762453,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:1
      4⤵
      PID:5024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,12791172783444896390,7393384944688762453,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:1
      4⤵
      PID:2016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1924,12791172783444896390,7393384944688762453,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=1296 /prefetch:8
      4⤵
      PID:1748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1924,12791172783444896390,7393384944688762453,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=6296 /prefetch:8
      4⤵
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      PID:1244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,12791172783444896390,7393384944688762453,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:1
      4⤵
      PID:1300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,12791172783444896390,7393384944688762453,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6436 /prefetch:1
      4⤵
      PID:3208
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,12791172783444896390,7393384944688762453,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:1
      4⤵
      PID:2996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,12791172783444896390,7393384944688762453,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3924 /prefetch:1
      4⤵
      PID:4148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,12791172783444896390,7393384944688762453,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6804 /prefetch:1
      4⤵
      PID:2024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,12791172783444896390,7393384944688762453,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6060 /prefetch:1
      4⤵
      PID:3756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,12791172783444896390,7393384944688762453,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6020 /prefetch:1
      4⤵
      PID:4560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,12791172783444896390,7393384944688762453,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7100 /prefetch:1
      4⤵
      PID:2616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,12791172783444896390,7393384944688762453,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7104 /prefetch:1
      4⤵
      PID:3908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,12791172783444896390,7393384944688762453,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6452 /prefetch:1
      4⤵
      PID:4040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1924,12791172783444896390,7393384944688762453,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=7164 /prefetch:8
      4⤵
      PID:4640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,12791172783444896390,7393384944688762453,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7072 /prefetch:1
      4⤵
      PID:4552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,12791172783444896390,7393384944688762453,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6504 /prefetch:1
      4⤵
      PID:2200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,12791172783444896390,7393384944688762453,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7108 /prefetch:1
      4⤵
      PID:4680
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,12791172783444896390,7393384944688762453,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6736 /prefetch:1
      4⤵
      PID:1460

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3516

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4756

C:\Users\Admin\Downloads\Netflix-CE\RobloxStudio.exe
"C:\Users\Admin\Downloads\Netflix-CE\RobloxStudio.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1548
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start https://omgexploits.com/byfronbypass
  2⤵
  PID:4464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://omgexploits.com/byfronbypass
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffc347f3cb8,0x7ffc347f3cc8,0x7ffc347f3cd8
      4⤵
      PID:3124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1804,14134209181807510236,14642736379871313337,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1840 /prefetch:2
      4⤵
      PID:4092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1804,14134209181807510236,14642736379871313337,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2372 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1804,14134209181807510236,14642736379871313337,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2844 /prefetch:8
      4⤵
      PID:3520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,14134209181807510236,14642736379871313337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
      4⤵
      PID:784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,14134209181807510236,14642736379871313337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
      4⤵
      PID:4888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,14134209181807510236,14642736379871313337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4988 /prefetch:1
      4⤵
      PID:2668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,14134209181807510236,14642736379871313337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:1
      4⤵
      PID:1812
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,14134209181807510236,14642736379871313337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3756 /prefetch:1
      4⤵
      PID:4632
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,14134209181807510236,14642736379871313337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4856 /prefetch:1
      4⤵
      PID:4936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,14134209181807510236,14642736379871313337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5812 /prefetch:1
      4⤵
      PID:964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,14134209181807510236,14642736379871313337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6088 /prefetch:1
      4⤵
      PID:1144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,14134209181807510236,14642736379871313337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3980 /prefetch:1
      4⤵
      PID:3132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,14134209181807510236,14642736379871313337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
      4⤵
      PID:4772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,14134209181807510236,14642736379871313337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5632 /prefetch:1
      4⤵
      PID:2528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,14134209181807510236,14642736379871313337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3148 /prefetch:1
      4⤵
      PID:4396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1804,14134209181807510236,14642736379871313337,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6292 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2356

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2280

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2608

C:\Users\Admin\Downloads\Netflix-CE\RobloxStudio.exe
"C:\Users\Admin\Downloads\Netflix-CE\RobloxStudio.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1812
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start https://omgexploits.com/byfronbypass
  2⤵
  PID:1040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://omgexploits.com/byfronbypass
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:2880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffc347f3cb8,0x7ffc347f3cc8,0x7ffc347f3cd8
      4⤵
      PID:1212
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1888,513956043969763700,18306064792441843446,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1932 /prefetch:2
      4⤵
      PID:3132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1888,513956043969763700,18306064792441843446,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2036 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3584
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1888,513956043969763700,18306064792441843446,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2664 /prefetch:8
      4⤵
      PID:4504
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,513956043969763700,18306064792441843446,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
      4⤵
      PID:1780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,513956043969763700,18306064792441843446,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
      4⤵
      PID:5000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,513956043969763700,18306064792441843446,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4832 /prefetch:1
      4⤵
      PID:2520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,513956043969763700,18306064792441843446,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:1
      4⤵
      PID:4036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,513956043969763700,18306064792441843446,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4912 /prefetch:1
      4⤵
      PID:3624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,513956043969763700,18306064792441843446,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5656 /prefetch:1
      4⤵
      PID:4404

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5096

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
6007ca6192acc48214149185effd485e

SHA1
9e1bd79f873aa5bd113e6d1f3fd30078478f3239

SHA256
19d440e3d197437fa64e98ffd71ab3eae51f107c438b25fe712bbc92491d5af7

SHA512
ce79184486b1b9da0b1ed9564b89a3641fbd593ea34f303f6fd50e9b3b6f66ccebb824f71ea229af04248fd64f4bc48b65cff61af5beaf8533f6c3475aa235a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Filesize
724B

MD5
8202a1cd02e7d69597995cabbe881a12

SHA1
8858d9d934b7aa9330ee73de6c476acf19929ff6

SHA256
58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5

SHA512
97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
ad3e68ba850a380d71870e1d5ecb23c1

SHA1
34c17b2d034ce20a7554bf8285fe675f83e76fe3

SHA256
8f2dc66cf48b6cb2f5b80b24fdcf641711f50f66e583f292bb691040be2433a6

SHA512
07290442aaccab3a56d7696ae62a15b881eb2fa667b242e56db103bdb16b37fcd3a9bfac899f888f2489dd58da2649c3be0c05984d2236fefd18946b2926034b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Filesize
392B

MD5
856323b2418d961f54456207d61e184c

SHA1
7c4c5b05a827b1001541c91531f4ad53f2bd9b7d

SHA256
8cdc7f193ce1ae8da4bf192416557f3e8106774a50a877f7da0604d67048924f

SHA512
e2ef465e2214652eac7d390bb120a5af7db622e3921a824be9dd56a2ee78eb57f6276e9cfe46c4b6e8a2bf70c5a1f0a36bc2fc461e362a527a8bcf9f2a1cc79e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
45dc316dd59fa853c4c0ecb261c512cf

SHA1
dd2aaf585b5aea9c922706d2f3b1c2cc65f67693

SHA256
fa59dc649f4a9a41d8fa3395b0a3b67eed8338b5d80272376c4ab9060b44813a

SHA512
dd5810a2f5471cfc3f1dbd681a5ac1f444d448fed00a2bd58a29409e4cd0a62f538753dbc9b8586de344346621fa479b1dc9ef452aacbffa4d1d220f12493327

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5a37afe631605165a70b0a3633ec7a7c

SHA1
1cb9acce83c86acd8d88244b0ff308fce61f9fb9

SHA256
a605ff1c42ac5fa59e82b849f1b20ab38f6c3c44b8b8c802980bfe5324f7b145

SHA512
1d4a61349a11de01dfc028aabf18f80b7e1d7d26d8b63d18182e421cee39f67e40d2ea670c3c2ec052b6fdcdac2486777ef36141bd8b10e84e52762c85f5053d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0c826005ab414a9565b574b3cd4777c0

SHA1
cb04551c7d01f6662966991a740fa2958f7e9579

SHA256
c23bed76f5e6b6630e6493368a675dbe819d375967b679cbcdf0328bce1b9915

SHA512
954271042bfd833b878f047df57c8de0aa3efc6642621ec7a0e93d514cf42075b12aa6055122df4b364e447fa6ac4f876cc8427aa042ef002cc01ebbdc387a71

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0f25425fcda7474bc74cf6b914ce2262

SHA1
541620b08eedb97ada0840960b2c59391ba9a530

SHA256
b170ac8e893bcbc87746d28c5068393019160b9f798db01d364812cac69f1cbe

SHA512
f4c7257d8729f6d6338872ca36ed128349944c9efe8989dee267230e5ebae8675a3fba3ac3038a88d5b70977b767eee0c2423481c526ade354fb335592d80b7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0354ef8afd53bc4c27ab99144970a9c9

SHA1
7105316ebb6a50dc71cc5402c64bba847a7c95ae

SHA256
acef151efdca7eef151e0cc9e45d5945737c4ab7cd8493e3dd9acb49d8df6020

SHA512
af6d8f1010ab8181c6cbe4c64a0d72c20ddfc56257cb862570c410546ddc52d2f1a67e58b93e7548573091b0e7173f230868c28bc6ed0abb8116f850f7122893

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5fdb0fb1-e586-4be8-ae2d-b6e1e7c66274.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
200KB

MD5
a484f2f3418f65b8214cbcd3e4a31057

SHA1
5c002c51b67db40f88b6895a5d5caa67608a65ce

SHA256
79cbe928773386d07f0127f256f383debed5ccea5ff230465bf46ec7c87319d6

SHA512
0be1bb8db08f6e6041a85cfee90cd36a5b595afbca34d52a125465454fc806b4bb7ae569eaf4c882922fb1b962b6060534e597791cd0ad23483be5981d9be85c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000016

Filesize
113KB

MD5
4d129404e14c61f0b87e2d85db07373b

SHA1
3c6e855f55f214213ff1d4f762f34dff4190470c

SHA256
d4363e3e3f219b53d4d9f9360c57f2a9ca69f21e1a078b6a2aa65c9547b5e85f

SHA512
89982d1422f60e521573b70aae119085bc39f3663379281ba1580cb99f889a1eee4a3b7fbab7aa8f01251eda50933dc82d6c27f379c8e850a9e1af253ecf2f7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000017

Filesize
26KB

MD5
050a643606ede5f4459f15ab42ef658e

SHA1
e5ca7a0dbfef1228604b94d58cf619057e24afaf

SHA256
a7725581f9b9aeff5856ef888347c7bb6d0bbb8516a7b089ab6b3443abf41976

SHA512
f1be7e85be6b1be0b159219e49795ebc3e12608b1a4a9ef4df72885126c89bd1c9291e172529ffeff128a9a49a76cf15054b983048922f8d7d4994764c9f3f75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000018

Filesize
27KB

MD5
ed59959dc5f41ff2ab1dd0ce73f83f4d

SHA1
fbe1ccffc148701eaab5141eea8e848f871e4c92

SHA256
867fcc29b69777b4e0e32977a929b76658393623e46a7ff3f00361224c709963

SHA512
b2c6c937bc7716db32707934c7f292fd013ba2cadff290e2d622655e6b83e169cda4a0ebc7a9da956c7897fc00ee236eba844070bc0beae089f53b96552a6f10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001a

Filesize
31KB

MD5
15482ac65022328724046fc444f32c8b

SHA1
5e6ad56df74650015e5c56865ab17c1573c9e472

SHA256
e0b082ca5ad3930319f4825efec55df3a06cbf7bce37366fa37205a04651b792

SHA512
354d2a35489a237b7c15715d411be35a0c5dc6ec8de1c280ba081628b61c4879c42abd36bf5d6c501d278541e87d4cef49ef3a17b5840c8c9fceac73dba5dfb2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001c

Filesize
22KB

MD5
094a6b103270d145a46c5fa1eaf78cf4

SHA1
dd045b6a682d155625c54d6164b706158cf02d7c

SHA256
489ba81eb8868eb62421e5aacbfeab22d6ea9e387c227b182f32692c550c24cd

SHA512
85ec58723e35d3d1ad08e2973350082c47e6d7806af591c693bd0dbcafd8302766d4b748f313a23551b36155af2ffc8e8b759e0eba7e47a4ce85c11f390a30ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001d

Filesize
28KB

MD5
314fd6de476c090fb3a460db973c13ae

SHA1
73bac1af55a9e3a8c4bddcb6f47dd33fba2883b1

SHA256
470a893939ed6bfd9e81dfb23aae63d75bd5b46b0874bc3b887a4d73745230dc

SHA512
ae7b2d51f39722e16a704008bc36d3bab206998bfb504da25ff70e228eddcf94f2a47e183ef8a60d46ef143aad648f83a49c8b0c377c7692dc6a9a4b1e93f784

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001e

Filesize
42KB

MD5
164be23d7264175ad016a13a0bcaf957

SHA1
c35ce3510b46a12a5ad3f73edc9ac18eb1e8018c

SHA256
4bb1ef87d7b93cb72976e936bca7f607d5dee5517dfa739fcf403a2cd130f6d7

SHA512
7dcfeb8007467dec38af535e1240cbd15e951735720e66e5887d7c69404edc2b2737fce054a369726b46b5a2038bc296b136615dc981d56cad7a8d674cb88aba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001f

Filesize
19KB

MD5
cfabbcd29935bd7b97eff9c96c4b48db

SHA1
487cb972e6f6d9e87039d9307ce0bdfdb9b36f00

SHA256
05175d421ed1fffa52ae6b38275e4e382378f2f97b61df1ba4082d4c43b37453

SHA512
4cb8d4a8f7f22ff5a680a141cfe44cf74473559e1795826a239185e290fe95f25b13c0fd73e75ac1209df29ad9cf133b321c60aaf365249b91a9c4854b7fba08

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000020

Filesize
56KB

MD5
b0a8579dbb3e07be05e833ea925a0e4b

SHA1
07eda19052cd108154d49168f7cbccd15e2fa3d5

SHA256
0a5d2cc3430ad71f3a93e631c4dad3d095d4846c12d4dfbb9f137ebc23cfd2fb

SHA512
5987cf7c63447ebaace01429f02a65c7f86f16e4bf368fd6dac4821301a9ded1ca591199ddaa1bb399b6d9125598e02e5e229bac5734dfb3e0ca293512b7ce3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000021

Filesize
62KB

MD5
be87ba7e57b063801210196bd07e078b

SHA1
0384f8cff41132e206882fde73a6d530e4345b6b

SHA256
1c57b06c205d185ac807bb12d1962caf6c29bf331b852543bf2a6a80b2c341c8

SHA512
42dcebe61edc9fe52ee8c863ce36e00132ab2f3e85a48f98440055996e0446d16d4034b68c2f60f3f7ec242bd455354f406c8e26f0e1ee380a0df79163f0f7dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000022

Filesize
104KB

MD5
968513e656f19a84e4ebf35f0584dd8e

SHA1
c782872e0e04bb72f4117637e0c5095214d10ff6

SHA256
3a74c98e0cbeab86161098d101f72a9b134b79d9a6744b3a5f6c314c2e2976b8

SHA512
238e44daf55a4e60c5167f9e9f5f8746e5473fbd6d7774a82ebe160f8d5b9c212e1e12935774e5ee9ba7a43f714c3961a09b108c20aa8ce65a2384b45246c234

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000023

Filesize
77KB

MD5
9ec41a95a527b31ebc55f9bf8d113509

SHA1
fc92a7c1bf7aa3fc2a1b88d68b1a9841d4a5ecc1

SHA256
4089a5d5027d9cbeb66ad4ff2e1c29580424c2fe28b585907393cc8ef06e86b2

SHA512
95ebaa6222bd1586ea353793b4403fbd68baeec8a532404a3c644828576c939cf0468de19d75d8baa7f01a5fee2baa4280dddea332347f1f8cd00731f4b7133f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000024

Filesize
103KB

MD5
e4945413184d65f94f64c59e9e43f686

SHA1
51bd126ccbd5e693c1441ffef1b3b51f6e46fe93

SHA256
4eb24dc9c5191b3973b26d0677b18e0181a7b64507dc3ea80f4b960d4e3bdbaf

SHA512
3bfadc9543769c21312a8e4542faf97cb41b7d1b2c6b5c8380d19adadb8a2c52d22a206479549ca4c929c02dfa08d6be6479860c5afb855dfed87ce3bc83b1b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002f

Filesize
85KB

MD5
008d0ae10f41631bb124d78799baf5bb

SHA1
cd5956db2574b3e718d8e87f3e4af79e2a3b5e0b

SHA256
a0aee1664677fce87357ff299c236f12803be313c1838a312d779ccf1ce0e590

SHA512
e4c1c5a8d88b6e0caa60b3c6ce02c05b0b2653c478a788d9d6c330d34439a5f91acecd67dc6baa4f40cf8f4cf21a684a13162562df8e2406cd06ac3145c6216e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000048

Filesize
18KB

MD5
6ed920e0f3a6447c3e5d86c552438db3

SHA1
4bd9cd1b552e1879e596c57e47b3813bd95dcafc

SHA256
e513c909d83dcbbbb9ba1b54f1cc8e6d6044ed212d04583d1629afef46eacad6

SHA512
ccd98e921f910e736fa59855a4aae6b170fed4fe359fc3790f92608b5f0ec03f2e92243fad55f51c8cb301003a4115d37c1ec4b7652e4109258b156744f3b1cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00006c

Filesize
36KB

MD5
dcc416e7f77b9ce8f0c3c17c45a603c3

SHA1
f4c3164c2f7e029350562d5549acfc36c3f72386

SHA256
60c8cd24f11af64df3c2d899850ab77d46d5fdbe6c8e008e3b72e4e51566bb0b

SHA512
e5e36a5feea91d8eb3e0764f19aa50fe5ae437c86a929b9818ed662deae2b527f959412f27fd2db3548faa50ec1f54ee3d872a0ad4955995cad7596ae893aea4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
ad9b64bf38a83fdf4a880284f7ab3453

SHA1
c3440d1353303ae95ca62da73d999f27ddf980fa

SHA256
55bd3206e66ddb37aee71838ac5e4d04ad4e780f6eef837ca072fbe65c20bcba

SHA512
3c692b6e1dc96fd3da9f36853c60bee51f6b44c5489150f74628a9d6b63927a2192b587ae576a9db2f79f0bec0224616a9ba723abbc69dad2db734472d2337cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
c197d7fa96ddaa058f2c132d392c2621

SHA1
edb6669526dd0f72dba8918da8760cc059e3e010

SHA256
d4b82e6e51843cb18e5cc05a4653650bb9ea4606405218b7c9381a1cc6d3ed27

SHA512
a749890dec0022b9deb7b23364227cfcaeaf217de080e0e09ef9317ec93c6f698b525e6304d52ca911c66deda6d306eaf6207877554a87fce89139c735299a1b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
e1a6d7b59672c12656e5fdcd07518d7b

SHA1
342334edf029c2caaaf9441af2b8ef0454e9922f

SHA256
7f330132018c9cedbe0f47e51f827a9bd7b14e84a20e134e803fb2969c275714

SHA512
2155d675b459328a7f72fff73960ac402a4703de113a5f8722088d78160ff3dd77602030ff7b328b63aab17482278ded0a22da4bc94bd98dade3609b0f7f4823

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies

Filesize
32KB

MD5
3aecc366ea1603b9382c224a66e0d2d7

SHA1
2be832bcfad697be5e51d1c5693139fcdd3783af

SHA256
5cd4d6436d9c3a0924b26b0a695f94d2603f29f42b1e311c57e4345f12f17caa

SHA512
4f7170f0d862f7138919b9e81477a35c98e7c5fbc799684eb0900eb8db80ce204e3dbd453c28e032bf6aba8149f66b43c2a99bfe4b4019c392585e5dd32a13a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons

Filesize
20KB

MD5
8c6d4ca59d211474ea54e7271be4e9c3

SHA1
30b9ccc29907a977cbd6909f242af9805a4a8de0

SHA256
fd10d332af19e78ff71fba3717983c891ce679b6b41606f9474179b29133a15b

SHA512
6b45ae05881c6f2bd1e0b22c05abcb7e637a11ebcbbfa5565ed5f107ba4ef522bc57627cd73a9c296a41233a143d615bfd336cb89e31c45e9fda384f6038378b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
65dee13d18ef9ff8576b84d58752044f

SHA1
d0cb7c650676609b5fdaf7d5bcd2de4056a6b281

SHA256
3a2e6a71723cfd0d3b2557ac8260b5f6c171b3aa703c7749be31e13a987cccec

SHA512
fb0ecbce758c4208337fb168e108d3c69815bdca69a53aff455e7b6b52574be15a45cb1b60c9f9cd39ae5cbe3e51ccf0835c4a3e9884879e43280a90e16fad26

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

Filesize
132KB

MD5
f19f16a231afd6246747f4a5bc7711e0

SHA1
735f600ef4d4879bcb9907cf78bdd979330e00a9

SHA256
dc24e3008ab1eb86c0cb842680ed29933ada844b0aa3bf534bd998f3bbb49da4

SHA512
9f127ef84417bc1adb8e57633b8b85121e4700130f7ef7c3e48f73108ad0926397b3625e6d7bb6ebfbb845de1b16ca67439e20238e864c5301aa5a199c787731

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History Provider Cache

Filesize
16KB

MD5
131daf954ced30aa61f5ef8d4f9e3930

SHA1
4e385dd6e15c03f07f83f0b12cfb34991fe2c201

SHA256
77da823cbf0f43e7a5e9a84e787e95532a3c35d7b10ef870fd73eb34846b23ef

SHA512
6c8f703bf67aa006c500c9765e5618f9e92734344c8bed9a0d2ad9272aec999efee2138e440a826a80e72ee9663ceed92b04982d856e08022f330d6e3890b8f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_best.aliexpress.com_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000005.ldb

Filesize
125KB

MD5
0f3dfd8faf00686f096531fe47548b56

SHA1
9865d7322077f448fbdbf91742124704d33ac079

SHA256
c9eae0901e2092ef3f12a671fed5afb592cfec91c523f6f75395a5524615f3fb

SHA512
7e02a13252fc8439f6c5ac5c0c9ba71fdf8f10ac4335ae0f22d8aa2b0b79abd30cc16ec02c1bfe427b99d41d7e3c92bf7d079b880fa50657fe73a88c1a73d914

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000006.log

Filesize
2KB

MD5
820a2e0232e907ecbe29aa715697cb36

SHA1
12a1b0b0066b63ebd817d9c4bcee074632937bce

SHA256
0ce80b59d43e204c5c48929e85be289cb8e590f5f46ceca2b4667251316f5d31

SHA512
ca4248ca94d963fb0a085a5f8b96f97f89cc7ec067c708912d7780fb739792316782085271640282b371268b062516a63d9ad859eeb5121289f8dd54057459db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000007.ldb

Filesize
93KB

MD5
a410d04c20c53918c8a4f776ff5a8265

SHA1
96fa410fb8db8210bf884443070f65290d732db2

SHA256
dbefab876707908d1bd807268581773bf0d53790c954519f3d523f0e8e629bba

SHA512
262bbc90d3c95508c33d371ccd2cbae7e840e9087a7bd4d47e51b22b702ff1fffbb274f646731fc39a40688b0afa1aaccf8510e4f8cb9fd0caf3cc3b44e07b3d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Filesize
652B

MD5
8604ea307e9070e945947c1b0357f483

SHA1
eced920a0d0199f5101e6ae4f182d594defd0a80

SHA256
aff1ca1ca6d954d5329e9da34539f83b4c8dcaab8fbfa096ee31230f7a50ba79

SHA512
e9ced064372fc58209c86c4b8e3f111c98a962fb40ddf5c8ebb8ccaae506aeef290ce5d58b48eee0520c3d0a2aef313db2a62b0fc067b8d3b4603b28c6d95594

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\MANIFEST-000001

Filesize
251B

MD5
02a602bd4728752aeb56fdf811774de5

SHA1
0bb29a91668f56a2d655dee25bb585733b46289b

SHA256
85991b0c313d505b628a1170d9d8a6941adcefa6b2a60c88195e758edb0688a3

SHA512
e74de7913ea3bfcfb613d4a315cf490e3eda62cea3e61973f1ec9ef1ed4438da7a24ff32ed0a5962796fc78f3d5a11db5736fae78422459559e6a1569c5893d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
6KB

MD5
080e37318be86e2b39d12c2424838277

SHA1
5d384be876a07cd87911a29026928f7b86cc493f

SHA256
5ab334c82da94a24cce54a4c52599f05e3e7d5d28206d45834b35a47eec776ff

SHA512
0ba27a58e4f5f96185ca64c90f5e5eae74d0361b358840e34f49b0cb39c6889f7bf3c29429edd6b756575e382fbc55b0130f9139ca49b6e3fef7ccb584af5da8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
5KB

MD5
5f04bb37e87e44520064c331f08eee88

SHA1
81696856c4f76150170bdee832cfc47174212bd5

SHA256
eb1d6abc45671ee3b777f7d14108dcafe46ca4847eee12b53cd868d5a1c3ba61

SHA512
524a0cc248afac38894761ceb6aa961abd90ea93bd701635b17ce5b8729bf5b4b2c5245592856c5d09d7d15be34ef6310d0375f13b7e12e65f4523cb048ed264

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
af4b562e0aee89b763bedb151d77032a

SHA1
0c95550ce8fa09c133d297af6f2622130752e672

SHA256
4f3c62358305a4651790807e71ebd69e19a06ea71c4415c07a2783100741bc29

SHA512
ad6315d4e510fea83fd4f4bf5ea18f0ac52bab8fac63ac3d206b321820a6931f3306211aae0ab8d96b5a961369f6f0cfa11ada1934a5ba5994f07d1ed759365b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
79afd6eabd5f3f8d386afc426a32ebe7

SHA1
ffb32dcf701896ef81726fad016a55a73f03a136

SHA256
8b527f06a6e1c57eae37cb298629bd8521b1337ea291f0804f337dadc38b6fe2

SHA512
09f215fc65e7610d8d80143410a053d25b03ded523c78dd90b87cbaf835104216e70651b6efaaa55c4e6272bb908131ffda3a1d690c855563613bc7654a61cb2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
062f5150656610058e15069ab96d6dbc

SHA1
c97953274e9389290ee9b78a7061f46a6d3fbda6

SHA256
415350d1201956d02b6c90d006547e3139f31105906cbee2cdb2a3a27f32cc21

SHA512
39445ae89a9a40c73aa47f53bb349c878c064cfd6bd92ddc4b2b604aa8225549c971e0921f64e958b4b1beb1836983fc703d1e03694d26502497c15a651d65c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
1a299a662b6af215e8c3dd4bf6d127ca

SHA1
3103098ed6dea400495dba1daf92b985adc44fc3

SHA256
912a000f05f2c46c8451d5fd806b868ed3143198280dabcaa870c936a26d811c

SHA512
9e58fa192b73138dd1e7125c019bf5b32b5fb34b97f60396504a0cdb1baee807c656562250f43b0627b221bcf72c59b92d79f0a14930cdb57b8bc0d13a5475a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
6521273a40c6044d5c10fd432b6a7622

SHA1
a810374b79f7c9f391da868dd86cdd2c55ca7506

SHA256
7fc0f6d1985181d04ba840069803f1baa9f07d6a9adbbb6213c34841ea4ade6c

SHA512
3457994087398324c202cc46d0c5c13673270a511f84aece8653bf70981e952bdee77b6605803d9c74d26266fe87a8bbf21c1cf11a09e89f5cfbe755cffea25c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
f5fe5957c7e9892d61861d0ec4c4eb10

SHA1
e3db9ff5c1970caa2411e4f366f4ac11a0c0d026

SHA256
2a04be2284b58893c855e6856568f733f44597a2cf2de3a9df1aef5f4e97bf09

SHA512
e99dbb823af0c5c418f7542fd71e20e3b1743d6967404962525640e5101c03899ddc386dfe65a2a75a4aee88db39effb092d5bc294bd0e2068b2a576b6d7aa39

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
05550d76ee01b8169e7fdd97bab3ff21

SHA1
6c00149914611a0533b523e7bc0c8e107f772fec

SHA256
d0ccf94db40f5c6a5704e9d83ed54b7aa7879e39098d96cc5b9ee91dc6e958cc

SHA512
09444e6960f7fa66fd3f0d8466b5ea38948a3dbe332c6558bd38e966fa66bd99a4668d2e0b8520ec48ffd69181cf3c296af69a03a92ce3124b59992f51d3141d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e96e3587c56d8121ecbad8fdd1c70e26

SHA1
33fed0c637f646fc5e5b4d5806bf6e0a2c1a93d2

SHA256
5e8ca16430d32dea89a1ee3e869115af37dae0ee8e43ffc3c95acfe23f946e3d

SHA512
00449b28e0001470c3332d5e00f962adff93424997c0be045b94bea917fddb10de46947e5f02b611ceb5dff0bd7e9db802338b5b62f6dca88a066a71a3a4c172

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
d4dc902bb7e95c791a938d0b0d117c3b

SHA1
bdab66bdd58aa47b105e78f88123b993ff06c7f3

SHA256
f0feba610cb6d5533007046cd13891fe3067a186756db32cd203605c1dbd53d6

SHA512
0cb7e30d25ebb4d2263e442c25736114b6fce9d4467bc33e3ad697c5cd9001ad85df1bc11328b7c38fd4982c6b54f08caa314800d4633715a1ed079eca78566b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
837d439f3bf1c48e38982282163adb4c

SHA1
ad006333c41a56ec64b3b4b2274fecef61a63b32

SHA256
cbeb5d6409e5eed31fdb3e723c333d0964522831956d8bbe105a2c93379d80c6

SHA512
4d4fb5a001590a410d415a52dc69a52a7e5009fec60189f9be61d45213a708e35365665b1f95a5a8c933a06a45083a7b72cd2151712ea688f834deb73f80c09e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG

Filesize
297B

MD5
5aa2958493f9c0624e39ab83469e3403

SHA1
b5d2e389be46c19340bc938d36b7dfdbb574cc19

SHA256
605865e5920d325b172b154fa70fd8b8210a0a50cfb332fba16a4d4c20e46b6b

SHA512
165d5d07644ad4dee2c8f9bf640ea3070908fd506c3bbab62e89e28b89d33eebef2157edbb603c40b0cb1908ef45b1f42406d3a5e766bd0ea05ffbf00b89dc09

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
240B

MD5
97d567a52ba5a1f0ee66ba6bb866cb83

SHA1
5dc09d517e63a6b283bb3e85755e6116050827b6

SHA256
12a0505f6ff4f99ad8650d661c928278d187b06d94f377aa76799fec6186c227

SHA512
59acd464e59ee2ba71271887fcfd936e37d1f83d81a37f96d9ba59891ffce1792ccfee2925ab05676e18567bc49633d4376d38fb1664d6ffcff127d7a9227205

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe590238.TMP

Filesize
48B

MD5
dc09c3f58748ba713236e89052989203

SHA1
2d46b584e4c03006ea26866053fac3106af30890

SHA256
f870d0f93e6e6b67316c40ecc6a7e844f7b525f6a4806cf62e6eee6b7c157db0

SHA512
9ea4d1aac4358ce15b030df3793143f9eb41b9294c3a1d833232a0f6e569c8800e003be35babb1b1b20fd06add446e4e73dfd62ec3a3db1e00ff2d139852a8bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13359042141648959

Filesize
46KB

MD5
3a7eda6e9b31285074175e7b0d619f8c

SHA1
cc128b81df32544ca560e8af3acac5caec52fd9f

SHA256
8420f887047765a6316c06de334a0c2f521b922aad6600e4f19bc1f73594c93b

SHA512
e38fa2d10a70220b5c97c2cc7f308f72dece8f418da6f298b615f3f66be7a57e2e784dc1932abc2bc1cf92f1f4115b707531d60dc4bcc8e448f333dee9553c66

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log

Filesize
184B

MD5
5557a4680f4cc50ec5085ea7fc1d6350

SHA1
1588544ffe07683e78fe8d96f0935144492cc0a8

SHA256
7f9a4bb636b92a4c821c8dd35e94d1903edf94561e27dfddf46fb6bcae5c76b7

SHA512
4e19cd8bf960adad3636cd2c341a491d80f4bd608895d293914b481fef6b4974f790d7ccc708689b39cfe2937678ffa35f3fc22beb7ac842b17f3e10d53afcbb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Filesize
350B

MD5
b8bf39a5a03a56ea29ef12a31ceac651

SHA1
6dd6fc7b4ecde95b615a0029b2566b5136182454

SHA256
c2c38ab078a5bd1b408664ac5f099bd561fb0ddd7b15dbd0524f56b88e63a9fb

SHA512
c0549f14d5f1795bf61af2315903c5440fae22edca1270a822b575930d3684ef2c6b767890407204e81a1e3ee45280c7c78788527058e969e98e782471d1a5b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Filesize
323B

MD5
a699f1c2ff87c69e5d6b7a2f39367785

SHA1
61b1fa7240171b7b1a61b1de6d17196011ff5128

SHA256
4b74a07b772229a37b63ad6f8f7b27c3a03d2e18b9fcea7d71699d5c40f41b7c

SHA512
f1f1b02134390c816f18d61aad3098cb80ac3050fd9fa353270583cbd95d264276a2dd34bbbe76fe20cc8e0cdee03418eb26c26b62d2d833757b58ba9075f6c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
96ffd7b70ccf53cf1b8764f3af161faa

SHA1
00af3cf8da4b15f182c91fb5f8b04676f31472ac

SHA256
2fee5db28dcbad70603f5a2e47031c4f55647ba2a1fff934c5f068e0c4a708a5

SHA512
fa9f10e9139998c1764fefaed5cdf7c6b6add1dbdf861874625c071a0eb7b8029c310894ae358db6552d574887b7e82535d67334bcd17807021a89b9c5ec39eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
7e8bd8edc5c638e1c25c9aab896bb839

SHA1
d029162272b7f45579cfea1fdb387358cac77fba

SHA256
96b4527694f8e7b56499cd15b6d788b682746f09e1a493e8eefeb9ce1e10c393

SHA512
61a1b6f0f4ad7488602c9b93924798fdd7651519fb0c5014011b78011e8e4d5ca4f237fa491c268b4a7b247ccb56eba9901f0fd7159b224bba0442244badd191

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
312910f00d6f8e429511fd38534d3182

SHA1
0c60c75a948a3cf77abe345300842944d8aac26b

SHA256
d69b37054fe57ebacbf842fdd76615e9536858f0d27e2eacf03ffa8e139f5128

SHA512
79c669f904aa9acd330259a598bb5780eccb8f827127fbf87358e1a3942c480b07862dc3687273d19745e9630c2a333b54f7f6b50d64003d84121ec8f6722629

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
e73a18edf35c59049c9a28aa1a9e7177

SHA1
7f415686998ea1c5d5f1fd964e76a2ba35c2de49

SHA256
a829b868cdc150e2aafa0abf3a200f007da5bdc71784e07b0d48d26536fc81a0

SHA512
d4e59ec378804591eb985e7267f4a92224e5dcd5a0e87a4d4d3b8ddd373235a25d1fb04f28a46a432ba26d6deffc980cccd0f987faf480e31ee19e41690ee7b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58dfad.TMP

Filesize
2KB

MD5
d3f0a02451dce84f2fb58d1c19650ef0

SHA1
138ce652e70d096c54bed80ef1e185b9b7704db3

SHA256
f2955e9652130e61b02357c34a91bde2d9519b1cfcba9ba2a9f7cfbc2e73a5cd

SHA512
bd6a32179e250b344ce691a0a4a5596555af079cb337b9577d30e1add76cdfd19f26ffdc7c2e6b89696f7f8ef07dddf5c4da8ef755342a9f2c29f7c767892ccc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links

Filesize
128KB

MD5
2dd79b812c512b3dd3438a55dfe84881

SHA1
08aab6d767e192af5df0b0eab70cd945c9155b68

SHA256
32faccaa3b0ed415743d03f71e429aae8b915fb3a5dd65985561e79a0f966bf0

SHA512
35d3e36b3ed494445be3a3d8abf3eae5664650e2b353f04917f80b8365b5f30f8701e35a624d5e1ce1393d21c1fb6570bb9f3054df91409ee6c278d4bf3614a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
aefd77f47fb84fae5ea194496b44c67a

SHA1
dcfbb6a5b8d05662c4858664f81693bb7f803b82

SHA256
4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

SHA512
b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db

Filesize
140KB

MD5
f25f91a9b488d46fff60484df017217f

SHA1
18a787e7ff747c753a6ac67d3f87828cf7921f7a

SHA256
7c98a347474ea41dbd473e6d9395616d5839172b9f7815643d71f406526b7e5f

SHA512
94a17c9c72037a20c579fdaac03b8fc38cd709b4476c47da8c5e74666978d17c966a0cbb8d11dabef982b0eeae412418bb0abc5f2682f62a15453128d1d52e7a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Filesize
4.0MB

MD5
de2abf252110c8d0352a2f63f013c5ef

SHA1
662af95967c15ad5a45d5705f0a53021f105309c

SHA256
8f0b836dd2d5feeb00d12b2830ad3c3f867ce853ee105daaa48766e26b321f72

SHA512
2ab4ade7135456fb12cf4c3762a00ebffabe55ffc188db3e3151b63c1e0d58c339659685f9e92c1ecec2be35ab4bff79af5575b3455394dbe4303a2eff1e6691

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

Filesize
11B

MD5
b29bcf9cd0e55f93000b4bb265a9810b

SHA1
e662b8c98bd5eced29495dbe2a8f1930e3f714b8

SHA256
f53ab2877a33ef4dbde62f23f0cbfb572924a80a3921f47fc080d680107064b4

SHA512
e15f515e4177d38d6bb83a939a0a8f901ce64dffe45e635063161497d527fbddaf2b1261195fde90b72b4c3e64ac0a0500003faceffcc749471733c9e83eb011

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
18374be8fc7d439e4b3b320730e065f9

SHA1
2476aa85e385e203d5294f7bf8f87954d485719a

SHA256
52cb5cf1f0cb0937ba82b98847a747c2c27904fe3c6aaf265e706b65f8467664

SHA512
24507a5939eb1ac3a1a3f9f9ad10631e1c939679b24c2a38a8010a0bbd746f53583b8c38ed7b8e7d05faa78227affb595e8c0f6445414b64c28d5a2272a85911

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c719b761c05d5f662b07bf37ed2091df

SHA1
fae6128b9f956f698282d1e85890ec023e50b14a

SHA256
8ec81f9dfe321208dfd9eaa810eef0c5c5c4c51687f677b7c6e70dfb2a554585

SHA512
22094bf91ef4500684ec891fd6df0969805c6b96d3be6c640e27db807ab2bdd7c745c31f81c9aa6e408dfa87b48677197ffe6e64ed1598b7e1a99145e13b8a8c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
99b26b241a2c1f6a78a40814f8b5d7b9

SHA1
1927077fa56602cf2a1abd1e65f76283207aad68

SHA256
c72f94385837f16364ab6f7e63de513b75af45f82ff886354ae5a93ee0b5149b

SHA512
895ac7f754d288b41f57c2a4f51e7491949bfd829debcde46bda0ac0fcdcf23b36d15a691a9e25d76945711f4d12a8136e5bc4f5afd07a1d0e0603961e8d013c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
7d65b2b57e4721a651bded955a7bb5f8

SHA1
a9b9713b131f20df4b5ba1fc313aa6fc08e75ce5

SHA256
3efc5fa57f2d92ae4e4d305666b3d61dac7090fc54714cebe07385f587fab8e4

SHA512
79edeaf991d0430fa87b083a9c710ceb970dbefda598cfc8291db7f953ff0b7294bb19400b78f18190d2bf8a94d94c1d0bedee0f99f9fcc9c87a4638523c614c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
8fb7e5011c64b2e757afff98d3254bde

SHA1
d78a048ea4c714c1defd76e6229ec00c6ddbc433

SHA256
5b3f4e0e392e9ac00a26485063c089483bac7d9ac20608da4eb482da442f0f6b

SHA512
75e2ece1d37ce5d438d3f182f0cdf06b82c507fc5063b2f46b99c83d67bb8884fef6c3e6b6997bfb887b7338b7a7cb444836bce9a2f1e678081192c2d7d969fd

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
ad30d9f881aa1d1c22b77e500fd9180f

SHA1
09bb0f29101631b999069e61a0e8216c56b5827a

SHA256
26293c349b8b82d059b34a7e315402f6267ff6397baeb3dc646f6ea9bb4a7646

SHA512
20bd448d517a4801b6363e81f1149f7dd4091993ae27605dfbd8b0433f9078560741057d671a2bc29cc88ddbc03e3f1e12d054230446adc742c5ac11afe767b8

Download Submit
memory/2828-0-0x0000000006150000-0x0000000006151000-memory.dmp

Filesize
4KB

Download
memory/2828-3-0x0000000006160000-0x0000000006161000-memory.dmp

Filesize
4KB

Download
memory/2828-5-0x0000000006DE0000-0x0000000006DE1000-memory.dmp

Filesize
4KB

Download
memory/2828-1-0x0000000006150000-0x0000000006151000-memory.dmp

Filesize
4KB

Download